pi-roundtable 0.7.19 → 0.9.0

package/src/core/builtin/modules.ts

@@ -1,38 +1,58 @@
 import { join } from "node:path";
-import type { ModelRuntime } from "@earendil-works/pi-coding-agent";
-import type { SurfacePort } from "../contract/surface.ts";
+import type {
+	ExtensionFactory,
+	ModelRuntime,
+} from "@earendil-works/pi-coding-agent";
 import { scheduleCommands } from "../discord/schedule-commands.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
+import {
+	ConfigError,
+	DelegationError,
+	ScheduleError,
+} from "../domain/errors.ts";
 import { messages } from "../i18n/index.ts";
+import { legacyPrincipalsOf } from "../identity/identity-view.ts";
 import type { OwnerIdentity } from "../identity.ts";
 import type { ModelRef, ThinkingLevel } from "../models.ts";
 import { ConversationBackgroundTurns } from "../modules/background/background-turns.ts";
+import {
+	type PerPrincipalLimits,
+	personalTarget,
+} from "../modules/background/personal-target.ts";
 import { delegateExtension } from "../modules/delegation/delegate.ts";
 import {
 	DefaultDelegator,
 	type DelegationWorker,
 } from "../modules/delegation/delegator.ts";
 import { WebResearchWorker } from "../modules/delegation/web-research-worker.ts";
-import { notifyExtension } from "../modules/notify/notify.ts";
+import { sessionNotify } from "../modules/notify/session-notify.ts";
 import { precheckScriptHoldRule } from "../modules/schedules/precheck-tools.ts";
 import { Scheduler } from "../modules/schedules/scheduler.ts";
 import { schedulesExtension } from "../modules/schedules/schedules.ts";
+import type { ErrorReporter } from "../ops/error-reporter.ts";
 import type { RoundtablePlugin } from "../plugin.ts";
+import { splitReply } from "../presentation/reply-splitter.ts";
 import {
 	AGENTS,
 	BACKGROUND_TURNS,
 	DELEGATION,
+	IDENTITY,
 	PRECHECKS,
 	SCHEDULES,
 } from "../services.ts";
 import type { SessionContext } from "../sessions.ts";
 import { DELEGATE_TOOL } from "../shared/delegate-tool.ts";
 import { SCHEDULE_TOOLS } from "../shared/schedule-tools.ts";
-import { THE_SPEAKER, type Tier } from "../speakers.ts";
+import type { Tier } from "../speakers.ts";
 import { DISCORD } from "./discord.ts";
 import { fixed } from "./session-tool.ts";
 
 export interface ModulesOptions {
+	/**
+	 * Reports the process's own errors to a conversation, connected when the modules start; one
+	 * that reports to an agent is the agent server's to connect.
+	 */
+	errorReporter?: ErrorReporter;
 	/** Who the tools serve in the owner's own sessions. */
 	owner: OwnerIdentity & { id: string };
 	/** The name a turn the process itself starts is written by. */
@@ -41,6 +61,11 @@ export interface ModulesOptions {
 	modelRuntime: ModelRuntime;
 	agentDir: string;
 	dataDir: string;
+	/**
+	 * Each person's limits across their conversations, which the personal target holds them to;
+	 * unset, only each conversation's, as in 0.8.
+	 */
+	perPrincipal?: PerPrincipalLimits;
 	/** The model that runs delegated tasks, or a worker of your own that replaces it. */
 	delegation: {
 		model: ModelRef;
@@ -64,20 +89,24 @@ const MODULE_TIERS: Readonly<Record<string, Tier>> = {
 };
 
 /**
- * The owner's modules: notifications, schedules, and delegated tasks, each a session tool, and
- * the turns nobody wrote. The delegator's running jobs join the shutdown drain.
+ * The modules: notifications, schedules, and delegated tasks, each a session tool, and the turns
+ * nobody wrote. The delegator's running jobs join the shutdown drain. `notify` sends through the
+ * plugins' direct channels, so with none there is no notify. A conversation no chat surface carries
+ * schedules and delegates only when recorded private, into its creator's reachable,
+ * background-capable direct channel. It
+ * contributes `PERSONAL_TARGET`, with the per-person limits given, whose turns the schedules and
+ * delegated reports are, and a session whose conversation's claim takes no background turns gets
+ * neither tool.
  */
 export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 	const { owner } = options;
-	// Outside the agent server a conversation has no channel of its own to post a run in.
-	const channelFor = async (
-		channel: ChannelKey,
-		surfaces: SurfacePort,
-		ownerChannel: () => Promise<ChannelKey>,
-	) => (surfaces.of(channel) ? channel : ownerChannel());
+	const personal = personalTarget(options.perPrincipal);
+	// Set up once the modules set up; the preflight reads it after every plugin linked.
+	let reportsReach: (() => void) | undefined;
 	return {
 		name: "modules",
 		provides: [BACKGROUND_TURNS, DELEGATION],
+		preflight: () => reportsReach?.(),
 		setup: ({
 			conversations,
 			services,
@@ -85,20 +114,44 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 			surfaces,
 			sessions,
 			toolTiers,
+			directChannels,
 		}) => {
 			const schedules = services.get(SCHEDULES);
 			// Absent when a plugin list leaves the prechecks plugin out: then none can be attached.
 			const prechecks = services.find(PRECHECKS);
-			const discord = services.get(DISCORD);
-			const { connection } = discord;
+			// Absent on a host without Discord: then there are no threads.
+			const discord = services.find(DISCORD);
 			// Another agent's channel, for schedule_list; asked when a tool runs, after the agent server set up.
 			const agentChannelOf = (agent: string) =>
 				services.get(AGENTS).team.channelOf(agent);
-			const ownerChannelFor = (channel: ChannelKey) =>
-				channelFor(channel, surfaces, () => connection.ownerChannel());
+			// A conversation no chat surface carries keeps its runs in the creator's direct messages, where
+			// a claim must take them; anyone's elsewhere would run in a conversation that is not theirs.
+			const channelFor = async (
+				channel: ChannelKey,
+				principalId: string,
+				refused: (message: string) => Error,
+			) => {
+				if (surfaces.of(channel)) return channel;
+				const reached = await directChannels.reach(principalId);
+				if (!reached)
+					throw refused(
+						"this conversation has no chat surface to post a run in, and you have no direct channel on this host to post it in instead",
+					);
+				if (!conversations.takesBackground(reached.channel))
+					throw refused(
+						`this conversation has no chat surface to post a run in, and nothing here takes background turns in your ${reached.provider.name} direct messages, where it would go instead`,
+					);
+				return reached.channel;
+			};
+			const scheduleChannelFor = (channel: ChannelKey, principalId: string) =>
+				channelFor(channel, principalId, (m) => new ScheduleError(m));
+			const delegateChannelFor = (channel: ChannelKey, principalId: string) =>
+				channelFor(channel, principalId, (m) => new DelegationError(m));
+			const identity = services.find(IDENTITY);
 			const background = new ConversationBackgroundTurns({
 				conversations,
 				system: { id: "assistant", name: options.assistant },
+				...(identity ? { principalOf: legacyPrincipalsOf(identity) } : {}),
 				logger,
 			});
 			const delegator = new DefaultDelegator({
@@ -113,17 +166,106 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 					}),
 				targets: (name) => conversations.target(name),
 				deliver: (job, outcome) => background.runDelegated(job, outcome),
-				threads: discord.threads,
+				...(discord ? { threads: discord.threads } : {}),
 				logger,
 			});
 			services.provide(BACKGROUND_TURNS, background);
 			services.provide(DELEGATION, delegator);
-			// An agent session serves every speaker, so its tools name none.
-			const served = (session: SessionContext) =>
-				session.agent ? THE_SPEAKER : owner;
+			// Schedules and delegated reports run as background turns in the conversation, or, for one
+			// no chat surface carries, in the creator's direct messages; where no claim would take them,
+			// none could ever start, so the session gets no tools. Read when a session is made, after
+			// every plugin set up: a conversation without a chat surface has them only when it is
+			// recorded private to someone a direct channel knows. Creation checks the speaker's own
+			// destination again.
+			const offered = (
+				session: SessionContext,
+				extension: () => ExtensionFactory,
+			): ExtensionFactory | null => {
+				const home = session.homeChannel;
+				if (surfaces.of(home))
+					return conversations.takesBackground(home) ? extension() : null;
+				if (directChannels.providers().length === 0) return null;
+				// Only a conversation recorded private has a person to run its work for: a session
+				// outlives the turn it is built in, so whoever speaks then decides nothing.
+				const { conversation } = session;
+				if (session.agent || conversation.visibility !== "private") return null;
+				const own = conversation.principalId;
+				return async (pi) => {
+					// Only whether a direct channel knows them, without the network; the conversation there,
+					// and whether a claim takes its turns, are checked when a tool runs.
+					try {
+						if (!(await directChannels.known(own))) return;
+					} catch (error) {
+						logger.warn(
+							{ channel: home, err: error },
+							"could not tell whether the conversation's person has a direct channel",
+						);
+						return;
+					}
+					await extension()(pi);
+				};
+			};
+			// Whose a conversation is, as its session was made: an agent's serves everyone; another's
+			// schedules are its person's in a private one, and the speaker's own in one no chat surface
+			// carries, where its schedules are kept in a conversation it is not.
+			const visibility =
+				(session: SessionContext) =>
+				async (): Promise<"private" | "shared"> => {
+					if (session.agent) return "shared";
+					if (session.conversation.visibility === "private") return "private";
+					return surfaces.of(session.homeChannel) ? "shared" : "private";
+				};
+			const principalOf = identity ? legacyPrincipalsOf(identity) : undefined;
+			// A reporter for an ops agent is the agent server's to connect.
+			const reporter =
+				options.errorReporter &&
+				"conversation" in options.errorReporter.destination
+					? options.errorReporter
+					: undefined;
+			if (reporter && "conversation" in reporter.destination) {
+				const channel = reporter.destination.conversation;
+				// A report that no surface can post, or that no conversation owns, would only be logged;
+				// its report turn is the owner's background turn, which runs only where a claim takes one.
+				reportsReach = () => {
+					if (!surfaces.of(channel))
+						throw new ConfigError(
+							`config ops.conversation: no chat surface serves ${JSON.stringify(channel)}, so its error reports could never be posted. Name a conversation of a surface a plugin brings, or leave ops out.`,
+						);
+					if (!conversations.owns(channel))
+						throw new ConfigError(
+							`config ops.conversation: no plugin's conversations own ${JSON.stringify(channel)}, so nothing answers its error reports. Name a conversation a plugin's claim owns, or leave ops out.`,
+						);
+					if (!conversations.takesBackground(channel))
+						throw new ConfigError(
+							`config ops.conversation: the claim that owns ${JSON.stringify(channel)} takes no background turns, so nothing answers its error reports. Name a conversation whose claim takes background turns, or leave ops out.`,
+						);
+					// A report turn is the system principal's, which a conversation private to its person refuses.
+					if (!conversations.takesSystemReports(channel))
+						throw new ConfigError(
+							`config ops.conversation: the claim that owns ${JSON.stringify(channel)} keeps its conversations private to their people, so it takes no system error reports and each would only be logged. Name a conversation of a surface whose conversations are shared, such as a Discord channel, or report to an agent with ops.agent.`,
+						);
+				};
+			}
 			return {
 				services: [
 					{ name: "delegator", busy: () => delegator.runningChannels() },
+					...(reporter
+						? [
+								{
+									name: "error-reports",
+									start: () =>
+										reporter.connect({
+											post: (channel, text) =>
+												surfaces.sendReply(channel, {
+													chunks: splitReply(text),
+												}),
+											turn: (channel, text) =>
+												background.runErrorReport(channel, text),
+											logger,
+										}),
+								},
+							]
+						: []),
 				],
 				// Saving a precheck script that calls a held tool waits for the owner, as the call would.
 				holdRules: [
@@ -134,37 +276,49 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 					}),
 				],
 				sessionTools: [
-					fixed("notify", () => notifyExtension(connection, owner)),
+					fixed(
+						"notify",
+						sessionNotify({
+							directChannels,
+							owner,
+							logger,
+							onlyOwnerNotified: async () =>
+								toolTiers.minTier("notify") === "owner" &&
+								(identity ? (await identity.owners()).length <= 1 : true),
+						}),
+					),
 					fixed("schedules", (session) =>
-						schedulesExtension(
-							{
-								store: schedules,
-								owner: { id: owner.id, name: owner.name },
-								channelFor: ownerChannelFor,
-								...(prechecks ? { prechecks } : {}),
-								holds: () => sessions().holds,
-							},
-							session.homeChannel,
-							served(session),
-							session.agent ? agentChannelOf : undefined,
-							session.speaker,
+						offered(session, () =>
+							schedulesExtension(
+								{
+									store: schedules,
+									channelFor: scheduleChannelFor,
+									...(prechecks ? { prechecks } : {}),
+									holds: () => sessions().holds,
+									visibility: visibility(session),
+									...(principalOf ? { principalOf } : {}),
+									target: personal,
+								},
+								session.homeChannel,
+								session.agent ? agentChannelOf : undefined,
+								session.speaker,
+							),
 						),
 					),
 					fixed("delegate", (session) =>
-						delegateExtension(
-							{
-								delegator,
-								owner: { id: owner.id, name: owner.name },
-								channelFor: ownerChannelFor,
-							},
-							session.homeChannel,
-							served(session),
-							session.turnChannel,
-							session.speaker,
+						offered(session, () =>
+							delegateExtension(
+								{ delegator, channelFor: delegateChannelFor },
+								session.homeChannel,
+								session.turnChannel,
+								session.speaker,
+							),
 						),
 					),
 				],
 				toolTiers: MODULE_TIERS,
+				// Every person's conversations where a claim takes background turns are its own.
+				backgroundTargets: [personal],
 			};
 		},
 	};

package/src/core/builtin/stores.ts

@@ -4,9 +4,10 @@ import { PgMemoryStore } from "../modules/memory/owner-memory-store.ts";
 import { memoryPrecheckRegistry } from "../modules/schedules/prechecks.ts";
 import { PgScheduleStore } from "../modules/schedules/schedule-store.ts";
 import type { RoundtablePlugin } from "../plugin.ts";
+import { memoryReader } from "../runtime/session-conversation.ts";
 import { MEMORY, type MemoryStore, PRECHECKS, SCHEDULES } from "../services.ts";
-import type { SessionTool } from "../sessions.ts";
-import { THE_SPEAKER, type Tier } from "../speakers.ts";
+import type { SessionContext, SessionTool } from "../sessions.ts";
+import type { Tier } from "../speakers.ts";
 import { fixed } from "./session-tool.ts";
 
 export interface MemoryOptions {
@@ -21,29 +22,47 @@ export const MEMORY_TIERS: Readonly<Record<string, Tier>> = {
 	memory_remove: "member",
 };
 
-/** The memory tools and prompt block of every conversation, over the given store. */
+/**
+ * Whose memory a session's running turn reads: a private conversation's person's, whoever speaks
+ * in it, and in a shared one each turn's speaker's; never by tier, so a second owner reads their
+ * own. The host's own turns read no one's in a shared conversation.
+ */
+function memoryOwner(
+	session: SessionContext,
+): { principalId: string; name: string } | undefined {
+	if (session.memory === "none") return undefined;
+	const speaker = session.speaker();
+	const { conversation } = session;
+	const principalId = memoryReader(conversation, speaker);
+	if (principalId === undefined) return undefined;
+	// A principal 0.8 left is named by their id until someone names them; their speaker has a name.
+	const principal =
+		conversation.visibility === "private" ? conversation.principal : undefined;
+	const named =
+		principal && principal.displayName !== principal.id
+			? principal.displayName
+			: undefined;
+	const name =
+		named ??
+		(speaker?.principalId === principalId ? speaker.name : principalId);
+	return { principalId, name };
+}
+
+/** The memory tools and prompt block of every conversation, over the given store; none for a persona without memory. */
 export function memorySessionTool(
 	memory: MemoryStore,
 	owner: MemoryOptions["owner"],
 ): SessionTool {
-	return fixed("owner-memory", (session) => {
-		// An agent session serves every speaker, so its tools name none.
-		if (session.agent)
-			return ownerMemoryExtension(
-				memory,
-				owner.id,
-				THE_SPEAKER,
-				session.speaker,
-			);
-		// Any other conversation may admit a member or an admin, who reads and changes their own
-		// memory; an owner-tier speaker, such as remote MCP, speaks as the owner.
-		const speaker = () => {
-			const current = session.speaker();
-			return current?.tier === "owner" ? undefined : current;
-		};
-		// Its tools keep the owner's words, so the owner's own chats read as before.
-		return ownerMemoryExtension(memory, owner.id, owner, speaker, false);
-	});
+	return fixed("owner-memory", (session) =>
+		session.memory === "none"
+			? null
+			: ownerMemoryExtension(memory, {
+					ownerId: owner.id,
+					addressee: session.addressee,
+					describesSpeakers: session.conversation.visibility === "shared",
+					whose: () => memoryOwner(session),
+				}),
+	);
 }
 
 /**

package/src/core/config/access.ts

@@ -0,0 +1,229 @@
+import { ConfigError } from "../domain/errors.ts";
+import {
+	type AccessRules,
+	type AccessTier,
+	checkAccessRules,
+	rulesOfSpeakerMap,
+} from "../identity/access-policy.ts";
+import { parseIdentity } from "../identity/actor-facts.ts";
+import { PRONOUNS } from "../identity.ts";
+import type { Logger } from "../log.ts";
+import type { TierMembers } from "../speakers.ts";
+import type { Pronouns, ResolvedConfig, RoundtableConfig } from "./config.ts";
+import {
+	type Field,
+	guarded,
+	integer,
+	list,
+	oneOf,
+	optional,
+	shape,
+	text,
+} from "./schema.ts";
+
+/** Who holds a tier besides the owners: identities, roles written `<surface>:role:<name>`, or everyone, on every surface or on those listed. */
+export interface AccessTierConfig {
+	identities?: readonly string[];
+	roles?: readonly string[];
+	everyone?: boolean | readonly string[];
+}
+
+/** One owner: their name and pronouns, their principal, and the identities that are theirs. */
+export interface AccessOwnerConfig {
+	name: string;
+	pronouns?: Pronouns;
+	/**
+	 * Their principal's id. Required for the first owner, the primary one: give the old
+	 * `owner.id`, which `roundtable upgrade` writes, or an id of your choosing, such as their
+	 * Discord user id. Another owner without one gets a new `p_` principal at the first boot.
+	 */
+	principal?: string;
+	/** `<provider>:<subject>` strings, such as `discord:<user id>` or `token:remote-mcp`; `roundtable principal list` prints them. */
+	identities?: readonly string[];
+}
+
+/** Who the host serves, and at which tier: the owners, then admins and members by identity, role, or everyone. */
+export interface AccessConfig {
+	/** The owners, the first of them the primary owner, whose Discord identity the Discord parts act for until 0.10. */
+	owners: readonly AccessOwnerConfig[];
+	admins?: AccessTierConfig;
+	members?: AccessTierConfig;
+	/** `admitted` (default): someone the rules admit gets a principal at first contact, and a 0.8 speaker claims theirs; `linked`: only identities linked with the CLI, or the owners' configured ones, are served, and no one claims a 0.8 principal. */
+	provisioning?: "admitted" | "linked";
+	/** How many days someone whose tier comes only from the rules may go unseen before their background turns are refused; default 30. */
+	backgroundStaleDays?: number;
+}
+
+const everyone: Field<boolean | string[]> = guarded(
+	"true, false, or a list of surfaces",
+	(value): value is boolean | string[] =>
+		typeof value === "boolean" ||
+		(Array.isArray(value) &&
+			value.every((item) => typeof item === "string" && item.trim() !== "")),
+);
+
+const tierShape = shape({
+	identities: optional(list(text)),
+	roles: optional(list(text)),
+	everyone: optional(everyone),
+});
+
+/** The `access` key's shape. */
+export const accessShape = shape({
+	owners: list(
+		shape({
+			name: text,
+			pronouns: optional(oneOf<Pronouns>("he", "she", "they")),
+			principal: optional(text),
+			identities: optional(list(text)),
+		}),
+	),
+	admins: optional(tierShape),
+	members: optional(tierShape),
+	provisioning: optional(oneOf<"admitted" | "linked">("admitted", "linked")),
+	backgroundStaleDays: optional(integer(1, 36_500)),
+});
+
+/** The days an unseen principal's background turns keep their last tier, by default. */
+export const BACKGROUND_STALE_DAYS = 30;
+
+/** The deprecation the 0.8 `owner` and `speakers` print, once per host logger. */
+export const LEGACY_ACCESS =
+	"config owner and speakers are deprecated and go away in 0.10: write access: { owners, admins, members } instead; roundtable upgrade rewrites them";
+
+function tierOf(config: AccessTierConfig | undefined): AccessTier | undefined {
+	if (!config) return undefined;
+	return {
+		...(config.identities ? { identities: config.identities } : {}),
+		...(config.roles ? { roles: config.roles } : {}),
+		...(config.everyone === undefined ? {} : { everyone: config.everyone }),
+	};
+}
+
+/** The rules an `access` configuration means, checked. */
+export function rulesOfAccess(config: AccessConfig): AccessRules {
+	if (config.owners.length === 0)
+		throw new ConfigError(
+			"config access.owners: expected at least one owner. Name the person who runs this host.",
+		);
+	const [primary] = config.owners;
+	if (primary?.principal === undefined)
+		throw new ConfigError(
+			"config access.owners[0].principal: required for the primary owner in 0.9, expected their principal id. Give the old owner.id (roundtable upgrade writes it), or an id of your choosing, such as their Discord user id.",
+		);
+	const admins = tierOf(config.admins);
+	const members = tierOf(config.members);
+	return checkAccessRules({
+		owners: config.owners.map((owner) => ({
+			name: owner.name,
+			...(owner.pronouns ? { pronouns: owner.pronouns } : {}),
+			...(owner.principal === undefined ? {} : { principal: owner.principal }),
+			identities: owner.identities ?? [],
+		})),
+		...(admins ? { admins } : {}),
+		...(members ? { members } : {}),
+		provisioning: config.provisioning ?? "admitted",
+		backgroundStaleDays: config.backgroundStaleDays ?? BACKGROUND_STALE_DAYS,
+	});
+}
+
+/**
+ * The rules the 0.8 `owner` and `speakers` mean: the owner as the primary owner, their principal
+ * the old `owner.id`, which is also their Discord identity on a host with Discord, and the tiers
+ * by Discord user and role ids, with `everyone` meaning everyone on Discord, the one surface it
+ * reached in 0.8.
+ */
+export function rulesOfLegacy(
+	owner: { id: string; name: string; pronouns?: Pronouns },
+	speakers: { admins?: TierMembers; members?: TierMembers } = {},
+	withDiscord = true,
+): AccessRules {
+	const map = rulesOfSpeakerMap({
+		owners: [owner.id],
+		...(speakers.admins ? { admins: speakers.admins } : {}),
+		...(speakers.members ? { members: speakers.members } : {}),
+	});
+	return checkAccessRules({
+		...map,
+		owners: [
+			{
+				name: owner.name,
+				...(owner.pronouns ? { pronouns: owner.pronouns } : {}),
+				principal: owner.id,
+				identities: withDiscord ? [`discord:${owner.id}`] : [],
+			},
+		],
+		provisioning: "admitted",
+		backgroundStaleDays: BACKGROUND_STALE_DAYS,
+	});
+}
+
+/** The Discord user id among an owner's identities, if they list one. */
+export function discordIdOf(identities: readonly string[]): string | undefined {
+	for (const identity of identities) {
+		const ref = parseIdentity(identity);
+		if (ref?.provider === "discord") return ref.subject;
+	}
+	return undefined;
+}
+
+const warned = new WeakMap<Logger, Set<string>>();
+
+/** Logs each deprecation once per logger, so a host warns once however often it is defined. */
+export function warnDeprecations(
+	logger: Logger,
+	deprecations: readonly string[],
+): void {
+	let seen = warned.get(logger);
+	if (!seen) {
+		seen = new Set();
+		warned.set(logger, seen);
+	}
+	for (const message of deprecations) {
+		if (seen.has(message)) continue;
+		seen.add(message);
+		logger.warn(`deprecated: ${message}`);
+	}
+}
+
+/** The access rules and the primary owner, from `access` or the deprecated `owner` and `speakers`. */
+export function accessOf(
+	config: Pick<RoundtableConfig, "owner" | "speakers" | "access">,
+	withDiscord: boolean,
+): Pick<ResolvedConfig, "access" | "primaryOwner" | "deprecations"> {
+	const { owner, speakers, access } = config;
+	if (access && (owner || speakers))
+		throw new ConfigError(
+			"config access: write the owners in access or in owner and speakers, not both. Remove owner and speakers; roundtable upgrade rewrites them as access.",
+		);
+	if (!access && !owner)
+		throw new ConfigError(
+			'config access: required, expected who runs this host, such as access: { owners: [{ name: "Ada", principal: "<id>", identities: ["discord:<user id>"] }] }. Add it to roundtable.config.ts.',
+		);
+	const rules = access
+		? rulesOfAccess(access)
+		: rulesOfLegacy(
+				// The schema checked that one of the two is here.
+				owner as NonNullable<typeof owner>,
+				speakers,
+				withDiscord,
+			);
+	const [primary] = rules.owners;
+	if (primary?.principal === undefined)
+		throw new ConfigError("config access.owners[0].principal: required");
+	const discordId = discordIdOf(primary.identities);
+	if (withDiscord && discordId === undefined)
+		throw new ConfigError(
+			'config access.owners[0].identities: the primary owner needs a discord:<user id> identity while Discord is configured; the Discord parts act for them until 0.10. Add it, such as identities: ["discord:<your user id>"].',
+		);
+	return {
+		access: rules,
+		primaryOwner: {
+			id: primary.principal,
+			name: primary.name,
+			pronouns: PRONOUNS[primary.pronouns ?? "they"],
+			...(discordId === undefined ? {} : { discordId }),
+		},
+		deprecations: access ? [] : [LEGACY_ACCESS],
+	};
+}