unoverse 0.1.208 → 0.1.210

package/operator/.env.example

@@ -61,7 +61,7 @@ UNOVERSE_MARKETPLACE_URL=
 CREDENTIAL_ENCRYPTION_KEY=
 
 # Auth is ON by default (missing flag = enabled), same as production.
-AUTH_ISSUER=https://your-tenant.auth0.com
+AUTH_ISSUER=https://your-environment.authkit.app
 AUTH_CLIENT_ID=your-client-id
 AUTH_AUDIENCE=gravity-api
 

package/operator/infra/aws/main.tf

@@ -430,7 +430,7 @@ resource "aws_elasticache_replication_group" "redis" {
 
 # ── Cognito: user pool (Essentials) + pre-token Lambda ────────────────────────
 # The Lambda is LOAD-BEARING: it puts email/roles/permissions on the ACCESS token
-# (the platform's token contract, AUTH_TOKEN_FLOW.md). Roles come from Cognito
+# (the platform's token contract, docs/auth-security/IDENTITY.md). Roles come from Cognito
 # groups. It lives in Terraform precisely so a pool rebuild cannot drop it — the
 # documented Auth0 footgun, not repeated here.
 
@@ -561,7 +561,7 @@ resource "aws_cognito_user_pool" "pool" {
 locals {
   # TWO LEVELS, BECAUSE THE PLATFORM READS TWO CLAIMS.
   #
-  # Auth0 (the DigitalOcean ground) models this properly and is the standing contract:
+  # The standing contract, whichever IdP issues the token:
   #
   #     ROLE admin      → permission  admin:access
   #     ROLE developer  → permissions marketplace:publish, workflow:author, workflow:promote

package/operator/infra/aws/pretoken/index.mjs

@@ -2,10 +2,10 @@
  * Cognito Pre Token Generation (V2_0) — the platform's token contract.
  *
  * LOAD-BEARING. The platform reads sub/email/roles (and permissions) off the
- * ACCESS token and never calls back to the IdP (docs/AUTH_TOKEN_FLOW.md). Without
+ * ACCESS token and never calls back to the IdP (docs/auth-security/IDENTITY.md). Without
  * this Lambda, email-keyed features silently no-op and no role-gated surface
  * (workflow:author builder, marketplace:publish publish, requires.role nodes)
- * can ever pass. The Cognito equivalent of the Auth0 Post-Login Action.
+ * can ever pass. The Cognito equivalent of another IdP's claims configuration.
  *
  * Roles = the user's Cognito groups, verbatim. Groups are named in the platform's
  * noun:verb grammar (workflow:author, marketplace:publish, finance:approve, ...),

package/operator/infra/aws/terraform.tfvars.example

@@ -40,7 +40,7 @@ oauth_callback_urls = [
 
 # RBAC roles (noun:verb — the grammar node manifests' requires.role matches).
 # Each becomes a Cognito group; put a user in the group and the role rides their
-# token. THE FULL SET, mirroring the Auth0 tenant's Gravity API permissions
+# token. THE FULL SET, mirroring the platform's standing permission set
 # (2026-07-28). The first two are enforced by code gates and are always created
 # even if removed from this list; the last two are declared intent (no code gate
 # yet — enforcement arrives with the surfaces they name).

package/operator/infra/digitalocean/outputs.tf

@@ -109,7 +109,7 @@ output "env_production" {
     REDIS_TLS=${local.redis_tls}
     REDIS_NAMESPACE=universe
 
-    # OIDC — byo (Auth0 today): the tenant is authoritative for roles/permissions.
+    # OIDC — byo (WorkOS today): the tenant is authoritative for roles/permissions.
     AUTH_ISSUER=${var.auth_issuer}
     AUTH_CLIENT_ID=${var.auth_client_id}
     AUTH_AUDIENCE=${var.auth_audience}

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -24,9 +24,9 @@ manage_dns   = false                    # true only if the domain's DNS is on DO
 # Add that URL to the IdP's allowed origins. Default false = admin-only.
 canvas_public = true
 
-# Auth — byo-oidc (the standing choice: DO universes use the existing Auth0
-# tenant; roles/permissions live THERE, Terraform doesn't touch them).
-auth_issuer    = "https://your-tenant.auth0.com"
+# Auth — byo-oidc (the standing choice: DO universes use the existing WorkOS
+# environment; roles/permissions live THERE, Terraform doesn't touch them).
+auth_issuer    = "https://your-environment.authkit.app"
 auth_client_id = "your-spa-client-id"
 auth_audience  = "gravity-api"
 # In that client's Allowed Callback URLs, include http://127.0.0.1:4109/callback —

package/operator/infra/digitalocean/variables.tf

@@ -51,11 +51,11 @@ variable "manage_dns" {
   default     = false
 }
 
-# ── Auth: DigitalOcean universes run byo-oidc (Auth0 today) — the tenant is
+# ── Auth: DigitalOcean universes run byo-oidc (WorkOS today) — the tenant is
 # authoritative for roles/permissions; Terraform only passes the pointers through
 # (INFRASTRUCTURE.md: roles are PROVISIONED only under Cognito on AWS).
 variable "auth_issuer" {
-  description = "OIDC issuer, e.g. https://your-tenant.auth0.com"
+  description = "OIDC issuer, e.g. https://your-environment.authkit.app"
   type        = string
 }
 
@@ -65,7 +65,7 @@ variable "auth_client_id" {
 }
 
 variable "auth_audience" {
-  description = "OIDC audience (the Auth0 API identifier, e.g. gravity-api)."
+  description = "OIDC audience (the API identifier, e.g. gravity-api)."
   type        = string
   default     = "gravity-api"
 }

package/operator/lib/deploy.sh

@@ -485,7 +485,7 @@ _ensure_ground_config() {
     if [ -z "$env_auth" ]; then
       echo ""
       info "A deployed universe requires a login. Local auth-off does not deploy"
-      info "${DIM}(Auth0 or any OIDC provider; the issuer looks like https://your-tenant.auth0.com)${NC}"
+      info "${DIM}(WorkOS or any OIDC provider; the issuer looks like https://your-environment.authkit.app)${NC}"
     fi
   fi
   # AWS ONLY. Cognito needs a first administrator, and nothing else in the CLI collects an

package/operator/lib/ground.sh

@@ -187,7 +187,7 @@ manage_dns   = false                     # true only if the domain's DNS is on D
 canvas_public = true
 
 # Auth — byo-oidc: roles/permissions live in YOUR IdP tenant.
-auth_issuer    = "FILL_ME"               # e.g. https://your-tenant.auth0.com
+auth_issuer    = "FILL_ME"               # e.g. https://your-environment.authkit.app
 auth_client_id = "FILL_ME"
 auth_audience  = "gravity-api"
 

package/operator/lib/setup.sh

@@ -219,7 +219,7 @@ cmd_setup() {
   [ "$cur_auth" = "true" ] && idp_prompt="[Y/n]"
   echo ""
   info "Sign-in: deploying provides one. ${DIM}AWS creates a Cognito user pool; DigitalOcean asks for an issuer then${NC}"
-  read -r -p "  Are you bringing your own (Auth0/OIDC)? $idp_prompt " HAS_IDP
+  read -r -p "  Are you bringing your own (WorkOS/OIDC)? $idp_prompt " HAS_IDP
   echo ""
   if [ -z "$HAS_IDP" ] && [ "$cur_auth" = "true" ]; then HAS_IDP=y; fi
 
@@ -235,7 +235,7 @@ cmd_setup() {
         read -p "  AUTH_ISSUER [$cur_iss]: " AUTH_ISSUER || { fail "no input (end of stream). Run unoverse create interactively"; exit 1; }
         AUTH_ISSUER="${AUTH_ISSUER:-$cur_iss}"
       else
-        read -p "  AUTH_ISSUER (e.g. https://your-tenant.auth0.com): " AUTH_ISSUER || { fail "no input (end of stream). Run unoverse create interactively"; exit 1; }
+        read -p "  AUTH_ISSUER (e.g. https://your-environment.authkit.app): " AUTH_ISSUER || { fail "no input (end of stream). Run unoverse create interactively"; exit 1; }
       fi
       if [ -n "$AUTH_ISSUER" ] && [[ "$AUTH_ISSUER" == https://* ]]; then
         break

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.208",
+  "version": "0.1.210",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/lint/design/file.mjs

@@ -413,6 +413,28 @@ function lintFile(file) {
     }
   }
 
+  // AN ORG'S OWN IMAGES (definitions/load/assets.ts): `src: assets/<file>` must name a file in
+  // an assets/ folder from the file's own folder up to the org's (a template keeps its own), or
+  // the shared one, of an image type, under 256 KB.
+  {
+    const home = (orgDirs ?? []).find((d) => file.startsWith(d + sep)) ?? null;
+    const shared = DS ?? null;
+    const walk = (n) => {
+      if (Array.isArray(n)) return n.forEach(walk);
+      if (!n || typeof n !== "object") return;
+      if (n.type === "Image" && typeof n.src === "string" && n.src.startsWith("assets/")) {
+        const dirs = [];
+        for (let d = dirname(file); home && d.startsWith(home); d = dirname(d)) dirs.push(d);
+        const hit = [...dirs, shared].map((d) => d && join(d, n.src)).find((f) => f && existsSync(f));
+        if (!hit) report("error", file, `image "${n.src}" is not in this org's assets/ folder (docs.unoverse.ai/design/styles-and-tokens)`);
+        else if (!/\.(svg|png|jpe?g|webp|gif)$/i.test(n.src)) report("error", file, `image "${n.src}" is not an image type the platform serves (svg, png, jpg, webp, gif)`);
+        else if (statSync(hit).size > 256 * 1024) report("error", file, `image "${n.src}" is over 256 KB; a photo belongs on a CDN, not in the design folder`);
+      }
+      Object.values(n).forEach(walk);
+    };
+    walk(json);
+  }
+
   // A STATE'S PLACE (UNOVERSE_SCREEN.md §2.3) is `chat` or a Place some app declares. A name no
   // app has sends the interface to the conversation without a word, so it is refused here.
   if (placeNames && !isAppPath(file) && json && typeof json === "object" && !Array.isArray(json) && json.states && typeof json.states === "object") {
@@ -552,8 +574,10 @@ function lintFile(file) {
               report("error", file, `preview."${state}" must be an array of component names, or an object of template-state mock data`);
               continue;
             }
+            // `name#state` names the state the seed opens in (the address grammar, owner
+            // 2026-09-11); the lookup is the name before the hash.
             for (const c of list)
-              if (comps && !comps.has(String(c).toLowerCase()))
+              if (comps && !comps.has(String(c).split("#")[0].toLowerCase()))
                 report("error", file, `preview."${state}" names unknown component "${c}". No match in design/marketplace/components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
           }
         }
@@ -676,13 +700,13 @@ function lintFile(file) {
       // EVERY PROP CARRIES A DESCRIPTION (UNOVERSE_AUTHORING §3b, RULED 2026-08-30).
       //
       // It reads BOTH ways, which is why it is compulsory rather than encouraged. A
-      // description is not only what a copywriter fills against: it is what lets an agent
+      // description is not only what an Agent fills against: it is what lets an agent
       // UNDERSTAND the screen it is looking at. `read` reports where the person is; the
       // descriptions say what is actually in front of them. A screen of unnamed fields is
       // one no agent can reason about, in either direction.
       //
-      // AND IT SAYS NOTHING ABOUT PERMISSION. That is the layout's word — `static` /
-      // `copywriter` / `director` (TEMPLATE_MODEL §9b) — never a prop's. The rule this
+      // AND IT SAYS NOTHING ABOUT PERMISSION. That is the prop's `input` (UNOVERSE_AUTHORING
+      // "input decides"), never its description. The rule this
       // replaces was "a described prop is a writable prop", which made silence the safety
       // mechanism: a field was protected because nobody had explained it, and explaining it
       // was what exposed it. Describing a field is now free of consequence, so there is no
@@ -691,7 +715,7 @@ function lintFile(file) {
         .filter(([, v]) => !(v && typeof v === "object" && typeof v.description === "string" && v.description.trim()))
         .map(([k]) => k);
       if (undescribed.length)
-        report("error", file, `props [${undescribed.join(", ")}] carry no "description". Every prop says what it IS, so an agent can read the screen as well as fill it. A description grants nothing: permission is the layout's word (static / copywriter / director), never a prop's (UNOVERSE_AUTHORING §3b)`);
+        report("error", file, `props [${undescribed.join(", ")}] carry no "description". Every prop says what it IS, so an agent can read the screen as well as fill it. A description grants nothing: permission is the prop's input: true or false (UNOVERSE_AUTHORING §3b)`);
 
       // only components that ADOPTED the structure are held to the full discipline
       if (hasLayouts || stateFiles.length || hasStateBlock) {

package/vendor/base/lint/design/vocabulary.mjs

@@ -114,7 +114,7 @@ export const STYLE_KEYS = new Set([
   "width", "height", "maxWidth", "minWidth", "minHeight", "maxHeight", "flex",
   "padding", "margin", "gap", "overflow",
   "position", "inset", "top", "right", "bottom", "left", "zIndex",
-  "direction", "wrap", "align", "justify", "display", "columns", "span", "stackBelow", "container", "hideBelow", "hideAbove",
+  "direction", "wrap", "align", "justify", "display", "columns", "span", "stackBelow", "stage", "container", "hideBelow", "hideAbove",
   "background", "radial", "border", "borderTop", "borderRight", "borderBottom", "borderLeft",
   "outline", "shadow", "radius", "radiusTopLeft", "radiusTopRight", "radiusBottomLeft", "radiusBottomRight",
   "font", "weight", "lineHeight", "color", "textAlign", "fit",

package/vendor/base/lint/design/walk.mjs

@@ -13,26 +13,19 @@
  * The context is created per run by index.mjs, so nothing survives between runs.
  */
 import { existsSync, statSync, readdirSync, readFileSync } from "node:fs";
-import { join, dirname, basename, relative, sep } from "node:path";
+import { join, dirname, relative, sep } from "node:path";
 import { PRIMITIVES, CONDITION_KEYS, STYLE_KEYS, RAW_VALUE, CHILD_NODE_KEYS, PARTIAL_DIRS, DIMENSION_KEYS, UNIVERSAL_PROPS, PRIMITIVE_PROPS, PRIMITIVE_BINDS } from "./vocabulary.mjs";
-import { isDefFile, defName, defPath, readDef } from "./defs.mjs";
+import { isDefFile, defPath } from "./defs.mjs";
 
-// THE FOUR WORDS and the two closed blocks (UNOVERSE_TEMPLATE_MODEL.md §9b + §9e).
-const SECTION_WORDS = ["static", "copywriter", "director"];
-const DELIVERY_KEYS = ["state", "pick", "rules", "preview"];
-// §9e: a queried place says WHAT draws it, WHAT it asks, WHAT KIND may answer, HOW MANY.
-const SEARCH_KEYS = ["component", "type", "include", "pick", "items"];
-// The `object_type`s a place may admit. Apps and skills are absent by construction: the
-// page's own searches are SILENT (no app unlocked, no tool minted, no card lane, no
-// director woken), or every place would rain cards onto a page still assembling itself.
-// `products` since migration 035 (2026-09-05; `services` retired 2026-09-07, `actions` with it:
-// no row is written as one). Each word maps to a declared spatial type (guarded by a test).
-const QUERY_TYPES = ["products", "images", "needs"];
+// RETIRED LAYOUT WORDS. A template layout places its own parts with the ordinary element,
+// `type: Ref` + `ref: components/<name>`, and what an Agent writes into a part is each
+// prop's `input`, never the element that places it (UNOVERSE_TEMPLATE_MODEL §9b).
+const RETIRED_WORDS = ["static", "director", "copywriter", "query"];
+/** The one way a layout places a part: a `Ref` into the template's own `components/`. */
+const PART_PREFIX = "components/";
 
 export function makeWalkNode(ctx) {
-  const { report, checkCondition, checkDimension, checkToken, appSizesForFile, componentNamesForFile, refResolves, canonicalRef, declaredProps, atomsDirExists, stepList, spaceSteps, isAppPath, isTemplatePath, isTemplatePart, defRoot } = ctx;
-  // One director per LAYOUT FILE, tracked for this run only (each file is walked once).
-  const directorsSeen = new Map();
+  const { report, checkCondition, checkDimension, checkToken, appSizesForFile, refResolves, canonicalRef, declaredProps, atomsDirExists, stepList, spaceSteps, isAppPath, isTemplatePath, isTemplatePart, defRoot } = ctx;
 
 function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
   if (Array.isArray(node)) return node.forEach((n) => walkNode(n, file, root, widthCap));
@@ -54,147 +47,29 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     return; // the included file is linted on its own
   }
 
-  // THE THREE WORDS (UNOVERSE_TEMPLATE_MODEL.md §9b): a template layout's parts say HOW
-  // they are filled instead of naming a primitive. They compile to ComponentSlots at
-  // serve time, so the linter checks the authored word here and hands the rest of the
-  // node to the ordinary walk as the slot it becomes.
-  const word = SECTION_WORDS.find((w) => node[w] !== undefined);
-  if (word && node.type === undefined) {
-    if (!isTemplatePath(file))
-      report("error", file, `"${word}:" is template grammar — only a template layout's parts say how they are filled. Apps and components author ComponentSlot directly (UNOVERSE_TEMPLATE_MODEL §9b)`);
-    if (node.query !== undefined) {
-      report("error", file, `"query:" is retired vocabulary (§9e rule 10b REVERSED 2026-09-02) — spell the place director: with the same component/items/type/include/pick. One word, one judge`);
-    }
-    if (word === "director") {
-      /**
-       * ONE WORD, TWO MODES (§9e, 2026-09-02): a director place WITH `component` is a
-       * SEARCH place (the page fetches its own content); WITHOUT one it is a DELIVERY
-       * band (the conversation fills it). The key sets are mutually exclusive, so a
-       * place is always unambiguously one or the other — behaviour never forks on a
-       * stray key. The QUESTION is never authored (rule 10d): it is derived from the
-       * writing, the page's pool, the component's contract, or the guest's ask.
-       */
-      const d = node.director;
-      if (!d || typeof d !== "object" || Array.isArray(d)) {
-        report("error", file, `"director:" is a block, not a path (§9b rule 1)`);
-      } else if (d.limit !== undefined) {
-        report("error", file, `director.limit is retired — the one cap word is "pick": how many the director keeps (§9e rule 9, renamed 2026-09-02)`);
-      } else if (d.ask !== undefined || d.query !== undefined) {
-        report("error", file, `a director place never states its question — it is DERIVED (§9e rule 10d): the writer's headings (items), the page's pool (a gallery), the component's own contract, or the guest's ask`);
-      } else if (typeof d.component === "string" && d.component) {
-        // A SEARCH PLACE. The checks here are the ones that fail SILENTLY at runtime: a
-        // place missing include or pick is skipped, and a kind nobody stores draws
-        // nothing — both read as "the design is broken" with no log saying why.
-        //
-        // THE SEARCH WORDS SIT ON THE THING THAT SEARCHES (owner ruling 2026-09-02): on
-        // an items place each ITEM searches, so type/include/pick nest INSIDE items:
-        // beside min/max, and pick reads unambiguously as per-item. Spelled flat, the
-        // same word meant two scopes depending on whether items: was present.
-        const itemed = d.items && typeof d.items === "object" && !Array.isArray(d.items);
-        if (d.items !== undefined && !itemed)
-          report("error", file, `director.items is a block — items: { min, max, type, include, pick } (§9e rule 10c)`);
-        if (itemed && (d.type !== undefined || d.include !== undefined || d.pick !== undefined))
-          report("error", file, `an items place nests its search words INSIDE items: { min, max, type, include, pick } — each ITEM searches, so pick reads per item (§9e rule 10c, 2026-09-02)`);
-        const TOP_KEYS = itemed ? ["component", "items"] : SEARCH_KEYS;
-        for (const k of Object.keys(d))
-          if (!TOP_KEYS.includes(k))
-            report("error", file, `a search place has no "${k}". It reads ${TOP_KEYS.map((x) => `"${x}"`).join(", ")} (§9e; "state"/"rules" belong to a delivery band — a place with a component is governed by the page's brief)`);
-        if (!defPath(root, d.component) && !existsSync(join(root, d.component)))
-          report("error", file, `director.component "${d.component}" does not resolve under ${relative(process.cwd(), root)}/ (§9e)`);
-        const ITEM_KEYS = ["min", "max", "type", "include", "pick"];
-        if (itemed) {
-          for (const k of Object.keys(d.items))
-            if (!ITEM_KEYS.includes(k))
-              report("error", file, `director.items has no "${k}". It reads ${ITEM_KEYS.map((x) => `"${x}"`).join(", ")} (§9e rule 10c)`);
-          const { min, max } = d.items;
-          if (typeof min !== "number" || typeof max !== "number" || min < 1 || max < min)
-            report("error", file, `director.items carries { min, max } — how many items the writer may shape, 1 <= min <= max (§9e rule 10c)`);
-        }
-        // The search words, read where they live: the place itself, or each item.
-        const s = itemed ? d.items : d;
-        const at = itemed ? "director.items" : "director";
-        // REQUIRED, both (2026-09-01, carried over). The engine supplies NO defaults: a
-        // default include or pick would be one template's answer written into the platform.
-        if (s.include === undefined)
-          report("error", file, `${at}.include is REQUIRED on a search place — what KIND may answer; the engine has no default kind (§9e rule 6)`);
-        else if (!Array.isArray(s.include) || s.include.some((t) => typeof t !== "string"))
-          report("error", file, `${at}.include is an array of result types — ${QUERY_TYPES.map((t) => `"${t}"`).join(", ")} (§9e rule 6)`);
-        else
-          for (const t of s.include)
-            if (!QUERY_TYPES.includes(String(t)))
-              report("error", file, `${at}.include has no "${t}". A place may admit ${QUERY_TYPES.map((x) => `"${x}"`).join(", ")}; apps and skills are never included, because the page's own searches are SILENT (§9e rule 6)`);
-        if (s.pick === undefined)
-          report("error", file, `${at}.pick is REQUIRED — how many the director keeps${itemed ? " PER ITEM" : ""}; the engine has no default count (§9e rule 9)`);
-        else if (typeof s.pick !== "number" || s.pick < 1)
-          report("error", file, `${at}.pick is a NUMBER — how many the director keeps${itemed ? " per item" : ""}, a cap the machine enforces (§9e rule 9)`);
-        // `type` is OPTIONAL since the question derives (rule 10d): authored it stands;
-        // absent, a contract subject searches as intent and the guest's ask as discovery.
-        if (s.type !== undefined && s.type !== "discovery" && s.type !== "intent")
-          report("error", file, `${at}.type is "discovery" (what lives around a topic) or "intent" (a named need) — or omitted, and the derivation decides (§9e rule 10d)`);
-      } else {
-        // A DELIVERY BAND.
-        for (const k of Object.keys(d))
-          if (!DELIVERY_KEYS.includes(k))
-            report("error", file, `a delivery band has no "${k}". It reads ${DELIVERY_KEYS.map((x) => `"${x}"`).join(", ")} (§9b; a place that names a component is a search place)`);
-        if (d.pick !== undefined && (typeof d.pick !== "number" || d.pick < 1))
-          report("error", file, `director.pick is a NUMBER — how many the director keeps, a cap the machine enforces (§9e rule 9)`);
-        // NOTHING READS `rules`: the director's model was removed (UNOVERSE_SCREEN.md §2.7).
-        if (d.rules !== undefined)
-          report("warn", file, `director.rules is ignored: no model reads it any more. A band holds what arrives in search rank, up to pick. Remove it`);
-        if (d.preview !== undefined && (!Array.isArray(d.preview) || d.preview.some((c) => typeof c !== "string")))
-          report("error", file, `director.preview is an array of component names — Studio's stand-ins until a real run exists (§9b rule 6)`);
-        else if (Array.isArray(d.preview)) {
-          const comps = componentNamesForFile(file);
-          for (const c of d.preview)
-            if (comps && !comps.has(String(c).toLowerCase()))
-              report("error", file, `director.preview names unknown component "${c}". No match in the design system or this org's components (lookup is case-insensitive)`);
-        }
-        // A PLACE NEEDS NO NAME (§9d): the compiler addresses delivery bands by
-        // position; an AUTHORED state: still stands (the flat-email pin), so two bands
-        // pinned to the SAME face remains the one genuine ambiguity.
-        const seen = directorsSeen.get(file) ?? [];
-        const face = typeof d?.state === "string" ? d.state : null;
-        if (face && seen.includes(face))
-          report("error", file, `two directed bands claim the face "${face}". A face has exactly one surface, or the active one is ambiguous (§9b rule 3, the reaction contract)`);
-        directorsSeen.set(file, [...seen, face]);
-      }
-    } else if (typeof node[word] !== "string") {
-      report("error", file, `"${word}:" links a component by PATH (${word}: components/<part>) — that is what makes it a known part (§9b rule 1)`);
-    } else {
-      const path = node[word];
-      if (!defPath(root, path) && !existsSync(join(root, path)))
-        report("error", file, `${word} "${path}" does not resolve under ${relative(process.cwd(), root)}/ (§9b rule 1)`);
-    }
-    // Everything else on the line rides through to the slot it compiles into. The select
-    // is SYNTHESIZED here exactly as the compiler builds it (a linked part claims its own
-    // face, limit 1; the director's claim is its `state:` pin) so the rest of the walk
-    // sees what will actually be served — and an authored one is the ceremony §9b rule 9
-    // exists to abolish.
+  // RETIRED: the section words. A stale layout fails here with the fix in the message.
+  const retired = RETIRED_WORDS.find((w) => node[w] !== undefined);
+  if (retired) {
+    report("error", file, `"${retired}:" is retired. Place the part with type: Ref and ref: components/<name>, and mark each of its props input: true (an Agent fills it) or input: false (drawn from its default) (UNOVERSE_AUTHORING "input decides")`);
+    return;
+  }
+
+  // A PLACED PART (UNOVERSE_TEMPLATE_MODEL §9b): in a template's layout, a `Ref` into the
+  // template's own `components/` folder. It compiles to a ComponentSlot at serve time,
+  // claiming the part's own face (its basename) at limit 1, so the linter checks the part
+  // resolves and hands the rest of the node to the ordinary walk as the slot it becomes.
+  if (node.type === "Ref" && typeof node.ref === "string" && node.ref.startsWith(PART_PREFIX) && isTemplatePath(file) && !isTemplatePart(file)) {
+    const path = node.ref;
+    if (!defPath(root, path) && !existsSync(join(root, path)))
+      report("error", file, `part "${path}" does not resolve under ${relative(process.cwd(), root)}/. A layout places the template's own parts: components/<name> (§9b)`);
+    if (node.props !== undefined || node.with !== undefined)
+      report("error", file, `a placed part takes no "props" or "with": its props are its own, filled by an Agent where marked input: true and drawn from their defaults where input: false (§9b)`);
+    // An authored select is the ceremony §9b rule 9 abolishes: the claim is synthesized.
     if (node.select !== undefined)
-      report("error", file, `a template part never authors "select" — the three words compile to the wire primitives at serve time (§9b rule 9)`);
-    const { static: _s, copywriter: _c, director: _d, query: _q, select: _sel, ...rest } = node;
-    // An unpinned director claims the OWNING STATE's name (arrivals keep their own state
-    // and the template's states react by name — the free grid↔page dance), so the face
-    // comes from whichever state in the envelope declares this layout.
-    const owningState = () => {
-      const env = defPath(root, basename(root));
-      const states = env ? readDef(env)?.states : undefined;
-      if (!states || typeof states !== "object") return undefined;
-      const here = defName(basename(file));
-      return Object.keys(states).find((s) => {
-        const l = states[s]?.layout;
-        return typeof l === "string" && basename(l).toLowerCase() === here.toLowerCase();
-      });
-    };
-    // A QUERIED place links its component under `component:`, and claims that part's own
-    // face at limit 1 exactly as a linked part does — its `limit:` counts ROWS inside the
-    // part, not instances of it, so it never reaches the slot (§9e).
-    const linkedPath = word === "query" ? node.query?.component : node[word];
-    const face =
-      word === "director" ? (node.director?.state ?? owningState()) : typeof linkedPath === "string" ? linkedPath.split("/").pop() : undefined;
-    const limit = word === "director" ? node.director?.limit : 1;
-    const select = { from: "all", ...(face ? { where: { field: "state", eq: face } } : {}), ...(typeof limit === "number" ? { limit } : {}) };
-    return walkNode({ type: "ComponentSlot", select, ...rest }, file, root, widthCap);
+      report("error", file, `a placed part never authors "select". It claims its own face at serve time (§9b rule 9)`);
+    const { type: _t, ref: _r, props: _p, with: _w, select: _sel, ...rest } = node;
+    const face = path.split("/").pop();
+    return walkNode({ type: "ComponentSlot", select: { from: "all", where: { field: "state", eq: face }, limit: 1 }, ...rest }, file, root, widthCap);
   }
 
   const t = node.type;

package/vendor/base/lint/nodes/_schema/audio.schema.json

@@ -108,6 +108,13 @@
         "endWhen": {
           "$ref": "_defs.schema.json#/definitions/expression",
           "description": "THE MODEL ENDING THE CALL ITSELF, tested against every vendor event with it in scope as `response`. True ends the session exactly as a hang-up does.\n\n`endOn` above is the LANE's list and every entry on it means the PERSON left: a carrier's stop frame, a browser tab closing. Nothing there can say the ASSISTANT is finished, and a live voice model may send no end-of-call event of its own, so a call whose business was done stayed open: it said goodbye, stopped talking, and held the line until the idle timer fired minutes later. The caller hears silence and the session bills for it.\n\nWhat counts is the node's to decide. For a vendor with function calling the natural answer is a tool the model may call, so the expression tests for that name. Absent, nothing changes: only the lane ends a call."
+        },
+        "speech": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The vendor events that mean someone actually SPOKE, the person or the assistant. A call with none of them for 60 seconds ends (docs/VOICE_STREAMING_GUIDE.md, \"Every Call Ends\"), so a call nobody hangs up is not billed for ever.\n\nName them when the defaults are wrong for the vendor. Absent, speech is the person's speech event (`userSpeaking`) and the assistant's audio (`out.match`), which is wrong for a vendor that streams silent audio: GPT-Live names its transcript deltas instead."
         }
       },
       "additionalProperties": false

package/vendor/base/lint/nodes/_schema/credential.schema.json

@@ -74,7 +74,7 @@
           "secret": {
             "type": "boolean",
             "default": true,
-            "description": "REQUIRED. Encrypted at rest, masked in the UI, never returned to a client once saved. Optional was how a Google API key and a Cloudinary API key ended up in the database in plaintext (docs/auth-security/SECURITY.md, 2026-08-30): an omission read as false and nothing warned. Set false ONLY for a genuinely non-sensitive field such as a region or an account id, and say why."
+            "description": "REQUIRED. Encrypted at rest, masked in the UI, never returned to a client once saved. Optional was how a Google API key and a Cloudinary API key ended up in the database in plaintext (docs/auth-security/legacy/SECURITY_FINDINGS_LOG.md, 2026-08-30): an omission read as false and nothing warned. Set false ONLY for a genuinely non-sensitive field such as a region or an account id, and say why."
           },
           "default": {
             "type": "string"

package/vendor/base/lint/nodes/_schema/node.schema.json

@@ -185,8 +185,11 @@
       "items": {
         "type": "object",
         "required": [
-          "label",
-          "component"
+          "label"
+        ],
+        "oneOf": [
+          { "required": ["component"], "not": { "required": ["service"] } },
+          { "required": ["service"], "not": { "required": ["component"] } }
         ],
         "additionalProperties": false,
         "properties": {
@@ -195,6 +198,11 @@
             "minLength": 1,
             "description": "The tab, as a person reads it."
           },
+          "service": {
+            "type": "string",
+            "enum": ["voice"],
+            "description": "A native service the tab opens instead of drawing a component. `voice` is a live call: the tab starts this workflow from the trigger upstream of this node, with that trigger's Testing inputs, and carries the person's microphone and speakers on the browser lane for as long as the tab is open. For a voice node on the browser lane."
+          },
           "component": {
             "type": "string",
             "minLength": 1,