naive-framework 0.1.0 → 0.3.0

package/platform/integrations/remote-image.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+// Fetches a remote image for a venture (J-3), the platform half of Next.js remotePatterns. The
+// framework records a remote image as a link with a note in raw/ (interface/brand.mjs addRemote);
+// this fetcher is the only part that reaches the network, so it lives in platform/ (EE-041).
+//
+//   - The host must be in the venture's remote_hosts (public/assets.json): the list of hosts an
+//     agent may fetch from. A redirect to another host is checked again; any other host is refused.
+//   - The original is kept private at raw/sources/<id>/original.<ext>, which stays out of git.
+//   - A full copy goes to public/ only with --copy, and only when the license allows a copy.
+//   - Facts (type, width, height, bytes, sha256) are read from the bytes by code (schema/assets.mjs).
+//
+//   node platform/integrations/remote-image.mjs <url> --venture <id> --license <id> --credit <who>
+//        [--id <raw id>] [--alt <text>] [--copy public/<file>] [--workspace <dir>] [--json]
+
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { ventureDir } from "../../interface/router.mjs";
+import { addAsset, addRemote } from "../../interface/brand.mjs";
+import { allowsCopy, factsOf, hostAllowed, IMAGE, registerOf } from "../../schema/assets.mjs";
+
+const MAX_BYTES = 20 * 1024 * 1024;
+const EXT = { png: "png", gif: "gif", jpeg: "jpg", webp: "webp", ico: "ico", svg: "svg" };
+
+/** Fetches url, following at most three redirects, each to a host the venture allows. */
+export async function fetchAllowed(url, hosts, { fetchImpl = fetch } = {}) {
+  let at = url;
+  for (let hop = 0; hop < 4; hop++) {
+    const u = new URL(at);
+    if (!/^https?:$/.test(u.protocol)) throw new Error(`${at}: only http and https are fetched`);
+    if (!hostAllowed(u.host, hosts)) throw new Error(`${u.host} is not in remote_hosts, the hosts an agent may fetch from; a person adds it with mentura assets hosts`);
+    const res = await fetchImpl(at, { redirect: "manual" });
+    if (res.status >= 300 && res.status < 400 && res.headers.get("location")) { at = new URL(res.headers.get("location"), at).href; continue; }
+    if (!res.ok) throw new Error(`${at}: HTTP ${res.status}`);
+    const size = Number(res.headers.get("content-length") ?? 0);
+    if (size > MAX_BYTES) throw new Error(`${at}: ${size} bytes is more than ${MAX_BYTES}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length > MAX_BYTES) throw new Error(`${at}: more than ${MAX_BYTES} bytes`);
+    return { url: at, buf };
+  }
+  throw new Error(`${url}: too many redirects`);
+}
+
+export async function fetchRemoteImage({ venture, workspace, url, license, credit, id, alt, copy, actor = "agent", fetchImpl }) {
+  const dir = ventureDir(venture, workspace);
+  if (!dir) return { ok: false, error: `no venture ${venture}` };
+  if (!license) return { ok: false, error: "say the image's license: --license <id>" };
+  if (copy && !copy.startsWith("public/")) return { ok: false, error: `${copy} is not in public/` };
+  if (copy && !allowsCopy(license)) return { ok: false, error: `license ${license} does not allow a full copy; link to the image instead (leave out --copy)` };
+  if (copy && existsSync(join(dir, copy))) return { ok: false, error: `${copy} is already there` };
+  const hosts = registerOf(dir)?.remote_hosts ?? [];
+  let got;
+  try { got = await fetchAllowed(url, hosts, { fetchImpl }); } catch (e) { return { ok: false, error: String(e.message ?? e) }; }
+  const f = factsOf(got.buf);
+  if (!IMAGE.has(f.type)) return { ok: false, error: `${url} is ${f.type}, not an image` };
+  const fetched = Object.fromEntries(Object.entries({ type: f.type, width: f.width, height: f.height, sizes: f.sizes, bytes: f.bytes, sha256: f.sha256, filled_at: new Date().toISOString() }).filter(([, v]) => v !== undefined));
+  if (copy) {
+    if (!copy.toLowerCase().endsWith(`.${EXT[f.type]}`) && !(f.type === "jpeg" && /\.jpe?g$/i.test(copy))) return { ok: false, error: `${copy}: the image is ${f.type}; name it .${EXT[f.type]}` };
+    mkdirSync(dirname(join(dir, copy)), { recursive: true });
+    writeFileSync(join(dir, copy), got.buf);
+    const a = await addAsset({ venture, workspace, path: copy, source: url, license, credit, alt, origin_url: url, actor });
+    if (!a.ok) return a;
+  }
+  const r = await addRemote({ venture, workspace, url, license, credit, id, alt, fetched, copy, actor });
+  if (!r.ok) return r;
+  // The original stays private: raw/sources/<id>/original.* is ignored by git (EE-070).
+  const original = join(r.result.raw, `original.${EXT[f.type]}`);
+  writeFileSync(join(dir, original), got.buf);
+  return { ok: true, result: { ...r.result, original, facts: fetched } };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const argv = process.argv.slice(2);
+  const opt = (n) => { const i = argv.indexOf(`--${n}`); return i >= 0 ? argv[i + 1] : undefined; };
+  const url = argv.find((a, i) => !a.startsWith("--") && !(i > 0 && argv[i - 1].startsWith("--") && argv[i - 1] !== "--json"));
+  if (!url || !opt("venture")) { console.error("usage: node platform/integrations/remote-image.mjs <url> --venture <id> --license <id> --credit <who> [--id <raw id>] [--alt <text>] [--copy public/<file>]"); process.exit(2); }
+  const r = await fetchRemoteImage({ venture: opt("venture"), workspace: opt("workspace") ? resolve(opt("workspace")) : undefined, url, license: opt("license"), credit: opt("credit"), id: opt("id"), alt: opt("alt"), copy: opt("copy"), actor: opt("as") === "person" ? "person" : "agent" });
+  if (!r.ok) { console.error(r.error); process.exit(1); }
+  console.log(argv.includes("--json") ? JSON.stringify(r.result, null, 2) : `fetched ${url}: ${r.result.facts.type} ${r.result.facts.width ?? "?"}x${r.result.facts.height ?? "?"}, original kept private at ${r.result.original}${r.result.copy ? `, copy at ${r.result.copy}` : ""}`);
+}

package/platform/integrations/rho.mjs

@@ -12,15 +12,16 @@
 //   --save-fixture   keeps what Rho answered, for --fixture later
 //
 // The package it writes (data package shape, PR #23 stage C):
-//   money/accounts/<rho id>.json                       master record, with a rho:account pointer
+//   money/<rho id>.json                                master record, with a rho:account pointer
 //   money/_streams/transactions/stream.json            sensitive: kept out of git and out of traces
 //   money/_streams/transactions/YYYY/MM/<date>-<id>.json   append-only; a resync never rewrites one
-//   money/summary.json                                 versioned: cash, net burn, runway, as of when
+//   money/_summary.json                                 versioned: cash, net burn, runway, as of when
 //
 // Amounts stay in minor units (cents for USD), as Rho returns them.
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { ventureFile } from "../../schema/venture-paths.mjs";
 
 export const SANDBOX = "https://rhoapi-sandbox.rho.co/mcp/v1";
 export const LIVE = "https://rhoapi.rho.co/mcp/v1";
@@ -107,13 +108,14 @@ export function summarize(data, syncedAt) {
 const json = (f, v) => { mkdirSync(join(f, ".."), { recursive: true }); writeFileSync(f, `${JSON.stringify(v, null, 2)}\n`); };
 
 export function write(venture, data, syncedAt = new Date().toISOString()) {
-  const money = join(venture, "money");
+  const money = join(ventureFile(venture, "money"));
   const pointer = (kind, id) => `${data.source}:${kind}:${id}`;
   for (const a of data.accounts)
-    json(join(money, "accounts", `${a.id}.json`), { id: a.id, name: a.account_name, type: a.account_type, last_4: a.account_number_last_4 ?? null, balance: a.balance, source: pointer("account", a.id), synced_at: syncedAt });
+    json(join(money, `${a.id}.json`), { id: a.id, name: a.account_name, type: a.account_type, last_4: a.account_number_last_4 ?? null, balance: a.balance, source: pointer("account", a.id), synced_at: syncedAt });
   const stream = join(money, "_streams/transactions");
-  json(join(stream, "stream.json"), { stream: "transactions", sensitive: true, source: data.source, append_only: true,
-    description: "Every transaction Rho posted, one file each, as Rho returned it. Rho is the system of record; corrections are new entries that point to the old one." });
+  // The stream's declaration, as schema/stream.schema.json has it. Its events are append-only and stay out of git.
+  json(join(stream, "stream.json"), { id: "transactions", sensitive: true,
+    summary: `Every transaction ${data.source} posted, one file each, as Rho returned it; Rho is the system of record. The versioned view is money/_summary.json.` });
   let added = 0;
   for (const t of data.transactions) {
     const at = t.posted_at ?? t.initiated_at;
@@ -126,7 +128,7 @@ export function write(venture, data, syncedAt = new Date().toISOString()) {
   const ignore = join(money, ".gitignore");
   if (!existsSync(ignore)) writeFileSync(ignore, "_streams/transactions/*/\n");
   const summary = summarize(data, syncedAt);
-  json(join(money, "summary.json"), summary);
+  json(join(money, "_summary.json"), summary);
   return { added, summary };
 }
 

package/platform/kits/README.md

@@ -4,4 +4,11 @@ A kit belongs to Mentura. It is an enhanced package: automations, agent workflow
 
 A kit lives at `platform/kits/<name>/kit.json`. It names the one package it extends (`package`) and never replaces that package. The package at `packages/<name>/package.json` works with no kit installed: schemas, templates, deterministic checks and at most one skill, offline, naming no vendor (EE-071).
 
-No kits are built yet. This folder is the place they will go.
+A kit can also extend a framework command (`extends.command`), and bring automations: triggers that name the package they need and run only once it is complete (`schema/kit.schema.json`). A venture turns kits on with `kits` in its `naive.config.json`.
+
+| Kit | What it does |
+|---|---|
+| `agent-upgrade/` | Runs `naive upgrade --agent`: an agent does the guides' by-hand steps on a staged copy; the framework's checks and a typed confirmation decide what lands (U-3) |
+| `validation-kickoff/` | Proposes the decision to start validating once the foundation is complete (M-12) |
+
+`node platform/kits/test.mjs` tests them offline.

package/platform/kits/agent-upgrade/kit.json

@@ -0,0 +1,15 @@
+{
+  "name": "agent-upgrade",
+  "title": "Agent-run upgrade",
+  "purpose": "An agent works the upgrade of a venture (U-3, I-29): the framework's migrations run on a copy, the agent does what the version guides leave to a person (prose such as AGENTS.md), and the framework's checks decide. Nothing lands until the checks pass and the founder types the confirmation.",
+  "extends": { "command": "upgrade --agent" },
+  "entry": "run.mjs",
+  "agent": {
+    "command": ["claude", "-p", "--output-format", "json", "--permission-mode", "acceptEdits", "--allowedTools", "Read,Edit,Write,Glob,Grep", "--strict-mcp-config"],
+    "env": ["MENTURA_AGENT_CMD"]
+  },
+  "use_model": ["the agent edits the staged copy by the version guides' by-hand steps"],
+  "checks": ["schema/upgrades.mjs"],
+  "status": "built",
+  "note": "The agent sees only the staged copy, never _private/, and its claims are not trusted: every file it changed is found by hash and logged as an agent's write, and the framework's checks run after it. MENTURA_AGENT_CMD replaces the default agent (platform/kits/agent-upgrade/stand-in-agent.mjs is the offline stand-in the tests use)."
+}

package/platform/kits/agent-upgrade/run.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// The agent-run upgrade (U-3, I-29), a Mentura kit over the framework's staged upgrade. Next.js's
+// `next upgrade --agent` has a coding agent perform and verify the upgrade; here the work is split the
+// System 1 way. Code runs the migrations on a copy (schema/upgrades.mjs stage). The agent does only what
+// the version guides leave to a person, in the copy. Code then finds every file the agent changed (by
+// hash, not by its word), logs each as an agent's write, and runs the framework's checks. The upgrade
+// stays a draft until the checks pass and the founder types the confirmation:
+//
+//   node platform/kits/agent-upgrade/run.mjs <venture dir> [--json]      (naive upgrade <dir> --agent)
+//   node interface/cli/naive.mjs upgrade <dir> --accept --confirm upgrade
+//
+// The agent is `claude -p` with file tools only, working in the copy, or MENTURA_AGENT_CMD (a command that
+// reads the prompt on stdin, works in its current directory and answers as claude -p --output-format json).
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { agentFromEnv, record } from "../../../interface/provenance.mjs";
+import { annotate, check, CONFIRM, snapshot, stage, STAGED } from "../../../schema/upgrades.mjs";
+
+const repo = new URL("../../..", import.meta.url).pathname;
+const kit = JSON.parse(readFileSync(new URL("./kit.json", import.meta.url), "utf8"));
+const dirArg = process.argv[2];
+const json = process.argv.includes("--json");
+if (!dirArg || !existsSync(join(dirArg, "venture.json"))) { console.error("usage: node platform/kits/agent-upgrade/run.mjs <venture dir> [--json]"); process.exit(2); }
+const dir = resolve(dirArg);
+
+/** Runs the agent in the staged copy and returns its answer (an object), or throws saying why. */
+export function runAgent(prompt, cwd) {
+  const cmd = process.env.MENTURA_AGENT_CMD ? process.env.MENTURA_AGENT_CMD.split(" ") : kit.agent.command;
+  // A relative program path in MENTURA_AGENT_CMD is relative to where naive was run, not to the copy.
+  const args = cmd.slice(1).map((a) => (/\.m?js$/.test(a) && !a.startsWith("/") && existsSync(resolve(a)) ? resolve(a) : a));
+  const p = spawnSync(cmd[0], args, { cwd, input: prompt, encoding: "utf8", maxBuffer: 1 << 26, env: { ...process.env, NAIVE_STAGE: cwd, NAIVE_TRIGGERS_ACTIVE: "upgrade" } });
+  if (p.error) throw new Error(`could not run the agent (${cmd[0]}): ${p.error.message}`);
+  let text = p.stdout;
+  try { const r = JSON.parse(p.stdout); if (r && typeof r.result === "string") { if (r.is_error) throw new Error(`the agent stopped: ${r.result}`); text = r.result; } }
+  catch (e) { if (e.message.startsWith("the agent stopped")) throw e; }
+  if (p.status !== 0) throw new Error(`the agent stopped with status ${p.status}: ${(p.stderr || text).trim().slice(0, 500)}${/login/i.test(p.stderr + text) ? " (run claude, then /login)" : ""}`);
+  const m = text.match(/\{[\s\S]*\}/);
+  try { return m ? JSON.parse(m[0]) : { summary: text.trim() }; } catch { return { summary: text.trim().slice(0, 2000) }; }
+}
+
+const staged = await stage(dir, { by: kit.name }).catch((e) => { console.error(e.message); process.exit(1); });
+const copy = join(dir, STAGED);
+const guides = staged.guides.map((g) => `--- ${g}\n${readFileSync(join(repo, g), "utf8")}`).join("\n\n");
+const prompt = [
+  `You are upgrading the venture in your current directory from Naive ${staged.from} to ${staged.to}. It is a copy: nothing you do reaches the venture until its founder accepts it.`,
+  "The framework's migrations have already run. Do only what the guides below leave to a person (their \"By hand\" sections) and what the migrations escalated, by editing files in this directory.",
+  "Rules: never open anything under _private/. Do not edit provenance.jsonl, naive.config.json, or anything under .release/ or .naive/. Do not delete files. Keep every JSON record valid against its schema. When something needs the founder's judgment, leave it and say so.",
+  `Escalated by the migrations:\n${staged.escalated.length ? staged.escalated.map((e) => `- ${e}`).join("\n") : "- nothing"}`,
+  `The guides:\n\n${guides || "(none)"}`,
+  'When you are done, answer with JSON only: {"summary": "<one sentence>", "edits": [{"path": "<file>", "why": "<the guide step>"}], "left": [{"what": "<item>", "why": "<why it needs the founder>"}]}',
+].join("\n\n");
+
+const before = snapshot(copy);
+let answer;
+try { answer = runAgent(prompt, copy); }
+catch (e) {
+  annotate(dir, { agent: { kit: kit.name, error: e.message } });
+  const d = check(dir);
+  console.error(`${e.message}\nThe migrations' copy is staged without the agent's work (${d.status}). Accept it with --accept --confirm ${CONFIRM}, or --reject.`);
+  process.exit(1);
+}
+// What the agent changed, by hash. Each change is an agent's write in the copy's provenance.
+const after = snapshot(copy);
+const changed = Object.keys(after).filter((f) => f !== "provenance.jsonl" && after[f] !== before[f]).sort();
+const deleted = Object.keys(before).filter((f) => !(f in after)).sort();
+const who = agentFromEnv("agent", "cli", { id: kit.name, ...(process.env.MENTURA_AGENT_CMD ? {} : { harness: "Claude Code" }) });
+const why = new Map((answer.edits ?? []).map((e) => [e.path, e.why]));
+for (const f of changed) record(copy, { entity: f, activity: "write", agent: who, note: `agent-run upgrade to Naive ${staged.to}: ${why.get(f) ?? "changed by the agent (it did not say why)"}` });
+annotate(dir, { agent: { kit: kit.name, summary: answer.summary ?? null, changed, deleted, reported: [...why.keys()], left: answer.left ?? [] } });
+const d = check(dir);
+
+if (json) { console.log(JSON.stringify(d, null, 2)); process.exit(d.status === "ready" ? 0 : 1); }
+console.log(`staged upgrade of ${staged.from} to ${staged.to}, worked by an agent: ${d.status}`);
+if (answer.summary) console.log(`agent     ${answer.summary}`);
+for (const f of changed) console.log(`edited    ${f}${why.has(f) ? `: ${why.get(f)}` : " (not reported by the agent)"}`);
+for (const f of deleted) console.log(`deleted   ${f} (the agent was told not to delete; the founder decides)`);
+for (const l of answer.left ?? []) console.log(`left      ${l.what}: ${l.why}`);
+for (const c of d.checks) console.log(`${c.passed ? "pass" : "FAIL"}      ${c.check}${c.passed ? "" : `: ${c.output.split("\n").slice(-2).join(" / ")}`}`);
+console.log(d.status === "ready" ? `Nothing has landed. To land it: node interface/cli/naive.mjs upgrade ${dirArg} --accept --confirm ${CONFIRM}` : `Nothing has landed, and it cannot until the checks pass. Fix the copy in ${dirArg}/${STAGED}, then run --status; or --reject.`);
+process.exit(d.status === "ready" ? 0 : 1);

package/platform/kits/agent-upgrade/stand-in-agent.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// A stand-in for the upgrade agent, for tests and docs that run offline
+// (MENTURA_AGENT_CMD="node platform/kits/agent-upgrade/stand-in-agent.mjs"). It does the 0.3.0 guide's
+// by-hand step the way an agent would: in every AGENTS.md of the copy it is working in (its current
+// directory), it says package where the text says kit. It answers as claude -p --output-format json does.
+// STAND_IN_BREAK=1 also breaks a record, so tests can show the checks stop a bad upgrade.
+
+import { mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+let prompt = "";
+for await (const c of process.stdin) prompt += c;
+const cwd = process.cwd();
+const edits = [];
+const walk = (rel) => {
+  for (const e of readdirSync(join(cwd, rel), { withFileTypes: true })) {
+    const r = rel ? `${rel}/${e.name}` : e.name;
+    if (e.isDirectory()) { if (!e.name.startsWith(".") && e.name !== "_private") walk(r); continue; }
+    if (e.name !== "AGENTS.md") continue;
+    const text = readFileSync(join(cwd, r), "utf8");
+    const next = text.replace(/\bkits\b/g, "packages").replace(/\bkit\b/g, "package");
+    if (next !== text) { writeFileSync(join(cwd, r), next); edits.push({ path: r, why: "0.3.0 by hand: say package where the text says kit" }); }
+  }
+};
+if (/say package where you wrote kit/.test(prompt)) walk("");
+if (process.env.STAND_IN_BREAK === "1") {
+  mkdirSync(join(cwd, "foundation"), { recursive: true });
+  writeFileSync(join(cwd, "foundation/icp.json"), JSON.stringify({ broken: true }) + "\n");
+  edits.push({ path: "foundation/icp.json", why: "rewrote the ICP" });
+}
+const answer = { summary: edits.length ? `Updated ${edits.length} file(s) by the guides' by-hand steps.` : "Nothing in the guides' by-hand steps applied to this venture.", edits, left: [] };
+console.log(JSON.stringify({ type: "result", is_error: false, result: JSON.stringify(answer) }));

package/platform/kits/validation-kickoff/kit.json

@@ -0,0 +1,29 @@
+{
+  "name": "validation-kickoff",
+  "title": "Validation kickoff",
+  "purpose": "When the foundation is settled, start the next step: put the decision to begin validating in front of the founder (M-12). An automation over the validation package, so it waits until the foundation package it needs is complete.",
+  "extends": { "package": "validation" },
+  "automations": [
+    {
+      "id": "start",
+      "on": { "activity": ["write", "accept", "confirm"], "route": "foundation/**", "by": "person" },
+      "needs": "foundation",
+      "once": true,
+      "run": {
+        "propose": {
+          "id": "start-validation",
+          "question": "The foundation is settled. Start validating the solution now: write the solution record and plan the first problem interviews?",
+          "options": ["Yes: start validation now", "Not yet: keep working the foundation"],
+          "layer": "purpose",
+          "boundary": "fail-open",
+          "decides": { "record": "validation-solution", "path": "validation/solution.json" },
+          "unlocks": [{ "activity": "Draft the solution record and the interview plan", "routes": ["validation/solution"] }]
+        }
+      },
+      "note": "Proposes a decision rather than writing records: the founder decides whether validation starts."
+    }
+  ],
+  "use_model": [],
+  "status": "built",
+  "note": "Turn it on with \"kits\": [\"validation-kickoff\"] in the venture's naive.config.json. The framework's trigger runner (schema/triggers.mjs) runs it; this kit holds no code."
+}

package/platform/webhooks/server.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// Webhooks from systems of record (V-9, platform): a CRM, a bank or a spend tool calls Mentura when
+// something it holds changes, the way a CMS calls a Next.js revalidation webhook. The request is checked
+// (an HMAC-SHA256 signature of the raw body with the source's shared secret), and the framework marks
+// every summary that reads the changed items stale (schema/stale.mjs notify). Nothing is fetched and no
+// record is rewritten here: the next write of each summary makes it fresh.
+//
+//   node platform/webhooks/server.mjs [--port 4330] [--host 127.0.0.1] [--workspace <dir>]
+//
+//   POST /webhooks/<venture id>/<source id>
+//     header  x-naive-signature: sha256=<hex HMAC-SHA256 of the raw body>
+//     body    { "paths": ["customers/acme.json"], "version": "<the source's version, optional>", "at": "<when, optional>" }
+//     202     { "venture", "source", "paths", "stale": [the files marked stale] }
+//
+// The secret is NAIVE_WEBHOOK_SECRET_<SOURCE> (the source id upper-cased, hyphens as underscores), else
+// NAIVE_WEBHOOK_SECRET; with neither set every request is refused. A source must be in the venture's
+// knowledge/sources.json. It binds to 127.0.0.1 by default; put it behind the platform's TLS to expose it.
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { resolve } from "node:path";
+import { ventureDir } from "../../interface/router.mjs";
+import { notify } from "../../schema/stale.mjs";
+
+const MAX = 256 * 1024;
+export const secretFor = (source, env = process.env) => env[`NAIVE_WEBHOOK_SECRET_${source.toUpperCase().replace(/-/g, "_")}`] ?? env.NAIVE_WEBHOOK_SECRET ?? null;
+export const sign = (secret, body) => `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+
+function verified(secret, body, header) {
+  if (!secret || typeof header !== "string") return false;
+  const want = Buffer.from(sign(secret, body)), got = Buffer.from(header);
+  return want.length === got.length && timingSafeEqual(want, got);
+}
+
+/** The webhook server over a workspace. env supplies the secrets (default process.env). */
+export function webhooks({ workspace = process.env.MENTURA_WORKSPACE, env = process.env } = {}) {
+  return createServer((req, res) => {
+    const send = (code, body) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(body) + "\n"); };
+    const m = req.url?.match(/^\/webhooks\/([a-z0-9][a-z0-9-]*)\/([a-z][a-z0-9-]*)\/?$/);
+    if (!m) return send(404, { error: "POST /webhooks/<venture id>/<source id>" });
+    if (req.method !== "POST") return send(405, { error: "webhooks are POST" });
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => { size += c.length; if (size > MAX) { send(413, { error: `a notification is at most ${MAX / 1024} KB` }); req.destroy(); } else chunks.push(c); });
+    req.on("end", () => {
+      if (size > MAX) return;
+      const raw = Buffer.concat(chunks);
+      const [, venture, source] = m;
+      if (!verified(secretFor(source, env), raw, req.headers["x-naive-signature"])) return send(401, { error: "the signature does not match this source's secret" });
+      const dir = ventureDir(venture, workspace);
+      if (!dir) return send(404, { error: `no venture ${venture}` });
+      let body;
+      try { body = JSON.parse(raw.toString("utf8")); } catch { return send(400, { error: "the body is not JSON" }); }
+      const paths = [body.paths ?? body.path].flat().filter((p) => typeof p === "string" && p && !p.startsWith("/") && !p.split("/").includes(".."));
+      if (!paths.length) return send(400, { error: "name the changed items in paths" });
+      try {
+        const r = notify(dir, { source, paths, version: typeof body.version === "string" ? body.version : undefined, at: typeof body.at === "string" ? body.at : undefined, via: "webhook" });
+        return send(202, { venture, ...r });
+      } catch (e) { return send(/no source/.test(e.message) ? 404 : 400, { error: e.message }); }
+    });
+  });
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const a = process.argv.slice(2);
+  const opt = (n, d) => { const i = a.indexOf(`--${n}`); return i >= 0 ? a[i + 1] : d; };
+  const workspace = opt("workspace") ? resolve(opt("workspace")) : process.env.MENTURA_WORKSPACE;
+  const s = webhooks({ workspace });
+  s.listen(Number(opt("port", 4330)), opt("host", "127.0.0.1"), () => console.log(`webhooks on http://${opt("host", "127.0.0.1")}:${s.address().port}/webhooks/<venture>/<source> for ${workspace ?? "this repository's instance/"}`));
+}

package/purpose/frameworks/idea-map/ideamap.mjs

@@ -19,6 +19,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { answersFor, configFor, questionsFor, threshold } from "../../../schema/naive-config.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const repo = join(here, "../../..");
@@ -163,8 +164,9 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   const opt = (n) => { const i = process.argv.indexOf(`--${n}`); return i >= 0 ? process.argv[i + 1] : undefined; };
   const json = (x) => console.log(JSON.stringify(x, null, 2));
   if (a === "split") json(split(readFileSync(b, "utf8")));
-  else if (a === "request") json(request(split(readFileSync(join(b, DUMP), "utf8")), ventureOf(b)));
-  else if (a === "answers") json(fromAnswers(load(c).answers ?? load(c)));
+  // Gate group hook (P-2): the venture's naive.config.json says which System 1 questions run and the tag threshold.
+  else if (a === "request") json(questionsFor(request(split(readFileSync(join(b, DUMP), "utf8")), ventureOf(b)), configFor(b), "idea-map"));
+  else if (a === "answers") { const cfg = configFor(b); json(fromAnswers(answersFor(load(c).answers ?? load(c), cfg, "idea-map"), threshold(cfg, "idea-map", CONVENTIONS.threshold))); }
   else if (a === "write") {
     const ideas = split(readFileSync(join(b, DUMP), "utf8"));
     mkdirSync(join(b, dirname(MAP)), { recursive: true });

package/purpose/frameworks/idea-map/route.mjs

@@ -25,6 +25,7 @@ import { CONVENTIONS, MAP, parse } from "./ideamap.mjs";
 import { GRAPH, ORDER } from "./graph.mjs";
 import { confirmedIn } from "../../../schema/foundation.mjs";
 import { loadPackages } from "../../../schema/load-packages.mjs";
+import { ventureFile } from "../../../schema/venture-paths.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const load = (p) => JSON.parse(readFileSync(p, "utf8"));
@@ -37,7 +38,7 @@ const HOME = { "venture-core": "foundation", brand: "marketing", ...Object.fromE
 /** Understand is a gate (EE-069): the founder confirms Mentura read the ideas right, after any
  *  corrections, before they are routed. A person's confirm of the map after its last agent write. */
 export function understood(dir) {
-  return existsSync(join(dir, MAP)) && confirmedIn(dir, MAP, "ideas");
+  return existsSync(ventureFile(dir, MAP)) && confirmedIn(dir, MAP, "ideas");
 }
 
 export const STAGES = [["routed", "Routed"], ["drafted", "Drafted"], ["yours", "Your decision"], ["waiting", "Waiting"], ["done", "Done"]];
@@ -62,13 +63,13 @@ function written(dir, key) {
   const rel = m?.paths?.[0]?.replace(/^instance\/\*\*\//, "");
   if (!rel) return null;
   if (rel.includes("*")) { const d = join(dir, dirname(rel)); return existsSync(d) && readdirSync(d).some((f) => f.endsWith(".json")); }
-  return existsSync(join(dir, rel));
+  return existsSync(ventureFile(dir, rel));
 }
 
 export function route(dir, { now } = {}) {
   const venture = load(join(dir, "venture.json"));
-  const g = existsSync(join(dir, GRAPH)) ? load(join(dir, GRAPH)) : null;
-  const nodes = g?.nodes ?? (existsSync(join(dir, MAP)) ? parse(readFileSync(join(dir, MAP), "utf8")).ideas.map((i) => ({ ...i, signal: null, lane: null })) : []);
+  const g = existsSync(ventureFile(dir, GRAPH)) ? load(ventureFile(dir, GRAPH)) : null;
+  const nodes = g?.nodes ?? (existsSync(ventureFile(dir, MAP)) ? parse(readFileSync(ventureFile(dir, MAP), "utf8")).ideas.map((i) => ({ ...i, signal: null, lane: null })) : []);
   if (!nodes.length) return { venture: venture.id, phase: venture.phase, waiting: "no idea map yet: map the idea dump first (purpose/ideas)" };
   const lanes = new Map((g?.lanes ?? []).map((l) => [l.id, l]));
   const m = decisions(dir, now);

package/purpose/frameworks/product-anatomy/anatomy.mjs

@@ -20,6 +20,7 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { ventureFile } from "../../../schema/venture-paths.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const ENDPOINT = "https://api.typesafe.ai/v1/systemone";
@@ -39,7 +40,7 @@ function readVenture(path) {
   }
   const venture = load(join(path, "venture.json"));
   const dir = join(path, "products");
-  const cards = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => load(join(dir, f))) : [];
+  const cards = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => load(ventureFile(dir, f))) : [];
   const products = Object.fromEntries(cards.map((c) => [c.id, c]));
   const flows = cards.flatMap((c) => (c.flows_to ?? []).map((to) => ({ from: c.id, to })));
   return { venture, core: venture.core, products, flows };

package/schema/README.md

@@ -36,6 +36,7 @@ Status:
 |---|---|---|---|
 | Purpose | Core product | `core` in `venture.json` | defined |
 | Purpose | Telos (start with the end) | `schema/telos.schema.json` at `<venture>/purpose/telos.json`; `check-telos.mjs` (EE-023) | defined |
+| System | Venture config (`naive.config.json`: the gate's rules, owners, check settings, thresholds, System 1 questions, pinned packages, acting) | `schema/naive-config.schema.json` at `<venture>/naive.config.json`; `schema/naive-config.mjs` (defaults), `schema/check-config.mjs`, the gate `schema/gate.mjs` and held drafts `schema/gate-drafts.mjs` (EE-073) | defined |
 | Governance | Publication policy (the publication gate) | `schema/publication-policy.schema.json` at `<venture>/governance/publication-policy.json`; `check-publication.mjs` (EE-025) | defined |
 | Purpose | Validation package: problem record, shared evidence item, GRADE-adapted grading | `schema/validation-problem.schema.json` and `schema/validation-evidence.schema.json` at `<venture>/purpose/validation/`; `check-validation.mjs`; package at `packages/validation/` (templates and skills still under `purpose/kits/validation/`, EE-026, EE-071) | problem built; six sub-scores to build |
 | Purpose | Goals and vision | `purpose/frameworks/business-discovery-framework.md` | prose |

package/schema/access.mjs

@@ -0,0 +1,58 @@
+// Access (P-27, the robots of a venture): what each team-plan role may read and write, as globs over
+// routes (purpose/**, product/*). The same rules the router applies before every action, here so the
+// gate (X-4) and every read of a record (F-5) can check them again. Files only: no model, no network.
+//
+// A role the team plan does not list, or one that lists no routes, may reach every route; gates
+// still apply. A role with routes may read every route unless it lists read, and write none unless
+// it lists write.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ventureFile } from "./venture-paths.mjs";
+
+export const PLANS = ["people/team-plan.json", "operations/team-plan.json"];
+
+// Globs over routes, as in the team plan: * is one segment, ** any depth.
+export const routeGlob = (g) => new RegExp("^" + g.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, "\u0001").replace(/\*/g, "[^/]*").replace(/\0/g, "(?:[^/]+/)*").replace(/\u0001/g, ".*") + "$");
+
+/** The venture's team plan, or null. Read fresh on every call, so a changed plan is seen at once. */
+export function teamPlan(dir) {
+  const f = dir && PLANS.map((p) => ventureFile(dir, p)).find((p) => existsSync(p));
+  return f ? { path: f, ...JSON.parse(readFileSync(f, "utf8")) } : null;
+}
+
+/** A role's entry in the team plan, or null. */
+export function roleOf(dir, roleId) {
+  if (!roleId) return null;
+  return teamPlan(dir)?.roles?.find((r) => r.id === roleId) ?? null;
+}
+
+/** The globs a role may read and write, or null for a role that may reach every route. */
+export function globsOf(dir, roleId) {
+  const role = roleOf(dir, roleId);
+  if (!role?.routes) return null;
+  return { read: role.routes.read ?? ["**"], write: role.routes.write ?? [] };
+}
+
+/** Whether a role may read or write a route. */
+export function may(dir, roleId, act, route) {
+  if (!roleId || !dir) return true;
+  const g = globsOf(dir, roleId);
+  if (!g) return true;
+  return (act === "write" ? g.write : g.read).some((x) => routeGlob(x).test(route));
+}
+
+/**
+ * Whether a role may read at least one item of a collection: it may read the list route itself,
+ * or one of its read globs reaches an item under it (product/kettle under product).
+ */
+export function mayReadSome(dir, roleId, listRoute) {
+  if (may(dir, roleId, "read", listRoute)) return true;
+  const g = globsOf(dir, roleId);
+  return !!g && g.read.some((x) => x.startsWith(`${listRoute}/`) || routeGlob(x).test(`${listRoute}/x`));
+}
+
+/** Whether a role may read one item of a collection: the list route covers its items, or the item route is listed. */
+export function mayReadItem(dir, roleId, listRoute, id) {
+  return may(dir, roleId, "read", listRoute) || may(dir, roleId, "read", `${listRoute}/${id}`);
+}

package/schema/adapter.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "adapter.schema.json",
+  "title": "Adapter",
+  "description": "What runs Naive on a platform or in an agent harness (Z-4), as a Next.js adapter customizes build and deploy for a platform. A harness adapter (Claude Code, Codex, Cursor) adapts the framework through the venture's AGENTS.md and skills: the entry files it writes into a venture, and where it puts the package skills. A platform adapter (Mentura, Naive's first, as Vercel is for Next.js) names the tests it runs. An adapter is verified when it passes the framework's tests (node interface/adapters.mjs verify <name>). Harness adapters are interface/adapters/<name>.json; the platform's is platform/adapter.json.",
+  "type": "object",
+  "required": ["name", "title", "kind", "reads", "files", "skills", "sources"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+    "title": { "type": "string" },
+    "kind": { "enum": ["harness", "platform"] },
+    "integration": { "type": "string", "description": "Its entry in interface/tooling/integrations.json" },
+    "reads": { "type": "array", "items": { "type": "string" }, "description": "The files the harness or platform reads on its own, as globs" },
+    "files": {
+      "type": "array",
+      "description": "Entry files the adapter writes into a venture; each must lead to the venture's AGENTS.md",
+      "items": {
+        "type": "object",
+        "required": ["path", "text"],
+        "additionalProperties": false,
+        "properties": {
+          "path": { "type": "string", "pattern": "^(?!/)(?!.*\\.\\.)(?!_private/).+$" },
+          "text": { "type": "string" }
+        }
+      }
+    },
+    "skills": { "type": ["string", "null"], "description": "The folder the harness loads skills from; each open package's skill is copied to <folder>/<skill id>/SKILL.md. null when the harness reaches skills through AGENTS.md" },
+    "verify": { "type": "array", "items": { "type": "string" }, "description": "A platform adapter: the test programs it must pass, each run as node <path> and ending with all passing or exit 0" },
+    "sources": { "type": "array", "items": { "type": "string", "format": "uri" }, "description": "Where the harness documents what it reads" },
+    "note": { "type": "string" }
+  }
+}

package/schema/add-department.mjs

@@ -11,6 +11,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { catalog, foldersOf } from "./departments.mjs";
+import { ventureFile } from "./venture-paths.mjs";
 
 const args = process.argv.slice(2);
 const group = args.includes("--group");
@@ -28,8 +29,8 @@ const tag = { department: d.id, value_chain: d.value_chain, apqc: d.apqc.id };
 const made = [];
 for (const layer of layersOn.filter((l) => !held.includes(l))) {
   const rel = join(layer, "departments", ...(group ? [d.value_chain] : []), d.id);
-  if (existsSync(join(dir, rel))) { console.error(`${rel} exists without a department.json; add the tag by hand`); process.exit(1); }
-  mkdirSync(join(dir, rel), { recursive: true });
+  if (existsSync(ventureFile(dir, rel))) { console.error(`${rel} exists without a department.json; add the tag by hand`); process.exit(1); }
+  mkdirSync(ventureFile(dir, rel), { recursive: true });
   writeFileSync(join(dir, rel, "department.json"), JSON.stringify(tag, null, 2) + "\n");
   const [file, title, what] = layer === "governance"
     ? ["charter.md", "charter", d.governance] : ["README.md", "operations", d.operations];

package/schema/assess-problem.mjs

@@ -26,6 +26,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { ventureFile } from "./venture-paths.mjs";
 
 export const ASSUMPTIONS = [
   { id: "exists", says: "the problem is real", field: "statement", test: "Find people already paying for or building a workaround (search, forums, competitors' customers)" },
@@ -97,7 +98,7 @@ export const ASK = "Some things the assessment reads are missing. Fill them in f
 
 /** The whole run: preflight first, then the assessment unless input is missing and as_is is not set. */
 export function assess(dir, { as_is = false, today = new Date() } = {}) {
-  const f = join(dir, "purpose/validation/problem.json");
+  const f = join(ventureFile(dir, "purpose/validation/problem.json"));
   const rec = existsSync(f) ? JSON.parse(readFileSync(f, "utf8")) : null;
   const missing = preflight(rec);
   if (missing.length && !as_is) return { needs_input: { ask: ASK, missing, options: [
@@ -117,7 +118,7 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   const dir = process.argv[2];
   if (!dir) { console.error("usage: node schema/assess-problem.mjs <venture dir> [--json] [--preflight] [--as-is]"); process.exit(2); }
   const flag = (f) => process.argv.includes(f);
-  const out = flag("--preflight") ? { missing: preflight(existsSync(join(dir, "purpose/validation/problem.json")) ? JSON.parse(readFileSync(join(dir, "purpose/validation/problem.json"), "utf8")) : null) } : assess(dir, { as_is: flag("--as-is") });
+  const out = flag("--preflight") ? { missing: preflight(existsSync(join(ventureFile(dir, "purpose/validation/problem.json"))) ? JSON.parse(readFileSync(join(ventureFile(dir, "purpose/validation/problem.json")), "utf8")) : null) } : assess(dir, { as_is: flag("--as-is") });
   if (flag("--json")) { console.log(JSON.stringify(out, null, 2)); process.exit(0); }
   const list = (m) => m.map((x) => `  - ${x.field}${x.items ? ` (${x.items.join(", ")})` : ""}: ${x.why}. As is: ${x.as_is}`).join("\n");
   if (out.needs_input) { console.log(`${out.needs_input.ask}\n${list(out.needs_input.missing)}\nFill in: ${out.needs_input.options[0].how}\nRun as is: ${out.needs_input.options[1].how}`); process.exit(0); }