otto-intel-mcp 0.1.2 → 0.1.3

package/dist/execution-delegation-policy.d.ts

@@ -37,10 +37,30 @@ import { type Address } from 'viem';
  * the prefix in the middle, a suffix, no description — is foreign and is never touched.
  */
 export declare const MODEL_B_POLICY_LINEAGE_PREFIX = "OTTO model b swap fence";
-/** This binary's fence version. Bump it whenever the rules change shape or caps. */
-export declare const MODEL_B_POLICY_VERSION: 1;
-/** The versioned match key. */
-export declare const MODEL_B_POLICY_NAME_V1: string;
+/**
+ * This binary's fence version. Bump it whenever the rules change shape or caps.
+ *
+ * 🔴 v2 (Founder word `fence v2`, pending — Yield Copilot withdraw, 2026-09-03). v2 ADDS to v1: an approve
+ * rule per registry Morpho share token (spender = the diamond only, bounded by
+ * `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`) so a delegated vault WITHDRAW can route shares → USDC through the
+ * same fenced GenericSwapV3 entry, and a sign-only accept rule for a USDC `transfer` (see
+ * `modelBProjectPolicyRules`). The router rule is UNCHANGED and still carries no receiver condition — that
+ * is the person's only way to move value out of an Otto/CDP wallet today (ws-7, 2026-09-03), and the
+ * receiver pin lives in Otto's delegated verifier.
+ *
+ * TRANSITION: a v2 binary ACCEPTS a v1 fence (swaps and deposits keep working; a withdraw under v1 is
+ * refused by name) and the fence tool upgrades v1 → v2 in place only when it is run — deploying this code
+ * writes nothing to the CDP project.
+ */
+export declare const MODEL_B_POLICY_VERSION: 2;
+/** The v1 match key — the fence every permission before `fence v2` was minted under; still accepted for swaps and deposits. */
+export declare const MODEL_B_POLICY_NAME_V1: "OTTO model b swap fence v1";
+/** The v2 match key — what the fence tool writes; the only fence that admits a delegated Yield Copilot withdraw. */
+export declare const MODEL_B_POLICY_NAME_V2: string;
+/** The CURRENT match key (v2). */
+export declare const MODEL_B_POLICY_NAME: string;
+/** Every lineage version this binary accepts on read-back, oldest first. */
+export declare const MODEL_B_POLICY_ACCEPTED_VERSIONS: readonly (1 | 2)[];
 /** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
 export declare function modelBLineageVersion(description: unknown): number | undefined;
 export declare const MODEL_B_POLICY_NETWORK: "base";
@@ -53,19 +73,63 @@ export declare const MODEL_B_CHAIN_ID: 8453;
  */
 export declare const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS: 90;
 export declare const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS: 180;
-/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+/**
+ * The floor `boundedDelegationExpiry` has always enforced, NAMED — it was a literal `1` inside the bound,
+ * so the reserve schema could not state the range it accepts without hand-copying the number, and a
+ * hand-copied bound is a bound that drifts. Mirrors `MODEL_B_DELEGATION_EXPIRY_MIN_DAYS` in the dApp.
+ */
+export declare const MODEL_B_DELEGATION_EXPIRY_MIN_DAYS: 1;
+/**
+ * A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint.
+ *
+ * 🔴 THE RESULT LANDS ON A WHOLE SECOND (round 3). CDP stores `expiresAt` at whole-second granularity and
+ * truncates milliseconds toward zero — verified live on the dev project 2026-09-02 (`…:46.137Z` came back
+ * as `…:46Z` from `createDelegation` AND from `getDelegationForEndUser`; `…:45.999Z` came back as
+ * `…:45Z`, so it truncates rather than rounds). Everything downstream — the reservation, the durable row
+ * and every enforcement read — keys on that second, so the bound produces it directly rather than leaving
+ * a millisecond remainder for one of them to drop and another to keep.
+ */
 export declare function boundedDelegationExpiry(requestedDays: unknown, nowMs: number): {
     readonly days: number;
     readonly expiresAt: string;
 };
+/**
+ * The mint-expiry helpers live with the store that owns the reserved second; re-exported here because
+ * this is the module every consumer of the Model-B numbers already imports.
+ */
+export { MINT_EXPIRY_FILLER_MS as MODEL_B_MINT_EXPIRY_FILLER_MS } from './execution-delegation-cap-store.js';
+export { mintExpiryForSecond as mintExpiryFor } from './execution-delegation-cap-store.js';
+export { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
 /**
  * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
  * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
  * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
  * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
  * bounds the swap's `fromAmount` on-chain).
+ *
+ * 🔴 THIS IS THE CEILING, SHARED BY EVERY DELEGATED USER — NOT ANY ONE PERSON'S CAP (Founder word
+ * `delegate cap choice`, 2026-09-02). Coinbase's engine offers end-user accounts exactly one fence, the
+ * project-scope policy, so the number compiled into those rules is the same for everybody and CANNOT be
+ * narrowed per user by the engine. A person who wants a lower number — "try it with $10" — gets it from
+ * Otto's own server: their choice is recorded against their grant (`execution-delegation-cap-store.ts`)
+ * and enforced on every delegated send, on top of this ceiling and never above it.
  */
 export declare const MODEL_B_PER_SWAP_CAP_USD: 5000;
+/**
+ * The floor of the range a person may choose. One whole dollar: the smallest cap that can still pass a
+ * real swap, and low enough that "try it with $10" is nowhere near it.
+ */
+export declare const MODEL_B_PER_SWAP_CAP_MIN_USD: 1;
+/**
+ * A requested per-swap cap, bounded — the same shape as `boundedDelegationExpiry`, and the ONLY place a
+ * requested number becomes a cap.
+ *
+ * 🔴 IT REFUSES; IT NEVER CLAMPS. A hostile 50,000 is not silently turned into 5,000: a caller that asked
+ * for a number outside the range is a caller whose intent this server does not know, and quietly
+ * substituting one would make "the cap you chose" a claim nobody could check. Absent means the ceiling —
+ * the terms every grant already carried before a choice existed.
+ */
+export declare function boundedPerSwapCap(requestedUsd: unknown): number;
 export interface ModelBInputToken {
     readonly symbol: string;
     readonly address: Address;
@@ -80,6 +144,28 @@ export declare const BASE_USDC: Address;
  */
 export declare const MODEL_B_INPUT_TOKENS_V1: readonly ModelBInputToken[];
 export declare function modelBInputToken(token: Address): ModelBInputToken | undefined;
+/**
+ * 🔴 v2 — the share tokens a delegated Yield Copilot WITHDRAW may approve to the diamond: exactly the
+ * registry's executable Morpho vaults (ERC-4626 shares, 18 decimals), derived from the registry so a vault
+ * added or removed there changes the fence shape (= a new digest) rather than drifting past it.
+ */
+export interface ModelBWithdrawToken {
+    readonly symbol: string;
+    readonly address: Address;
+    readonly decimals: 18;
+    readonly marketId: string;
+}
+export declare const MODEL_B_WITHDRAW_TOKENS_V2: readonly ModelBWithdrawToken[];
+export declare function modelBWithdrawToken(token: Address): ModelBWithdrawToken | undefined;
+/**
+ * The engine-side bound on ONE withdraw's approve, in share atomic units: 5,000 shares. A USDC vault's
+ * share is worth ≥ 1 USDC by construction at inception and accrues from there (gtUSDCp ≈ 1.107 USDC on
+ * 2026-09-03), so 5,000 shares ≈ the 5,000 USD per-swap ceiling at par and somewhat more as yield accrues;
+ * after a vault loss the bound only tightens. It is the residual bound for a re-pointed withdraw, the same
+ * class as the swap rule's; the person's own cap does NOT apply to a withdraw (see the send gate: a withdraw
+ * returns the person's own assets to the person and never increases exposure).
+ */
+export declare const MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC: bigint;
 /** The cap in the token's atomic units. */
 export declare function modelBPerSwapCapAtomic(token: ModelBInputToken, capUsd?: number): bigint;
 /** The two GenericSwapV3 ERC20→ERC20 entry points a same-chain swap plan may call. */
@@ -206,10 +292,26 @@ export type DelegationPolicyCriterion = {
 };
 export interface DelegationPolicyRule {
     readonly action: 'accept';
-    readonly operation: 'sendEndUserEvmTransaction';
+    /** `sendEndUserEvmTransaction` = the delegated send; `signEndUserEvmTransaction` (v2) = sign-only, the client broadcasts. */
+    readonly operation: 'sendEndUserEvmTransaction' | 'signEndUserEvmTransaction';
     readonly criteria: readonly DelegationPolicyCriterion[];
 }
 /** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
+/** The v1 rules, frozen as history: USDC approve to the diamond up to the cap + the router rule. */
+export declare function modelBProjectPolicyRulesV1(capUsd?: number): readonly DelegationPolicyRule[];
+/**
+ * The v2 rules = v1 + (a) one approve rule per registry Morpho share token, spender = the diamond only,
+ * value ≤ `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`, ethValue 0 — the delegated withdraw's allowance leg; the
+ * router rule is UNCHANGED (no receiver condition; the person's exit path); (b) a SIGN-ONLY accept rule
+ * (`signEndUserEvmTransaction`) for a USDC `transfer(to, value)` with value ≤ the per-swap cap and NO
+ * recipient condition — the person's own USDC exit without a swap, signed in their browser and broadcast
+ * by the page. The CDP policy schema carries no initiator/session criterion, so the engine cannot tell a
+ * user-signed send from a delegated one on the SAME operation; what it can do is fence a DIFFERENT
+ * operation, and Otto's delegated signer only ever calls the send operation (`adapter/cdp-signer.ts`).
+ * Stated residual: the developer-side end-user client also exposes `signEvmTransaction`, so under a
+ * delegation a compromised Otto could sign a USDC transfer to any address up to the cap — the same
+ * class and bound as the router rule's missing receiver condition, not a new one.
+ */
 export declare function modelBProjectPolicyRules(capUsd?: number): readonly DelegationPolicyRule[];
 /** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
 export declare function modelBProjectPolicyBody(): {
@@ -220,6 +322,14 @@ export declare function modelBProjectPolicyBody(): {
 /** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
 export declare function policyRulesDigest(rules: unknown): string;
 export declare const MODEL_B_POLICY_DIGEST_V1: string;
+export declare const MODEL_B_POLICY_DIGEST_V2: string;
+/** The CURRENT digest (v2). */
+export declare const MODEL_B_POLICY_DIGEST: string;
+/** name → {version, digest} for every accepted lineage version. */
+export declare const MODEL_B_POLICY_DIGEST_BY_NAME: ReadonlyMap<string, {
+    readonly version: 1 | 2;
+    readonly digest: string;
+}>;
 /** What the server reads back from `cdp.policies.listPolicies({ scope: 'project' })`, structurally. */
 export interface DelegationPolicyRecord {
     readonly id: string;
@@ -231,6 +341,9 @@ export type ModelBFenceReadBack = {
     readonly present: true;
     readonly id: string;
     readonly rulesDigest: string;
+    /** Which accepted lineage version reads back; a delegated withdraw needs 2. */
+    readonly version: 1 | 2;
+    readonly name: string;
 } | {
     readonly present: false;
     readonly reason: 'absent' | 'ambiguous' | 'name_mismatch' | 'digest_mismatch';
@@ -243,6 +356,8 @@ export type ModelBFenceReadBack = {
  * "absent" — including a policy of the right name whose rules drifted.
  */
 export declare function readBackModelBFence(policies: readonly DelegationPolicyRecord[]): ModelBFenceReadBack;
+/** True when the read-back is THIS binary's fence version — what the fence tool leaves alone. */
+export declare function fenceIsCurrent(readBack: ModelBFenceReadBack): boolean;
 /**
  * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
  * engine would refuse is refused here without spending an allowance reset on it.
@@ -255,3 +370,35 @@ export declare function assertWithinModelBFence(plan: {
     readonly token: ModelBInputToken;
     readonly capAtomic: bigint;
 };
+/**
+ * 🔴 v2 — the delegated WITHDRAW's fence: the approve token must be a registry share token, the spender the
+ * diamond, the approve amount within the share cap, and the OUTPUT token USDC (a withdraw is "shares → the
+ * person's USDC", never a swap into something else under the withdraw's cap-free rule). The receiver pin
+ * (== the signing account) is the verifier's, already applied before this runs.
+ */
+export declare function assertWithdrawWithinModelBFence(plan: {
+    readonly token: Address;
+    readonly spender: Address;
+    readonly gross: bigint;
+    readonly outputToken: Address;
+}): {
+    readonly token: ModelBWithdrawToken;
+};
+/**
+ * THE PERSON'S OWN CAP, enforced after the engine's (Founder word `delegate cap choice`, 2026-09-02).
+ *
+ * 🔴 WHY THIS IS A SEPARATE CHECK AND A SEPARATE CODE. `assertWithinModelBFence` above answers "would
+ * Coinbase's engine have signed this?" — it is the shared ceiling and it is also enforced on-chain by the
+ * project policy, so a plan past it never reaches a signature whatever this server does. THIS check
+ * answers a different question: "is it inside the number THIS PERSON chose when they minted?" The engine
+ * cannot ask it (one project policy, shared by every delegated user), so Otto's server is the only place
+ * it can be asked, and a plan that fails it is one the engine WOULD have signed.
+ *
+ * Folding the two into one call with a smaller number would pass every shape-level test while making the
+ * two facts indistinguishable in the refusal, in the logs and in the tests. They are kept apart so a
+ * mutation that drops the user's cap reddens on its own named code rather than hiding behind the ceiling.
+ */
+export declare function assertWithinUserPerSwapCap(grossAtomic: bigint, capUsd: number, token: ModelBInputToken): {
+    readonly capUsd: number;
+    readonly capAtomic: bigint;
+};

package/dist/execution-delegation-policy.js

@@ -33,6 +33,7 @@ import { createHash } from 'node:crypto';
 import { getAddress } from 'viem';
 import { refuse } from './execution-errors.js';
 import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
+import { EXECUTABLE_YIELD_MARKETS } from './executable-yield-markets.js';
 /**
  * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
  * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
@@ -40,10 +41,30 @@ import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
  * the prefix in the middle, a suffix, no description — is foreign and is never touched.
  */
 export const MODEL_B_POLICY_LINEAGE_PREFIX = 'OTTO model b swap fence';
-/** This binary's fence version. Bump it whenever the rules change shape or caps. */
-export const MODEL_B_POLICY_VERSION = 1;
-/** The versioned match key. */
-export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+/**
+ * This binary's fence version. Bump it whenever the rules change shape or caps.
+ *
+ * 🔴 v2 (Founder word `fence v2`, pending — Yield Copilot withdraw, 2026-09-03). v2 ADDS to v1: an approve
+ * rule per registry Morpho share token (spender = the diamond only, bounded by
+ * `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`) so a delegated vault WITHDRAW can route shares → USDC through the
+ * same fenced GenericSwapV3 entry, and a sign-only accept rule for a USDC `transfer` (see
+ * `modelBProjectPolicyRules`). The router rule is UNCHANGED and still carries no receiver condition — that
+ * is the person's only way to move value out of an Otto/CDP wallet today (ws-7, 2026-09-03), and the
+ * receiver pin lives in Otto's delegated verifier.
+ *
+ * TRANSITION: a v2 binary ACCEPTS a v1 fence (swaps and deposits keep working; a withdraw under v1 is
+ * refused by name) and the fence tool upgrades v1 → v2 in place only when it is run — deploying this code
+ * writes nothing to the CDP project.
+ */
+export const MODEL_B_POLICY_VERSION = 2;
+/** The v1 match key — the fence every permission before `fence v2` was minted under; still accepted for swaps and deposits. */
+export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v1`;
+/** The v2 match key — what the fence tool writes; the only fence that admits a delegated Yield Copilot withdraw. */
+export const MODEL_B_POLICY_NAME_V2 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+/** The CURRENT match key (v2). */
+export const MODEL_B_POLICY_NAME = MODEL_B_POLICY_NAME_V2;
+/** Every lineage version this binary accepts on read-back, oldest first. */
+export const MODEL_B_POLICY_ACCEPTED_VERSIONS = Object.freeze([1, 2]);
 const MODEL_B_LINEAGE_PATTERN = new RegExp(`^${MODEL_B_POLICY_LINEAGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')} v(\\d+)$`);
 /** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
 export function modelBLineageVersion(description) {
@@ -62,24 +83,81 @@ export const MODEL_B_CHAIN_ID = 8453;
  */
 export const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS = 90;
 export const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS = 180;
-/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+/**
+ * The floor `boundedDelegationExpiry` has always enforced, NAMED — it was a literal `1` inside the bound,
+ * so the reserve schema could not state the range it accepts without hand-copying the number, and a
+ * hand-copied bound is a bound that drifts. Mirrors `MODEL_B_DELEGATION_EXPIRY_MIN_DAYS` in the dApp.
+ */
+export const MODEL_B_DELEGATION_EXPIRY_MIN_DAYS = 1;
+/**
+ * A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint.
+ *
+ * 🔴 THE RESULT LANDS ON A WHOLE SECOND (round 3). CDP stores `expiresAt` at whole-second granularity and
+ * truncates milliseconds toward zero — verified live on the dev project 2026-09-02 (`…:46.137Z` came back
+ * as `…:46Z` from `createDelegation` AND from `getDelegationForEndUser`; `…:45.999Z` came back as
+ * `…:45Z`, so it truncates rather than rounds). Everything downstream — the reservation, the durable row
+ * and every enforcement read — keys on that second, so the bound produces it directly rather than leaving
+ * a millisecond remainder for one of them to drop and another to keep.
+ */
 export function boundedDelegationExpiry(requestedDays, nowMs) {
     const days = requestedDays === undefined || requestedDays === null
         ? MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS
         : Number(requestedDays);
-    if (!Number.isInteger(days) || days < 1 || days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
-        throw new Error(`delegation expiry must be a whole number of days between 1 and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
+    if (!Number.isInteger(days) ||
+        days < MODEL_B_DELEGATION_EXPIRY_MIN_DAYS ||
+        days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
+        throw new Error(`delegation expiry must be a whole number of days between ${MODEL_B_DELEGATION_EXPIRY_MIN_DAYS} and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
     }
-    return Object.freeze({ days, expiresAt: new Date(nowMs + days * 86_400_000).toISOString() });
+    const wholeSecond = Math.floor((nowMs + days * 86_400_000) / 1000) * 1000;
+    return Object.freeze({ days, expiresAt: new Date(wholeSecond).toISOString() });
 }
+/**
+ * The mint-expiry helpers live with the store that owns the reserved second; re-exported here because
+ * this is the module every consumer of the Model-B numbers already imports.
+ */
+export { MINT_EXPIRY_FILLER_MS as MODEL_B_MINT_EXPIRY_FILLER_MS } from './execution-delegation-cap-store.js';
+export { mintExpiryForSecond as mintExpiryFor } from './execution-delegation-cap-store.js';
+export { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
 /**
  * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
  * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
  * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
  * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
  * bounds the swap's `fromAmount` on-chain).
+ *
+ * 🔴 THIS IS THE CEILING, SHARED BY EVERY DELEGATED USER — NOT ANY ONE PERSON'S CAP (Founder word
+ * `delegate cap choice`, 2026-09-02). Coinbase's engine offers end-user accounts exactly one fence, the
+ * project-scope policy, so the number compiled into those rules is the same for everybody and CANNOT be
+ * narrowed per user by the engine. A person who wants a lower number — "try it with $10" — gets it from
+ * Otto's own server: their choice is recorded against their grant (`execution-delegation-cap-store.ts`)
+ * and enforced on every delegated send, on top of this ceiling and never above it.
  */
 export const MODEL_B_PER_SWAP_CAP_USD = 5000;
+/**
+ * The floor of the range a person may choose. One whole dollar: the smallest cap that can still pass a
+ * real swap, and low enough that "try it with $10" is nowhere near it.
+ */
+export const MODEL_B_PER_SWAP_CAP_MIN_USD = 1;
+/**
+ * A requested per-swap cap, bounded — the same shape as `boundedDelegationExpiry`, and the ONLY place a
+ * requested number becomes a cap.
+ *
+ * 🔴 IT REFUSES; IT NEVER CLAMPS. A hostile 50,000 is not silently turned into 5,000: a caller that asked
+ * for a number outside the range is a caller whose intent this server does not know, and quietly
+ * substituting one would make "the cap you chose" a claim nobody could check. Absent means the ceiling —
+ * the terms every grant already carried before a choice existed.
+ */
+export function boundedPerSwapCap(requestedUsd) {
+    if (requestedUsd === undefined || requestedUsd === null)
+        return MODEL_B_PER_SWAP_CAP_USD;
+    const capUsd = Number(requestedUsd);
+    if (!Number.isInteger(capUsd) ||
+        capUsd < MODEL_B_PER_SWAP_CAP_MIN_USD ||
+        capUsd > MODEL_B_PER_SWAP_CAP_USD) {
+        throw new Error(`per-swap cap must be a whole number of USD between ${MODEL_B_PER_SWAP_CAP_MIN_USD} and ${MODEL_B_PER_SWAP_CAP_USD}`);
+    }
+    return capUsd;
+}
 export const BASE_USDC = getAddress('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913');
 /**
  * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
@@ -92,6 +170,25 @@ export function modelBInputToken(token) {
     const target = getAddress(token);
     return MODEL_B_INPUT_TOKENS_V1.find((entry) => entry.address === target);
 }
+export const MODEL_B_WITHDRAW_TOKENS_V2 = Object.freeze(EXECUTABLE_YIELD_MARKETS.filter((market) => market.protocol === 'MORPHO').map((market) => Object.freeze({
+    symbol: `${market.venue} shares`,
+    address: getAddress(market.vaultAddress),
+    decimals: 18,
+    marketId: market.id,
+})));
+export function modelBWithdrawToken(token) {
+    const target = getAddress(token);
+    return MODEL_B_WITHDRAW_TOKENS_V2.find((entry) => entry.address === target);
+}
+/**
+ * The engine-side bound on ONE withdraw's approve, in share atomic units: 5,000 shares. A USDC vault's
+ * share is worth ≥ 1 USDC by construction at inception and accrues from there (gtUSDCp ≈ 1.107 USDC on
+ * 2026-09-03), so 5,000 shares ≈ the 5,000 USD per-swap ceiling at par and somewhat more as yield accrues;
+ * after a vault loss the bound only tightens. It is the residual bound for a re-pointed withdraw, the same
+ * class as the swap rule's; the person's own cap does NOT apply to a withdraw (see the send gate: a withdraw
+ * returns the person's own assets to the person and never increases exposure).
+ */
+export const MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC = 5000n * 10n ** 18n;
 /** The cap in the token's atomic units. */
 export function modelBPerSwapCapAtomic(token, capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     if (!Number.isSafeInteger(capUsd) || capUsd <= 0)
@@ -140,7 +237,8 @@ export const GENERIC_SWAP_V3_ABI = [
     },
 ];
 /** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
-export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+/** The v1 rules, frozen as history: USDC approve to the diamond up to the cap + the router rule. */
+export function modelBProjectPolicyRulesV1(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     const approveRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
         action: 'accept',
         operation: 'sendEndUserEvmTransaction',
@@ -186,11 +284,87 @@ export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     };
     return Object.freeze([...approveRules, routerRule]);
 }
+/**
+ * The v2 rules = v1 + (a) one approve rule per registry Morpho share token, spender = the diamond only,
+ * value ≤ `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`, ethValue 0 — the delegated withdraw's allowance leg; the
+ * router rule is UNCHANGED (no receiver condition; the person's exit path); (b) a SIGN-ONLY accept rule
+ * (`signEndUserEvmTransaction`) for a USDC `transfer(to, value)` with value ≤ the per-swap cap and NO
+ * recipient condition — the person's own USDC exit without a swap, signed in their browser and broadcast
+ * by the page. The CDP policy schema carries no initiator/session criterion, so the engine cannot tell a
+ * user-signed send from a delegated one on the SAME operation; what it can do is fence a DIFFERENT
+ * operation, and Otto's delegated signer only ever calls the send operation (`adapter/cdp-signer.ts`).
+ * Stated residual: the developer-side end-user client also exposes `signEvmTransaction`, so under a
+ * delegation a compromised Otto could sign a USDC transfer to any address up to the cap — the same
+ * class and bound as the router rule's missing receiver condition, not a new one.
+ */
+export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    const v1 = modelBProjectPolicyRulesV1(capUsd);
+    const routerRule = v1[v1.length - 1];
+    const inputApproveRules = v1.slice(0, -1);
+    const shareApproveRules = MODEL_B_WITHDRAW_TOKENS_V2.map((token) => ({
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'approve',
+                        params: [
+                            { name: 'spender', operator: 'in', values: [LIFI_DIAMOND_ADDRESS] },
+                            { name: 'value', operator: '<=', value: MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC.toString() },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    /**
+     * 🔴 NO NETWORK CRITERION ON THE SIGN RULE — by the SDK's schema, not by choice (codex gate r1 HIGH 1):
+     * `signEndUserEvmTransaction` admits only `ethValue | evmAddress | netUSDChange | evmData`
+     * (`@coinbase/cdp-sdk/_types/policies/evmSchema.d.ts`); `evmNetwork` is a discriminator only the SEND
+     * operation accepts, and the SDK's create/update parse throws on it BEFORE any write. So this rule is
+     * pinned by the USDC contract ADDRESS (Base USDC lives at that address on Base alone) and by the amount,
+     * not by a network name. Stated residual: the same address on another network would be signable up to
+     * the cap — a broader statement than v1's, recorded in the PR for the Founder. A test parses the whole
+     * body through the SDK's own CreatePolicyBodySchema/UpdatePolicyBodySchema so this can never regress.
+     */
+    const userSignedUsdcTransferRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
+        action: 'accept',
+        operation: 'signEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'transfer',
+                        params: [
+                            { name: 'value', operator: '<=', value: modelBPerSwapCapAtomic(token, capUsd).toString() },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    return Object.freeze([
+        ...inputApproveRules,
+        ...shareApproveRules,
+        routerRule,
+        ...userSignedUsdcTransferRules,
+    ]);
+}
 /** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
 export function modelBProjectPolicyBody() {
     return Object.freeze({
         scope: 'project',
-        description: MODEL_B_POLICY_NAME_V1,
+        description: MODEL_B_POLICY_NAME,
         rules: modelBProjectPolicyRules(),
     });
 }
@@ -217,7 +391,15 @@ export function policyRulesDigest(rules) {
         .update(JSON.stringify(canonical(rules)))
         .digest('hex');
 }
-export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRules());
+export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRulesV1());
+export const MODEL_B_POLICY_DIGEST_V2 = policyRulesDigest(modelBProjectPolicyRules());
+/** The CURRENT digest (v2). */
+export const MODEL_B_POLICY_DIGEST = MODEL_B_POLICY_DIGEST_V2;
+/** name → {version, digest} for every accepted lineage version. */
+export const MODEL_B_POLICY_DIGEST_BY_NAME = new Map([
+    [MODEL_B_POLICY_NAME_V1, { version: 1, digest: MODEL_B_POLICY_DIGEST_V1 }],
+    [MODEL_B_POLICY_NAME_V2, { version: 2, digest: MODEL_B_POLICY_DIGEST_V2 }],
+]);
 /**
  * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
  * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
@@ -240,22 +422,35 @@ export function readBackModelBFence(policies) {
         };
     }
     const named = project[0];
-    if (named.description !== MODEL_B_POLICY_NAME_V1) {
+    const known = typeof named.description === 'string'
+        ? MODEL_B_POLICY_DIGEST_BY_NAME.get(named.description)
+        : undefined;
+    if (!known) {
         return {
             present: false,
             reason: 'name_mismatch',
-            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}"`,
+            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}" or "${MODEL_B_POLICY_NAME_V2}"`,
         };
     }
     const rulesDigest = policyRulesDigest(named.rules);
-    if (rulesDigest !== MODEL_B_POLICY_DIGEST_V1) {
+    if (rulesDigest !== known.digest) {
         return {
             present: false,
             reason: 'digest_mismatch',
-            detail: `the project policy "${MODEL_B_POLICY_NAME_V1}" carries rules that do not digest to v1 (${rulesDigest.slice(0, 16)}… ≠ ${MODEL_B_POLICY_DIGEST_V1.slice(0, 16)}…)`,
+            detail: `the project policy "${named.description}" carries rules that do not digest to v${known.version} (${rulesDigest.slice(0, 16)}… ≠ ${known.digest.slice(0, 16)}…)`,
         };
     }
-    return { present: true, id: named.id, rulesDigest };
+    return {
+        present: true,
+        id: named.id,
+        rulesDigest,
+        version: known.version,
+        name: named.description,
+    };
+}
+/** True when the read-back is THIS binary's fence version — what the fence tool leaves alone. */
+export function fenceIsCurrent(readBack) {
+    return readBack.present && readBack.version === MODEL_B_POLICY_VERSION;
 }
 /**
  * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
@@ -276,4 +471,53 @@ export function assertWithinModelBFence(plan, capUsd = MODEL_B_PER_SWAP_CAP_USD,
     }
     return { token, capAtomic };
 }
+/**
+ * 🔴 v2 — the delegated WITHDRAW's fence: the approve token must be a registry share token, the spender the
+ * diamond, the approve amount within the share cap, and the OUTPUT token USDC (a withdraw is "shares → the
+ * person's USDC", never a swap into something else under the withdraw's cap-free rule). The receiver pin
+ * (== the signing account) is the verifier's, already applied before this runs.
+ */
+export function assertWithdrawWithinModelBFence(plan) {
+    const token = modelBWithdrawToken(plan.token);
+    if (!token) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `input token ${plan.token} is neither an allow-listed delegated input nor a registry vault share token`);
+    }
+    if (getAddress(plan.spender) !== LIFI_DIAMOND_ADDRESS) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `approval spender ${plan.spender} is not the reviewed LI.FI diamond`);
+    }
+    if (getAddress(plan.outputToken) !== BASE_USDC) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `a delegated withdraw must deliver USDC to the signing account; this route delivers ${plan.outputToken}`);
+    }
+    if (plan.gross > MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `withdraw of ${plan.gross} share atomic units exceeds the engine bound ${MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC}`);
+    }
+    return { token };
+}
+/**
+ * THE PERSON'S OWN CAP, enforced after the engine's (Founder word `delegate cap choice`, 2026-09-02).
+ *
+ * 🔴 WHY THIS IS A SEPARATE CHECK AND A SEPARATE CODE. `assertWithinModelBFence` above answers "would
+ * Coinbase's engine have signed this?" — it is the shared ceiling and it is also enforced on-chain by the
+ * project policy, so a plan past it never reaches a signature whatever this server does. THIS check
+ * answers a different question: "is it inside the number THIS PERSON chose when they minted?" The engine
+ * cannot ask it (one project policy, shared by every delegated user), so Otto's server is the only place
+ * it can be asked, and a plan that fails it is one the engine WOULD have signed.
+ *
+ * Folding the two into one call with a smaller number would pass every shape-level test while making the
+ * two facts indistinguishable in the refusal, in the logs and in the tests. They are kept apart so a
+ * mutation that drops the user's cap reddens on its own named code rather than hiding behind the ceiling.
+ */
+export function assertWithinUserPerSwapCap(grossAtomic, capUsd, token) {
+    if (!Number.isInteger(capUsd) ||
+        capUsd < MODEL_B_PER_SWAP_CAP_MIN_USD ||
+        capUsd > MODEL_B_PER_SWAP_CAP_USD) {
+        // A recorded cap outside the range is a corrupted record, not a permission. Fail closed.
+        return refuse('DELEGATION_CAP_UNRECORDED', `the recorded per-swap cap (${String(capUsd)}) is not a whole number of USD between ${MODEL_B_PER_SWAP_CAP_MIN_USD} and ${MODEL_B_PER_SWAP_CAP_USD}; nothing is submitted`);
+    }
+    const capAtomic = modelBPerSwapCapAtomic(token, capUsd);
+    if (grossAtomic > capAtomic) {
+        return refuse('DELEGATION_ABOVE_USER_CAP', `gross ${grossAtomic} ${token.symbol} atomic exceeds the ${capUsd} USD per-swap cap recorded for this delegation (${capAtomic} atomic)`);
+    }
+    return { capUsd, capAtomic };
+}
 //# sourceMappingURL=execution-delegation-policy.js.map

package/dist/execution-delegation.d.ts

@@ -31,12 +31,27 @@
  *
  * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
  * error bodies are never relayed.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE THREAT MODEL THE PER-SWAP CAP GATE (step 5b) ENFORCES (Founder ruling, 2026-09-03, verbatim)
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * "The per-person delegation cap protects every delegated send that goes through Otto's page
+ * (/app/delegate) and Otto's CLI (otto-execute delegate). A permission a person mints or revokes
+ * directly against Coinbase with their own login, outside Otto's page and CLI, is OUT OF SCOPE: Otto
+ * cannot distinguish it (CDP returns no grant identity, only an expiry) and does not defend against it;
+ * the CDP project-scope $5,000 ceiling remains the hard backstop for every permission. The delegated
+ * agent never holds the person's login."
+ *
+ * Note the direction that holds even out of the model: a grant Otto has no CONFIRMED record for
+ * authorises NOTHING here — it is refused by name, never admitted at the shared ceiling. An
+ * out-of-model actor can therefore shorten what Otto may do for them, never widen it.
  */
 import { type Address, type PublicClient } from 'viem';
 import type { SealedWaitOptions } from './adapter/chain.js';
 import { DelegatedPlanHaltedError, type CdpDeveloperCredentials, type CdpRig, type DelegatedHaltCause } from './adapter/cdp-signer.js';
 import { type DelegatedSendResult } from './execution-delegated-definition.js';
 import { type DelegationPolicyRecord, type ModelBInputToken } from './execution-delegation-policy.js';
+import { type DelegationCapStore } from './execution-delegation-cap-store.js';
 import { ExecutionRefusal } from './execution-errors.js';
 import type { ExecutionToolRuntime } from './execution-tools.js';
 export declare const DELEGATION_ENV_NAMES: readonly ["CDP_API_KEY_ID", "CDP_API_KEY_SECRET", "CDP_WALLET_SECRET", "OTTO_DELEGATION_SERVER_SECRET", "BASE_RPC_URL"];
@@ -156,6 +171,12 @@ export interface DelegationCdpClient {
 export declare function createDelegationRig(cdp: DelegationCdpClient, pub: PublicClient): DelegationRig;
 export interface DelegationServices {
     readonly rig: DelegationRig;
+    /**
+     * The Base public client the rig was built on — exposed so the constructor can SIMULATE a quoted route
+     * from the executing account before preparing it (`adapter/route-simulator.ts`). Absent in tests that
+     * build a rig without one; the constructor then prepares without a simulation and says so.
+     */
+    readonly pub?: PublicClient;
     /** The server-to-server secret the caller must present in `x-otto-delegation-auth`. Never logged. */
     readonly serverSecret: string;
     /** Otto's PUBLIC CDP project id (a UUID) the fence-status tool publishes; undefined disables that tool. */
@@ -171,6 +192,20 @@ export interface DelegationServices {
         readonly perSwapCapUsd?: number;
         readonly inputTokens?: readonly ModelBInputToken[];
     };
+    /**
+     * Where the per-swap cap each person CHOSE when they minted is recorded, keyed by their grant
+     * (Founder word `delegate cap choice`, 2026-09-02). Durable across redeploys — see
+     * `execution-delegation-cap-store.ts` for why a Map would not do. A send whose grant has no record
+     * here refuses; an UNAVAILABLE store refuses everything, by name.
+     */
+    readonly capStore: DelegationCapStore;
+    /**
+     * 🔴 THE STAGED-DEPLOY GATE. False (the default in code) means no NEW permission can be reserved on
+     * this worker — see `DELEGATION_MINT_ENABLED` in `execution-delegation-cap-store.ts` for why the first
+     * rollout cannot be fenced by the ruleset handshake alone. It gates CREATION only: a send under a
+     * permission that is already confirmed still runs under its own cap, and REVOKE always works.
+     */
+    readonly mintEnabled: boolean;
 }
 export interface DelegationCaller {
     /** The header value as presented, or undefined when absent. Never logged. */