otto-intel-mcp 0.1.2 → 0.1.4

package/dist/execution-delegation-policy.js

@@ -29,10 +29,12 @@
  *
  * Description obeys the SDK's regex (`/^[A-Za-z0-9 ,.]{1,50}$/`): no hyphens, no parentheses.
  */
-import { createHash } from 'node:crypto';
 import { getAddress } from 'viem';
 import { refuse } from './execution-errors.js';
 import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
+import { EXECUTABLE_YIELD_MARKETS } from './executable-yield-markets.js';
+import { policyRulesDigest, readBackPinnedLegacyCompatibleCompositePolicy, } from './execution-policy-compatibility.js';
+export { policyRulesDigest } from './execution-policy-compatibility.js';
 /**
  * The LINEAGE: a project policy is Otto's own only when its description matches the ANCHORED pattern
  * `^OTTO model b swap fence v<N>$` (`modelBLineageVersion` returns N). The fence tool updates a lineage policy
@@ -40,10 +42,30 @@ import { LIFI_DIAMOND_ADDRESS } from './execution-config.js';
  * the prefix in the middle, a suffix, no description — is foreign and is never touched.
  */
 export const MODEL_B_POLICY_LINEAGE_PREFIX = 'OTTO model b swap fence';
-/** This binary's fence version. Bump it whenever the rules change shape or caps. */
-export const MODEL_B_POLICY_VERSION = 1;
-/** The versioned match key. */
-export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+/**
+ * This binary's fence version. Bump it whenever the rules change shape or caps.
+ *
+ * 🔴 v2 (Founder word `fence v2`, pending — Yield Copilot withdraw, 2026-09-03). v2 ADDS to v1: an approve
+ * rule per registry Morpho share token (spender = the diamond only, bounded by
+ * `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`) so a delegated vault WITHDRAW can route shares → USDC through the
+ * same fenced GenericSwapV3 entry, and a sign-only accept rule for a USDC `transfer` (see
+ * `modelBProjectPolicyRules`). The router rule is UNCHANGED and still carries no receiver condition — that
+ * is the person's only way to move value out of an Otto/CDP wallet today (ws-7, 2026-09-03), and the
+ * receiver pin lives in Otto's delegated verifier.
+ *
+ * TRANSITION: a v2 binary ACCEPTS a v1 fence (swaps and deposits keep working; a withdraw under v1 is
+ * refused by name) and the fence tool upgrades v1 → v2 in place only when it is run — deploying this code
+ * writes nothing to the CDP project.
+ */
+export const MODEL_B_POLICY_VERSION = 2;
+/** The v1 match key — the fence every permission before `fence v2` was minted under; still accepted for swaps and deposits. */
+export const MODEL_B_POLICY_NAME_V1 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v1`;
+/** The v2 match key — what the fence tool writes; the only fence that admits a delegated Yield Copilot withdraw. */
+export const MODEL_B_POLICY_NAME_V2 = `${MODEL_B_POLICY_LINEAGE_PREFIX} v${MODEL_B_POLICY_VERSION}`;
+/** The CURRENT match key (v2). */
+export const MODEL_B_POLICY_NAME = MODEL_B_POLICY_NAME_V2;
+/** Every lineage version this binary accepts on read-back, oldest first. */
+export const MODEL_B_POLICY_ACCEPTED_VERSIONS = Object.freeze([1, 2]);
 const MODEL_B_LINEAGE_PATTERN = new RegExp(`^${MODEL_B_POLICY_LINEAGE_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')} v(\\d+)$`);
 /** The lineage version N of a policy description, or undefined when the description is not of our lineage. */
 export function modelBLineageVersion(description) {
@@ -62,24 +84,81 @@ export const MODEL_B_CHAIN_ID = 8453;
  */
 export const MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS = 90;
 export const MODEL_B_DELEGATION_EXPIRY_MAX_DAYS = 180;
-/** A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint. */
+/**
+ * The floor `boundedDelegationExpiry` has always enforced, NAMED — it was a literal `1` inside the bound,
+ * so the reserve schema could not state the range it accepts without hand-copying the number, and a
+ * hand-copied bound is a bound that drifts. Mirrors `MODEL_B_DELEGATION_EXPIRY_MIN_DAYS` in the dApp.
+ */
+export const MODEL_B_DELEGATION_EXPIRY_MIN_DAYS = 1;
+/**
+ * A requested expiry, bounded: a hostile, absent or over-long value never reaches the mint.
+ *
+ * 🔴 THE RESULT LANDS ON A WHOLE SECOND (round 3). CDP stores `expiresAt` at whole-second granularity and
+ * truncates milliseconds toward zero — verified live on the dev project 2026-09-02 (`…:46.137Z` came back
+ * as `…:46Z` from `createDelegation` AND from `getDelegationForEndUser`; `…:45.999Z` came back as
+ * `…:45Z`, so it truncates rather than rounds). Everything downstream — the reservation, the durable row
+ * and every enforcement read — keys on that second, so the bound produces it directly rather than leaving
+ * a millisecond remainder for one of them to drop and another to keep.
+ */
 export function boundedDelegationExpiry(requestedDays, nowMs) {
     const days = requestedDays === undefined || requestedDays === null
         ? MODEL_B_DELEGATION_EXPIRY_DEFAULT_DAYS
         : Number(requestedDays);
-    if (!Number.isInteger(days) || days < 1 || days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
-        throw new Error(`delegation expiry must be a whole number of days between 1 and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
+    if (!Number.isInteger(days) ||
+        days < MODEL_B_DELEGATION_EXPIRY_MIN_DAYS ||
+        days > MODEL_B_DELEGATION_EXPIRY_MAX_DAYS) {
+        throw new Error(`delegation expiry must be a whole number of days between ${MODEL_B_DELEGATION_EXPIRY_MIN_DAYS} and ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}`);
     }
-    return Object.freeze({ days, expiresAt: new Date(nowMs + days * 86_400_000).toISOString() });
+    const wholeSecond = Math.floor((nowMs + days * 86_400_000) / 1000) * 1000;
+    return Object.freeze({ days, expiresAt: new Date(wholeSecond).toISOString() });
 }
+/**
+ * The mint-expiry helpers live with the store that owns the reserved second; re-exported here because
+ * this is the module every consumer of the Model-B numbers already imports.
+ */
+export { MINT_EXPIRY_FILLER_MS as MODEL_B_MINT_EXPIRY_FILLER_MS } from './execution-delegation-cap-store.js';
+export { mintExpiryForSecond as mintExpiryFor } from './execution-delegation-cap-store.js';
+export { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
 /**
  * The per-swap cap in USD — the Founder's number (word `fence cap 5000`, 2026-08-29). It bounds ONE swap:
  * the engine carries no daily or total limit, and no copy may imply one. Changing it = a new fence version.
  * Engine conditions are on raw calldata, so the cap is expressed per allowed input token: v1 allows USDC
  * only, where the mapping is exact (5,000 USD = 5,000,000,000 atomic on the approve amount, which is what
  * bounds the swap's `fromAmount` on-chain).
+ *
+ * 🔴 THIS IS THE CEILING, SHARED BY EVERY DELEGATED USER — NOT ANY ONE PERSON'S CAP (Founder word
+ * `delegate cap choice`, 2026-09-02). Coinbase's engine offers end-user accounts exactly one fence, the
+ * project-scope policy, so the number compiled into those rules is the same for everybody and CANNOT be
+ * narrowed per user by the engine. A person who wants a lower number — "try it with $10" — gets it from
+ * Otto's own server: their choice is recorded against their grant (`execution-delegation-cap-store.ts`)
+ * and enforced on every delegated send, on top of this ceiling and never above it.
  */
 export const MODEL_B_PER_SWAP_CAP_USD = 5000;
+/**
+ * The floor of the range a person may choose. One whole dollar: the smallest cap that can still pass a
+ * real swap, and low enough that "try it with $10" is nowhere near it.
+ */
+export const MODEL_B_PER_SWAP_CAP_MIN_USD = 1;
+/**
+ * A requested per-swap cap, bounded — the same shape as `boundedDelegationExpiry`, and the ONLY place a
+ * requested number becomes a cap.
+ *
+ * 🔴 IT REFUSES; IT NEVER CLAMPS. A hostile 50,000 is not silently turned into 5,000: a caller that asked
+ * for a number outside the range is a caller whose intent this server does not know, and quietly
+ * substituting one would make "the cap you chose" a claim nobody could check. Absent means the ceiling —
+ * the terms every grant already carried before a choice existed.
+ */
+export function boundedPerSwapCap(requestedUsd) {
+    if (requestedUsd === undefined || requestedUsd === null)
+        return MODEL_B_PER_SWAP_CAP_USD;
+    const capUsd = Number(requestedUsd);
+    if (!Number.isInteger(capUsd) ||
+        capUsd < MODEL_B_PER_SWAP_CAP_MIN_USD ||
+        capUsd > MODEL_B_PER_SWAP_CAP_USD) {
+        throw new Error(`per-swap cap must be a whole number of USD between ${MODEL_B_PER_SWAP_CAP_MIN_USD} and ${MODEL_B_PER_SWAP_CAP_USD}`);
+    }
+    return capUsd;
+}
 export const BASE_USDC = getAddress('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913');
 /**
  * The input tokens a delegated swap may spend, v1: USDC only — the one token whose USD cap is exact.
@@ -92,6 +171,25 @@ export function modelBInputToken(token) {
     const target = getAddress(token);
     return MODEL_B_INPUT_TOKENS_V1.find((entry) => entry.address === target);
 }
+export const MODEL_B_WITHDRAW_TOKENS_V2 = Object.freeze(EXECUTABLE_YIELD_MARKETS.filter((market) => market.protocol === 'MORPHO').map((market) => Object.freeze({
+    symbol: `${market.venue} shares`,
+    address: getAddress(market.vaultAddress),
+    decimals: 18,
+    marketId: market.id,
+})));
+export function modelBWithdrawToken(token) {
+    const target = getAddress(token);
+    return MODEL_B_WITHDRAW_TOKENS_V2.find((entry) => entry.address === target);
+}
+/**
+ * The engine-side bound on ONE withdraw's approve, in share atomic units: 5,000 shares. A USDC vault's
+ * share is worth ≥ 1 USDC by construction at inception and accrues from there (gtUSDCp ≈ 1.107 USDC on
+ * 2026-09-03), so 5,000 shares ≈ the 5,000 USD per-swap ceiling at par and somewhat more as yield accrues;
+ * after a vault loss the bound only tightens. It is the residual bound for a re-pointed withdraw, the same
+ * class as the swap rule's; the person's own cap does NOT apply to a withdraw (see the send gate: a withdraw
+ * returns the person's own assets to the person and never increases exposure).
+ */
+export const MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC = 5000n * 10n ** 18n;
 /** The cap in the token's atomic units. */
 export function modelBPerSwapCapAtomic(token, capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     if (!Number.isSafeInteger(capUsd) || capUsd <= 0)
@@ -140,7 +238,8 @@ export const GENERIC_SWAP_V3_ABI = [
     },
 ];
 /** The static v1 rules: one approve rule per allow-listed input token, one router rule. */
-export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+/** The v1 rules, frozen as history: USDC approve to the diamond up to the cap + the router rule. */
+export function modelBProjectPolicyRulesV1(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     const approveRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
         action: 'accept',
         operation: 'sendEndUserEvmTransaction',
@@ -186,38 +285,99 @@ export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
     };
     return Object.freeze([...approveRules, routerRule]);
 }
+/**
+ * The v2 rules = v1 + (a) one approve rule per registry Morpho share token, spender = the diamond only,
+ * value ≤ `MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC`, ethValue 0 — the delegated withdraw's allowance leg; the
+ * router rule is UNCHANGED (no receiver condition; the person's exit path); (b) a SIGN-ONLY accept rule
+ * (`signEndUserEvmTransaction`) for a USDC `transfer(to, value)` with value ≤ the per-swap cap and NO
+ * recipient condition — the person's own USDC exit without a swap, signed in their browser and broadcast
+ * by the page. The CDP policy schema carries no initiator/session criterion, so the engine cannot tell a
+ * user-signed send from a delegated one on the SAME operation; what it can do is fence a DIFFERENT
+ * operation, and Otto's delegated signer only ever calls the send operation (`adapter/cdp-signer.ts`).
+ * Stated residual: the developer-side end-user client also exposes `signEvmTransaction`, so under a
+ * delegation a compromised Otto could sign a USDC transfer to any address up to the cap — the same
+ * class and bound as the router rule's missing receiver condition, not a new one.
+ */
+export function modelBProjectPolicyRules(capUsd = MODEL_B_PER_SWAP_CAP_USD) {
+    const v1 = modelBProjectPolicyRulesV1(capUsd);
+    const routerRule = v1[v1.length - 1];
+    const inputApproveRules = v1.slice(0, -1);
+    const shareApproveRules = MODEL_B_WITHDRAW_TOKENS_V2.map((token) => ({
+        action: 'accept',
+        operation: 'sendEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmNetwork', networks: [MODEL_B_POLICY_NETWORK], operator: 'in' },
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'approve',
+                        params: [
+                            { name: 'spender', operator: 'in', values: [LIFI_DIAMOND_ADDRESS] },
+                            { name: 'value', operator: '<=', value: MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC.toString() },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    /**
+     * 🔴 NO NETWORK CRITERION ON THE SIGN RULE — by the SDK's schema, not by choice (codex gate r1 HIGH 1):
+     * `signEndUserEvmTransaction` admits only `ethValue | evmAddress | netUSDChange | evmData`
+     * (`@coinbase/cdp-sdk/_types/policies/evmSchema.d.ts`); `evmNetwork` is a discriminator only the SEND
+     * operation accepts, and the SDK's create/update parse throws on it BEFORE any write. So this rule is
+     * pinned by the USDC contract ADDRESS (Base USDC lives at that address on Base alone) and by the amount,
+     * not by a network name. Stated residual: the same address on another network would be signable up to
+     * the cap — a broader statement than v1's, recorded in the PR for the Founder. A test parses the whole
+     * body through the SDK's own CreatePolicyBodySchema/UpdatePolicyBodySchema so this can never regress.
+     */
+    const userSignedUsdcTransferRules = MODEL_B_INPUT_TOKENS_V1.map((token) => ({
+        action: 'accept',
+        operation: 'signEndUserEvmTransaction',
+        criteria: [
+            { type: 'evmAddress', addresses: [token.address], operator: 'in' },
+            { type: 'ethValue', ethValue: '0', operator: '<=' },
+            {
+                type: 'evmData',
+                abi: 'erc20',
+                conditions: [
+                    {
+                        function: 'transfer',
+                        params: [
+                            { name: 'value', operator: '<=', value: modelBPerSwapCapAtomic(token, capUsd).toString() },
+                        ],
+                    },
+                ],
+            },
+        ],
+    }));
+    return Object.freeze([
+        ...inputApproveRules,
+        ...shareApproveRules,
+        routerRule,
+        ...userSignedUsdcTransferRules,
+    ]);
+}
 /** The body PR-2's installer creates or updates: scope, versioned description, the v1 rules. */
 export function modelBProjectPolicyBody() {
     return Object.freeze({
         scope: 'project',
-        description: MODEL_B_POLICY_NAME_V1,
+        description: MODEL_B_POLICY_NAME,
         rules: modelBProjectPolicyRules(),
     });
 }
-/** Sorted keys, undefined dropped, hex strings lowercased; arrays keep their order. Nothing else. */
-function canonical(value) {
-    if (Array.isArray(value))
-        return value.map(canonical);
-    if (value !== null && typeof value === 'object') {
-        const out = {};
-        for (const key of Object.keys(value).sort()) {
-            const item = value[key];
-            if (item !== undefined)
-                out[key] = canonical(item);
-        }
-        return out;
-    }
-    if (typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value))
-        return value.toLowerCase();
-    return value;
-}
-/** SHA-256 over the canonical JSON of a rule list — the fence's integrity check at read-back. */
-export function policyRulesDigest(rules) {
-    return createHash('sha256')
-        .update(JSON.stringify(canonical(rules)))
-        .digest('hex');
-}
-export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRules());
+export const MODEL_B_POLICY_DIGEST_V1 = policyRulesDigest(modelBProjectPolicyRulesV1());
+export const MODEL_B_POLICY_DIGEST_V2 = policyRulesDigest(modelBProjectPolicyRules());
+/** The CURRENT digest (v2). */
+export const MODEL_B_POLICY_DIGEST = MODEL_B_POLICY_DIGEST_V2;
+/** name → {version, digest} for every accepted lineage version. */
+export const MODEL_B_POLICY_DIGEST_BY_NAME = new Map([
+    [MODEL_B_POLICY_NAME_V1, { version: 1, digest: MODEL_B_POLICY_DIGEST_V1 }],
+    [MODEL_B_POLICY_NAME_V2, { version: 2, digest: MODEL_B_POLICY_DIGEST_V2 }],
+]);
 /**
  * The fence check the delegated-send path runs BEFORE any send: EXACTLY ONE project-scope policy reads back
  * (Coinbase allows one; more is an anomalous snapshot and never blessed on the strength of "one of them
@@ -240,22 +400,46 @@ export function readBackModelBFence(policies) {
         };
     }
     const named = project[0];
-    if (named.description !== MODEL_B_POLICY_NAME_V1) {
+    const known = typeof named.description === 'string'
+        ? MODEL_B_POLICY_DIGEST_BY_NAME.get(named.description)
+        : undefined;
+    if (!known) {
+        const compatible = readBackPinnedLegacyCompatibleCompositePolicy(named, MODEL_B_POLICY_DIGEST_V2, modelBProjectPolicyRules().length);
+        if (compatible) {
+            // Preserve the public legacy shape exactly. Composite identity is consumed only by the native rail.
+            return {
+                present: true,
+                id: compatible.policyId,
+                rulesDigest: MODEL_B_POLICY_DIGEST_V2,
+                version: 2,
+                name: MODEL_B_POLICY_NAME_V2,
+            };
+        }
         return {
             present: false,
             reason: 'name_mismatch',
-            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}"`,
+            detail: `the project policy is not "${MODEL_B_POLICY_NAME_V1}" or "${MODEL_B_POLICY_NAME_V2}"`,
         };
     }
     const rulesDigest = policyRulesDigest(named.rules);
-    if (rulesDigest !== MODEL_B_POLICY_DIGEST_V1) {
+    if (rulesDigest !== known.digest) {
         return {
             present: false,
             reason: 'digest_mismatch',
-            detail: `the project policy "${MODEL_B_POLICY_NAME_V1}" carries rules that do not digest to v1 (${rulesDigest.slice(0, 16)}… ≠ ${MODEL_B_POLICY_DIGEST_V1.slice(0, 16)}…)`,
+            detail: `the project policy "${named.description}" carries rules that do not digest to v${known.version} (${rulesDigest.slice(0, 16)}… ≠ ${known.digest.slice(0, 16)}…)`,
         };
     }
-    return { present: true, id: named.id, rulesDigest };
+    return {
+        present: true,
+        id: named.id,
+        rulesDigest,
+        version: known.version,
+        name: named.description,
+    };
+}
+/** True when the read-back is THIS binary's fence version — what the fence tool leaves alone. */
+export function fenceIsCurrent(readBack) {
+    return readBack.present && readBack.version === MODEL_B_POLICY_VERSION;
 }
 /**
  * The same bound the engine enforces, checked server-side BEFORE the first step is sent: a plan the
@@ -276,4 +460,53 @@ export function assertWithinModelBFence(plan, capUsd = MODEL_B_PER_SWAP_CAP_USD,
     }
     return { token, capAtomic };
 }
+/**
+ * 🔴 v2 — the delegated WITHDRAW's fence: the approve token must be a registry share token, the spender the
+ * diamond, the approve amount within the share cap, and the OUTPUT token USDC (a withdraw is "shares → the
+ * person's USDC", never a swap into something else under the withdraw's cap-free rule). The receiver pin
+ * (== the signing account) is the verifier's, already applied before this runs.
+ */
+export function assertWithdrawWithinModelBFence(plan) {
+    const token = modelBWithdrawToken(plan.token);
+    if (!token) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `input token ${plan.token} is neither an allow-listed delegated input nor a registry vault share token`);
+    }
+    if (getAddress(plan.spender) !== LIFI_DIAMOND_ADDRESS) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `approval spender ${plan.spender} is not the reviewed LI.FI diamond`);
+    }
+    if (getAddress(plan.outputToken) !== BASE_USDC) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `a delegated withdraw must deliver USDC to the signing account; this route delivers ${plan.outputToken}`);
+    }
+    if (plan.gross > MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC) {
+        return refuse('DELEGATION_OUTSIDE_FENCE', `withdraw of ${plan.gross} share atomic units exceeds the engine bound ${MODEL_B_WITHDRAW_SHARE_CAP_ATOMIC}`);
+    }
+    return { token };
+}
+/**
+ * THE PERSON'S OWN CAP, enforced after the engine's (Founder word `delegate cap choice`, 2026-09-02).
+ *
+ * 🔴 WHY THIS IS A SEPARATE CHECK AND A SEPARATE CODE. `assertWithinModelBFence` above answers "would
+ * Coinbase's engine have signed this?" — it is the shared ceiling and it is also enforced on-chain by the
+ * project policy, so a plan past it never reaches a signature whatever this server does. THIS check
+ * answers a different question: "is it inside the number THIS PERSON chose when they minted?" The engine
+ * cannot ask it (one project policy, shared by every delegated user), so Otto's server is the only place
+ * it can be asked, and a plan that fails it is one the engine WOULD have signed.
+ *
+ * Folding the two into one call with a smaller number would pass every shape-level test while making the
+ * two facts indistinguishable in the refusal, in the logs and in the tests. They are kept apart so a
+ * mutation that drops the user's cap reddens on its own named code rather than hiding behind the ceiling.
+ */
+export function assertWithinUserPerSwapCap(grossAtomic, capUsd, token) {
+    if (!Number.isInteger(capUsd) ||
+        capUsd < MODEL_B_PER_SWAP_CAP_MIN_USD ||
+        capUsd > MODEL_B_PER_SWAP_CAP_USD) {
+        // A recorded cap outside the range is a corrupted record, not a permission. Fail closed.
+        return refuse('DELEGATION_CAP_UNRECORDED', `the recorded per-swap cap (${String(capUsd)}) is not a whole number of USD between ${MODEL_B_PER_SWAP_CAP_MIN_USD} and ${MODEL_B_PER_SWAP_CAP_USD}; nothing is submitted`);
+    }
+    const capAtomic = modelBPerSwapCapAtomic(token, capUsd);
+    if (grossAtomic > capAtomic) {
+        return refuse('DELEGATION_ABOVE_USER_CAP', `gross ${grossAtomic} ${token.symbol} atomic exceeds the ${capUsd} USD per-swap cap recorded for this delegation (${capAtomic} atomic)`);
+    }
+    return { capUsd, capAtomic };
+}
 //# sourceMappingURL=execution-delegation-policy.js.map

package/dist/execution-delegation.d.ts

@@ -31,12 +31,30 @@
  *
  * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
  * error bodies are never relayed.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE THREAT MODEL THE PER-SWAP CAP GATE (step 5b) ENFORCES (Founder ruling, 2026-09-03, verbatim)
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * "The per-person delegation cap protects every delegated send that goes through Otto's page
+ * (/app/delegate) and Otto's CLI (otto-execute delegate). A permission a person mints or revokes
+ * directly against Coinbase with their own login, outside Otto's page and CLI, is OUT OF SCOPE: Otto
+ * cannot distinguish it (CDP returns no grant identity, only an expiry) and does not defend against it;
+ * the CDP project-scope $5,000 ceiling remains the hard backstop for every permission. The delegated
+ * agent never holds the person's login."
+ *
+ * Note the direction that holds even out of the model: a grant Otto has no CONFIRMED record for
+ * authorises NOTHING here — it is refused by name, never admitted at the shared ceiling. An
+ * out-of-model actor can therefore shorten what Otto may do for them, never widen it.
  */
 import { type Address, type PublicClient } from 'viem';
 import type { SealedWaitOptions } from './adapter/chain.js';
 import { DelegatedPlanHaltedError, type CdpDeveloperCredentials, type CdpRig, type DelegatedHaltCause } from './adapter/cdp-signer.js';
 import { type DelegatedSendResult } from './execution-delegated-definition.js';
 import { type DelegationPolicyRecord, type ModelBInputToken } from './execution-delegation-policy.js';
+import { type DelegationCapStore } from './execution-delegation-cap-store.js';
+import { type DelegationOperationStore } from './execution-delegation-operation-store.js';
+import { type DelegationExitStore } from './execution-delegation-exit-store.js';
+import { type ExecutionWorkerGuardStore } from './execution-worker-guard.js';
 import { ExecutionRefusal } from './execution-errors.js';
 import type { ExecutionToolRuntime } from './execution-tools.js';
 export declare const DELEGATION_ENV_NAMES: readonly ["CDP_API_KEY_ID", "CDP_API_KEY_SECRET", "CDP_WALLET_SECRET", "OTTO_DELEGATION_SERVER_SECRET", "BASE_RPC_URL"];
@@ -121,6 +139,7 @@ export interface DelegationCdpClient {
             address: string;
             transaction: `0x${string}`;
             network: 'base';
+            idempotencyKey?: string;
         }): Promise<{
             readonly transactionHash: string;
         }>;
@@ -156,6 +175,12 @@ export interface DelegationCdpClient {
 export declare function createDelegationRig(cdp: DelegationCdpClient, pub: PublicClient): DelegationRig;
 export interface DelegationServices {
     readonly rig: DelegationRig;
+    /**
+     * The Base public client the rig was built on — exposed so the constructor can SIMULATE a quoted route
+     * from the executing account before preparing it (`adapter/route-simulator.ts`). Absent in tests that
+     * build a rig without one; the constructor then prepares without a simulation and says so.
+     */
+    readonly pub?: PublicClient;
     /** The server-to-server secret the caller must present in `x-otto-delegation-auth`. Never logged. */
     readonly serverSecret: string;
     /** Otto's PUBLIC CDP project id (a UUID) the fence-status tool publishes; undefined disables that tool. */
@@ -171,6 +196,32 @@ export interface DelegationServices {
         readonly perSwapCapUsd?: number;
         readonly inputTokens?: readonly ModelBInputToken[];
     };
+    /**
+     * Where the per-swap cap each person CHOSE when they minted is recorded, keyed by their grant
+     * (Founder word `delegate cap choice`, 2026-09-02). Durable across redeploys — see
+     * `execution-delegation-cap-store.ts` for why a Map would not do. A send whose grant has no record
+     * here refuses; an UNAVAILABLE store refuses everything, by name.
+     */
+    readonly capStore: DelegationCapStore;
+    /** Durable, cross-process send journal. An unavailable or not-ready journal refuses every new send. */
+    readonly operationStore: DelegationOperationStore;
+    /** Same operations.db: exit records plus the unified mint/delegated/exit per-user claim. */
+    readonly exitStore: DelegationExitStore;
+    /** Permanent per-operation SQLite files; their held writer lock is process liveness, never elapsed time. */
+    readonly workerGuards: ExecutionWorkerGuardStore;
+    /**
+     * 🔴 THE STAGED-DEPLOY GATE. False (the default in code) means no NEW permission can be reserved on
+     * this worker — see `DELEGATION_MINT_ENABLED` in `execution-delegation-cap-store.ts` for why the first
+     * rollout cannot be fenced by the ruleset handshake alone. It gates CREATION only: a send under a
+     * permission that is already confirmed still runs under its own cap, and REVOKE always works.
+     */
+    readonly mintEnabled: boolean;
+    /**
+     * Model B trade-permission creation only. Production keeps this false permanently while
+     * mintEnabled retains its separate meaning for Muse enrolment and research permissions.
+     * Test worlds may set it true to exercise the preserved legacy grant and exit contracts.
+     */
+    readonly tradeMintEnabled: boolean;
 }
 export interface DelegationCaller {
     /** The header value as presented, or undefined when absent. Never logged. */