glove-foundry 0.3.3 → 0.4.0

package/dist/index.js

@@ -11,7 +11,6 @@ import {
   BindingId,
   BindingNotFound,
   CapabilityId,
-  EMPTY_AGENT_COMPOSITION,
   EventId,
   EventNotFound,
   EventReference,
@@ -38,23 +37,23 @@ import {
   TopologyStore,
   TransmissionId,
   compileApplicationManifest,
-  composeAgent,
   grantResolverLive,
   memoryAccountDirectory,
   memoryEventStore,
   memoryTopologyStore,
   serializeInboundTransmissionXml,
   writeGeneratedTypes
-} from "./chunk-P65RT7H5.js";
+} from "./chunk-25BGNRJN.js";
 import {
   FoundryClient,
   FoundryRunHandle,
   createFoundryClient
-} from "./chunk-3GCUECPA.js";
+} from "./chunk-GKZLWD5M.js";
 import {
   defineConfig
 } from "./chunk-ZFNMFE3T.js";
 import {
+  EMPTY_AGENT_COMPOSITION,
   EMPTY_CAPABILITY_REGISTRY,
   EMPTY_FOUNDRY_APPLICATION,
   EMPTY_NATIVE_REGISTRY,
@@ -65,6 +64,7 @@ import {
   FOUNDRY_AGENT_ROUTE_ENV,
   FOUNDRY_APPLICATION_BRAND,
   FOUNDRY_APPLICATION_ENV,
+  FOUNDRY_APPROVAL_DIRECTORY_ENV,
   FOUNDRY_COMPOSED_PLAYBOOK_BRAND,
   FOUNDRY_CONNECTION_BRAND,
   FOUNDRY_CORE_COMMAND_EVENT,
@@ -82,12 +82,15 @@ import {
   FOUNDRY_TRANSMISSION_EVENT_BRAND,
   FOUNDRY_TRANSMISSION_PREDICATE_BRAND,
   FOUNDRY_WORKING_ENVIRONMENT_BRAND,
+  FoundryApprovalDisplayManager,
   MemoryFoundryDataAdapter,
+  composeAgent,
   composePlaybook,
   configureLayer,
   configureMemory,
   createAgentInstance,
   createConversation,
+  createFoundryApproval,
   createFoundryCoreTools,
   createInstalledApplicationTransmissionTools,
   createManifest,
@@ -99,6 +102,9 @@ import {
   defineApplication,
   defineCall,
   defineConnection,
+  defineFacts,
+  defineForms,
+  defineGoals,
   defineLayer,
   defineMcp,
   defineMemory,
@@ -117,9 +123,11 @@ import {
   discoverAgents,
   findAgentFiles,
   foundryDataEnvironmentPersistence,
+  foundryGuidanceSubject,
   install,
   installRegistry,
   installationKey,
+  installedApplicationTransmissionToolName,
   internalAgentName,
   isFoundryAgent,
   isFoundryAgentDefinition,
@@ -130,17 +138,419 @@ import {
   isFoundrySubscriber,
   isFoundryTransmission,
   isInboxCapableStore,
+  listFoundryApprovals,
   mountAgentDefinitionMemory,
   mountFoundrySurfaces,
   reconstructAgentInstance,
   reconstructPlaybook,
   reconstructPlaybookSubscription,
+  resolveFoundryApproval,
   routeFromAgentFile,
   routeFromInternalAgentName,
   toGloveMessage,
   toGloveRequestInput,
-  transmissionPredicate
-} from "./chunk-CRWY7M66.js";
+  transmissionPredicate,
+  withFoundryPermissions
+} from "./chunk-5LDW2N2E.js";
+
+// src/file-data.ts
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
+import { Effect } from "effect";
+function emptyState(environment) {
+  return {
+    version: 1,
+    agents: [],
+    subscriptions: [],
+    inboundDeliveries: [],
+    activations: [],
+    conversations: [],
+    workspaceEntries: [],
+    workingEnvironments: [],
+    inbox: [],
+    tasks: [],
+    environment: structuredClone([...environment])
+  };
+}
+function replaceById(values, value) {
+  const index = values.findIndex((candidate) => candidate.id === value.id);
+  if (index === -1) values.push(structuredClone(value));
+  else values[index] = structuredClone(value);
+}
+function environmentOwnerKey(owner) {
+  return [
+    owner.scope,
+    owner.workspaceId,
+    owner.definitionId,
+    owner.agentId,
+    owner.scope === "conversation" ? owner.conversationId : ""
+  ].join("\0");
+}
+function effect(operation) {
+  return Effect.tryPromise({ try: operation, catch: (cause) => cause });
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function errorCode(cause) {
+  return cause && typeof cause === "object" && "code" in cause ? String(cause.code) : void 0;
+}
+var FileFoundryDataAdapter = class {
+  identifier;
+  file;
+  lockFile;
+  lockTimeoutMs;
+  staleLockMs;
+  seeds;
+  initialized;
+  queue = Promise.resolve();
+  constructor(options) {
+    if (!options.file.trim()) throw new Error("FileFoundryDataAdapter requires a file path.");
+    this.file = options.file;
+    this.lockFile = `${options.file}.lock`;
+    this.identifier = options.identifier ?? `foundry-file:${options.file}`;
+    this.lockTimeoutMs = options.lockTimeoutMs ?? 1e4;
+    this.staleLockMs = options.staleLockMs ?? 3e4;
+    this.seeds = {
+      agents: [...options.agents ?? []],
+      subscriptions: [...options.subscriptions ?? []],
+      activations: [...options.activations ?? []],
+      conversations: [...options.conversations ?? []],
+      environment: [...options.environment ?? []]
+    };
+  }
+  serialize(operation) {
+    const current = this.queue.then(operation, operation);
+    this.queue = current.then(() => void 0, () => void 0);
+    return current;
+  }
+  async acquireLock() {
+    await mkdir(dirname(this.file), { recursive: true });
+    const deadline = Date.now() + this.lockTimeoutMs;
+    while (true) {
+      try {
+        const handle = await open(this.lockFile, "wx");
+        await handle.writeFile(JSON.stringify({ pid: process.pid, acquiredAt: (/* @__PURE__ */ new Date()).toISOString() }));
+        await handle.close();
+        return async () => {
+          try {
+            await unlink(this.lockFile);
+          } catch (cause) {
+            if (errorCode(cause) !== "ENOENT") throw cause;
+          }
+        };
+      } catch (cause) {
+        if (errorCode(cause) !== "EEXIST") throw cause;
+        try {
+          const lock = await stat(this.lockFile);
+          if (Date.now() - lock.mtimeMs > this.staleLockMs) {
+            await unlink(this.lockFile);
+            continue;
+          }
+        } catch (staleCause) {
+          if (errorCode(staleCause) === "ENOENT") continue;
+          throw staleCause;
+        }
+        if (Date.now() >= deadline) {
+          throw new Error(`Timed out waiting for Foundry data lock "${this.lockFile}".`);
+        }
+        await sleep(20 + Math.floor(Math.random() * 30));
+      }
+    }
+  }
+  async read() {
+    try {
+      const parsed = JSON.parse(await readFile(this.file, "utf8"));
+      if (parsed.version !== 1) {
+        throw new Error(`Unsupported Foundry data version ${String(parsed.version)} in "${this.file}".`);
+      }
+      return {
+        version: 1,
+        agents: parsed.agents ?? [],
+        subscriptions: parsed.subscriptions ?? [],
+        inboundDeliveries: parsed.inboundDeliveries ?? [],
+        activations: parsed.activations ?? [],
+        conversations: parsed.conversations ?? [],
+        workspaceEntries: parsed.workspaceEntries ?? [],
+        workingEnvironments: parsed.workingEnvironments ?? [],
+        inbox: parsed.inbox ?? [],
+        tasks: parsed.tasks ?? [],
+        environment: parsed.environment ?? []
+      };
+    } catch (cause) {
+      if (errorCode(cause) === "ENOENT") return emptyState(this.seeds.environment);
+      throw cause;
+    }
+  }
+  async write(state) {
+    await mkdir(dirname(this.file), { recursive: true });
+    const temporary = `${this.file}.${process.pid}.${randomUUID()}.tmp`;
+    const handle = await open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(state, null, 2)}
+`, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    try {
+      await rename(temporary, this.file);
+    } catch (cause) {
+      try {
+        await unlink(temporary);
+      } catch {
+      }
+      throw cause;
+    }
+  }
+  async mutate(operation) {
+    return this.serialize(async () => {
+      const release = await this.acquireLock();
+      try {
+        const state = await this.read();
+        const result = await operation(state);
+        await this.write(state);
+        return result;
+      } finally {
+        await release();
+      }
+    });
+  }
+  async ensureInitialized() {
+    this.initialized ??= this.mutate((state) => {
+      for (const seed of this.seeds.agents) {
+        if (!state.agents.some((agent) => agent.id === seed.id)) {
+          state.agents.push(structuredClone(reconstructAgentInstance(seed)));
+        }
+      }
+      for (const seed of this.seeds.subscriptions) {
+        if (!state.subscriptions.some((item) => item.id === seed.id)) {
+          state.subscriptions.push(structuredClone(reconstructPlaybookSubscription(seed)));
+        }
+      }
+      for (const seed of this.seeds.activations) {
+        if (!state.activations.some((item) => item.id === seed.id)) {
+          state.activations.push(structuredClone(seed));
+        }
+      }
+      for (const seed of this.seeds.conversations) {
+        if (!state.conversations.some((item) => item.id === seed.id)) {
+          state.conversations.push(structuredClone(seed));
+        }
+      }
+      for (const seed of this.seeds.environment) {
+        const key = `${seed.scope}:${seed.workspaceId}:${seed.agentId ?? ""}:${seed.conversationId ?? ""}:${seed.key}`;
+        if (!state.environment.some(
+          (item) => `${item.scope}:${item.workspaceId}:${item.agentId ?? ""}:${item.conversationId ?? ""}:${item.key}` === key
+        )) state.environment.push(structuredClone(seed));
+      }
+    });
+    await this.initialized;
+  }
+  async snapshot() {
+    await this.ensureInitialized();
+    await this.queue;
+    return this.read();
+  }
+  getAgent(id) {
+    return effect(async () => {
+      const value = (await this.snapshot()).agents.find((agent) => agent.id === id);
+      return value ? reconstructAgentInstance(value) : null;
+    });
+  }
+  putAgent(agent) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.agents, reconstructAgentInstance(agent)));
+    });
+  }
+  listAgents(definitionId) {
+    return effect(async () => (await this.snapshot()).agents.filter((agent) => !definitionId || agent.definitionId === definitionId).map(reconstructAgentInstance));
+  }
+  provisionAgent(input) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      return this.mutate((state) => {
+        const existing = state.agents.find((agent) => agent.provisioningKey === input.provisioningKey);
+        if (existing) return reconstructAgentInstance(existing);
+        const created = createAgentInstance(input.definitionId, {
+          ...input,
+          id: input.id ?? `agent_${randomUUID()}`
+        }, input.provisioningKey);
+        state.agents.push(structuredClone(created));
+        return created;
+      });
+    });
+  }
+  getPlaybookSubscription(id) {
+    return effect(async () => {
+      const value = (await this.snapshot()).subscriptions.find((item) => item.id === id);
+      return value ? reconstructPlaybookSubscription(value) : null;
+    });
+  }
+  putPlaybookSubscription(subscription) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.subscriptions, reconstructPlaybookSubscription(subscription)));
+    });
+  }
+  deletePlaybookSubscription(id) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      return this.mutate((state) => {
+        const length = state.subscriptions.length;
+        state.subscriptions = state.subscriptions.filter((item) => item.id !== id);
+        return state.subscriptions.length !== length;
+      });
+    });
+  }
+  listPlaybookSubscriptions(workspaceId) {
+    return effect(async () => (await this.snapshot()).subscriptions.filter((item) => !workspaceId || item.workspaceId === workspaceId).map(reconstructPlaybookSubscription));
+  }
+  getInboundDelivery(key) {
+    return effect(async () => (await this.snapshot()).inboundDeliveries.find((item) => item.key === key) ?? null);
+  }
+  claimInboundDelivery(key) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      return this.mutate((state) => {
+        if (state.inboundDeliveries.some((item) => item.key === key)) return false;
+        state.inboundDeliveries.push({
+          key,
+          status: "pending",
+          runIds: [],
+          claimedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        return true;
+      });
+    });
+  }
+  completeInboundDelivery(key, runIds) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => {
+        const prior = state.inboundDeliveries.find((item) => item.key === key);
+        if (!prior) throw new Error(`Inbound delivery claim "${key}" does not exist.`);
+        const index = state.inboundDeliveries.findIndex((item) => item.key === key);
+        state.inboundDeliveries[index] = structuredClone({
+          ...prior,
+          status: "completed",
+          runIds: [...runIds],
+          completedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      });
+    });
+  }
+  releaseInboundDelivery(key) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => {
+        state.inboundDeliveries = state.inboundDeliveries.filter(
+          (item) => item.key !== key || item.status !== "pending"
+        );
+      });
+    });
+  }
+  getActivation(id) {
+    return effect(async () => structuredClone((await this.snapshot()).activations.find((item) => item.id === id) ?? null));
+  }
+  putActivation(activation) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.activations, activation));
+    });
+  }
+  listActivations(workspaceId) {
+    return effect(async () => structuredClone((await this.snapshot()).activations.filter((item) => !workspaceId || item.workspaceId === workspaceId)));
+  }
+  getConversation(id) {
+    return effect(async () => structuredClone((await this.snapshot()).conversations.find((item) => item.id === id) ?? null));
+  }
+  putConversation(conversation) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.conversations, conversation));
+    });
+  }
+  listConversations(agentId) {
+    return effect(async () => structuredClone((await this.snapshot()).conversations.filter((item) => item.agentId === agentId)));
+  }
+  getWorkspaceEntry(workspaceId, key) {
+    return effect(async () => structuredClone((await this.snapshot()).workspaceEntries.find((item) => item.workspaceId === workspaceId && item.key === key) ?? null));
+  }
+  putWorkspaceEntry(entry) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => {
+        const index = state.workspaceEntries.findIndex((item) => item.workspaceId === entry.workspaceId && item.key === entry.key);
+        if (index === -1) state.workspaceEntries.push(structuredClone(entry));
+        else state.workspaceEntries[index] = structuredClone(entry);
+      });
+    });
+  }
+  listWorkspaceEntries(workspaceId) {
+    return effect(async () => structuredClone((await this.snapshot()).workspaceEntries.filter((item) => item.workspaceId === workspaceId)));
+  }
+  compareAndSetWorkspaceEntry(entry, expectedUpdatedAt) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      return this.mutate((state) => {
+        const index = state.workspaceEntries.findIndex((item) => item.workspaceId === entry.workspaceId && item.key === entry.key);
+        const current = state.workspaceEntries[index];
+        if ((current?.updatedAt ?? null) !== expectedUpdatedAt) return false;
+        if (!Number.isFinite(Date.parse(entry.updatedAt)) || current && Date.parse(entry.updatedAt) <= Date.parse(current.updatedAt)) {
+          throw new Error("An atomic workspace update must advance updatedAt.");
+        }
+        if (index === -1) state.workspaceEntries.push(structuredClone(entry));
+        else state.workspaceEntries[index] = structuredClone(entry);
+        return true;
+      });
+    });
+  }
+  getWorkingEnvironmentSnapshot(owner) {
+    return effect(async () => {
+      const key = environmentOwnerKey(owner);
+      const value = (await this.snapshot()).workingEnvironments.find((item) => environmentOwnerKey(item.owner) === key);
+      return value ? structuredClone(value.snapshot) : null;
+    });
+  }
+  putWorkingEnvironmentSnapshot(owner, snapshot) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => {
+        const key = environmentOwnerKey(owner);
+        const index = state.workingEnvironments.findIndex((item) => environmentOwnerKey(item.owner) === key);
+        const value = structuredClone({ owner, snapshot });
+        if (index === -1) state.workingEnvironments.push(value);
+        else state.workingEnvironments[index] = value;
+      });
+    });
+  }
+  putInboxItem(item) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.inbox, item));
+    });
+  }
+  listInboxItems(workspaceId) {
+    return effect(async () => structuredClone((await this.snapshot()).inbox.filter((item) => item.workspaceId === workspaceId)));
+  }
+  putTask(task) {
+    return effect(async () => {
+      await this.ensureInitialized();
+      await this.mutate((state) => replaceById(state.tasks, task));
+    });
+  }
+  listTasks(workspaceId) {
+    return effect(async () => structuredClone((await this.snapshot()).tasks.filter((item) => item.workspaceId === workspaceId)));
+  }
+  listEnvironment(scope) {
+    return effect(async () => structuredClone((await this.snapshot()).environment.filter(
+      (item) => item.workspaceId === scope.workspaceId && (item.scope === "workspace" || item.scope === "agent" && item.agentId === scope.agentId || item.scope === "conversation" && item.conversationId === scope.conversationId)
+    )));
+  }
+};
 
 // src/authoring.ts
 import { Schema } from "effect";
@@ -287,6 +697,7 @@ export {
   FOUNDRY_AGENT_ROUTE_ENV,
   FOUNDRY_APPLICATION_BRAND,
   FOUNDRY_APPLICATION_ENV,
+  FOUNDRY_APPROVAL_DIRECTORY_ENV,
   FOUNDRY_COMPOSED_PLAYBOOK_BRAND,
   FOUNDRY_CONNECTION_BRAND,
   FOUNDRY_CORE_COMMAND_EVENT,
@@ -304,7 +715,9 @@ export {
   FOUNDRY_TRANSMISSION_EVENT_BRAND,
   FOUNDRY_TRANSMISSION_PREDICATE_BRAND,
   FOUNDRY_WORKING_ENVIRONMENT_BRAND,
+  FileFoundryDataAdapter,
   FoundryApplicationManifest,
+  FoundryApprovalDisplayManager,
   FoundryClient,
   FoundryManifestCapability,
   FoundryManifestTransmission,
@@ -335,6 +748,7 @@ export {
   configureMemory,
   createAgentInstance,
   createConversation,
+  createFoundryApproval,
   createFoundryClient,
   createFoundryCoreTools,
   createInstalledApplicationTransmissionTools,
@@ -350,6 +764,9 @@ export {
   defineCall,
   defineConfig,
   defineConnection,
+  defineFacts,
+  defineForms,
+  defineGoals,
   defineInboundRoute,
   defineLayer,
   defineMcp,
@@ -370,10 +787,12 @@ export {
   discoverAgents,
   findAgentFiles,
   foundryDataEnvironmentPersistence,
+  foundryGuidanceSubject,
   grantResolverLive,
   install,
   installRegistry,
   installationKey,
+  installedApplicationTransmissionToolName,
   internalAgentName,
   isFoundryAgent,
   isFoundryAgentDefinition,
@@ -384,6 +803,7 @@ export {
   isFoundrySubscriber,
   isFoundryTransmission,
   isInboxCapableStore,
+  listFoundryApprovals,
   memoryAccountDirectory,
   memoryEventStore,
   memoryTopologyStore,
@@ -392,11 +812,13 @@ export {
   reconstructAgentInstance,
   reconstructPlaybook,
   reconstructPlaybookSubscription,
+  resolveFoundryApproval,
   routeFromAgentFile,
   routeFromInternalAgentName,
   serializeInboundTransmissionXml,
   toGloveMessage,
   toGloveRequestInput,
   transmissionPredicate,
+  withFoundryPermissions,
   writeGeneratedTypes
 };

package/docs/architecture.md

@@ -40,6 +40,8 @@ interface AgentInstance {
 
 `FoundryDataAdapter` is the source of truth. Every run reloads the instance and conversation, then assembles a fresh Glove from the referenced definition and current message. Lazy `playbooks` and `schedules` resolvers reconcile desired runtime data before Foundry executes subsequent activations. `configureAgent` atomically replaces frontend-editable context, installations, and playbooks.
 
+Foundry ships an in-memory adapter for tests and a dependency-free `FileFoundryDataAdapter` for durable single-host deployments. The file adapter coordinates local worker processes with an advisory lock and commits state through atomic rename. Multi-host deployments provide a database-backed implementation of the same interface so the application model does not change.
+
 Definitions never accept an invocation input or output schema. Foundry owns those contracts.
 
 ## Reference normalization
@@ -86,6 +88,12 @@ An application owns one or many transmission definitions. A transmission may def
 - inbound config/event schemas, authentication, normalization, classification, predicates, and serialization; and
 - outbound config/input/output schemas and a delivery adapter.
 
+An outbound contract may define `observe(input)` as a secret-safe projection for
+retained telemetry. The validated delivery input itself crosses the worker boundary
+through a private mode-0600 command record, not the observable event stream, and is
+removed after the command settles. Without an explicit projection, Foundry records
+only that the payload was redacted.
+
 Applications are not installed by default. Their optional install hook is a headless factory that may contribute tools without receiving the Glove runtime or store. Foundry passes an operation-scoped account-session function when the user provided one; it never passes raw credentials.
 
 ## Inbound activation
@@ -132,12 +140,31 @@ A connection is colocated with its application and names the inbound transmissio
 
 The supervisor derives desired connections from installed application + active playbook combinations. It starts, stops, retries, and observes them. Its implementation can use any backend; retry/worker topology is not exposed as an authoring primitive.
 
+`receive()` is dispatch-oriented by default. A connection may set
+`awaitCompletion: true` on an event when its transport requires an ordered session:
+the Effect then remains open until all runs dispatched for that event are terminal,
+or until the connection is aborted. This is an adapter-level ordering choice, not a
+global runtime lock.
+
 ## Conversations and workspaces
 
 Conversations are independent data records owned by an instance. Transmission conversations derive stable ids from route, instance, and external thread. Direct conversations can be created freely.
 
 Workspace entries, inbox items, tasks, scoped environment values, and optional working-environment snapshots share the data adapter. They are suitable for document handles and coordination state across agents.
 
+Adapters may implement `compareAndSetWorkspaceEntry(entry, expectedUpdatedAt)` for
+optimistic atomic coordination. `null` requires absence; a successful replacement
+must advance `updatedAt`. The memory and file adapters implement the same contract,
+with file writes protected by the existing advisory lock. Consumers validate their
+own value schema and retry a conflict against newly read state. Use this contract
+consistently for every writer to a coordinated key; an unconditional
+`putWorkspaceEntry` is not a compare-and-set. Workspace entries are shared
+coordination data, not private memory or credentials.
+
+Session loops and goal continuation are composable
+agent policy over this data and normal scheduled activations. They do not introduce
+a second scheduler, memory store, filesystem, or agent loop.
+
 ## Working environment and REPL boundary
 
 Foundry owns contextual selection, mounting, lifecycle, and observability. The native packages retain their own semantics:
@@ -148,10 +175,27 @@ Foundry owns contextual selection, mounting, lifecycle, and observability. The n
 
 An agent can resolve either surface from its current instance, conversation, workspace, or message. Foundry exposes the mounted environment and guarded VFS to execution contexts, snapshots before cleanup when a persistence adapter is present, and emits safe mount/save telemetry. It permits one REPL per assembled agent to prevent colliding execution and discovery tool names.
 
+A REPL may declare `programmaticTools` as an explicit selector over the complete
+live Glove tool registry. Foundry delays that REPL's public mount until calls,
+instance installations, memory, mesh, and `configure` have finished, then
+registers only the exact tool references returned by the selector. This makes
+the primed function catalogue match the current message without turning every
+agent tool into ambient authority. The projection owns a bounded call budget,
+revalidates Zod inputs, propagates cancellation, and fails closed when a tool
+input requires an interactive approval. Programmatic calls emit metadata-only
+events; inputs, results, credentials, and interpreter state are not copied into
+the trace.
+
 The durable boundary is the VFS. Native REPL interpreter bindings are run-scoped and are not serialized by Foundry.
 
 ## Lazy assembly
 
+Goals, facts, forms, and custom context providers are first-class lazy fields too.
+Foundry mounts native runners with conversation-local scopes by default. Adapters
+retain authoritative workflow state. A definition-provided goal program initializes
+only absent state; later changes require an explicit native versioned revision.
+See [guidance](./guidance.md) for preparation and persistence boundaries.
+
 Every run resolves model, system prompt, tools, memory, inboxes, subscribers, layers, calls, playbooks, schedules, mesh, working environment, REPL, and custom build/run functions against `AgentAssemblyContext`. Resolvers can use both the instance and the current message, which makes message-dependent provisioning a first-class behavior rather than an environment switch.
 
 Installable applications, shared tools, and MCPs are filtered by the current instance desired state. Memory belongs to the definition but can be selected lazily. Inboxes must always be lazy functions.
@@ -173,3 +217,10 @@ Foundry stores only account metadata and opaque access references. It does not:
 - expose credential material to prompts or the inspector.
 
 Applications define account-session and provider adapters. Playbooks and instance installation data select account references.
+
+The HTTP control plane follows the same rule. A non-loopback listener is rejected
+unless the application supplies a `requestAuthorization` adapter. The server passes
+only method, path, query, selected credential headers, and peer address directly to
+that Effect; it retains neither the credential nor the adapter's internal identity
+state. Browser Basic auth, bearer tokens, session cookies, OIDC proxy assertions,
+rotation, rate limits, and revocation therefore remain deployment-owned policies.