fix(authority): close chief grant and root fire review gaps (#1873)

AGENTS.md

@@ -42,9 +42,15 @@ green at every step. Not production software — a proven foundation.
    rewritten, only pruned via `prune` with a receipt.
 6. **Fail closed**: missing or invalid config/policy refuses the operation.
    Never improvise around a refusal; diagnose it.
-7. **Policy**: missions govern tasks (least-privilege intersection — a task
-   narrows, never widens). Role authority is declared in `roles/` and changes
-   only via reviewed commits.
+7. **Policy**: missions govern tasks; a task narrows, never widens. The
+   rails, the core vocabulary of tools and actions, and the shipped role
+   templates in `roles/` change only by reviewed commit. An organization's
+   own roles are copies or compositions of known parts. One takes effect
+   only through a decision, resolved where the organization's owner-set
+   autonomy level sends it, by default a human with `org.hire`. The
+   decision lists every grant above the chief's own as a flagged line,
+   which only the owner approves. Only the chief raises hires, and a hired
+   agent cannot hire.
 8. **Git**: commit only after applicable suites are green. Work on the
    owner-authorized `refactor` branch; never force-push. Push remains an explicit
    act. Do not merge into `next` or `main` without separate authorization.
@@ -104,7 +110,8 @@ Finish all independent work first, then ask one focused question only when:
 
 Repository gates still apply. In particular, a successful implementation or a
 broad request to “finish” does not by itself authorize push, merge, deployment,
-release, production changes, policy/role expansion, or access to secrets. Perform
+release, production changes, policy/role expansion, or access to secrets. An approved
+hire decision is that authority for the one agent it names. Perform
 such an action only when the established plan explicitly includes it. If blocked,
 report the exact boundary, what is complete, the recommended resolution, and the
 specific action that will resume; do not use “waiting for confirmation” as a
@@ -206,7 +213,7 @@ Full reference — usage, fields, exit codes, safety notes:
 - `LAYERS.md` — implemented vs deferred layers
 - `docs/SESSIONS.md` — session registry
 - `adapters/README.md` — the harness adapter contract
-- `roles/` — role contracts (conductor, future agent/coder/reviewer)
+- `roles/` — shipped role templates and the conductor policy
 
 ## Recovery rule
 

packages/bus/src/broker.mjs

@@ -9,7 +9,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
-import { pluginName, ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';
+import { pluginName, ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';
 
 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -43,6 +43,7 @@ export const ACTIONS = Object.freeze([
   // Row 194 (#1692): routed under PRD 1.7 REQ-COS-3, below.
   'role.hire',
   'role.fire',
+  'role.change',
   'credential.mint',
   'spend',
   'deploy',
@@ -85,6 +86,7 @@ const ROUTED = new Set([
   // PRD 1.7 REQ-COS-3 (row 194, #1692): the chief's hire and fire, within the bounds the broker checks.
   'role.hire',
   'role.fire',
+  'role.change',
   // PRD 1.16 REQ-WAIT-3 and REQ-LIB-6 (row 285, #1790): a creative agent's library write.
   'library.write',
 ]);
@@ -172,7 +174,7 @@ export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'threa
   'thread.share', 'thread.unshare', 'thread.shares']);
 // Row 252 (#1753, design sections 2-3): the only verbs a Console owner cap reaches. Every other verb
 // refuses it human-required before its own checks, and these refuse every other cap.
-export const CONSOLE_VERBS = Object.freeze(['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
+export const CONSOLE_VERBS = Object.freeze(['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'hire.preview.console', 'hire.resolve.console', 'hire.start.console', 'hire.templates.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
   // Task 3 (#1839): and the owner's intake controls. The reads and writes are the same lifecycle methods the PM's
   // unsuffixed verbs reach, with the owner's verified (provider, iss, sub) as the only caller; the PM-only
   // request.question and the PM's own reads keep their unsuffixed names and refuse a console cap.
@@ -226,14 +228,6 @@ const LIFECYCLE_CODE = /^[a-z-]{1,64}$/;
 // Row 194 S6 (D2.2): the stop outcomes a fire's lifecycle.done reports, each written as its own event.
 const FIRE_STOPS = ['killed', 'alive'];
 const BOT_NAME = /^bot-[a-z0-9][a-z0-9._-]{0,60}$/;
-// Row 194 (#1692, D2.1, D2.2, PRD 1.7 REQ-COS-3): the chief's hire and fire arguments, allowed then
-// required. Each carries the reason the log records.
-const HIRE_FIRE_ARGS = Object.freeze({
-  'role.hire': [['name', 'definition', 'vars', 'reason'], ['name', 'definition', 'reason']],
-  'role.fire': [['name', 'reason'], ['name', 'reason']],
-});
-// N3: hire's vars hold only the model key and limits.* keys. The writer checks the values.
-const HIRE_VAR = (key) => key === 'model' || key.startsWith('limits.');
 // What instance.request and the host ops answer about a request.
 const lifecycleView = (r) => ({
   request: r.request, action: r.action, instance: r.instance, by: r.by, at: r.at, state: r.state,
@@ -602,6 +596,7 @@ export class Broker {
   #builtin;
   #builtinBinding;
   #organization;
+  #hires;
   #pluginService;
   #credentialVerbs;
   #proxyInit;
@@ -665,7 +660,7 @@ export class Broker {
   #processing;
   #taskTracker;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
+  constructor({ store, businesses, pluginService = null, secretCheck = () => {}, credentialStatus = () => [], organization = null, hires = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, proxyInit = null, proxyPage = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null, requestLifecycle = null, requirementsHost = null, workspaceRead = null, taskTracker = null }) {
     if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
     // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
     if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
@@ -688,6 +683,7 @@ export class Broker {
     this.#secretCheck = secretCheck;
     this.#credentialStatus = credentialStatus;
     this.#organization = organization;
+    this.#hires = hires;
     this.#pluginService = pluginService;
     // Row 199: the runtime's credential lifecycle (credential-verbs.mjs); it holds the store, not the broker.
     this.#credentialVerbs = credentialVerbs;
@@ -1561,6 +1557,11 @@ export class Broker {
   // agent-copies.mjs copyRefusal; inlined because this module also loads in the sandbox client).
   #copyRefused(b, instance) {
     const copy = b.copies && Object.hasOwn(b.copies, instance) ? b.copies[instance] : null;
+    if (b.roles[instance]?.unbound?.length) throw new BusError('credential-unbound', `${instance} has no binding for ${b.roles[instance].unbound.join(', ')}`);
+    if(copy?.level==='root') {
+      const refusal=this.#hires?.rootRefusal ? this.#hires.rootRefusal(copy.name) : this.#hires?.rootActive && !this.#hires.rootActive(copy.name) ? 'instance-fired' : null;
+      if(refusal)fail(refusal);
+    }
     if (!copy || copy.state === 'instance') return;
     if (copy.state === 'unbound') throw new BusError('credential-unbound', `${instance} has no binding in ${b.id} for ${copy.missing.join(', ')}`);
     throw new BusError(copy.project === null ? 'copy-refused' : 'project-refused', `${instance} can't launch in ${b.id}: ${copy.reason}`);
@@ -1848,6 +1849,7 @@ export class Broker {
     if (s.tester) fail('tester-refused');
     if (s.reader) fail('read-only');
     if (s.human) fail('agent-required');
+    this.#copyRefused(this.#business(s.business),s.role);
     const h = this.#own(s);
     if (h?.op !== 'claim' || (s.thread ? h.generation !== this.#runGeneration(s) : h.holder_run !== s.run))
       fail(this.#launcherReleased.has(s.business + ':' + s.run) ? 'launcher-released'
@@ -2283,6 +2285,14 @@ export class Broker {
       run: null,
     });
   }
+  // Trusted account transport supplies freshly resolved membership, never request arguments.
+  // This capability reaches only the A4 verbs; it cannot pass existing owner Console guards.
+  bindHireConsole({business, actor, subject, rights, owner = false, instanceOwner = false}) {
+    this.#business(business);
+    identifier(actor);
+    if (!object(subject) || !['provider','iss','sub'].every(k=>typeof subject[k]==='string' && subject[k]) || !Array.isArray(rights)) fail('human-required');
+    return this.#cap({business,human:actor,role:null,run:null,via:'console',console:Object.freeze({...subject}),hireMembership:Object.freeze({actor,rights:[...rights],agent:false,owner,instanceOwner,subject:{...subject}})});
+  }
   bindReader({ business }) {
     this.#business(business);
     return this.#cap({ business, reader: true, role: null, run: null, human: false });
@@ -2440,6 +2450,7 @@ export class Broker {
         options.some(o => !object(o) || !id(o.key) || !text(o.text, 1024)) ||
         new Set(options.map(o => o.key)).size !== options.length) return null;
     const digest = sha256(JSON.stringify([{ ...d, options }, raise]));
+    if (['role.hire','role.fire','role.change'].includes(d.action)) return raise.hire ? {kind:'hire',options,...raise.hire} : null;
     if (d.action !== 'credential.mint') return 'grant' in raise ? null : { kind: 'decision', options, digest };
     if (!object(raise.grant) || typeof raise.grant.method !== 'string' || options.length !== 2) return null;
     const approve = options.find((o) => o.key === raise.approvalChoice);
@@ -3355,7 +3366,8 @@ export class Broker {
       const result = await write('instance.fire');
       step = 'C';
       this.#store.transaction(() => {
-        this.#recordAuthority(sc, 'role.fire', authority, { reason: args.reason, transaction: result.transaction ?? null });
+        if(sc.human)this.#event(sc,'action.allowed',{action:'role.fire',target:args.name,reason:args.reason,transaction:result.transaction??null},args.name);
+        else this.#recordAuthority(sc, 'role.fire', authority, { reason: args.reason, transaction: result.transaction ?? null });
         this.#event(sc, 'action.allowed', { action: 'fire.done', transaction: result.transaction ?? null, job, grants: out.grants, grantsLeft: out.grantsLeft }, name);
       });
     } catch (e) {
@@ -6084,11 +6096,22 @@ export class Broker {
           return this.#withLast(cap, s, request);
       }
       if (CREDENTIAL_VERBS.includes(request.verb)) return this.#requestCredential(s, request.verb, structuredClone(args));
-      if (request.verb === 'instance.hire' || request.verb === 'instance.fire')
-      {
-        const result = this.#chiefLifecycle(s, request.verb, structuredClone(args));
-        return result?.then ? result.catch(error => { throw this.#refused(s, error, request); }) : result;
+      if (s.hireMembership && !['hire.preview.console','hire.resolve.console','hire.start.console','hire.templates.console'].includes(request.verb)) fail('human-required');
+      if(request.verb==='hire.templates.console') {
+        keys(args,[]);const caller=this.#hireCaller(s);
+        if(!caller.rights.includes('org.hire'))fail('right-required');
+        if(!this.#hires?.templates)fail('not-configured');
+        return this.#hires.templates();
       }
+      if (request.verb === 'instance.hire' || request.verb === 'instance.fire') fail('decision-required');
+      if (request.verb === 'hire.raise' || request.verb === 'hire.start.console' ||
+          (request.verb === 'decision.raise' && ['role.hire','role.fire','role.change'].includes(args.action))) {
+        const input=request.verb==='decision.raise' ? (()=>{ keys(args,['action','hire'],['action','hire']); if(args.action!==`role.${args.hire?.op}`)fail('invalid-request'); return args.hire; })() : args;
+        return this.#raiseHire(s,input,request.verb==='hire.start.console').catch(e=>{throw this.#refused(s,new BusError(e.code??'invalid-request'),request);});
+      }
+      if(request.verb==='decision.preview.console' && ['role.hire','role.fire','role.change'].includes(this.#decision(s,args.id).action))return this.#hireConsole(s,'hire.preview.console',args).catch(e=>{throw this.#refused(s,new BusError(e.code??'outcome-unknown'),request);});
+      if (['hire.preview.console','hire.resolve.console'].includes(request.verb))
+        return this.#hireConsole(s,request.verb,args).catch(e=>{throw this.#refused(s,new BusError(e.code??'outcome-unknown'),request);});
       if (request.verb === 'grants.scope' || request.verb === 'grants.scope.set')
         return this.#grantScopeVerb(s, request.verb, structuredClone(args));
       if (["limits", "limits.set", "organization.set", "organization.revision", "plugins", "plugins.set", "instances", "instances.set", "routes", "routes.set", "veto.set", "library.limits.set"].includes(request.verb) || Object.hasOwn(DEFINITION_BUS_KEYS, request.verb)) {
@@ -6288,47 +6311,121 @@ export class Broker {
     }
     return result;
   }
-  // Row 194 (#1692, D2.1, D2.2): the chief's hire and fire. PRD 1.7 REQ-COS-3 routes both within the
-  // chief's role with a reason, as role.end ends a run (S2e). The writer commits outside the store
-  // transaction, so the grant is checked before it and the use logged only after it, as
-  // organization.set's grant is.
-  #chiefLifecycle(s, verb, a) {
-    const hire = verb === 'instance.hire', action = hire ? 'role.hire' : 'role.fire';
-    this.#agent(s);
-    const [allowed, required] = HIRE_FIRE_ARGS[action];
-    keys(a, allowed, required);
-    this.#hireFireArgs(action, a);
-    const args = a;
-    const b = this.#business(s.business);
-    if (b.launch?.by !== s.role) fail('role-not-chief');
-    if (!this.#organization) fail('not-configured');
-    // The grant: the action is routed and on the chief's withinRole. Without both it needs a decision
-    // (decision-required), and these verbs take none.
-    const authority = { target: args.name };
-    this.#checkAuthority(s, action, authority);
-    // D2.4: a kept name is neither hired nor fired.
-    if ((b.launch?.keep ?? []).includes(args.name)) fail('instance-kept');
-    const actor = b.roles[s.role].definition + '.' + s.role;
-    const context = { instance: s.role, run: s.run, reason: args.reason };
-    // The writer gets its own keys. The reason goes in the context, which its receipt logs.
-    const { reason: _, ...written } = args;
-    const write = (op) => {
-      try {
-        const result = this.#organization(s.business, op, written, actor, context);
-        return result?.then ? result.catch(error => this.#organizationFail(error, verb)) : result;
-      } catch (e) {
-        this.#organizationFail(e, verb);
-      }
+  #hireCaller(s) {
+    if (!s.console || !s.human || s.reader || s.tester) fail('human-required');
+    if(s.hireMembership) return s.hireMembership;
+    if(s.human!==this.#business(s.business).human)fail('human-required');
+    return {actor:s.human,agent:false,rights:['org.hire'],owner:true,instanceOwner:true,subject:s.console};
+  }
+  async #raiseHire(s, input, immediate) {
+    const b=this.#business(s.business);
+    // Change is a replacement composition and uses the existing role.hire grant.
+    const chiefAllowed=()=>{
+      this.#agent(s);
+      if(s.role!==this.#business(s.business).launch?.by)fail('role-not-chief');
+      if(!['hire','change','fire'].includes(input?.op))fail('invalid-request');
+      if(this.#classification(s,input.op==='fire'?'role.fire':'role.hire')!=='within-role')fail('not-authorized');
     };
-    if (hire) {
-      this.#hireable(s, args.definition);
-      const result = write('instance.hire');
-      const finish = result => {
-        this.#store.transaction(() => this.#consumeAuthority(s, action, authority, { reason: args.reason, transaction: result.transaction }));
-        return result;
-      };
-      return result?.then ? result.then(finish) : finish(result);
+    if(immediate) { const c=this.#hireCaller(s); if(!c.rights.includes('org.hire'))fail('right-required'); }
+    else chiefAllowed();
+    if(!this.#hires)fail('not-configured');
+    const did=randomUUID(), at=this.#now(), expiresAt=new Date(Date.parse(at)+7*86400000).toISOString();
+    const p=await this.#hires.prepare(s.business,structuredClone(input),{id:did,expiresAt});
+    // Recheck the chief after asynchronous preparation; a released run cannot raise.
+    if(!immediate)chiefAllowed();
+    else {
+      const caller=this.#hireCaller(s);
+      if(((p.flagged.length || p.credentialLines.length) && !caller.owner) || (p.level==='root' && !caller.instanceOwner))fail('hire-owner-required');
     }
+    const action=`role.${p.op}`;
+    this.#store.transaction(()=>{
+      const raiser=immediate?'human':s.role;
+      this.#store.run('INSERT INTO decisions(id,at,business,project,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)',
+        did,at,s.business,p.project??null,raiser,immediate?'human-console':s.run,'gated',action,'human',`${p.op} ${p.name} at ${p.level} level?`,JSON.stringify([{key:'yes',text:'Approve'},{key:'no',text:'Deny'}]),'no',0);
+      this.#event(s,'action.allowed',{operation:'decision.raise',decision:did,action,approvalChoice:'yes',target:p.name,hire:p},did);
+    });
+    if(immediate) return this.#hireConsole(s,'hire.resolve.console',{id:did,choice:'yes',digest:p.digest});
+    return {...this.#decisionView(this.#decision(s,did)),hire:p};
+  }
+  async #hireConsole(s,verb,a) {
+    const caller={...this.#hireCaller(s),now:()=>Math.max(Date.now(),this.#clock)};
+    keys(a,verb==='hire.preview.console'?['id','adjust']:['id','choice','digest','adjust'],verb==='hire.preview.console'?['id']:['id','choice','digest']);
+    identifier(a.id);
+    const d=this.#decision(s,a.id), raise=this.#raised(s.business,d.id);
+    let p=raise?.hire;
+    if(!['role.hire','role.fire','role.change'].includes(d.action) || !p)fail('decision-not-eligible');
+    const closed=this.#closed(d.id);
+    if(closed)fail(closed.by==='expiry'?'decision-expired':'decision-closed');
+    if(this.#expireHire(s,d,p))fail('decision-expired');
+    if(!caller.rights.includes('org.hire'))fail('right-required');
+    if(a.adjust!==undefined) {
+      if(!this.#hires?.preview)fail('not-configured');
+      p=await this.#hires.preview(s.business,d.id,{...caller,adjust:a.adjust});
+    }
+    if((p.flagged.length || p.credentialLines.length) && !caller.owner || p.level==='root' && !caller.instanceOwner)fail('hire-owner-required');
+    if(verb==='hire.preview.console')return {id:d.id,business:s.business,question:d.question,kind:'hire',options:JSON.parse(d.options),...p};
+    if(a.digest!==p.digest)fail('decision-stale');
+    if(a.choice==='yes') { if(!this.#hires)fail('not-configured'); await this.#hires.check(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust}); }
+    if(!['yes','no'].includes(a.choice))fail('invalid-choice');
+    // A durable close/consume precedes the external file effect. A crash never replays an approval.
+    this.#store.transaction(()=>{
+      if(this.#closed(d.id))fail('decision-closed');
+      this.#store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)',d.id,this.#now(),'resolved',caller.actor,a.choice,'console');
+      this.#event(s,'human.input',{kind:'answer',decision:d.id,op:'resolved',choice:a.choice,via:'console',subject:s.console},d.id);
+      if(a.choice==='yes')this.#event(s,'action.allowed',{operation:'hire.consume',decision:d.id,digest:p.digest,hire:p},d.id);
+    });
+    if(a.choice==='no')return {id:d.id,op:'resolved',choice:a.choice};
+    if(!this.#hires)fail('not-configured');
+    try {
+      if(p.op==='fire' && p.level!=='org')await this.#stopCopyApproved(s,p);
+      const result=p.op==='fire' && p.level==='org' ? await this.#fireApproved(s,p) : await this.#hires.apply(s.business,d.id,{...caller,digest:p.digest,adjust:a.adjust});
+      if(p.op==='fire' && p.level!=='org')this.#store.transaction(()=>this.#event(s,'action.allowed',{action:'fire.done',decision:d.id},p.level==='project'?`${p.name}.${p.project}`:p.name));
+      this.#store.transaction(()=>this.#event(s,'action.allowed',{operation:result.done===false?'hire.started':'hire.apply',decision:d.id,transaction:result.transaction??null},d.id));
+      return {...result,id:d.id,op:'resolved',choice:a.choice,transaction:result.transaction??null};
+    } catch(e) {
+      this.#store.transaction(()=>this.#event(s,'action.allowed',{operation:'hire.failed',decision:d.id,code:e.code??'outcome-unknown'},d.id));
+      throw e;
+    }
+  }
+  #expireHire(s,d,p,insideTransaction=false) {
+    if(!p || Date.parse(p.expiresAt)>Math.max(Date.now(),this.#clock) || !Number.isFinite(Date.parse(p.expiresAt)))return false;
+    const close=()=>{
+      if(this.#closed(d.id))return;
+      this.#store.run('INSERT INTO decision_events(decision,at,op,by,via) VALUES(?,?,?,?,?)',d.id,this.#now(),'withdrawn','expiry','broker');
+      this.#event({business:s.business,role:null,run:null},'action.allowed',{operation:'hire.expired',decision:d.id},d.id);
+    };
+    if(insideTransaction)close();else this.#store.transaction(close);
+    return true;
+  }
+  #expireHires(s) {
+    for(const d of this.#store.all(`SELECT d.* FROM decisions d WHERE business=? AND action IN ('role.hire','role.fire','role.change') AND NOT EXISTS(SELECT 1 FROM decision_events x WHERE x.decision=d.id AND x.op IN ${CLOSED})`,s.business))
+      this.#expireHire(s,d,this.#raised(s.business,d.id)?.hire,true);
+  }
+  async #stopCopyApproved(s,p) {
+    const instance=p.level==='project'?`${p.name}.${p.project}`:p.name;
+    const b=this.#business(s.business);
+    if(!b.roles[instance])return;
+    if(this.#revoking.has(s.business+'/'+instance))fail('fire-in-progress');
+    const set=this.#store.transaction(()=>{
+      const held=this.#threaded(s.business,instance)?this.#threadHolders(s.business,instance):[this.#holder(s.business,instance)].filter(h=>h?.op==='claim');
+      for(const h of held)this.#claimEnd(s,h,'revoke',p.id);
+      const runs=[...this.#runs.values()].filter(r=>r.business===s.business&&r.role===instance).map(r=>r.run);
+      const request=runs.length?randomUUID():null;
+      if(request)this.#event(s,'action.allowed',{action:'lifecycle.end',request,via:'human',by:s.human,runs,reason:'Approved fire decision',kill:true},instance);
+      this.#event(s,'action.allowed',{action:'fire.stopped',request,decision:p.id},instance);
+      return this.#grantSet(s.business,instance);
+    });
+    if(set.length)await this.#stepG(s.business,instance,set,{job:p.id,reason:'Approved fire decision',by:s.human,flag:{fire:true}});
+  }
+  // The existing row-281 fire executor, now entered only after a consumed human decision.
+  #fireApproved(s,p) {
+    const args={name:p.name,reason:'Approved fire decision'},verb='instance.fire',action='role.fire';
+    const b=this.#business(s.business),authority={target:p.name};
+    const write=op=>{
+      try {const result=this.#organization(s.business,op,{name:p.name,revision:p.revision},s.human,{decision:p.id,digest:p.digest});
+        return result?.then?result.catch(e=>this.#organizationFail(e,verb)):result;
+      } catch(e) {this.#organizationFail(e,verb);}
+    };
     if (!Object.hasOwn(b.roles, args.name)) fail('unknown-role');
     if (END_PROTECTED.includes(b.roles[args.name].definition)) fail('organization-definition-refused');
     if (b.launch?.by === args.name) fail('organization-instance-referenced');
@@ -6370,7 +6467,7 @@ export class Broker {
     // A non-empty set: step G, B and C run as a job, and the verb answers now with no transaction.
     if (stopped.job) {
       const { job, set, ...rest } = stopped;
-      const sc = { business: s.business, role: s.role, run: s.run, thread: s.thread, human: null };
+      const sc = { business: s.business, role: s.role, run: s.run, thread: s.thread, human: s.human };
       this.#startGrantJob(s.business, args.name, verb, () => this.#fireJob(sc, args, authority, write, job, set));
       return { ...rest, job, revoking: set.map((g) => g.label), done: false };
     }
@@ -6379,41 +6476,13 @@ export class Broker {
     // Step C: log the fire and record it done. A failure at B or C leaves I firing until a repeat.
     const finish = result => {
       this.#store.transaction(() => {
-        this.#consumeAuthority(s, action, authority, { reason: args.reason, transaction: result.transaction ?? null });
+        this.#event(s,'action.allowed',{action:'role.fire',operation:'hire.apply',decision:p.id,transaction:result.transaction??null},args.name);
         this.#event(s, 'action.allowed', { action: 'fire.done', transaction: result.transaction ?? null }, args.name);
       });
       return { ...result, ...stopped };
     };
     return result?.then ? result.then(finish) : finish(result);
   }
-  // The shape of hire and fire arguments.
-  #hireFireArgs(action, args) {
-    identifier(args.name);
-    // FED R3 r4 (sage-2557): `user` is the granted user's principal, as checkBusiness refuses it.
-    if (args.name === 'human' || args.name === 'tester' || args.name === 'user') fail('invalid-request');
-    string(args.reason, 500);
-    if (action === 'role.fire') return;
-    identifier(args.definition);
-    if ('vars' in args && (!object(args.vars) || !Object.keys(args.vars).every(HIRE_VAR))) fail('invalid-request');
-  }
-  // D2.3 at hire, against the role files as they stand: a version 2 definition whose every action is
-  // on HIRE_ALLOWED (W-N2), named in the chief role file's hireable list and not in launch.noHire.
-  #hireable(s, definition) {
-    if (!this.#roleFile) fail('not-configured');
-    const b = this.#business(s.business);
-    const load = (name) => {
-      try {
-        return this.#roleFile(name);
-      } catch (e) {
-        if (e.name === 'BusinessError') fail('definition-not-hireable');
-        throw e;
-      }
-    };
-    const def = load(definition);
-    if (def.roleVersion !== 2 || unhireableAction(def) !== null) fail('definition-not-hireable');
-    if (!(load(b.roles[s.role].definition).hireable ?? []).includes(definition)) fail('definition-not-hireable');
-    if ((b.launch?.noHire ?? []).includes(definition)) fail('definition-not-hireable');
-  }
   // The bus code for an organization writer's refusal. Anything the writer didn't refuse by name is
   // outcome-unknown: the write may have committed.
   #organizationFail(e, verb) {
@@ -7314,6 +7383,7 @@ export class Broker {
         identifier(a.id);
         if (a.note !== undefined) string(a.note);
         const d = this.#decision(s, a.id);
+        if (['role.hire','role.fire','role.change'].includes(d.action) && ['decision.resolve','decision.resolve.console'].includes(verb)) fail('hire-resolution-required');
         if (this.#closed(d.id)) fail('decision-closed');
         // Recheck eligibility, context digest and membership in the current options in this
         // transaction, before any resolution, audit, notification or grant execution.
@@ -7773,6 +7843,7 @@ export class Broker {
         const allowed = verb === 'trail' ? ['subject'] : verb === 'tasks' ? TASK_ARGS : [];
         keys(a, allowed, verb === 'trail' ? ['subject'] : []);
         if (!s.human && !s.reader) this.#agent(s);
+        if (verb === 'inbox')this.#expireHires(s);
         if (verb === 'inbox')
           return this.#store
             .all(
@@ -7818,6 +7889,7 @@ export class Broker {
       case 'decisions': {
         if (!s.human && !s.reader) fail('human-required');
         keys(a, ['list'], ['list']);
+        this.#expireHires(s);
         if (a.list === 'roles')
           return this.#store
             .all(

packages/bus/src/model-keys.mjs

@@ -198,12 +198,12 @@ export class ModelKeys {
   // Host-only callbacks are the existing synchronous organization path.
   hire(instance, check, publish) {
     return this.#exclusive(async () => {
-      check(); // Fresh validation and captured revision AFTER controller queue.
+      await check(); // Fresh validation and captured revision AFTER controller queue.
       const existed = this.hasRecord(instance);
       try {
         await this.#issue(instance);
-        check(); // Recheck captured revision AFTER HTTP, before publication.
-        return publish();
+        await check(); // Recheck captured revision AFTER HTTP, before publication.
+        return await publish();
       } catch (error) {
         // A newly issued generation has not escaped to queued admission yet.
         if (!existed && this.hasRecord(instance)) {
@@ -347,7 +347,7 @@ export function modelOrganization({ modelKeys, writer }) {
   };
   const wrap = invoke => (business, verb, args, actor, context) => {
     const isRevoke = verb === 'instance.fire' || (verb === 'instances.set' && args.op === 'delete');
-    if (!isRevoke && verb !== 'instance.hire') return invoke(business, verb, args, actor, context);
+    if (!isRevoke) return invoke(business, verb, args, actor, context);
     return (async () => {
       if (pending.has(business)) fail('organization-busy');
       const agent = args.name ?? args.instance, instance = business + '/' + agent;
@@ -355,19 +355,11 @@ export function modelOrganization({ modelKeys, writer }) {
       if (verb === 'instances.set') invoke(business, 'instances.check', { instance: agent }, actor, context);
       const { revision } = writer.read(business);
       if (args.revision !== undefined && args.revision !== revision) fail('revision-conflict');
-      const checkHire = () => {
-        if (writer.read(business).revision !== revision) fail('revision-conflict');
-        const checked = invoke(business, 'instance.hireCheck', args, actor, context);
-        if (checked.revision !== revision) fail('revision-conflict');
-        return checked;
-      };
-      if (!isRevoke) checkHire(); // No registration or proxy I/O before shared checks.
       const prepare = { instance, revision, remoteRevoked: false };
       pending.set(business, prepare);
       const existed = modelKeys.hasRecord(instance);
       try {
         if (isRevoke) { await modelKeys.prepareRevoke(instance); prepare.remoteRevoked = existed; }
-        else return await modelKeys.hire(instance, checkHire, () => invoke(business, verb, args, actor, context));
         return invoke(business, verb, args, actor, context);
       } catch (error) {
         if (isRevoke && prepare.remoteRevoked && (error.code === 'revision-conflict' || error.code === 'revision-conflict-revoked')) modelKeys.revisionConflict(instance);
@@ -375,5 +367,12 @@ export function modelOrganization({ modelKeys, writer }) {
       } finally { pending.delete(business); }
     })();
   };
-  return { writer: adapter, revoke, wrap };
+  const hire = async (business, agent, check, publish) => {
+    if (pending.has(business)) fail('organization-busy');
+    const prepare = { instance: `${business}/${agent}`, revision: writer.read(business).revision, remoteRevoked: false };
+    pending.set(business, prepare);
+    try { return await modelKeys.hire(prepare.instance, check, publish); }
+    finally { pending.delete(business); }
+  };
+  return { writer: adapter, revoke, wrap, hire };
 }

packages/bus/src/refusals.mjs

@@ -1,6 +1,7 @@
 // Static refusal table: each listed code maps to one rail and next step. These strings
 // never interpolate caller arguments, credential references, policy values or file bytes.
 const entries = [];
+
 const group = (codes, rail, nextStep) => {
   const guidance = Object.freeze({ rail, nextStep });
   for (const code of codes.split(' ')) {
@@ -8,6 +9,10 @@ const group = (codes, rail, nextStep) => {
     entries.push([code, guidance]);
   }
 };
+group("definition-shared hire-resolution-required hire-owner-required decision-expired right-required", "R5/R8/R9: digest-bound hire approval by a permitted person", "Use the hire Console path with org.hire. Flagged, credential and root decisions need their owner; expired decisions need a fresh proposal.");
+group("root-fire-shared", "R3/R8: root fire must revoke every copy's grants", "Other organizations may retain running copies and grants. Ask the owner to coordinate revocation across those organizations before removing the root agent.");
+group("copy-stale", "R3: root policy changed since this bus booted", "Ask the owner to restart the organization bus to load the approved root policy, then launch a fresh copy.");
+group("root-policy-unreadable", "R3: root policy evidence must be readable", "Ask the owner to inspect root agent receipt metadata and restart the bus after repairing the read failure.");
 group("plugin-disabled", "R3/R6/R10: installed, pinned and enabled plugin capabilities", "Ask the instance owner to verify the installed plugin and the organization owner to enable it. A replacement of an already loaded package needs a host restart; then relaunch the agent.");
 group("plugin-restart-required", "R3/R10: one imported package pin per host process", "Ask the instance owner to restart the host after replacing an already loaded package, then retry through the supported path.");
 group(

packages/bus/src/runtime.mjs

@@ -1,3 +1,5 @@
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationPlugins } from '../../plugins/src/organization.mjs';
 import { pluginService } from '../../plugins/src/tools.mjs';
 import { readPluginLock } from '../../plugins/src/pinned.mjs';
 import { createRequirementsHost } from '../../tasks/src/builtin.mjs';
@@ -61,7 +63,7 @@ import { discordProcessingHooks } from '../../discord/src/processing.mjs';
 import { createContainerStopper } from '../../processing-control/src/containers.mjs';
 
 // Row 194 (D3): the verbs the instance writer commits, whose answers carry restart.
-const INSTANCE_VERBS = new Set(['instances.set', 'veto.set', 'instance.hire', 'instance.fire']);
+const INSTANCE_VERBS = new Set(['instances.set', 'veto.set', 'instance.fire']);
 // FED R4 (#1801, design 3.7): the revocation timer's period.
 export const ACCESS_SWEEP_MS = 30_000;
 // Trusted host API. S1 supplies resolved definitions, S6 supplies launch records and ends them.
@@ -818,8 +820,6 @@ export async function startBroker({
         if(verb==='instances.check')return instances.checkDelete(id,args.instance,actor);
         // Row 194 b6 (webby-0094 B1): a fire's checks against the file, before step A.
         if(verb==='instance.fireCheck')return instances.checkFire(id,args.name);
-        // Internal read-only path: no reload, journal, credential or publication.
-        if(verb==='instance.hireCheck')return instances.checkHire(id,args);
         let result;
         if (['limits.set', 'instances.set'].includes(verb) && settings.current(id).plugins?.['model-provider']?.length) {
           return catalogueFor(id, { fresh: true }).then(catalogue => {
@@ -855,8 +855,7 @@ export async function startBroker({
         // owner, so ROLE_RIGHTS.owner); the store's assertClean is the held-secret check each write needs.
         else if(Object.hasOwn(DEFINITION_BUS_VERBS,verb))result=definitionVerbs({writer:organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir}),rolesDir:organization.rolesDir,assertClean:value=>credentials.assertClean(value)})[DEFINITION_BUS_VERBS[verb]](id,args,{actor,rights:[...ROLE_RIGHTS.owner],agent:false});
         // Row 194 (D2.1, D2.2): the chief's hire and fire, with the reason in the change context.
-        else if(verb==='instance.hire')result=instances.hire(id,args,{actor,context});
-        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name},{actor,context});
+        else if(verb==='instance.fire')result=instances.fire(id,{name:args.name,revision:args.revision},{actor,context});
         else throw new BusError('invalid-request');
         // Row 194 (D3 item 2): one reload, after every verb that committed, then the limit checks.
         const live=reload(id);
@@ -867,6 +866,24 @@ export async function startBroker({
         return INSTANCE_VERBS.has(verb)?{...result,restart:!live}:result;
       }):null,
       // Row 194 (D2.3): the role files as they stand, for the hire checks.
+      hires: organization ? (()=>{
+        const service=hireDecisions({writer:organizationWriter({dir:organization.dir,rolesDir:organization.rolesDir,dataRoot:instanceRoot??dataRoot}),rolesDir:organization.rolesDir,configDir:organization.dir,dataRoot,
+          system:organization.system,levels,catalogueFor:async(id,doc)=>doc.plugins?.['model-provider']?.length?catalogueFor(id,{fresh:true}):null,assertClean:value=>credentials.assertClean(value),registryFor:doc=>organizationPlugins(instanceRoot??dataRoot,doc.plugins).registry});
+        return {...service,apply:async(id,decision,caller)=>{
+          const proposal=service.read(decision);
+          const publish=async()=>{
+            let approved=caller;
+            if(modelKeys && proposal.op==='fire' && proposal.level!=='org') {
+              const instance=`${id}/${proposal.level==='project'?`${proposal.name}.${proposal.project}`:proposal.name}`;
+              await modelKeys.prepareRevoke(instance);
+              approved={...caller,beforeWrite:()=>modelKeys.completeRevoke(instance)};
+            }
+            const result=await service.apply(id,decision,approved);reload(id);return result;
+          };
+          if(proxyOrganization && proposal.level==='org' && proposal.op==='hire')return proxyOrganization.hire(id,proposal.name,()=>service.check(id,decision,caller),publish);
+          return publish();
+        }};
+      })() : null,
       roleFile: organization ? (name) => loadRole(organization.rolesDir, name) : null,
       secretCheck: (value) => credentials.assertClean(value),
       credentialStatus: () => credentials.status(),
@@ -1254,7 +1271,7 @@ export async function startBroker({
         return refused(['model-provider-unavailable','model-catalogue-unavailable','model-harness-incompatible'].includes(answer?.code) ? answer.code : 'model-provider-unavailable');
       },
       modelPreflight: async ({ business, role }) => {
-        const current = settings ? settings.current(business) : businesses[business];
+        const current = organization ? loadOrg(business) : businesses[business];
         if (!Object.hasOwn(current?.roles ?? {}, role)) throw new BusError('unknown-role');
         return modelKeys ? modelKeys.preflight(business + '/' + role) : null;
       },

packages/bus/tests/chief-of-staff.test.mjs

@@ -8,7 +8,6 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Store, schemaDigest } from '../src/store.mjs';
 import { Broker, ACTIONS } from '../src/broker.mjs';
-import { HIRE_ALLOWED } from '../../organization/src/vocabulary.mjs';
 import { startBroker } from '../src/runtime.mjs';
 import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
 import { busOrganization } from '../src/organization-context.mjs';
@@ -711,380 +710,17 @@ test('row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse
   assert.deepEqual(organization.at(-1), ['demo', 'veto.set', { revision: PATCH.revision, op: 'unkeep', name: 'coder' }, 'jason']);
 });
 
-// Row 194 (#1692, D2.1-D2.3): the chief's hire and fire. PRD 1.7 REQ-COS-3 routes role.hire and
-// role.fire within-role for the chief (sage-1471, mos-1089), so they take the reason form, as
-// role.end does: no decision, a reason of 1 to 500 characters that goes into the log. The role
-// files are stubs, so a definition's authority is the test's to set.
 const LISTED = { launch: { by: 'chief', instances: ['pm', 'coder'], keep: ['pm'], noHire: ['banned'] } };
-const roleDoc = (withinRole, extra = {}) => ({ roleVersion: 2, authority: { withinRole, crossRole: [] }, hireable: [], ...extra });
-const ROLE_FILES = {
-  'chief-of-staff': roleDoc(chiefAuthority, { hireable: ['coder', 'researcher', 'wide', 'banned'] }),
-  coder: roleDoc(['message.send', 'record.write']),
-  // A version 1 file has empty authority lists, so only the version check refuses it (M60).
-  researcher: { roleVersion: 1, authority: { withinRole: [], crossRole: [] }, hireable: [] },
-  wide: roleDoc(['message.send', 'task.create']),
-  banned: roleDoc(['message.send']),
-  pm: roleDoc(['message.send']),
-};
-const roleFile = (files) => (name) => {
-  if (!Object.hasOwn(files, name)) throw Object.assign(new Error(`no role ${name}`), { name: 'BusinessError' });
-  return files[name];
-};
-function hireSetup(t, extra = LISTED, files = ROLE_FILES) {
-  return setup(t, extra, { roleFile: roleFile(files) });
-}
-const HIRE = { name: 'helper', definition: 'coder', reason: 'more hands for the queue' };
-const FIRE = { name: 'coder', reason: 'the work is done' };
-const CONTEXT = (reason) => ({ instance: 'chief', run: 'chief-run', reason });
-const withoutReason = ({ reason, ...rest }) => rest;
 
-test('row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it', (t) => {
-  const { call, organization, allowed, store } = hireSetup(t);
-  const result = call('chief', 'instance.hire', HIRE);
-  assert.equal(result.transaction, 't-1');
-  assert.deepEqual(organization, [['demo', 'instance.hire', withoutReason(HIRE), 'chief-of-staff.chief', CONTEXT(HIRE.reason)]]);
-  const [use, ...rest] = allowed('role.hire');
-  assert.equal(rest.length, 0);
-  assert.equal(use.subject, 'helper');
-  assert.deepEqual({ reason: use.body.reason, transaction: use.body.transaction, decision: use.body.decision ?? null }, { reason: HIRE.reason, transaction: 't-1', decision: null });
-  // Within-role: no decision is raised or needed.
-  assert.equal(store.get('SELECT count(*) AS n FROM decisions').n, 0);
-  // vars reach the writer with the name and definition.
-  call('chief', 'instance.hire', { ...HIRE, name: 'aide', vars: { model: 'm', 'limits.x': 1 } });
-  assert.deepEqual(organization.at(-1)[2], { name: 'aide', definition: 'coder', vars: { model: 'm', 'limits.x': 1 } });
-});
-
-// T11 (D5): a business id names one business on one bus. The chief's hire and fire go to its own
-// business's writer, and no argument names another.
-test('row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own', (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-two-'));
-  const store = new Store(root);
-  t.after(() => {
-    store.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const organization = [];
-  const one = demo(LISTED).demo;
-  const b = new Broker({
-    store,
-    businesses: { demo: one, other: { ...one, id: 'other' } },
-    roleFile: roleFile(ROLE_FILES),
-    organization: (...args) => (organization.push(args), { revision: 'b'.repeat(64), transaction: 't-' + organization.length }),
-  });
-  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  b.request(chief, { verb: 'role.claim' });
-  for (const verb of ['instance.hire', 'instance.fire'])
-    for (const extra of [{ business: 'other' }, { target: 'other' }])
-      assert.throws(() => b.request(chief, { verb, args: { ...(verb === 'instance.hire' ? HIRE : FIRE), ...extra } }), /invalid-request/, `${verb} ${Object.keys(extra)}`);
-  assert.equal(organization.length, 0);
-  b.request(chief, { verb: 'instance.hire', args: HIRE });
-  b.request(chief, { verb: 'instance.fire', args: FIRE });
-  assert.deepEqual(organization.map((c) => [c[0], c[1]]), [['demo', 'instance.hire'], ['demo', 'instance.fireCheck'], ['demo', 'instance.fire']]);
-  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE business='other'").n, 0);
-});
-
-test('row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key', (t) => {
-  const { call, organization } = hireSetup(t);
-  for (const reason of [undefined, '', 'x'.repeat(501), 7]) {
-    const r = reason === undefined ? {} : { reason };
-    assert.throws(() => call('chief', 'instance.hire', { name: 'helper', definition: 'coder', ...r }), /invalid-request/, String(reason));
-    assert.throws(() => call('chief', 'instance.fire', { name: 'coder', ...r }), /invalid-request/, String(reason));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, decision: 'd-1' }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, decision: 'd-1' }), /invalid-request/);
-  for (const name of ['human', 'tester']) assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name }), /invalid-request/, name);
-  assert.equal(organization.length, 0);
-  call('chief', 'instance.hire', { ...HIRE, reason: 'x'.repeat(500) });
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions', (t) => {
-  const granted = { authority: { withinRole: ['message.send', 'role.hire', 'role.fire'], crossRole: [] } };
-  const { call, organization, allowed } = hireSetup(t, { ...LISTED, roles: { ...roles, pm: { definition: 'pm', ...granted }, coder: { definition: 'coder', ...granted } } });
-  for (const who of ['pm', 'coder', 'assistant']) {
-    assert.throws(() => call(who, 'instance.hire', HIRE), /role-not-chief/, who);
-    assert.throws(() => call(who, 'instance.fire', FIRE), /role-not-chief/, who);
-  }
-  assert.throws(() => call('tester', 'instance.hire', HIRE), /tester-refused/);
-  assert.throws(() => call('reader', 'instance.hire', HIRE), /read-only/);
-  assert.throws(() => call('human', 'instance.fire', FIRE), /agent-required/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-test('row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer', (t) => {
-  for (const missing of ['role.hire', 'role.fire']) {
-    const authority = { withinRole: chiefAuthority.withinRole.filter((a) => a !== missing), crossRole: [] };
-    const { call, organization, lastClaim } = hireSetup(t, { ...LISTED, roles: { ...roles, chief: { definition: 'chief-of-staff', authority } } });
-    const [verb, args] = missing === 'role.hire' ? ['instance.hire', HIRE] : ['instance.fire', FIRE];
-    assert.throws(() => call('chief', verb, args), /decision-required/, missing);
-    assert.equal(organization.length, 0, missing);
-    assert.equal(lastClaim('coder').op, 'claim', missing);
-    // The other action still goes through.
-    const [other, otherArgs] = missing === 'role.hire' ? ['instance.fire', FIRE] : ['instance.hire', HIRE];
-    call('chief', other, otherArgs);
-    assert.equal(organization.filter(([, verb]) => verb !== 'instance.fireCheck').length, 1, missing);
-  }
-});
-
-test('row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer\'s refusals pass through by name', (t) => {
-  const { call, organization, writer } = hireSetup(t);
-  const again = { name: 'coder', definition: 'coder', reason: 'needed again' };
-  for (const code of ['organization-instance-exists', 'organization-instance-retired', 'definition-not-hireable', 'instance-kept']) {
-    writer.error = Object.assign(new Error(code), { code });
-    assert.throws(() => call('chief', 'instance.hire', again), new RegExp(code));
-  }
-  writer.error = null;
-  call('chief', 'instance.hire', again);
-  assert.deepEqual(organization.at(-1).slice(1, 3), ['instance.hire', withoutReason(again)]);
-});
-
-test('row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn\'t', (t) => {
-  assert.deepEqual([...HIRE_ALLOWED], ['message.send', 'record.write', 'review.request', 'task.update.assigned', 'task.scope.change', 'git.push.working']);
-  for (const action of ACTIONS) {
-    const files = { ...ROLE_FILES, wide: roleDoc(['message.send', action]) };
-    const { call, organization } = hireSetup(t, LISTED, files);
-    const run = () => call('chief', 'instance.hire', { ...HIRE, definition: 'wide' });
-    if (HIRE_ALLOWED.includes(action)) {
-      run();
-      assert.equal(organization.length, 1, action);
-    } else {
-      assert.throws(run, /definition-not-hireable/, action);
-      assert.equal(organization.length, 0, action);
-    }
-  }
-  const { call, organization } = hireSetup(t);
-  const hire = (definition) => call('chief', 'instance.hire', { ...HIRE, definition });
-  // Version 1 (M60), noHire, not on the chief's list, and no role file.
-  for (const definition of ['researcher', 'banned', 'pm', 'nothing'])
-    assert.throws(() => hire(definition), /definition-not-hireable/, definition);
-  assert.equal(organization.length, 0);
-  hire('coder');
-  assert.equal(organization.length, 1);
-});
-
-test('row 194 T8b: a hire without the role files configured refuses not-configured', (t) => {
-  const { call, organization } = setup(t, LISTED);
-  assert.throws(() => call('chief', 'instance.hire', HIRE), /not-configured/);
-  assert.equal(organization.length, 0);
-  assert.throws(() => new Broker({ store: null, businesses: demo(), roleFile: 'roles' }), /roleFile must be a function/);
-});
-
-test('row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs', (t) => {
-  const { call, organization, allowed, lastClaim, writer } = hireSetup(t);
-  // An open launch request of the coder, made by the human.
-  const open = call('human', 'instance.launch', { instance: 'coder' }).request;
-  let seen = null;
-  writer.during = ([, verb]) => { if (verb === 'instance.fire') seen = { stopped: allowed('fire.stopped').length, claim: lastClaim('coder').op, used: allowed('role.fire').length }; };
-  const result = call('chief', 'instance.fire', FIRE);
-  // Step A ran before the writer; step C after it.
-  assert.deepEqual(seen, { stopped: 1, claim: 'revoke', used: 0 });
-  assert.deepEqual(lastClaim('coder'), { op: 'revoke', decision: null, reason: 'the work is done', by: 'chief-run' });
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.deepEqual(result.cancelled, [open]);
-  assert.deepEqual(organization.at(-1), ['demo', 'instance.fire', { name: 'coder' }, 'chief-of-staff.chief', CONTEXT(FIRE.reason)]);
-  const [end] = allowed('lifecycle.end');
-  assert.equal(end.subject, 'coder');
-  assert.deepEqual({ ...end.body, request: null }, { action: 'lifecycle.end', request: null, via: 'chief', by: 'chief', runs: ['coder-run'], reason: 'the work is done', kill: true });
-  assert.equal(allowed('lifecycle.cancelled').filter((e) => e.body.request === open).length, 1);
-  const [use] = allowed('role.fire');
-  assert.equal(use.subject, 'coder');
-  assert.equal(use.body.reason, 'the work is done');
-  assert.equal(use.body.transaction, result.transaction);
-  assert.deepEqual(allowed('fire.done').map((e) => [e.subject, e.body.transaction]), [['coder', result.transaction]]);
-  // The human's read of the request shows the kill.
-  assert.equal(call('human', 'instance.request', { request: end.body.request }).kill, true);
-});
-
-// S6 (D2.2): the launcher closes a fire's end with the runs row 191's stop killed or left alive, and
-// each becomes its own event against the instance. Only a fire's end carries them.
-test('row 194 T9a (bus): a fire end\'s done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop\'s reason; a terminate\'s done or a bad stop refuses', (t) => {
-  const { b, call, allowed } = hireSetup(t);
-  call('chief', 'instance.fire', FIRE);
-  const [end] = allowed('lifecycle.end');
-  const request = end.body.request;
-  assert.equal(b.lifecycleTake({ business: 'demo', request }).go, true);
-  const done = (stops) => b.lifecycleDone({ business: 'demo', request, stops });
-  for (const bad of [[{ run: 'coder-run', pid: 4242, outcome: 'stopped' }], [{ run: 'coder-run', pid: 1, outcome: 'killed' }],
-    [{ run: 'coder-run', outcome: 'killed' }], [{ run: 'coder-run', pid: 4242, outcome: 'killed', signals: [] }], 'killed',
-    // sage-2289: only an alive stop carries a reason, and only unknown.
-    [{ run: 'coder-run', pid: 4242, outcome: 'killed', reason: 'unknown' }], [{ run: 'coder-run', pid: null, outcome: 'alive', reason: 'stuck' }]])
-    assert.throws(() => done(bad), { code: 'invalid-request' }, JSON.stringify(bad));
-  const closed = done([{ run: 'coder-run', pid: 4242, outcome: 'killed' }, { run: 'coder-other', pid: null, outcome: 'alive' },
-    { run: 'coder-unknown', pid: null, outcome: 'alive', reason: 'unknown' }]);
-  assert.equal(closed.state, 'closed');
-  assert.deepEqual(allowed('lifecycle.end.killed').map((e) => [e.subject, e.body]), [['coder', { action: 'lifecycle.end.killed', request, run: 'coder-run', pid: 4242 }]]);
-  assert.deepEqual(allowed('lifecycle.end.alive').map((e) => [e.subject, e.body]), [['coder', { action: 'lifecycle.end.alive', request, run: 'coder-other', pid: null }],
-    ['coder', { action: 'lifecycle.end.alive', request, run: 'coder-unknown', pid: null, reason: 'unknown' }]]);
-  // A terminate's end sends SIGTERM only, so its done has no stops.
-  const term = call('human', 'instance.end', { instance: 'pm' }).request;
-  assert.equal(b.lifecycleTake({ business: 'demo', request: term }).go, true);
-  assert.throws(() => b.lifecycleDone({ business: 'demo', request: term, stops: [{ run: 'pm-run', pid: 4242, outcome: 'killed' }] }), { code: 'invalid-request' });
-  assert.equal(allowed('lifecycle.end.killed').length, 1);
-  assert.equal(b.lifecycleDone({ business: 'demo', request: term }).state, 'closed');
-});
-
-test('row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone', (t) => {
-  const { call, organization, allowed, lastClaim } = hireSetup(t, { launch: { by: 'chief', instances: ['coder'], keep: ['pm'] } });
-  const fire = (name) => call('chief', 'instance.fire', { name, reason: 'r' });
-  assert.throws(() => fire('pm'), /instance-kept/);
-  assert.throws(() => fire('nobody'), /unknown-role/);
-  assert.throws(() => fire('assistant'), /organization-definition-refused/);
-  assert.throws(() => fire('chief'), /organization-instance-referenced/);
-  assert.throws(() => fire('coder'), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length + allowed('lifecycle.end').length + allowed('role.fire').length, 0);
-  assert.equal(lastClaim('coder').op, 'claim');
-});
-
-test('row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once', (t) => {
-  const { call, b, caps, organization, allowed, writer } = hireSetup(t);
-  writer.during = ([, verb]) => { if (verb === 'instance.fire') throw new Error('disk'); };
-  assert.throws(() => call('chief', 'instance.fire', FIRE), /outcome-unknown/);
-  writer.during = null;
-  assert.equal(allowed('fire.stopped').length, 1);
-  assert.equal(allowed('role.fire').length, 0);
-  // W-N1: while it fires, no launch of the instance starts by any path.
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  assert.throws(() => b.authorize(caps.chief, 'role.launch', { target: 'coder' }), /instance-firing/);
-  // The repeat has no claim to revoke. The revoked run is still bound until the launcher reports it
-  // ended, so the repeat asks for its kill again, then delists and logs.
-  const result = call('chief', 'instance.fire', FIRE);
-  assert.deepEqual(result.runs, ['coder-run']);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.deepEqual(allowed('lifecycle.end').map((e) => e.body.kill), [true, true]);
-  // Once done, the instance launches again.
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it', (t) => {
-  const { call, organization, allowed, store, writer } = hireSetup(t);
-  // The delist commits, then the step C transaction aborts.
-  writer.during = ([, verb]) => verb === 'instance.fire' && store.run("CREATE TRIGGER fail_c BEFORE INSERT ON events WHEN json_extract(new.body,'$.action')='fire.done' BEGIN SELECT RAISE(ABORT, 'c failed'); END");
-  assert.throws(() => call('chief', 'instance.fire', FIRE));
-  writer.during = null;
-  store.run('DROP TRIGGER fail_c');
-  assert.equal(allowed('role.fire').length, 0);
-  assert.equal(allowed('fire.done').length, 0);
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  call('chief', 'instance.fire', FIRE);
-  assert.equal(organization.filter(([, verb]) => verb === 'instance.fire').length, 2);
-  assert.equal(allowed('role.fire').length, 1);
-  assert.equal(allowed('fire.done').length, 1);
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance\'s done does not end it', (t) => {
-  const { call, store } = hireSetup(t);
-  const step = (instance, action) =>
-    store.run("INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,'demo','action.allowed','chief','chief-run',?,?)",
-      `${action}-${instance}-${Math.random()}`, new Date().toISOString(), instance, JSON.stringify({ action, request: null, transaction: null }));
-  step('coder', 'fire.done');
-  step('coder', 'fire.stopped');
-  step('pm', 'fire.done');
-  assert.throws(() => call('human', 'instance.launch', { instance: 'coder' }), /instance-firing/);
-  step('coder', 'fire.done');
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer', (t) => {
-  const { call, organization, lastClaim, allowed } = hireSetup(t);
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, name: 'pm' }), /instance-kept/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, name: 'pm' }), /instance-kept/);
-  assert.equal(organization.length, 0);
-  assert.equal(lastClaim('pm').op, 'claim');
-  assert.equal(allowed('role.hire').length + allowed('role.fire').length, 0);
-});
-
-// webby-0094 B1: the file's keep, which this copy hasn't loaded, refuses at the fire check, before
-// step A revokes, ends or marks anything, so the instance isn't left firing.
-test('row 194 T10: a fire the writer\'s check refuses from the file stops nothing and leaves the instance launchable', (t) => {
-  const { call, organization, lastClaim, allowed, writer } = hireSetup(t);
-  writer.during = ([, verb]) => { if (verb === 'instance.fireCheck') throw Object.assign(new Error('instance-kept'), { code: 'instance-kept' }); };
-  assert.throws(() => call('chief', 'instance.fire', FIRE), /instance-kept/);
-  writer.during = null;
-  assert.deepEqual(organization.map(([, verb]) => verb), ['instance.fireCheck']);
-  assert.equal(lastClaim('coder').op, 'claim');
-  assert.equal(allowed('fire.stopped').length + allowed('lifecycle.end').length + allowed('role.fire').length, 0);
-  assert.ok(call('human', 'instance.launch', { instance: 'coder' }).request);
-});
-
-test('row 194 T18: hire and fire take only their own keys, and a refused call writes nothing', (t) => {
-  const { call, organization, allowed } = hireSetup(t);
-  for (const extra of [{ keep: ['x'] }, { launch: {} }, { revision: 'a'.repeat(64) }, { force: true }]) {
-    assert.throws(() => call('chief', 'instance.hire', { ...HIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-    assert.throws(() => call('chief', 'instance.fire', { ...FIRE, ...extra }), /invalid-request/, JSON.stringify(extra));
-  }
-  assert.throws(() => call('chief', 'instance.hire', { ...HIRE, vars: { harness: 'pi' } }), /invalid-request/);
-  assert.throws(() => call('chief', 'instance.fire', { ...FIRE, definition: 'coder' }), /invalid-request/);
-  assert.equal(organization.length, 0);
-  assert.equal(allowed('fire.stopped').length, 0);
-});
-
-test('row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone', async (t) => {
-  const root = mkdtempSync(join(tmpdir(), 'bus-chief-hire-'));
-  const rolesDir = rolesCopy(root);
-  // A hireable scratch definition: version 2, no credentials, every action on HIRE_ALLOWED.
-  writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
-  writeJson(join(rolesDir, 'aide.json'), {
-    roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
-    authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],
-  });
-  const chiefFile = join(rolesDir, 'chief-of-staff.json');
-  writeJson(chiefFile, { ...JSON.parse(readFileSync(chiefFile, 'utf8')), hireable: ['aide'] });
-  const file = join(root, 'businesses/demo.json');
-  writeJson(file, { ...businessDoc(root, 'demo'), plugins: { harness: ['pi'] } });
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  // The boot copy is the file's own bus form, as cli bootConfig builds it, so a write reloads.
-  const busForm = (dir, roles) => {
-    const b = loadBusiness('demo', { dir, rolesDir: roles });
-    const resolved = {};
-    for (const instance of Object.keys(b.roles)) resolved[instance] = resolveInstance({ system: systemFor(dir), business: b, instance });
-    return busOrganization(b, resolved);
-  };
-  const bus = await startBroker({
-    dataRoot: join(root, 'data'),
-    businesses: { demo: busForm(root, rolesDir) },
-    organization: { dir: root, rolesDir, system: systemFor(root) },
-  });
-  t.after(async () => {
-    await bus.close();
-    rmSync(root, { recursive: true, force: true });
-  });
-  const { broker } = bus;
-  const chief = broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
-  broker.request(chief, { verb: 'role.claim' });
-  const call = (cap, verb, args) => broker.request(cap, { verb, args });
-  const receipts = () =>
-    readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').map(JSON.parse).filter((r) => r.state === 'committed');
-  const document = () => JSON.parse(readFileSync(file, 'utf8'));
-
-  // The shipped chief file grants both actions, so the runtime takes the reason form.
-  // A refused hire: coder declares credentials and isn't on the chief's list. The file is unchanged.
-  const bytes = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.hire', { name: 'helper', definition: 'coder', reason: 'r' }), /definition-not-hireable/);
-  assert.equal(readFileSync(file, 'utf8'), bytes);
-
-  call(chief, 'instance.hire', { name: 'helper', definition: 'aide', reason: 'more hands' });
-  assert.deepEqual(document().roles.helper, { definition: 'aide' });
-  assert.ok(document().launch.instances.includes('helper'));
-  const [h] = receipts().slice(-1);
-  assert.equal(h.actor, 'chief-of-staff.chief');
-  assert.deepEqual(h.context, CONTEXT('more hands'));
-
-  const result = call(chief, 'instance.fire', { name: 'helper', reason: 'the work is done' });
-  assert.equal(result.delisted, true);
-  assert.ok(!document().launch.instances.includes('helper'));
-  assert.deepEqual(receipts().slice(-1)[0].context, CONTEXT('the work is done'));
-  // The reloaded business sees the delist: a refused call leaves the file alone.
-  const after = readFileSync(file, 'utf8');
-  assert.throws(() => call(chief, 'instance.fire', { name: 'helper', reason: 'again', extra: 1 }), /invalid-request/);
-  assert.equal(readFileSync(file, 'utf8'), after);
+test('A4 the retired lifecycle verbs always require a decision and never call the writer',t=>{
+  const {call,organization}=setup(t,KEPT);
+  for(const who of ['chief','coder','human'])for(const verb of ['instance.hire','instance.fire'])
+    assert.throws(()=>call(who,verb,{name:'coder',definition:'coder',reason:'help'}),{code:'decision-required'});
+  assert.equal(organization.length,0);
 });
 
 test('row 194 W-N1: the launcher\'s take of a launch or regenerate of a firing instance closes it as instance-firing', (t) => {
-  const { b, call, store } = hireSetup(t);
+  const { b, call, store } = setup(t,LISTED);
   const launch = call('human', 'instance.launch', { instance: 'coder' }).request;
   const regenerate = call('human', 'instance.regenerate', { instance: 'pm' }).request;
   // A fire's step A as the store holds it with no step C, for requests step A didn't see.

packages/bus/tests/console-decide.test.mjs

@@ -89,7 +89,7 @@ function setup(t) {
 // #797 / #1839 adds the owner-only artifact read to the existing decision and request controls;
 // no unsuffixed verb is ever a console verb.
 test('N4: owner Console verbs have an explicit immutable whitelist and exclude decision.resolve', () => {
-  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
+  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'hire.preview.console', 'hire.resolve.console', 'hire.start.console', 'hire.templates.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
     'request.get.console', 'request.projects.console', 'request.answer.console', 'request.attach.console', 'request.cancel.console']);
   assert.ok(CONSOLE_VERBS.every(verb => verb.endsWith('.console')));
   assert.equal(CONSOLE_VERBS.includes('decision.resolve'), false);

packages/bus/tests/fire-revokes-grants.test.mjs

@@ -6,6 +6,7 @@
 // keys are real local ssh-keygen pairs in the scratch store, and no ssh connection is made. Decisions a
 // test needs outside the human's yes go in by SQL as fixtures.
 import test from 'node:test';
+import { hireServiceFixture, fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 import assert from 'node:assert/strict';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
@@ -156,7 +157,7 @@ async function setup(t) {
     return { revision: REV };
   };
   const make = () =>
-    new Broker({
+    new Broker({hires:hireServiceFixture,
       store,
       businesses: { demo: structuredClone(doc) },
       secretCheck: (value) => credentials.assertClean(value),
@@ -184,7 +185,7 @@ async function setup(t) {
     store
       .all("SELECT actor_role, subject, body FROM events WHERE business='demo' AND kind='action.allowed' ORDER BY seq")
       .map((e) => ({ ...e, body: JSON.parse(e.body) }))
-      .filter((e) => e.body.action === action);
+      .filter((e) => e.body.action === action && e.body.operation !== 'decision.raise');
   // The bus's step G messages to the human: no decision, so no grant notice.
   const inbox = () =>
     store.all("SELECT body FROM messages WHERE business='demo' AND from_role='_bus' AND to_role='human' AND decision IS NULL ORDER BY rowid").map((r) => r.body);
@@ -232,7 +233,8 @@ async function setup(t) {
         adminSha256: adminSha256(grantApi.adminMeta('demo') ?? meta),
       },
     });
-  const fire = (name) => call('chief', 'instance.fire', { name, reason: 'the work is done' });
+  const hireConsole=fixtureConsole(broker);
+  const fire = name => approveFixtureFire(broker,hireConsole,name);
   // A delete as the launcher's pass runs it: the human's request, the take, then lifecycleDelete. A
   // refused delete closes the request with its code, as the launcher does.
   const remove = (instance) => {
@@ -304,7 +306,7 @@ function allRevoked(f, hosts = ['web1', 'web2']) {
 test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three', async (t) => {
   const f = await setup(t);
   await threeGrants(f);
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.equal(out.done, false);
   assert.match(out.job, UUID);
   assert.deepEqual(out.revoking, ['host:web1', 'host:web2', 'gitea']);
@@ -313,7 +315,7 @@ test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers
   assert.equal(more.length, 0);
   assert.equal(revoking.body.job, out.job);
   assert.deepEqual(revoking.body.grants, out.revoking);
-  assert.equal(revoking.actor_role, 'chief');
+  assert.equal(revoking.actor_role, null);
   assert.equal(revoking.subject, 'coder');
   await f.broker.grantsIdle();
   // Each host as hosts.revoke records it, with fire: true, line first so the close says removed.
@@ -340,7 +342,7 @@ test('row 281 T2: a fire with host grants on two hosts and a Gitea grant answers
   assert.deepEqual(done.body.grants.map((x) => x.grant), ['host:web1', 'host:web2', 'gitea']);
   assert.deepEqual(done.body.grantsLeft, []);
   assert.match(done.body.transaction, /^t-/);
-  assert.equal(done.actor_role, 'chief');
+  assert.equal(done.actor_role, null);
   assert.deepEqual(f.org.log.filter(([op]) => op === 'instance.fire'), [['instance.fire', 'coder']]);
   assert.ok(!f.doc.launch.instances.includes('coder'));
   // No step G message for a job that completed.
@@ -480,7 +482,7 @@ test('row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked
   const f = await setup(t);
   await threeGrants(f);
   f.failing.add('web2');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await f.broker.grantsIdle();
   const [refused, ...more] = f.grantEvents().filter((e) => e.action === 'grant.revoke.refused');
   assert.equal(more.length, 0);
@@ -510,7 +512,7 @@ test('row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked
   assert.equal(f.state('coder', 'gitea'), 'valid');
   // B back: the repeat revokes only B and Gitea.
   f.failing.delete('web2');
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
   assert.deepEqual(repeat.revoking, ['host:web2', 'gitea']);
   await f.broker.grantsIdle();
   const [done] = f.allowed('fire.done');
@@ -529,7 +531,7 @@ test('row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the
   const tag3 = f.tag('coder', 'web3');
   assert.equal(manual.hostLineLeft, tag3);
   f.failing.delete('web3');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['host:web1', 'line:web3']);
   await f.broker.grantsIdle();
   assert.equal(f.lines.web3.has(tag3), false);
@@ -552,7 +554,7 @@ test('row 281 T4b (Q1): with C unreachable, the fire completes and names the lin
   f.failing.add('web3');
   await f.call('human', 'hosts.revoke', { agent: 'coder', host: 'web3', reason: 'web3 is down' });
   const tag3 = f.tag('coder', 'web3');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['host:web1', 'line:web3']);
   await f.broker.grantsIdle();
   assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 0);
@@ -568,7 +570,7 @@ test("row 281 T5: Gitea's admin token can't be checked: the job refuses with the
   const f = await setup(t);
   await f.approveGitea('coder');
   const off = f.gitea.rule((e) => e.method === 'GET' && e.path === '/api/v1/version', { status: 500, json: {} });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['gitea']);
   await f.broker.grantsIdle();
   off();
@@ -597,7 +599,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
   const helperDeletes = () => f.gitea.requests.filter(tokenDelete('demo-helper')).length;
   const before = helperDeletes();
   const offCoder = f.gitea.rule(tokenDelete('demo-coder'), { status: 500, json: {} });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await f.broker.grantsIdle();
   const [refused] = f.grantEvents().filter((e) => e.action === 'grant.revoke.refused');
   assert.equal(refused.grant, 'gitea');
@@ -608,7 +610,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
   assert.equal(f.allowed('fire.done').length, 0);
   // Gitea back for coder only. The helper's DELETE still fails, so a business-wide sweep would show.
   offCoder();
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
   assert.deepEqual(repeat.revoking, ['gitea']);
   await f.broker.grantsIdle();
   const [done] = f.allowed('fire.done');
@@ -627,7 +629,7 @@ test("row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat ret
 test('row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied', async (t) => {
   const f = await setup(t);
   const id = f.fixtureHost('coder', 'web1');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['host:web1']);
   await f.broker.grantsIdle();
   const [r] = f.revoked('coder', (e) => e.host === 'web1');
@@ -644,7 +646,7 @@ test('row 281 T6 (sage-2574): a host decision approved before the fire and run a
 test('row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write', async (t) => {
   const f = await setup(t);
   const id = f.fixtureGitea('coder');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['gitea']);
   await f.broker.grantsIdle();
   const [r] = f.revoked('coder', (e) => e.method === 'gitea');
@@ -689,7 +691,7 @@ test('row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea ex
   const gd = await f.raiseGitea('coder');
   f.call('human', 'decision.resolve', { id: gd.id, choice: 'yes' });
   await until(() => reached);
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['host:web1', 'gitea']);
   await until(() => f.ended(host.id));
   assert.equal(f.ended(host.id).code, 'revoked');
@@ -714,7 +716,7 @@ test('row 281 T6d (B1): undecided host and Gitea decisions are in the set, and a
   const f = await setup(t);
   const host = await f.raiseHost('coder', 'web1');
   const gd = await f.raiseGitea('coder');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.deepEqual(out.revoking, ['host:web1', 'gitea']);
   await f.broker.grantsIdle();
   assert.equal(f.allowed('fire.done').length, 1);
@@ -736,14 +738,14 @@ test('row 281 T6e (B1): a grant raise refuses instance-fired while firing and af
   await f.approveHost('coder', 'web1');
   // Firing with no job: step B refused, so fire.stopped stands with no fire.done.
   f.org.fireError = Object.assign(new Error('refused'), { code: 'credential-revoke-failed' });
-  f.fire('coder');
+  await f.fire('coder');
   await f.broker.grantsIdle();
   assert.equal(f.allowed('fire.failed').length, 1);
   await rejects(() => f.raiseHost('coder', 'web2'), 'instance-fired');
   await rejects(() => f.raiseGitea('coder'), 'instance-fired');
   // After fire.done: delisted.
   f.org.fireError = null;
-  assert.match(f.fire('coder').transaction, /^t-/);
+  assert.match((await f.fire('coder')).transaction, /^t-/);
   await rejects(() => f.raiseHost('coder', 'web2'), 'instance-fired');
   await rejects(() => f.raiseGitea('coder'), 'instance-fired');
   // A rehire lists the name again.
@@ -761,7 +763,7 @@ test('row 281 T6e (B1): a grant raise refuses instance-fired while firing and af
 
 test('row 281 T7: an instance with no grant fires as today, synchronously, with the same events', async (t) => {
   const f = await setup(t);
-  const out = f.fire('helper');
+  const out = await f.fire('helper');
   assert.deepEqual(Object.keys(out).sort(), ['cancelled', 'request', 'revision', 'runs', 'taken', 'transaction']);
   assert.match(out.transaction, /^t-/);
   // Recorded before the verb answered: no job.
@@ -781,9 +783,9 @@ test('row 281 T9 (B3): one step G per agent; the manual verbs refuse while it ru
   await f.approveHost('coder', 'web1');
   await f.approveGitea('coder');
   f.held.add('web1:remove');
-  f.fire('coder');
+  await f.fire('coder');
   await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`));
-  assert.equal(code(() => f.fire('coder')), 'fire-in-progress');
+  await assert.rejects(f.fire('coder'),{code:'fire-in-progress'});
   assert.equal(f.remove('coder').code, 'grants-revoking');
   assert.equal(f.allowed('grants.revoking').length, 0);
   assert.equal(f.allowed('fire.revoking').length, 1);
@@ -820,7 +822,7 @@ test('row 281 T10 (B2): the fire and the delete answer while their jobs are held
   // The verbs answer before the event loop turns, so before any part of a job has run.
   let turned = false;
   setImmediate(() => (turned = true));
-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
   const deleted = f.remove('ops');
   assert.equal(turned, false);
   assert.equal(fired.done, false);
@@ -844,7 +846,7 @@ test("row 281 T11 (C1): a fire's job completes after the chief's run ends and pr
   const f = await setup(t);
   await f.approveHost('coder', 'web1');
   f.held.add('web1:remove');
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`));
   f.broker.endLaunch({ business: 'demo', run: 'chief-run', reason: 'test' });
   f.sw.state = { version: 1, halted: true, generation: GENERATION };
@@ -855,7 +857,7 @@ test("row 281 T11 (C1): a fire's job completes after the chief's run ends and pr
   assert.match(done.body.transaction, /^t-/);
   const [used, ...more] = f.allowed('role.fire');
   assert.equal(more.length, 0);
-  assert.equal(used.actor_role, 'chief');
+  assert.equal(used.actor_role, null);
   assert.equal(used.body.transaction, done.body.transaction);
   assert.ok(!f.doc.launch.instances.includes('coder'));
   assert.equal(f.allowed('fire.failed').length, 0);
@@ -867,12 +869,12 @@ test("row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the
   await f.approveHost('coder', 'web1');
   // N7: the writer's own credential-revoke-failed, which step G's key revokes can't clear.
   f.org.fireError = Object.assign(new Error('refused'), { code: 'credential-revoke-failed' });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await f.broker.grantsIdle();
   const [failed, ...more] = f.allowed('fire.failed');
   assert.equal(more.length, 0);
   assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'credential-revoke-failed']);
-  assert.equal(failed.actor_role, 'chief');
+  assert.equal(failed.actor_role, null);
   const [message] = f.inbox();
   for (const s of [out.job, 'host:web1', 'step B', 'credential-revoke-failed']) assert.ok(message.includes(s), s);
   assert.equal(f.grantEvents().filter((e) => e.action === 'grant.revoke.refused').length, 0);
@@ -882,7 +884,7 @@ test("row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the
   // The grant was revoked before step B.
   assert.equal(f.hostRow('coder', 'web1'), undefined);
   f.org.fireError = null;
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
   assert.equal(repeat.job, undefined);
   assert.match(repeat.transaction, /^t-/);
   assert.equal(f.allowed('fire.done').length, 1);
@@ -900,7 +902,7 @@ test('row 281 T13 (N4): a restart records each held job interrupted once, with o
   assert.equal(f.allowed('grants.revoked.done').length, 1);
   f.held.add('web1:remove');
   f.held.add('web2:remove');
-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
   assert.equal(f.remove('ops').code, 'grants-revoking');
   const deleteJob = f.allowed('grants.revoking').at(-1).body.job;
   await until(() => f.sent.includes(`remove web1 ${f.tag('coder', 'web1')}`) && f.sent.includes(`remove web2 ${f.tag('ops', 'web2')}`));
@@ -930,7 +932,7 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
   const d = await f.raiseHost('coder', 'web1');
   // N1: hosts.remove doesn't check open decisions, so the decision outlives its host.
   assert.deepEqual(await f.call('human', 'hosts.remove', { host: 'web1' }), { host: 'web1', removed: true });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   assert.match(out.job, UUID);
   assert.deepEqual(out.revoking, ['host:web1']);
   await f.broker.grantsIdle();
@@ -946,7 +948,7 @@ test("row 281 T14 (N1, sage-2653): a host removed under an undecided decision st
   f.call('human', 'decision.resolve', { id: d.id, choice: 'no' });
   await f.broker.grantsIdle();
   assert.equal(f.ended(d.id), undefined);
-  const repeat = f.fire('coder');
+  const repeat = await f.fire('coder');
   assert.equal(repeat.job, undefined);
   assert.match(repeat.transaction, /^t-/);
   assert.equal(f.allowed('fire.done').length, 1);
@@ -961,7 +963,7 @@ test("row 239 T4: a refusal after the writer's revoke is named -revoked, in the
   const f = await setup(t);
   await f.approveHost('coder', 'web1');
   f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict', revoked: true });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await f.broker.grantsIdle();
   const [failed] = f.allowed('fire.failed');
   assert.deepEqual([failed.body.job, failed.body.step, failed.body.code], [out.job, 'B', 'revision-conflict-revoked']);
@@ -987,7 +989,7 @@ test("row 239 T4b: an unmarked step B refusal keeps its code, and the notice say
   const f = await setup(t);
   await f.approveHost('coder', 'web1');
   f.org.fireError = Object.assign(new Error('refused'), { code: 'revision-conflict' });
-  const out = f.fire('coder');
+  const out = await f.fire('coder');
   await f.broker.grantsIdle();
   const [failed] = f.allowed('fire.failed');
   assert.deepEqual([failed.body.job, failed.body.code], [out.job, 'revision-conflict']);

packages/bus/tests/hire-decisions.test.mjs

@@ -0,0 +1,207 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Broker } from '../src/broker.mjs';
+import { Store } from '../src/store.mjs';
+
+test('A4 direct instance.hire and instance.fire refuse and cannot write', t => {
+  const root = mkdtempSync(join(tmpdir(), 'a4-'));
+  const store = new Store(root);
+  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
+  let writes = 0;
+  const b = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['role.hire','role.fire'], crossRole: [] } } }, launch: { by: 'chief', instances: [] } } }, organization: () => { writes++; } });
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  for (const verb of ['instance.hire', 'instance.fire']) assert.throws(() => b.request(chief, { verb, args: { name: 'scout', definition: 'coder', reason: 'Need help' } }), { code: 'decision-required' });
+  assert.equal(writes, 0);
+});
+
+import { hireDecisions } from '../../organization/src/hire-decisions.mjs';
+import { organizationWriter } from '../../organization/src/organization.mjs';
+import { loadBusiness } from '../../organization/src/organization-config.mjs';
+import { businessDoc, rolesCopy, writeJson } from '../../organization/tests/helpers.mjs';
+import { readFileSync, mkdirSync } from 'node:fs';
+const INLINE = { tools: ['read'], network: 'none', authority: { withinRole: [], crossRole: [] }, credentials: [], instructions: 'Read and report sk-test-NOT-A-SECRET-1234.' };
+const SUBJECT={provider:'test',iss:'https://issuer.test',sub:'owner'};
+function fixture(t) {
+  const root=mkdtempSync(join(tmpdir(),'a4-bus-')), rolesDir=rolesCopy(root);
+  const file=writeJson(join(root,'businesses/demo.json'),{...businessDoc(root,'demo'),plugins:{harness:['pi']}});
+  const storeRoot=join(root,'data');mkdirSync(storeRoot,{mode:0o700});
+  const writer=organizationWriter({dir:root,rolesDir}),store=new Store(storeRoot);
+  const service=hireDecisions({writer,rolesDir,dataRoot:storeRoot,configDir:root,assertClean:()=>{}});
+  const loaded=()=>{const doc=loadBusiness('demo',{dir:root,rolesDir});return {...doc,roles:Object.fromEntries(Object.entries(doc.roles).map(([n,e])=>[n,{...doc.definitions[e.definition],...e}]))};};
+  let writes=0;
+  const b=new Broker({store,businesses:{demo:loaded()},hires:{...service,apply:async(...args)=>{writes++;const r=await service.apply(...args);b.reloadBusiness('demo',loaded());return r;}}});
+  const owner=b.bindConsole({business:'demo',human:'jason',subject:SUBJECT});
+  const member=rights=>b.bindHireConsole({business:'demo',actor:'member',subject:{...SUBJECT,sub:'member'},rights});
+  const caps={owner,chief:b.bindLaunch({business:'demo',role:'chief',run:'chief-run',harness:'pi'}),coder:b.bindLaunch({business:'demo',role:'coder',run:'coder-run',harness:'pi'})};
+  b.request(caps.chief,{verb:'role.claim'});b.request(caps.coder,{verb:'role.claim'});
+  const call=(cap,verb,args={})=>b.request(cap,{verb,args});
+  const request=extra=>({op:'hire',level:'org',name:'scout',role:{inline:INLINE},route:{harness:'pi',model:'claude-opus-5-5'},reason:'Need help',...extra});
+  const raise=extra=>call(caps.chief,'hire.raise',request(extra));
+  t.after(()=>{store.close();rmSync(root,{recursive:true,force:true});});
+  const reloadChief=authority=>{const doc=loaded();doc.roles.chief.authority=authority;b.reloadBusiness('demo',doc);};
+  return {root,rolesDir,b,store,file,writer,service,owner,member,caps,call,request,raise,reloadChief,writes:()=>writes};
+}
+test('A4 only the chief raises; forged flagged lines refuse without a record',async t=>{
+  const {call,caps,request,store}=fixture(t);
+  await assert.rejects(call(caps.coder,'hire.raise',request()),{code:'role-not-chief'});
+  await assert.rejects(call(caps.chief,'hire.raise',request({flagged:[]})),{code:'invalid-request'});
+  assert.equal(store.get('SELECT count(*) n FROM decisions').n,0);
+});
+test('A4 approve is digest bound and consumed once; generic decide never resolves hire, fire or change',async t=>{
+  const {raise,call,owner,writes,store,file,b,caps}=fixture(t);
+  const d=await raise();const p=await call(owner,'hire.preview.console',{id:d.id});
+  assert.ok(!JSON.stringify(p).includes('sk-test-NOT-A-SECRET-1234'));
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:'0'.repeat(64)}),{code:'decision-stale'});
+  for(const action of ['role.hire','role.fire','role.change']) {
+    if(action!==d.action)store.run('INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',action,'2026-01-01T00:00:00.000Z','demo','chief','chief-run','gated',action,'human','Question?',JSON.stringify([{key:'yes',text:'Yes'},{key:'no',text:'No'}]),'no',0);
+    assert.throws(()=>call(owner,'decision.resolve.console',{id:action===d.action?d.id:action,choice:'yes',digest:p.digest}),{code:'hire-resolution-required'});
+    const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+    assert.throws(()=>call(human,'decision.resolve',{id:action===d.action?d.id:action,choice:'yes'}),{code:'hire-resolution-required'});
+  }
+  const before=readFileSync(file);
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest});
+  assert.equal(writes(),1);assert.notDeepEqual(readFileSync(file),before);
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest}),{code:'decision-closed'});
+  assert.equal(writes(),1);
+  for(const row of [...store.all('SELECT * FROM decisions'),...store.all('SELECT * FROM events')])assert.ok(!JSON.stringify(row).includes('sk-test-NOT-A-SECRET-1234'));
+});
+test('A4 denied and expired decisions leave organization bytes untouched',async t=>{
+  const {raise,call,owner,file,writes}=fixture(t);
+  const before=readFileSync(file),d=await raise();
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'no',digest:d.hire.digest});
+  const e=await raise(); const original=Date.now;
+  try{Date.now=()=>original()+8*86400000;await assert.rejects(call(owner,'hire.resolve.console',{id:e.id,choice:'yes',digest:e.hire.digest}),{code:'decision-expired'});}finally{Date.now=original;}
+  assert.deepEqual(readFileSync(file),before);assert.equal(writes(),0);
+});
+test('A4 members with org.hire refuse flagged or credential grants; decide alone refuses all hires',async t=>{
+  const {raise,call,member}=fixture(t);
+  const plain=await raise();
+  await assert.rejects(call(member(['decide']),'hire.resolve.console',{id:plain.id,choice:'yes',digest:plain.hire.digest}),{code:'right-required'});
+  const flagged=await raise({role:{inline:{...INLINE,tools:['read','bash']}}});
+  const credential=await raise({role:{inline:{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  for(const d of [flagged,credential])await assert.rejects(call(member(['org.hire']),'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest}),{code:'hire-owner-required'});
+  await call(member(['org.hire']),'hire.resolve.console',{id:plain.id,choice:'yes',digest:plain.hire.digest});
+});
+test('A4 human Console start raises and resolves one recorded decision with computed lines',async t=>{
+  const {call,owner,request,store,writes}=fixture(t);
+  const r=await call(owner,'hire.start.console',request({role:{inline:{...INLINE,tools:['read','bash']}}}));
+  assert.equal(r.op,'resolved');assert.equal(writes(),1);
+  const event=store.all("SELECT body FROM events WHERE json_extract(body,'$.operation')='decision.raise'").map(e=>JSON.parse(e.body))[0];
+  assert.deepEqual(event.hire.flagged,[{field:'tools',value:'bash',reasons:['above-chief']}]);
+  assert.equal(store.get('SELECT raised_by_role FROM decisions WHERE id=?',r.id).raised_by_role,'human');
+});
+test('A4 a stale organization digest never reaches the writer',async t=>{
+  const {raise,call,owner,writer,file,writes}=fixture(t);
+  const d=await raise(),old=writer.read('demo');
+  writeJson(file,{...old.document,vars:{...old.document.vars,'tracker.pollSeconds':61}});
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest}),{code:'decision-stale'});
+  assert.equal(writes(),0);
+});
+
+test('A4 approved credential role refuses launch until a binding is present',async t=>{
+  const {raise,call,owner,b,caps,writer,file,root,rolesDir}=fixture(t);
+  const d=await raise({role:{inline:{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:d.hire.digest});
+  assert.throws(()=>b.request(b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true}),{verb:'instance.launch',args:{instance:'scout'}}),{code:'credential-unbound'});
+  // Binding implementation is outside A4. The existing file shape supplies its metadata here.
+  const doc=writer.read('demo').document;
+  doc.roles.scout.credentials={gitea:{store:true,rotateBy:'2099-01-01'}};
+  writeJson(file,doc);
+  const loaded=loadBusiness('demo',{dir:root,rolesDir});
+  b.reloadBusiness('demo',{...loaded,roles:Object.fromEntries(Object.entries(loaded.roles).map(([n,e])=>[n,{...loaded.definitions[e.definition],...e}]))});
+  assert.doesNotThrow(()=>b.request(b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true}),{verb:'instance.launch',args:{instance:'scout'}}));
+});
+test('A4 refusals and records never carry invalid role text',async t=>{
+  const {raise,store}=fixture(t);
+  await assert.rejects(raise({role:{inline:{...INLINE,authority:{withinRole:['sk-test-NOT-A-SECRET-1234'],crossRole:[]}}}}),e=>{
+    assert.ok(!JSON.stringify(e).includes('sk-test-NOT-A-SECRET-1234'));return true;
+  });
+  assert.ok(!JSON.stringify(store.all('SELECT * FROM events')).includes('sk-test-NOT-A-SECRET-1234'));
+});
+
+test('A4 a human may mark a hire seen, and the chief may withdraw its own proposal',async t=>{
+  const {raise,call,b,caps,writes}=fixture(t),d=await raise();
+  const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+  assert.equal(call(human,'decision.seen',{id:d.id}).op,'seen');
+  assert.equal(call(caps.chief,'decision.withdraw',{id:d.id}).op,'withdrawn');
+  assert.equal(writes(),0);
+});
+
+test('A4 Console previews and consumes only the exact narrowed grants and route',async t=>{
+  const {raise,call,owner,writer,store}=fixture(t);
+  const d=await raise({role:{inline:{...INLINE,tools:['read','bash'],credentials:[{service:'gitea',scopes:['read:repository']}]}}});
+  const adjust={role:{tools:['read']},credentials:[],route:{harness:'pi',model:'claude-sonnet-5-5'}};
+  const p=await call(owner,'hire.preview.console',{id:d.id,adjust});
+  assert.notEqual(p.digest,d.hire.digest);assert.deepEqual(p.flagged,[]);assert.deepEqual(p.credentialLines,[]);
+  await assert.rejects(call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest}),{code:'decision-stale'});
+  await call(owner,'hire.resolve.console',{id:d.id,choice:'yes',digest:p.digest,adjust});
+  const doc=writer.read('demo').document,entry=doc.definitions[doc.roles.scout.definition.slice(4)];
+  assert.deepEqual(entry.role.tools,['read']);assert.deepEqual(entry.role.credentials,[]);
+  const consume=JSON.parse(store.get("SELECT body FROM events WHERE json_extract(body,'$.operation')='hire.consume'").body);
+  assert.equal(consume.hire.digest,p.digest);assert.deepEqual(consume.hire.credentialLines,[]);
+});
+
+test('A4 Console lists template hashes without role text, under org.hire',async t=>{
+ const {call,owner,member}=fixture(t);
+ const list=await call(owner,'hire.templates.console');
+ assert.ok(list.templates.some(x=>x.name==='coder'&&/^[a-f0-9]{64}$/.test(x.sha256)));
+ assert.ok(list.templates.every(x=>Object.keys(x).sort().join(',')==='name,sha256'));
+ assert.throws(()=>call(member(['decide']),'hire.templates.console'),{code:'right-required'});
+});
+
+test('A4 chief proposals require current role.hire for hire/change and role.fire for fire',async t=>{
+ const f=fixture(t);
+ f.reloadChief({withinRole:['message.send'],crossRole:[]});
+ for(const op of ['hire','change','fire'])for(const verb of ['hire.raise','decision.raise']) {
+  const hire=f.request({op});
+  await assert.rejects(f.call(f.caps.chief,verb,verb==='decision.raise'?{action:`role.${op}`,hire}:hire),{code:'not-authorized'});
+ }
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+ f.reloadChief({withinRole:['role.hire'],crossRole:[]});
+ assert.ok((await f.raise()).id);
+ assert.ok((await f.raise({op:'change',name:'coder'})).id);
+ const fire={op:'fire',level:'org',name:'coder',reason:'Finished'};
+ await assert.rejects(f.call(f.caps.chief,'hire.raise',fire),{code:'not-authorized'});
+ f.reloadChief({withinRole:['role.fire'],crossRole:[]});
+ assert.ok((await f.call(f.caps.chief,'hire.raise',fire)).id);
+ await assert.rejects(f.raise(),{code:'not-authorized'});
+});
+
+test('A4 chief authority is checked again after asynchronous proposal preparation',async t=>{
+ const f=fixture(t),pending=f.raise();
+ f.reloadChief({withinRole:['message.send'],crossRole:[]});
+ await assert.rejects(pending,{code:'not-authorized'});
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+});
+
+test('A4 a member start needing owner approval refuses before saving a decision',async t=>{
+ const f=fixture(t),cap=f.member(['org.hire']),before=readFileSync(f.file);
+ for(const inline of [{...INLINE,tools:['read','bash']},{...INLINE,credentials:[{service:'gitea',scopes:['read:repository']}]}])
+  await assert.rejects(f.call(cap,'hire.start.console',f.request({role:{inline}})),{code:'hire-owner-required'});
+ assert.equal(f.store.get('SELECT count(*) n FROM decisions').n,0);
+ assert.deepEqual(readFileSync(f.file),before);
+ assert.equal((await f.call(cap,'hire.start.console',f.request())).op,'resolved');
+});
+
+test('A4 inbox and decision reads expire unopened hires once without changing configuration',async t=>{
+ const f=fixture(t),d=await f.raise({role:{inline:{...INLINE,tools:['read','bash']}}}),before=readFileSync(f.file);
+ const human=f.b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+ const original=Date.now;
+ try {
+  Date.now=()=>original()+8*86400000;
+  await assert.rejects(f.call(f.member(['org.hire']),'hire.preview.console',{id:d.id}),{code:'decision-expired'});
+  assert.deepEqual(f.call(human,'inbox'),[]);
+  const recent=f.call(human,'decisions',{list:'recent'});
+  assert.equal(recent[0].closed.by,'expiry');
+  const another=await f.raise();
+  Date.now=()=>original()+16*86400000;
+  assert.deepEqual(f.call(human,'inbox'),[]);
+  f.call(human,'decisions',{list:'recent'});
+  assert.equal(f.store.get("SELECT count(*) n FROM decision_events WHERE decision=? AND by='expiry'",another.id).n,1);
+ } finally {Date.now=original;}
+ assert.deepEqual(readFileSync(f.file),before);assert.equal(f.writes(),0);
+});

packages/bus/tests/hire-fixtures.mjs

@@ -0,0 +1,14 @@
+// Trusted proposal service stand-in for executor-only tests. Authorization and real writers are
+// covered by hire-decisions.test.mjs; these tests isolate the existing grant/fire executors.
+export const hireServiceFixture = {
+  prepare: (_business,args,{id,expiresAt}) => ({id,op:args.op,level:args.level,name:args.name,revision:'b'.repeat(64),flagged:[],credentialLines:[],digest:'a'.repeat(64),expiresAt}),
+  check: () => {},
+};
+export const fixtureConsole = (broker,business='demo') => broker.bindConsole({business,human:'jason',subject:{provider:'test',iss:'https://issuer.test',sub:'owner'}});
+export const approveFixtureFire = async (broker,cap,name) => {const {id,op,choice,...result}=await broker.request(cap,{verb:'hire.start.console',args:{op:'fire',level:'org',name,reason:'The work is done'}});if(result.done===false)delete result.transaction;return result;};
+export const ownerConsole = (broker,business='demo') => broker.bindConsole({business,human:'jason',subject:{provider:'test',iss:'https://issuer.test',sub:'owner'}});
+export async function approveTemplateHire(broker,rolesDir,{business='demo',name,definition,reason='Fixture hire',model='claude-opus-5-5',...extra}) {
+  const {readTemplate}=await import('../../organization/src/definitions.mjs');
+  const source=readTemplate(rolesDir,definition);
+  return broker.request(ownerConsole(broker,business),{verb:'hire.start.console',args:{op:'hire',level:'org',name,role:{template:definition,sha256:source.sha256},route:{harness:'pi',model},reason,...extra}});
+}

packages/bus/tests/library-credential.test.mjs

@@ -6,6 +6,7 @@
 // use fixtures: the evidence and the gitea_grants row go in by SQL, as gitea-grant.test.mjs does for
 // decisions. Tokens are made up or the fake's, and only ever compared.
 import test from 'node:test';
+import { hireServiceFixture, fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 import assert from 'node:assert/strict';
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -68,7 +69,7 @@ function world(t, options) {
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const business = makeBusiness({ ...options, root });
   const held = new Set();
-  const broker = new Broker({ store, businesses: { acme: business }, giteaKeys: { held: (b, a) => held.has(b + '/' + a) } });
+  const broker = new Broker({hires:hireServiceFixture, store, businesses: { acme: business }, giteaKeys: { held: (b, a) => held.has(b + '/' + a) } });
   return { store, business, broker, held, choose: () => broker.libraryFetchCredential('acme') };
 }
 
@@ -138,7 +139,7 @@ async function verbWorld(t, opts = {}) {
     }
     return { revision: REV };
   };
-  broker = new Broker({
+  broker = new Broker({hires:hireServiceFixture,
     store, businesses: { acme: structuredClone(doc) }, secretCheck: (value) => credentials.assertClean(value), organization,
     processing: { read: () => SWITCH }, giteaGrant: grantApi, giteaKeys: giteaKeys({ credentials, storeRoot }),
   });
@@ -174,7 +175,7 @@ async function verbWorld(t, opts = {}) {
     assert.ok(events().some((e) => e.action === 'grant.revoked' && e.agent === 'chief'));
   };
   const fire = async () => {
-    await broker.request(boss, { verb: 'instance.fire', args: { name: 'chief', reason: 'the work is done' } });
+    await approveFixtureFire(broker,fixtureConsole(broker,'acme'),'chief');
     await until(() => !doc.launch.instances.includes('chief'));
     await broker.grantsIdle();
     assert.equal(row(), undefined, 'the fire\'s step G deleted the row (row 281)');
@@ -196,7 +197,7 @@ test('C2-03b T6: the slot before any chief evidence, then the listed chief\'s li
   assert.deepEqual(w.choose(), { kind: 'slot' }, 'a seat grant is not the chief\'s: the chief entry keeps the fallback');
   grant(w.store, 'chief', { user: 'chief-bot' });
   assert.deepEqual(w.choose(), { kind: 'chief', agent: 'chief', user: 'chief-bot' });
-  assert.deepEqual(new Broker({ store: w.store, businesses: { acme: w.business } }).libraryFetchCredential('acme'), REFUSED,
+  assert.deepEqual(new Broker({hires:hireServiceFixture, store: w.store, businesses: { acme: w.business } }).libraryFetchCredential('acme'), REFUSED,
     'a bus with no grant store refuses rather than guess');
   assert.throws(() => w.broker.libraryFetchCredential('other'), { code: 'unknown-business' });
   assert.equal(LIBRARY_FETCH_FIX, 'add the chief of staff, or grant the library through C2-21');

packages/bus/tests/lifecycle-revoke.test.mjs

@@ -1,3 +1,4 @@
+import { fixtureConsole, approveFixtureFire } from './hire-fixtures.mjs';
 // Row 194 (#1692, brief item 8, row 199 D13, T20): fire and delete revoke the agent's credentials
 // after the writer's checks and before the write. Fire revokes each service and keeps the store
 // directory. Delete calls remove (sage-1593). A failed revoke stops the verb with
@@ -54,7 +55,8 @@ async function setup(t, { drop = [], seed = null } = {}) {
   const chief = bus.broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
   bus.broker.request(chief, { verb: 'role.claim' });
   const ask = (verb, args) => bus.broker.request(human, { verb, args });
-  const fire = (name) => bus.broker.request(chief, { verb: 'instance.fire', args: { name, reason: 'the work is done' } });
+  const hireConsole=fixtureConsole(bus.broker);
+  const fire = name => approveFixtureFire(bus.broker,hireConsole,name);
   const agentDir = (agent) => join(root, 'secrets', 'agents', 'demo', agent);
   const plant = (agent, service) => {
     mkdirSync(agentDir(agent), { recursive: true, mode: 0o700 });
@@ -85,12 +87,12 @@ test('T20 fire: a revoke that fails stops the fire with the file unchanged; one
   // The revoke can't unlink the token, so it fails before the write: the file still lists coder.
   const before = f.bytes();
   chmodSync(f.agentDir('coder'), 0o500);
-  assert.equal(f.code(() => f.fire('coder')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('coder'),{code:'credential-revoke-failed'});
   chmodSync(f.agentDir('coder'), 0o700);
   assert.equal(f.bytes(), before);
   assert.ok(JSON.parse(before).launch.instances.includes('coder'));
 
-  const fired = f.fire('coder');
+  const fired = await f.fire('coder');
   assert.equal(fired.delisted, true);
   assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: ['vikunja'] });
   assert.ok(!JSON.parse(f.bytes()).launch.instances.includes('coder'));
@@ -109,7 +111,7 @@ test('T20 fire: an instance already delisted still has its tokens revoked and th
   doc.launch.instances = doc.launch.instances.filter((name) => name !== 'rev-2');
   writeFileSync(f.file, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
   const before = f.bytes();
-  const fired = f.fire('rev-2');
+  const fired = await f.fire('rev-2');
   assert.equal(fired.delisted, false);
   assert.equal(fired.transaction, null);
   assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: [] });
@@ -122,10 +124,10 @@ test('T20 fire: with no entry in the running bus, a token on disk refuses and an
   const f = await setup(t, { drop: ['rev-2'] });
   f.plant('rev-2', 'gitea');
   const before = f.bytes();
-  assert.equal(f.code(() => f.fire('rev-2')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('rev-2'),{code:'credential-revoke-failed'});
   assert.equal(f.bytes(), before);
   rmSync(join(f.agentDir('rev-2'), 'gitea'));
-  const fired = f.fire('rev-2');
+  const fired = await f.fire('rev-2');
   assert.equal(fired.delisted, true);
   assert.deepEqual(fired.credentials, { revoked: ['gitea', 'vikunja'], outsideStore: [] });
 });
@@ -198,11 +200,11 @@ test('row 281 T1 fire: a host.<id> or granted gitea file in the store refuses st
   const f = await setup(t);
   f.plant('coder', 'host.web1');
   const before = f.bytes();
-  assert.equal(f.code(() => f.fire('coder')), 'credential-revoke-failed');
+  await assert.rejects(f.fire('coder'),{code:'credential-revoke-failed'});
   assert.equal(f.bytes(), before);
   assert.deepEqual(readdirSync(f.agentDir('coder')), ['host.web1']);
   rmSync(join(f.agentDir('coder'), 'host.web1'));
-  assert.equal(f.fire('coder').delisted, true);
+  assert.equal((await f.fire('coder')).delisted, true);
 });
 
 // T1, the start: a host_grants record whose key file is gone (what a delete left before this row). The

packages/bus/tests/model-hire-ownership-fixture.mjs

@@ -1,3 +1,5 @@
+import {readTemplate} from '../../organization/src/definitions.mjs';
+import { approveTemplateHire, ownerConsole } from './hire-fixtures.mjs';
 // #655 isolated STATIC fixture: actual managed fromSession caller + runtime/writer/controller.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -25,10 +27,10 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
  // Available before any acquired resource/setup can fail; no later f/launcher TDZ.
  const launchLog=()=>{const file=launchLogFile(join(root,'data'),'acme');return fs.existsSync(file)?fs.readFileSync(file,'utf8').trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)):[];};
  t.after(async()=>{const failures=[];for(const g of gates)g.release();try{await waitFor(()=>active.size===0,'owned operations did not settle',5000);}catch{failures.push('owned-operation-close');}for(const close of [...closers].reverse()){try{await close();}catch{failures.push('owned-close');}}try{server?.closeAllConnections();if(server?.listening)await new Promise((resolve,reject)=>server.close(e=>e?reject(e):resolve()));}catch{failures.push('owned-server-close');}try{checkHistory({logs,proxyReceipts,trace});}catch{failures.push('value-free-receipts');}try{checkHistory({launch:launchLog()});}catch{failures.push('owned-launch-log-guard');}if(stderr)process.stderr.write=stderr;try{fs.rmSync(root,{recursive:true,force:true});}catch{failures.push('owned-root-close');}if(failures.length)throw new AggregateError(failures.map(code=>Error(code)),'owned managed fixture cleanup failed');});
- const f=fixture(root,'acme',doc=>{doc.plugins={...doc.plugins,harness:['pi']};for(const role of Object.values(doc.roles))role.vars={...role.vars,harness:'pi'};doc.roles.chief.vars.model='claude-opus-5-5';doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};if(listed)doc.launch.instances.push('aide');if(keep)doc.launch.keep=['aide'];if(retired)doc.retired=['alpha'];if(noHire)doc.launch.noHire=['aide'];return doc;});
+ const f=fixture(root,'acme',doc=>{doc.plugins={...doc.plugins,harness:['pi']};for(const role of Object.values(doc.roles))role.vars={...role.vars,harness:'pi'};doc.roles.chief.vars.model='claude-opus-5-5';doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};if(listed)doc.launch.instances.push('aide');if(keep)doc.launch.keep=['aide'];if(retired)doc.retired=['alpha'];if(noHire)doc.launch.noHire=['aide'];if(!listed)delete doc.roles.aide;return doc;});
  // The established scratch aide pattern only; repository roles/policy stay untouched.
  for(const name of ['aide','helper']){fs.writeFileSync(join(f.roles,name+'.md'),'# Scratch aide\n\n## Authority\n');writeJson(join(f.roles,name+'.json'),{roleVersion:2,name,title:'Aide',contract:name+'.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});}
- const chiefFile=join(f.roles,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide','helper']});
+ const chiefFile=join(f.roles,'chief-of-staff.json');
  const env={PATH:process.env.PATH,HOME:process.env.HOME,TMPDIR:process.env.TMPDIR,MOSAIC_CONFIG:f.config,MOSAIC_ROLES_DIR:f.roles};
  const configDir=join(root,'config'),prefix=`msk-${id(configDir)}-`,sentinel=prefix+'sentinel-'+randomBytes(32).toString('base64url');history.add(sentinel);
  const state={keys:[sentinel],calls:[],refuseProbe,counts:{GET:0,PUT:0,PROBE:0},puts:[],failRemoval:false};
@@ -110,7 +112,7 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
  const file=join(configDir,'businesses','acme.json');
  const hold=(method='GET',ordinal=state.counts[method]+1)=>{let release;const promise=new Promise(r=>{release=r;});const gate={method,ordinal,seen:false,used:false,cancelled:false,promise,release};gates.push(gate);return {ordinal,seen:()=>gate.seen,entered:()=>waitFor(()=>gate.seen,'owned HTTP gate not reached',5000),release,cancel:()=>{gate.cancelled=true;release();}};};
  const outcome=promise=>{const box={settled:false};box.promise=track(Promise.resolve(promise).then(value=>{box.settled=true;box.ok=true;box.value=value;return box;},error=>{box.settled=true;box.ok=false;box.code=error.code??'unexpected-error';return box;}));return box;};
- const hire=(name='aide',extra={},cap=chief)=>{const called={value:false};const box=outcome(Promise.resolve().then(()=>{const operation=bus.broker.request(cap,{verb:'instance.hire',args:{name,definition:'aide',reason:'fixture ownership',...extra}});called.value=true;return operation;}));Object.defineProperty(box,'invoked',{get:()=>called.value});return box;};
+ const hire=(name='aide',extra={},cap=chief)=>{const called={value:false};const box=outcome(Promise.resolve().then(()=>{const operation=(async()=>{const definition=extra.definition??'aide';const d=await bus.broker.request(cap,{verb:'hire.raise',args:{op:'hire',level:'org',name,role:{template:definition,sha256:readTemplate(f.roles,definition).sha256},route:{harness:'pi',model:'claude-opus-5-5'},reason:'fixture ownership',...(extra.vars?{vars:extra.vars}:{})}});return bus.broker.request(ownerConsole(bus.broker,'acme'),{verb:'hire.resolve.console',args:{id:d.id,choice:'yes',digest:d.hire.digest}});})();called.value=true;return operation;}));Object.defineProperty(box,'invoked',{get:()=>called.value});return box;};
  const record=(name='aide')=>bus.credentials.modelRecord('acme/'+name);
  const snapshot=()=>{const journal=join(configDir,'businesses','.history','acme','changes.jsonl');return {membership:id(fs.readFileSync(file)),journal:fs.existsSync(journal)?id(fs.readFileSync(journal)):null,credentials:id(JSON.stringify(bus.credentials.status())),model:record()?id(JSON.stringify(record())):null,remote:id(JSON.stringify(state.keys)),calls:state.calls.length};};
  return {root,f,state,trace,proxyReceipts,logs,launcher,bus,chief,record,hold,outcome,hire,snapshot,file,launchLog,expectedKeyId:()=>expectedKeyId,valueFree,
@@ -123,7 +125,7 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
   assertModelAbsent:name=>{assert.equal(bus.credentials.modelRecord('acme/'+name)===null,true);assert.equal(fs.existsSync(join(configDir,'secrets','agents','acme',name,'model')),false);},
   rotateBound:async()=>{const before=record();bus.credentials.writeModel('acme/aide',{...before,rotateBy:new Date(Date.now()-86400_000).toISOString().slice(0,10)});await waitFor(()=>record()?.retiring.some(r=>r.keyId===before.keyId),'original runtime sweep rotates bound generation');return before.keyId;},
   explicitEnd:()=>bus.broker.request(chief,{verb:'role.revoke',args:{role:'aide',reason:'fixture explicit end'}}),
-  fire:()=>outcome(Promise.resolve().then(()=>bus.broker.request(chief,{verb:'instance.fire',args:{name:'aide',reason:'fixture explicit fire'}}))),
+  fire:()=>outcome(Promise.resolve().then(()=>bus.broker.request(ownerConsole(bus.broker,'acme'),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'aide',reason:'fixture explicit fire'}}))),
   runDirectories:()=>fs.existsSync(runsDir(f.dataRoot,'acme'))?fs.readdirSync(runsDir(f.dataRoot,'acme')).map(name=>join(runsDir(f.dataRoot,'acme'),name)):[],
   sessions:()=>readSessions(f.dataRoot),send:body=>bus.broker.request(human,{verb:'message.send',args:{to:'aide',body,class:'REQUEST'}}),
   reply:sent=>waitFor(()=>bus.broker.request(human,{verb:'message.receive'}).find(m=>m.in_reply_to===sent.id),'real managed reply observed'),

packages/bus/tests/model-hire-ownership.test.mjs

@@ -38,9 +38,8 @@ test('655 actual launch own preflight generation and bound consumer survive conc
 
 for(const [label,options,args,code] of [
  ['retired name',{retired:true},{name:'alpha'},'organization-instance-retired'],
- ['listed duplicate vars',{}, {vars:{model:'claude-opus-5-5'}},'organization-instance-exists'],
- ['fired mismatched legal definition',{listed:false},{definition:'helper'},'organization-instance-exists'],
- ['fired matching definition with vars',{listed:false},{vars:{model:'claude-opus-5-5'}},'organization-instance-exists'],
+ ['listed duplicate vars',{}, {vars:{model:'claude-opus-5-5'}},'invalid-request'],
+ ['fired matching definition with vars',{listed:false},{vars:{model:'claude-opus-5-5'}},'invalid-request'],
 ])test('655 shared validation '+label+' has no credential effects',{timeout:30000},async t=>{
  const f=await ownershipFixture(t,options),before=f.snapshot(),{name='aide',...extra}=args;await refused(f.hire(name,extra),code);
  assert.deepEqual(f.snapshot(),before,'shared hire refusal precedes credential registration or proxy I/O');f.valueFree();
@@ -49,7 +48,7 @@ for(const [label,options,args,code] of [
 for(const [label,options,extra,code] of [
  ['kept target',{keep:true},{},'instance-kept'],
  ['noHire definition',{noHire:true},{},'definition-not-hireable'],
- ['ineligible definition',{}, {definition:'security-reviewer'},'definition-not-hireable'],
+ ['duplicate with another definition',{}, {definition:'security-reviewer'},'organization-instance-exists'],
  ['invalid vars',{}, {vars:{harness:'pi'}},'invalid-request'],
 ])test('655 existing Broker '+label+' refusal remains before model effects',{timeout:30000},async t=>{
  const f=await ownershipFixture(t,options),before=f.snapshot();await refused(f.hire('aide',extra),code);assert.deepEqual(f.snapshot(),before);f.valueFree();
@@ -59,9 +58,9 @@ test('655 existing nonchief actor refusal remains before shared checks and model
  const f=await ownershipFixture(t),cap=f.wrongActor(),before=f.snapshot();await refused(f.hire('aide',{},cap),'role-not-chief');assert.deepEqual(f.snapshot(),before);f.valueFree();
 });
 
-test('655 valid fired matching definition rehire publishes before queued acquisition',{timeout:30000},async t=>{
+test('655 valid new hire publishes before queued acquisition',{timeout:30000},async t=>{
  const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();const p=f.preflight();assert.equal(f.listed('aide'),false);
- put.release();await done(h);assert.equal(h.ok,true);assert.equal(typeof h.value.transaction,'string');await done(p);assert.equal(p.ok,true);assert.equal(f.listed('aide'),true);assert.equal(p.value.key===f.record().key,true);assert.equal(await f.healthy(p.value.key),200);f.valueFree();
+ put.release();await done(h);assert.equal(h.ok,true);assert.equal(typeof h.value.transaction,'string');await done(p);assert.equal(p.code,'unknown-role','no admission before membership publication');assert.equal(f.listed('aide'),true);const admitted=await done(f.preflight());assert.equal(admitted.ok,true);assert.equal(admitted.value.key===f.record().key,true);assert.equal(await f.healthy(admitted.value.key),200);f.valueFree();
 });
 
 test('655 preexisting admitted generation and retiring metadata survive duplicate failure',{skip:unavailable,timeout:30000},async t=>{
@@ -74,22 +73,22 @@ test('655 captured revision is checked after controller queue before generation
  const f=await ownershipFixture(t),gate=f.hold('GET'),p=f.preflight('chief');await gate.entered();const h=f.hire('alpha');
  // A following same-business operation proves H established its pending slot,
  // rather than an arbitrary sleep before the external owner revision change.
- await refused(f.hire('beta'),'organization-busy');f.bumpRevision();gate.release();await done(p);assert.equal(p.ok,true);await refused(h,'revision-conflict');
+ await refused(f.hire('beta'),'organization-busy');f.bumpRevision();gate.release();await done(p);assert.equal(p.ok,true);await refused(h,'decision-stale');
  assert.equal(f.state.counts.PUT,1,'queued stale hire does not issue a generation');f.assertModelAbsent('alpha');assert.equal(f.listed('alpha'),false);f.valueFree();
 });
 
 test('655 genuine new generation revision failure cleans before queued acquisition receives a key',{timeout:30000},async t=>{
  const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();
  const failedGeneration=f.state.puts[0].find(k=>!k.includes('-sentinel-'));assert.ok(failedGeneration,'real first issuance payload observed');
- const p=f.preflight();f.bumpRevision();put.release();await refused(h,'revision-conflict');await done(p);
- const valid=p.ok&&p.value.key!==failedGeneration&&f.record()?.key===p.value.key&&f.state.keys.includes(p.value.key)&&!f.state.keys.includes(failedGeneration);
- assert.equal(valid,true,'queued acquisition receives a valid post-cleanup generation');assert.equal(f.listed('aide'),false);assert.equal(await f.healthy(p.value.key),200);f.valueFree();
+ const p=f.preflight();f.bumpRevision();put.release();await refused(h,'decision-stale');await done(p);
+ assert.equal(p.code,'unknown-role','an unpublished agent cannot acquire a model key');
+ assert.equal(f.state.keys.includes(failedGeneration),false,'failed generation was removed');f.assertModelAbsent('aide');assert.equal(f.listed('aide'),false);f.valueFree();
 });
 
 test('655 failed cleanup retains revoking intent and refuses queued admission',{timeout:30000},async t=>{
  const f=await ownershipFixture(t,{listed:false}),put=f.hold('PUT'),h=f.hire();await put.entered();const p=f.preflight();f.bumpRevision();f.state.failRemoval=true;put.release();
- await refused(h,'revision-conflict');await done(p);assert.equal(f.record()?.state,'revoking','failed removal keeps durable nonlaunchable intent');
- assert.equal(!p.ok&&p.code==='proxy-key-revoking',true,'queued admission refuses retained revoking intent');assert.equal(f.listed('aide'),false);assert.equal(fs.existsSync(join(f.root,'config','secrets','agents','acme','aide','model')),true);f.valueFree();
+ await refused(h,'decision-stale');await done(p);assert.equal(f.record()?.state,'revoking','failed removal keeps durable nonlaunchable intent');
+ assert.equal(!p.ok&&p.code==='unknown-role',true,'unpublished membership refuses admission while model record retains revoking intent');assert.equal(f.listed('aide'),false);assert.equal(fs.existsSync(join(f.root,'config','secrets','agents','acme','aide','model')),true);f.valueFree();
 });
 
 test('655 no-launch remains before own preflight and grants no consumer or stop authority',{timeout:30000},async t=>{

packages/bus/tests/model-keys.test.mjs

@@ -1,3 +1,6 @@
+import {materializeCopies,withCopies} from '../../organization/src/agent-copies.mjs';
+import {loadRootAgents} from '../../organization/src/agent-levels.mjs';
+import { approveTemplateHire, ownerConsole } from './hire-fixtures.mjs';
 // P2: real private Credentials, fake loopback management/model server. No live config.
 import test from 'node:test';
 import assert from 'node:assert/strict';
@@ -173,7 +176,7 @@ test('proxy-stop-failed: old proxy key and retiring record survive a failed grac
   stopped = true; await overdue.sweep(); assert.equal(f.state.keys.includes(first.key), false);
 });
 
-async function bootBusiness(f, binding = {}) {
+async function bootBusiness(f, {copyLevel = null,...binding} = {}) {
   const rolesDir = rolesCopy(f.root), system = systemFor(f.root), doc = businessDoc(f.root, 'demo');
   // Aide is needed because shipped chief hireable:[] and security-reviewer has review.verdict outside HIRE_ALLOWED.
   fs.writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
@@ -181,23 +184,26 @@ async function bootBusiness(f, binding = {}) {
     roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
     authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],
   });
-  const chiefFile = join(rolesDir, 'chief-of-staff.json');
-  writeJson(chiefFile, { ...JSON.parse(fs.readFileSync(chiefFile, 'utf8')), hireable: ['aide'] });
+
   doc.plugins = { ...doc.plugins, harness: ['pi'] };
   doc.roles['sec-1'] = { definition: 'security-reviewer' }; doc.launch.instances.push('sec-1');
+  const copyEntry={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5'}};
+  if(copyLevel==='project')doc.projects.stack.agents={aide:copyEntry};
+  if(copyLevel==='root')writeJson(join(f.configDir,'agents.json'),{agentsVersion:1,agents:{aide:copyEntry}});
+  const copies=copyLevel?materializeCopies({orgId:'demo',doc,rolesDir,root:loadRootAgents(f.configDir,{rolesDir})}):null;
   const file = writeJson(join(f.configDir, 'businesses', 'demo.json'), doc);
   fs.writeFileSync(join(f.configDir, 'secrets', 'proxy-management.key'), 'fx331-manage', { mode: 0o600 });
-  const business = loadBusiness('demo', { dir: f.configDir, rolesDir }), resolved = {};
+  const business = copies?withCopies(doc,file,{rolesDir,snapshot:copies}):loadBusiness('demo', { dir: f.configDir, rolesDir }), resolved = {};
   for (const instance of Object.keys(business.roles)) resolved[instance] = resolveInstance({ system, business, instance });
   fs.mkdirSync(join(f.root, 'data'), { mode: 0o700 });
   // Fresh mkdtemp fixture + exclusive mkdir above: no prior session registry can exist.
   new Registry(join(f.root, 'data'));
   const bus = await startBroker({ dataRoot: join(f.root, 'data'), businesses: { demo: busOrganization(business, resolved) },
-    organization: { dir: f.configDir, rolesDir, system }, proxy: { port: Number(new URL(f.baseUrl).port), binary: '/fixture-unused' }, ...binding });
+    copies, organization: { dir: f.configDir, rolesDir, system }, proxy: { port: Number(new URL(f.baseUrl).port), binary: '/fixture-unused' }, ...binding });
   f.closers.push(() => bus.close());
   const chief = bus.broker.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
   bus.broker.request(chief, { verb: 'role.claim' });
-  const fire = () => bus.broker.request(chief, { verb: 'instance.fire', args: { name: 'sec-1', reason: 'fixture fire' } });
+  const fire = () => bus.broker.request(ownerConsole(bus.broker), { verb: 'hire.start.console', args: { op:'fire',level:'org',name: 'sec-1', reason: 'fixture fire' } });
   const listed = () => JSON.parse(fs.readFileSync(file, 'utf8')).launch.instances.includes('sec-1');
   return { bus, chief, fire, listed, file, rolesDir, system };
 }
@@ -233,7 +239,7 @@ test('proxy-revoke-revision-conflict: racing organization write keeps record, ne
 });
 test('bus hire issues and confirms implicit model key before publishing new membership', async t => {
   const f = await fixture(t); const b = await bootBusiness(f); const calls = f.state.calls.length;
-  const result = await b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } });
+  const result = await approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'});
   assert.equal(typeof result.transaction, 'string');
   assert.equal(JSON.parse(fs.readFileSync(b.file, 'utf8')).launch.instances.includes('sec-new'), true);
   assert.equal(b.bus.credentials.modelRecord('demo/sec-new')?.state, 'valid');
@@ -242,7 +248,7 @@ test('bus hire issues and confirms implicit model key before publishing new memb
 test('proxy-key-issue-failed: bus hire failure publishes neither membership nor model file', async t => {
   const f = await fixture(t); const b = await bootBusiness(f); f.state.failPut = true;
   const before = fs.readFileSync(b.file, 'utf8');
-  await assert.rejects(b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } }), failCode('proxy-key-issue-failed'));
+  await assert.rejects(approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'}), failCode('proxy-key-issue-failed'));
   assert.equal(fs.readFileSync(b.file, 'utf8'), before); assert.equal(b.bus.credentials.modelRecord('demo/sec-new') === null, true);
 });
 test('proxy-open: removing sentinel after boot refuses the next launch before models probe', async t => {
@@ -252,7 +258,7 @@ test('proxy-open: removing sentinel after boot refuses the next launch before mo
 });
 test('newly hired role can use runtime preflight without a broker restart', async t => {
   const f = await fixture(t); const b = await bootBusiness(f);
-  await b.bus.broker.request(b.chief, { verb: 'instance.hire', args: { name: 'sec-new', definition: 'aide', reason: 'fixture hire' } });
+  await approveTemplateHire(b.bus.broker,b.rolesDir,{name:'sec-new',definition:'aide'});
   const proxy = await b.bus.modelPreflight({ business: 'demo', role: 'sec-new' });
   assert.equal(proxy.baseUrl, f.baseUrl); assert.equal(f.state.keys.includes(proxy.key), true);
 });
@@ -328,3 +334,15 @@ test('beta bus registers while alpha bus runs and alpha key stays accepted', asy
   assert.ok(f.state.keys.some(value => value.startsWith(`mso-${hash(f.configDir)}-beta-sentinel-`)));
   assert.equal((await alpha.bus.modelPreflight({ business: 'demo', role: 'sec-1' })).key, key);
 });
+
+for(const level of ['root','project'])test(`A4 ${level} fire removes its implicit model key before publication`,async t=>{
+  const f=await fixture(t),b=await bootBusiness(f,{copyLevel:level});
+  const instance=level==='root'?'aide':'aide.stack';
+  const issued=await b.bus.modelPreflight({business:'demo',role:instance});
+  assert.ok(issued.key);
+  await b.bus.broker.request(ownerConsole(b.bus.broker),{verb:'hire.start.console',args:{op:'fire',level,...(level==='project'?{project:'stack'}:{}),name:'aide',reason:'Copy work finished'}});
+  assert.equal(f.state.keys.includes(issued.key),false,'remote generation is revoked');
+  assert.equal(b.bus.credentials.modelRecord('demo/'+instance),null,'private generation is removed');
+  const human=b.bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
+  assert.throws(()=>b.bus.broker.request(human,{verb:'instance.launch',args:{instance}}));
+});

packages/bus/tests/model-orphan-hire.test.mjs

@@ -1,3 +1,4 @@
+import { approveTemplateHire } from './hire-fixtures.mjs';
 // #651 actual runtime + organization.hire publication with orphan private records.
 // In-process trusted Broker, real SQLite/organization writer/HTTP; not process IPC.
 import test from 'node:test';
@@ -16,7 +17,7 @@ async function hireFixture(t,{revoking=false}={}){
  const rolesDir=rolesCopy(f.root),system=systemFor(f.root),doc=businessDoc(f.root,'demo');
  // Scratch aide: shipped chief hireable:[] and review.verdict is outside HIRE_ALLOWED.
  fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
- const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});doc.plugins={...doc.plugins,harness:['pi']};
+ const chiefFile=join(rolesDir,'chief-of-staff.json');doc.plugins={...doc.plugins,harness:['pi']};
  const file=writeJson(join(f.configDir,'businesses','demo.json'),doc);fs.writeFileSync(join(f.configDir,'secrets','proxy-management.key'),'fx651-manage',{mode:0o600});
  const business=loadBusiness('demo',{dir:f.configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});
  const dataRoot=join(f.root,'data');fs.mkdirSync(dataRoot,{mode:0o700});
@@ -27,7 +28,7 @@ async function hireFixture(t,{revoking=false}={}){
  assert.equal(f.state.keys.includes(issued.key),false,'runtime boot reconciled omitted orphan');assert.equal(bus.credentials.modelRecord('demo/orphan')===null,true,'orphan remains unregistered before hire');
  const cap=bus.broker.bindLaunch({business:'demo',role:'chief',run:'orphan-hire-chief',harness:'pi'});bus.broker.request(cap,{verb:'role.claim'});
  const listed=()=>JSON.parse(fs.readFileSync(file,'utf8')).launch.instances.includes('orphan'),observed=[];f.state.observePut=()=>observed.push(listed());f.state.calls=[];
- const hire=()=>bus.broker.request(cap,{verb:'instance.hire',args:{name:'orphan',definition:'aide',reason:'fixture orphan hire'}});
+ const hire=()=>approveTemplateHire(bus.broker,rolesDir,{name:'orphan',definition:'aide'});
  return {...f,bus,issued,file,log,listed,observed,hire};
 }
 test('L3b runtime hire publishes orphan only after fresh remote confirmation',async t=>{

packages/bus/tests/model-pending-fixture.mjs

@@ -1,3 +1,5 @@
+import { readTemplate } from '../../organization/src/definitions.mjs';
+import { ownerConsole } from './hire-fixtures.mjs';
 // #654 isolated real runtime/writer/controller with owned HTTP request gates.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -22,7 +24,7 @@ export async function pendingFixture(t,{twoBusinesses=false}={}){
  const configDir=join(root,'config'),dataRoot=join(root,'data'),rolesDir=rolesCopy(root),system=systemFor(root);fs.mkdirSync(dataRoot,{mode:0o700});
  const doc=businessDoc(root,'demo');doc.plugins={...doc.plugins,harness:['pi']};
  // Existing row331 scratch aide pattern only; repository role authority unchanged.
- fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});
+ fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
  const ids=twoBusinesses?['demo','other']:['demo'],files={},businesses={};for(const name of ids){const document={...structuredClone(doc),id:name};files[name]=writeJson(join(configDir,'businesses',name+'.json'),document);const business=loadBusiness(name,{dir:configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});businesses[name]=busOrganization(business,resolved);}
  fs.mkdirSync(join(configDir,'secrets'),{recursive:true,mode:0o700});fs.writeFileSync(join(configDir,'secrets','proxy-management.key'),'fx654-manage',{mode:0o600});fs.mkdirSync(join(dataRoot,'bus-host'),{recursive:true,mode:0o700});writeJson(sessionsFile(dataRoot),{sessionsVersion:SESSIONS_VERSION,sessions:[]});
  const sentinel=`msk-${hash(configDir).slice(0,12)}-sentinel-${randomBytes(32).toString('base64url')}`;state.keys.push(sentinel);history.add(sentinel);
@@ -44,7 +46,7 @@ export async function pendingFixture(t,{twoBusinesses=false}={}){
  const holdNext=(method='GET')=>{assert.equal(state.nextGate,null,'only one owned HTTP hold armed');const g={method,entered:deferred(),release:deferred()};gates.push(g);state.nextGate=g;return {entered:()=>bounded(g.entered.promise,'owned lifecycle HTTP boundary not observed'),release:()=>g.release.resolve()};};
  const listed=(business,name)=>JSON.parse(fs.readFileSync(files[business],'utf8')).launch.instances.includes(name);
  const snapshot=business=>{const journal=join(configDir,'businesses','.history',business,'changes.jsonl');return {membership:hash(fs.readFileSync(files[business])),publicationJournal:fs.existsSync(journal)?hash(fs.readFileSync(journal)):null,modelStatus:hash(JSON.stringify(bus.credentials.status())),remote:hash(JSON.stringify(state.keys)),calls:state.calls.length};};
- const hire=(business,name,definition='aide',cap=chief[business])=>track(Promise.resolve().then(()=>bus.broker.request(cap,{verb:'instance.hire',args:{name,definition,reason:'fixture pending hire'}})));
+ const hire=(business,name,definition='aide',cap=chief[business])=>track(Promise.resolve().then(()=>(async()=>{const d=await bus.broker.request(cap,{verb:'hire.raise',args:{op:'hire',level:'org',name,role:{template:definition,sha256:readTemplate(rolesDir,definition).sha256},route:{harness:'pi',model:'claude-opus-5-5'},reason:'fixture pending hire'}});return bus.broker.request(ownerConsole(bus.broker,business),{verb:'hire.resolve.console',args:{id:d.id,digest:d.hire.digest,choice:'yes'}});})()));
  const busy=async promise=>{const result=await bounded(promise.then(()=>({code:'unexpected-success'}),e=>({code:e.code??'unexpected-error'})),'same-business refusal not observed');assert.equal(result.code,'organization-busy','second same-business lifecycle call refuses exact pending code');};
  return {root,configDir,dataRoot,rolesDir,bus,state,receipts,chief,holdNext,listed,snapshot,hire,busy,valueFree,
   healthy:async(business,name)=>{const value=await bus.modelPreflight({business,role:name});const record=bus.credentials.modelRecord(business+'/'+name);assert.equal(value.key===record.key,true);assert.equal(state.keys.includes(record.key),true,'published member retains confirmed model credential');},

packages/bus/tests/model-revocation-fixture.mjs

@@ -1,3 +1,4 @@
+import {ownerConsole} from './hire-fixtures.mjs';
 // #656 STATIC isolated fixtures. No real config/key/proxy; no production seam.
 import fs from 'node:fs';
 import http from 'node:http';
@@ -74,7 +75,7 @@ export async function revocationFixture(t,{runtime=false,onRoot=()=>{},missingBo
  syncBuiltinESMExports();restoreFs=()=>{Object.assign(fs,original);syncBuiltinESMExports();};
  const record=()=>c.modelRecord(instance),exists=path=>{try{original.lstatSync(path);return true;}catch(error){if(error.code==='ENOENT')return false;throw error;}};
  const seed=({matchingTmp=true,retiring=0,valid=false}={})=>{const current=key(),old=Array.from({length:retiring},()=>({key:key(),issuedAt:'2026-10-23T00:00:00.000Z',retireAt:'2099-01-01T00:00:00.000Z'})).map(r=>({...r,keyId:id(r.key)}));const value={key:current,keyId:id(current),issuedAt:'2026-10-24T00:00:00.000Z',rotateBy:'2099-01-01',state:valid?'valid':'revoking',...(valid?{}:{revokingAt:'2026-10-25T00:00:00.000Z'}),retiring:old};state.keys.push(current,...old.map(r=>r.key));c.writeModel(instance,value);if(matchingTmp){fs.copyFileSync(file,temporary);fs.chmodSync(temporary,0o600);}removedTmp=false;return value;};
- const lifecycle=how=>track((async()=>{if(how==='fire')return await bus.broker.request(chief,{verb:'instance.fire',args:{name:'aide',reason:'fixture recognized tmp'}});const revision=writer.read('demo').revision;const request=bus.broker.request(human,{verb:'instances.set',args:{revision,instance:'aide',op:'delete'}});const route={business:'demo',request:request.request},take=bus.lifecycleTake(route);assert.equal(take.go,true,'real trusted delete request is taken');try{const result=await bus.lifecycleDelete(route);bus.lifecycleDone({...route,transaction:result.transaction});return result;}catch(error){bus.lifecycleDone({...route,refusal:error.code??'outcome-unknown'});throw error;}})());
+ const lifecycle=how=>track((async()=>{if(how==='fire')return await bus.broker.request(ownerConsole(bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'aide',reason:'fixture recognized tmp'}});const revision=writer.read('demo').revision;const request=bus.broker.request(human,{verb:'instances.set',args:{revision,instance:'aide',op:'delete'}});const route={business:'demo',request:request.request},take=bus.lifecycleTake(route);assert.equal(take.go,true,'real trusted delete request is taken');try{const result=await bus.lifecycleDelete(route);bus.lifecycleDone({...route,transaction:result.transaction});return result;}catch(error){bus.lifecycleDone({...route,refusal:error.code??'outcome-unknown'});throw error;}})());
  const writeSessions=entries=>writeJson(sessionsFile(dataRoot),{sessionsVersion:SESSIONS_VERSION,sessions:entries});
  const ownRun=async({wrongTicks=false,wrongKey=false,publish=true}={})=>{
   const spawnOwn=async()=>{const handle=spawn('/usr/bin/sleep',['60'],{stdio:'ignore'}),closed=new Promise(resolve=>handle.once('close',resolve));const owned={handle,closed};children.push(owned);await once(handle,'spawn');const ticks=startTimeOf(handle.pid);assert.equal(typeof ticks,'string');return {...owned,ticks,exit:async()=>{if(handle.exitCode===null&&handle.signalCode===null)handle.kill('SIGTERM');await bounded(closed,'owned stand-in exit timeout');}};};

packages/bus/tests/project-runtime.test.mjs

@@ -41,7 +41,7 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
     // Row 236 (#1742, #436b) reads giteaName and parseGiteaUrl for the Gitea grant path.
     // FED R3 r5 (row 274, #414) reads covers, a user's grant check, from it.
     // Row 219 reads THREAD_DEFINITIONS from the same vocabulary for creative thread admission.
-    "import { pluginName, ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';",
+    "import { pluginName, ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../organization/src/vocabulary.mjs';",
   ]);
   assert.doesNotMatch(source, /\bimport\s*\(/);
   assert.doesNotMatch(readFileSync(new URL('../src/proxy-page-vocabulary.mjs', import.meta.url), 'utf8'), /\bimport\b/);

packages/bus/tests/reload.test.mjs

@@ -1,3 +1,4 @@
+import {approveTemplateHire,ownerConsole} from './hire-fixtures.mjs';
 // Row 194 (#1692, D3, T14): after every write that commits, the broker takes the business as a
 // restart would load it, so a created instance binds with no restart. A definition change on a
 // running instance refuses, and a file whose credential references changed isn't reloaded.
@@ -149,8 +150,6 @@ test('T19 a credentialed create answers restart true; issue works only after a r
 // A, from the file, so the kept instance keeps its claim and isn't left firing.
 test('T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A', async (t) => {
   const f = await setup(t);
-  const roleFile = join(f.rolesDir, 'chief-of-staff.json');
-  writeFileSync(roleFile, JSON.stringify({ ...JSON.parse(readFileSync(roleFile, 'utf8')), hireable: ['chief-information-security-officer'] }, null, 2));
   mkdirSync(join(f.root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
   const chief = bind(f.bus, 'chief');
   f.bus.broker.request(chief, { verb: 'role.claim' });
@@ -162,21 +161,21 @@ test('T14 after a refused reload veto.set, instance.hire and instance.fire answe
 
   const added = f.ask('instances.set', { revision: f.revision(), instance: 'rev-2', op: 'add', definition: 'reviewer', tracker: { bot: 'bot-demo-rev-2', botId: 40 } });
   assert.equal(added.restart, true);
-  const hired = asChief('instance.hire', { name: 'sec-2', definition: 'chief-information-security-officer', reason: 'a security lead' });
-  assert.equal(hired.restart, true);
+  const hired = await approveTemplateHire(f.bus.broker,f.rolesDir,{name:'sec-2',definition:'chief-information-security-officer'});
+  assert.ok(hired.transaction);
   const kept = f.ask('veto.set', { revision: f.revision(), op: 'keep', name: 'reviewer' });
   assert.equal(kept.restart, true);
   assert.equal(f.reloads.length, 0, 'the running copy still has reviewer unkept');
 
   const before = readFileSync(f.file, 'utf8');
-  assert.equal(code(() => asChief('instance.fire', { name: 'reviewer', reason: 'the work is done' })), 'instance-kept');
+  await assert.rejects(f.bus.broker.request(ownerConsole(f.bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'reviewer',reason:'the work is done'}}),{code:'instance-kept'});
   assert.equal(readFileSync(f.file, 'utf8'), before);
   assert.deepEqual(f.ask('instances').instances.reviewer.running, run, 'step A never ran: the claim is held');
   assert.notEqual(code(() => f.ask('instance.launch', { instance: 'reviewer' })), 'instance-firing');
 
   const unkept = f.ask('veto.set', { revision: f.revision(), op: 'unkeep', name: 'reviewer' });
   assert.equal(unkept.restart, true);
-  const fired = asChief('instance.fire', { name: 'reviewer', reason: 'the work is done' });
+  const fired = await f.bus.broker.request(ownerConsole(f.bus.broker),{verb:'hire.start.console',args:{op:'fire',level:'org',name:'reviewer',reason:'the work is done'}});
   assert.equal(fired.restart, true);
   assert.equal(JSON.parse(readFileSync(f.file, 'utf8')).launch.instances.includes('reviewer'), false);
 });

packages/bus/tests/request-console.test.mjs

@@ -90,7 +90,7 @@ const ask = (x, state, extra = {}) => x.call('pm', 'request.question', { request
   options: [{ key: 'web', text: 'Web' }, { key: 'cli', text: 'CLI' }], ...extra });
 
 test('the console verb list includes the artifact read and existing owner controls', () => {
-  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
+  assert.deepEqual([...CONSOLE_VERBS], ['system-types.console', 'project.remote.get.console', 'project.remote.set.console', 'request.workspace.console', 'request.artifact.console', 'decision.preview.console', 'decision.resolve.console', 'hire.preview.console', 'hire.resolve.console', 'hire.start.console', 'hire.templates.console', 'prd.revoke.console', 'request.mode.console', 'request.draft.console',
     'request.get.console', 'request.projects.console', 'request.answer.console', 'request.attach.console', 'request.cancel.console']);
 });
 

packages/bus/tests/user-principal.test.mjs

@@ -385,7 +385,7 @@ test('R3 r4: the chief\'s hire refuses an instance named user with the code it g
   caps.chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi', address: 'chief' });
   b.request(caps.chief, { verb: 'role.claim' });
   const hire = (name) => code('chief', 'instance.hire', { name, definition: 'coder', reason: 'more hands' });
-  for (const name of ['human', 'tester', 'user']) assert.equal(hire(name), 'invalid-request', name);
+  for (const name of ['human', 'tester', 'user']) assert.equal(hire(name), 'decision-required', name);
   // A name that isn't reserved passes the name check and refuses later, for want of role files.
   assert.notEqual(hire('helper'), 'invalid-request');
 });

packages/business/src/hire-decisions.mjs

@@ -0,0 +1 @@
+export * from "../../organization/src/hire-decisions.mjs";

packages/cli/tests/case-cleanup-time-fixture.mjs

@@ -0,0 +1,27 @@
+// Invoked inside a private PID namespace. Check residual processes BEFORE its
+// init exits: namespace teardown would otherwise mask a missed descendant kill.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { instrumentCleanupTimer } from './case-inner-timing-fixture.mjs';
+import { blockingQuerySource, killRecordedPids, recordedPids, recordedLivePids } from './case-sudo-fixture.mjs';
+
+const [script,dir]=process.argv.slice(2),clock=join(dir,"clock '$;literal"),records=join(dir,'pids');
+try {
+  writeFileSync(clock,'',{mode:0o600});
+  const worker=join(dir,'blocked.mjs');
+  writeFileSync(worker,blockingQuerySource(records,'sleep')+'\nloadSystem();');
+  const source=instrumentCleanupTimer(readFileSync(script,'utf8'),clock);
+  const body=source.slice(source.indexOf('# row253-supervisor-begin'),source.indexOf('# row253-supervisor-end'));
+  const result=spawnSync('/bin/bash',['-c',body+'\nexec /bin/bash -c "$TESTER_SUPERVISOR" -- 2 /usr/bin/setsid /usr/bin/sleep "$@"','--',process.execPath,worker],{
+    encoding:'utf8',timeout:12000,killSignal:'SIGKILL',
+  });
+  // These PIDs belong to this namespace; never use them to signal host PIDs.
+  process.stdout.write(JSON.stringify({
+    status:result.status,signal:result.signal,error:result.error?.message,
+    stdout:result.stdout,stderr:result.stderr,pairs:recordedPids(records),
+    live:recordedLivePids(records),clock:readFileSync(clock,'utf8'),
+  }));
+} finally {
+  killRecordedPids(records);
+}

packages/cli/tests/case-cleanup-time.test.mjs

@@ -0,0 +1,69 @@
+// A delay in finish(), after timing2's end stamp, must fail independently of
+// the inner timer. One fixed process tree runs at a time, without host setup,
+// fake sudo, or a parent-side elapsed-time assertion.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { instrumentCleanupTimer, removeInnerObservers, readProbeSeconds } from './case-inner-timing-fixture.mjs';
+
+const scripts=['case1-accept.sh','case2-unit.sh'];
+const read=name=>readFileSync(new URL(`../../../scripts/${name}`,import.meta.url),'utf8');
+// The namespace fixes /proc inventory size; it does not replace clean_session.
+// See org-cleanup-time-build.md for the standalone and loaded calibration. The
+// bound must reject 1s/2s delays and leave most of the 2s production headroom.
+// Constant delays below 0.5s can pass; this is not a bound on host-wide scan
+// cost. In particular, per-entry work needs a shipped scan-cost follow-up.
+const CLEANUP_LIMIT_SECONDS=0.5;
+const probe=fileURLToPath(new URL('./case-cleanup-time-fixture.mjs',import.meta.url));
+
+for(const name of scripts)test(`cleanup timing ${name}: observers preserve bytes and reject exit-anchor drift`,()=>{
+  const source=read(name),clock="/unused/clock '$;literal";
+  const copy=instrumentCleanupTimer(source,clock);
+  assert.equal(removeInnerObservers(copy,clock),source);
+  for(const marker of ['SO_PEERCRED','MOSAIC_TESTER_SOCKET_V1','MOSAIC_LEGACY_STATUS'])
+    assert.equal(copy.split(marker).length,source.split(marker).length,marker);
+  const exit='    exit "$rc"\n';
+  assert.throws(()=>instrumentCleanupTimer(source.replace(exit,''),clock),/anchor/);
+  assert.throws(()=>instrumentCleanupTimer(source.replace(exit,exit+exit),clock),/anchor/);
+});
+
+// Both shipped copies are executed: Case1 shares this supervisor across legacy
+// calls, queries and P10; Case2 uses its copy for config queries.
+for(const name of scripts)test(`cleanup timing ${name}: inner timeout kills descendants within the cleanup budget`,t=>{
+  const dir=mkdtempSync(join(tmpdir(),'cl-'));
+  t.after(()=>rmSync(dir,{recursive:true,force:true}));
+  // No skip/fallback: this Linux test requires unprivileged user/PID/mount
+  // namespaces. --kill-child also removes our namespace if the probe times out.
+  const outer=spawnSync('/usr/bin/unshare',[
+    '--user','--map-root-user','--pid','--fork','--kill-child=KILL','--mount-proc',
+    process.execPath,probe,fileURLToPath(new URL(`../../../scripts/${name}`,import.meta.url)),dir,
+  ],{
+    encoding:'utf8',timeout:15000,killSignal:'SIGKILL',
+  });
+  const prerequisite='requires /usr/bin/unshare and unprivileged user/PID/mount namespaces (check kernel/AppArmor/container seccomp)';
+  assert.equal(outer.error,undefined,`${prerequisite}: ${outer.error?.message}`);
+  assert.equal(outer.status,0,`${prerequisite}; probe output:\n${outer.stdout}${outer.stderr}`);
+  assert.equal(outer.stderr,'');
+  const result=JSON.parse(outer.stdout);
+  assert.equal(result.error,undefined,result.error);
+  assert.equal(result.signal,null,result.stderr);
+  assert.equal(result.status,81,result.stderr);
+  assert.equal(result.stdout,'');
+  assert.equal(result.stderr,'');
+  const pairs=result.pairs;
+  assert.equal(pairs.length,2,'the session leader and its live descendant both started');
+  assert.equal(pairs[0][0],pairs[0][1],'the command leads its kernel session');
+  assert.notEqual(pairs[1][0],pairs[0][0]);
+  assert.equal(pairs[1][1],pairs[0][1],'the descendant belongs to the supervised session');
+  assert.deepEqual(result.live,[],'cleanup must kill the whole process tree before namespace teardown');
+  // A positive centisecond pair relies on clean_session's current mandatory
+  // 0.01s retry sleep. Revisit this measurement if shipped cleanup removes it;
+  // keep the shared inner-timer parser strict in the meantime.
+  const seconds=readProbeSeconds(result.clock);
+  t.diagnostic(`${name}: cleanup ${seconds}s; limit ${CLEANUP_LIMIT_SECONDS}s`);
+  assert.ok(seconds<CLEANUP_LIMIT_SECONDS,`${name}: cleanup ${seconds}s must be < ${CLEANUP_LIMIT_SECONDS}s`);
+});

packages/cli/tests/case-inner-timing-fixture.mjs

@@ -0,0 +1,50 @@
+// Test-copy observations only: bracket the supervisor's inner timer before
+// clean_session scans the host's /proc. Keep all shipped control flow intact.
+import { readProbeSeconds } from './case-p10-timing-fixture.mjs';
+export { readProbeSeconds };
+const BEGIN = '# row253-supervisor-begin\n';
+const END = '# row253-supervisor-end\n';
+const TIMER = '"$sleep_bin" "$seconds" & timer=$!\n';
+const FINISH = 'finish() {\n    local rc="$?"\n';
+function unique(source, anchor) {
+  const at=source.indexOf(anchor);
+  if(at<0 || source.indexOf(anchor,at+anchor.length)>=0) throw new Error('inner observer anchor must occur exactly once');
+  return at;
+}
+function innerObservers(clock) {
+  // The literal path survives env -i in the fake sudo. It is a private scratch
+  // file, never a product input. Quote even paths containing shell metacharacters.
+  const file="'"+clock.replaceAll("'", "'\\''")+"'";
+  return {
+    begin:`# inner-observer-begin\n{ read -r timing2_up timing2_spare < /proc/uptime &&\n  printf 'begin %s\\n' "$timing2_up" >> ${file}; } 2>/dev/null || :\n# inner-observer-begin-end\n`,
+    end:`    # inner-observer-end\n    { read -r timing2_up timing2_spare < /proc/uptime &&\n      printf 'end %s\\n' "$timing2_up" >> ${file}; } 2>/dev/null || :\n    # inner-observer-end-end\n`,
+  };
+}
+export function instrumentInnerTimer(source,clock) {
+  const from=unique(source,BEGIN),to=unique(source,END);
+  if(to<=from)throw new Error('inner observer scope is reversed');
+  let supervisor=source.slice(from,to);
+  unique(supervisor,TIMER);unique(supervisor,FINISH);
+  const blocks=innerObservers(clock);
+  supervisor=supervisor.replace(TIMER,blocks.begin+TIMER).replace(FINISH,FINISH+blocks.end);
+  return source.slice(0,from)+supervisor+source.slice(to);
+}
+export function removeInnerObservers(source,clock) {
+  for(const block of Object.values(innerObservers(clock))){unique(source,block);source=source.replace(block,'');}
+  return source;
+}
+
+// Reuse the timing2 finish-entry stamp, moving only the other observation.
+// The end is in the supervisor, after clean_session and both waits, immediately
+// before exit. Parent scheduling and process start-up never enter this pair.
+export function instrumentCleanupTimer(source,clock) {
+  const blocks=innerObservers(clock);
+  let observed=instrumentInnerTimer(source,clock);
+  const from=unique(observed,BEGIN),to=unique(observed,END);
+  let supervisor=observed.slice(from,to);
+  const exit='    exit "$rc"\n';
+  unique(supervisor,exit);
+  supervisor=supervisor.replace(blocks.begin,'').replace(blocks.end,blocks.begin);
+  supervisor=supervisor.replace(exit,blocks.end+exit);
+  return observed.slice(0,from)+supervisor+observed.slice(to);
+}

packages/cli/tests/case-inner-timing.test.mjs

@@ -0,0 +1,33 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { tmp } from './helpers.mjs';
+import { instrumentInnerTimer, removeInnerObservers, readProbeSeconds } from './case-inner-timing-fixture.mjs';
+const scripts=['case1-accept.sh','case2-unit.sh'];
+const read=name=>readFileSync(new URL(`../../../scripts/${name}`,import.meta.url),'utf8');
+for(const name of scripts)test(`inner timing ${name}: private copy preserves shipped bytes and rejects anchor drift`,t=>{
+ const clock=join(tmp(t,'timer-'),'clock');
+ const source=read(name),copy=instrumentInnerTimer(source,clock);
+ assert.equal(removeInnerObservers(copy,clock),read(name));
+ for(const marker of ['SO_PEERCRED','MOSAIC_TESTER_SOCKET_V1','MOSAIC_LEGACY_STATUS'])
+  assert.equal(copy.split(marker).length,source.split(marker).length,marker);
+ for(const anchor of ['# row253-supervisor-begin\n','# row253-supervisor-end\n','"$sleep_bin" "$seconds" & timer=$!\n','finish() {\n    local rc="$?"\n']){
+  assert.throws(()=>instrumentInnerTimer(source.replace(anchor,''),clock),/anchor/);
+  assert.throws(()=>instrumentInnerTimer(source.replace(anchor,anchor+anchor),clock),/anchor/);
+ }
+});
+for(const name of scripts)test(`inner timing ${name}: real supervisor retains streams status and EXIT cleanup`,t=>{
+ const clock=join(tmp(t,'timer-'),"clock '$;literal");writeFileSync(clock,'');
+ const source=instrumentInnerTimer(read(name),clock);
+ const body=source.slice(source.indexOf('# row253-supervisor-begin'),source.indexOf('# row253-supervisor-end'));
+ const result=spawnSync('/bin/bash',['-c',body+'\n/bin/bash -c "$TESTER_SUPERVISOR" -- 2 /usr/bin/setsid /usr/bin/sleep /bin/bash -c \'printf exact-out; printf exact-err >&2; /usr/bin/sleep 0.1; exit 7\''],{encoding:'utf8'});
+ assert.equal(result.status,87,result.stderr);
+ assert.equal(result.stdout,'exact-out');assert.equal(result.stderr,'exact-err');
+ assert.match(readFileSync(clock,'utf8'),/^begin [0-9]+\.[0-9]{2}\nend [0-9]+\.[0-9]{2}\n$/);
+ // The same strict parser used by the timing bands rejects a guard's partial,
+ // duplicate or reversed pair, rather than substituting wall time.
+ for(const invalid of ['begin 10.00\n','end 11.00\n','begin 10.00\nend 11.00\nbegin 12.00\nend 13.00\n','begin 11.00\nend 10.00\n'])
+  assert.throws(()=>readProbeSeconds(invalid));
+});

packages/cli/tests/case1-accept.test.mjs

@@ -13,6 +13,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { tmp } from "./helpers.mjs";
 import { instrumentP10Probe, removeP10Observers, readProbeSeconds, P10_OBSERVERS } from "./case-p10-timing-fixture.mjs";
+import { instrumentInnerTimer } from "./case-inner-timing-fixture.mjs";
 import { CASE_SUDO_SESSION, recordedLivePids, killRecordedPids, fixtureGuard, cleanupFixture, pollFixtureGone, blockingQuerySource, LEGACY_CASES } from "./case-sudo-fixture.mjs";
 
 const REPO = fileURLToPath(new URL("../../../", import.meta.url));
@@ -968,8 +969,8 @@ test("row 195 accept: the host check runs with --check and never --enforce", (t)
 
 
 // Row276 exercises the real legacy launcher with fixture-only commands, never sudo.
-function legacyBody() {
- const source=read(SCRIPT),start=source.indexOf('# row253-supervisor-begin'),end=source.indexOf('# row276-legacy-end');
+function legacyBody(source=read(SCRIPT)) {
+ const start=source.indexOf('# row253-supervisor-begin'),end=source.indexOf('# row276-legacy-end');
  assert.ok(start>=0&&end>start,'legacy supervisor block exists');
  return source.slice(start,end);
 }
@@ -991,11 +992,18 @@ for(const {tag} of LEGACY_CASES)test(`row276 ${tag} legacy inner timeout cleans
   const h=host(t),records=join(h.hc,'legacy-pids'),files=[join(h.hc,'session-pids'),records];
   put(join(h.hc,'session-mode'),mode);
   const file=join(h.dir,'blocked.mjs');put(file,blockingQuerySource(records,'signals')+'\nloadSystem();');
-  const capture=cleanupFixture(t,files),stop=fixtureGuard(t,files,4500);
-  const start=performance.now(),r=legacyCall(h,tag,[NODE,file]);capture();
+  const clock=join(h.dir,'inner-clock');put(clock,'',0o600);
+  const body=legacyBody(instrumentInnerTimer(read(SCRIPT),clock));
+  const capture=cleanupFixture(t,files),stop=fixtureGuard(t,files,4500,clock);
+  // The outer watchdog includes startup and cleanup; only the supervisor pair
+  // measures the inner budget. Seven seconds also lets the 4.5s guard expose a missing timer.
+  const start=performance.now(),r=legacyCall(h,tag,[NODE,file],{outer:7,body});capture();
   assert.equal(r.status,81,r.stdout+r.stderr);
   assert.equal(r.stderr,`case1-accept: ${tag} inner-timeout\n`);
-  assert.ok((performance.now()-start)/1000<2,mode);
+  const seconds=readProbeSeconds(read(clock)),wall=(performance.now()-start)/1000;
+  assert.ok(seconds>=0.25&&seconds<1.25,`${tag}/${mode}: inner timer ${seconds}s (wall ${wall}s)`);
+  assert.ok(wall>=seconds,`${mode}: the call contains its timer interval`);
+  t.diagnostic(`${tag}/${mode}: inner ${seconds}s; wall ${wall}s`);
   assert.deepEqual(await pollFixtureGone(files),[],mode);await stop();
  }
 });

packages/cli/tests/case2-unit.test.mjs

@@ -14,6 +14,7 @@ import { fileURLToPath } from "node:url";
 import { businessDoc, systemConfig, writeJson } from "../../business/tests/helpers.mjs";
 import { binds, prepareRun, sandboxArgv, sandboxProblem } from "../../seat/src/sandbox.mjs";
 import { tmp } from "./helpers.mjs";
+import { instrumentInnerTimer, readProbeSeconds } from "./case-inner-timing-fixture.mjs";
 import { CASE_SUDO_SESSION, recordedLivePids, killRecordedPids, fixtureGuard, cleanupFixture, pollFixtureGone, blockingQuerySource } from "./case-sudo-fixture.mjs";
 
 const REPO = fileURLToPath(new URL("../../../", import.meta.url));
@@ -107,13 +108,13 @@ const libraryFlags = (h) => ["--port", "443", "--business", "acme", "--public-ho
   "--allow-user", "melanie", "--proof-header", "X-Proxy-Proof", "--proof-file", h.proof];
 const factoryFlags = () => ["--port", "443", "--business", "acme", "--tester-socket"];
 
-function unit(h, { profile = "library", node = USR_NODE, copy = COPY_A, extra = [], flags, env = {}, outer = ["--business", "acme"], argv } = {}) {
+function unit(h, { profile = "library", node = USR_NODE, copy = COPY_A, extra = [], flags, env = {}, outer = ["--business", "acme"], argv, script: unitScript = UNIT } = {}) {
   const serve = flags ?? (profile === "factory" ? factoryFlags() : libraryFlags(h));
   const args = argv ?? ["--user", "mosaic", "--home", h.home, ...outer, "--copy", copy, "--node", node, "--profile", profile, ...extra, "--", ...serve];
-  const r = spawnSync(UNIT, args, {
+  const r = spawnSync(unitScript, args, {
     encoding: "utf8",
     timeout: 30000,
-    env: { PATH: `${h.bin}:${process.env.PATH}`, CASE2_UNIT_DIR: h.units, CASE2_SYSTEMCTL: join(h.bin, "systemctl"), CASE2_GETENT: join(h.bin, "getent"), ...env },
+    env: { HOME: process.env.HOME, TMPDIR: process.env.TMPDIR, LANG: process.env.LANG, PATH: `${h.bin}:${process.env.PATH}`, CASE2_UNIT_DIR: h.units, CASE2_SYSTEMCTL: join(h.bin, "systemctl"), CASE2_GETENT: join(h.bin, "getent"), ...env },
   });
   return { code: r.status, out: r.stdout, err: r.stderr };
 }
@@ -197,12 +198,27 @@ for(const kind of ['sleep','signals','member']) test(`row253 C4 ${kind} query ha
   const member=join(h.root,'q ) '+String.fromCharCode(10)+'mem'),proof=join(h.root,'comm-proof');
   if(kind==='member')symlinkSync('/usr/bin/sleep',member);
   writeFileSync(join(copyDir(h),'packages/cli/src/config.mjs'),blockingQuerySource(queries,kind,member,proof));
-  const capture=cleanupFixture(t,files);const stopGuard=fixtureGuard(t,files);
-  const start=performance.now(),r=unit(h,{profile:'factory'}),seconds=(performance.now()-start)/1000;capture();
+  const clock=join(h.root,'inner-clock'),observed=join(h.root,'observed/scripts/case2-unit.sh');
+  mkdirSync(dirname(observed),{recursive:true});
+  symlinkSync(join(REPO,'scripts/selector.sh'),join(dirname(observed),'selector.sh'));
+  writeFileSync(clock,'',{mode:0o600});
+  // The 7s outer watchdog spans startup and cleanup too. Give the private copy
+  // cleanup room while retaining a separate band on the unchanged 5s inner timer.
+  const source=read(UNIT),call='query="$(tester_capture 5 7 4096';
+  assert.equal(source.split(call).length,2,'tester query budget anchor is unique');
+  script(observed,instrumentInnerTimer(source.replace(call,call.replace(' 5 7 ',' 5 15 ')),clock));
+  const capture=cleanupFixture(t,files);const stopGuard=fixtureGuard(t,files,9500,clock);
+  const start=performance.now(),r=unit(h,{profile:'factory',script:observed,env:{
+   CASE2_BUS_TEMPLATE:BUS_TEMPLATE,CASE2_WEBUI_TEMPLATE:WEBUI_TEMPLATE,
+   CASE2_PROXY_TEMPLATE:join(REPO,'packages/cli/systemd/mosaic-proxy.service.in'),
+  }}),wall=(performance.now()-start)/1000;capture();
   refuses(r,/^case2-unit: tester config query inner-timeout\n$/);
+  const seconds=readProbeSeconds(read(clock));
   const [queryPid,querySid]=read(queries).trim().split('\n')[0].trim().split(/\s+/).map(Number);
   assert.equal(queryPid,querySid,`${kind}/${mode}: direct query PID must equal its kernel SID`);
-  assert.ok(seconds<7,`${kind}/${mode}: ${seconds}s exceeds outer bound`);
+  assert.ok(seconds>=4.25&&seconds<5.75,`${kind}/${mode}: inner timer ${seconds}s (wall ${wall}s)`);
+  assert.ok(wall>=seconds,`${mode}: the call contains its timer interval`);
+  t.diagnostic(`${kind}/${mode}: inner ${seconds}s; wall ${wall}s`);
   assert.deepEqual(await pollFixtureGone(files),[],mode);
   if(kind==='member')assert.ok(read(proof).includes('('+member.split('/').at(-1)+') '),'member comm with newline and closing parenthesis was observed');
   assert.equal(existsSync(h.log),false,mode);await stopGuard();

packages/cli/tests/lifecycle.test.mjs

@@ -1,3 +1,5 @@
+import {ownerConsole} from '../../bus/tests/hire-fixtures.mjs';
+import {readTemplate} from '../../organization/src/definitions.mjs';
 import { requestHostOps } from './request-host-ops.mjs';
 // Row 194 (#1692, D1.1, T2-T5, V5): the launcher half of the lifecycle verbs. The broker records
 // the human's launch, end, regenerate and delete as requests (bus lifecycle-verbs.test.mjs), and
@@ -238,7 +240,7 @@ function bind(s, role, run) {
   s.runtime.broker.request(cap, { verb: "role.claim" });
   return cap;
 }
-const fire = (s, chief, name) => s.runtime.broker.request(chief, { verb: "instance.fire", args: { name, reason: "the review is done" } });
+const fire = (s, chief, name) => s.runtime.broker.request(chief, {verb:"hire.raise",args:{op:"fire",level:"org",name,reason:"the review is done"}}).then(d => s.runtime.broker.request(ownerConsole(s.runtime.broker,"acme"),{verb:"hire.resolve.console",args:{id:d.id,choice:"yes",digest:d.hire.digest}}));
 
 const allowed = (p, action) => {
   const db = new DatabaseSync(join(p.f.dataRoot, "bus", "bus.sqlite"), { readOnly: true });
@@ -601,7 +603,7 @@ test("row 194 T9a: fire signals its bound run and a spawned but unbound registry
   const spare = await standIn(t, p, s, { instance: "coder", run: "coder-spare" });
   const stuck = await standIn(t, p, s, { instance: "coder", run: "coder-stuck", ignoreTerm: true });
   bind(s, "coder", "coder-run");
-  const fired = fire(s, bind(s, "chief", "chief-run"), "coder");
+  const fired = await fire(s, bind(s, "chief", "chief-run"), "coder");
   // The bus knows only the bound run. The pass takes the spawned ones from the registry.
   assert.deepEqual(fired.runs, ["coder-run"]);
   await s.launcher.tick();
@@ -629,7 +631,7 @@ test("row 194 T9a: fire of a registry run with no runtime record reads lifecycle
   const bound = await standIn(t, p, s, { instance: "coder", run: "coder-run" });
   const ghost = await standIn(t, p, s, { instance: "coder", run: "coder-ghost", managed: false });
   bind(s, "coder", "coder-run");
-  const fired = fire(s, bind(s, "chief", "chief-run"), "coder");
+  const fired = await fire(s, bind(s, "chief", "chief-run"), "coder");
   assert.deepEqual(fired.runs, ["coder-run"]);
   await s.launcher.tick();
   assert.equal(await bound.exited, 143);
@@ -685,7 +687,7 @@ test("row 194 T9a: a runner whose identity changed before the SIGTERM gets no si
   const between = await standIn(t, p, s, { instance: "coder", run: "coder-between", ignoreTerm: true });
   Object.assign(pids, { before: before.pid, between: between.pid });
   bind(s, "coder", "coder-between");
-  const fired = fire(s, bind(s, "chief", "chief-run"), "coder");
+  const fired = await fire(s, bind(s, "chief", "chief-run"), "coder");
   await s.launcher.tick();
   assert.deepEqual(sent, [["coder-between", "SIGTERM"]]);
   assert.deepEqual([before.gone(), between.gone(), before.terms(), between.terms()], [false, false, 0, 1]);
@@ -719,7 +721,7 @@ test("row 194 T9b: a halt during a fire's stop sends no second SIGTERM, keeps th
   const x = await standIn(t, p, s, { instance: "coder", run: "coder-run", ignoreTerm: true });
   const chief = bind(s, "chief", "chief-run");
   bind(s, "coder", "coder-run");
-  const fired = fire(s, chief, "coder");
+  const fired = await fire(s, chief, "coder");
   const began = Date.now();
   const pass = s.launcher.tick();
   await until(() => x.terms() === 1);
@@ -848,12 +850,6 @@ test("row 194 T11: two stack roots with the same business id; a launch, a termin
 // listing gets through to the host, which checks the file.
 test("row 194 D3 item 5: the chief's session hires with its tool and launches its hire in the same session, then fires it", { skip, timeout: 90000 }, async (t) => {
   const p = prepare(t);
-  // The shipped role file lists nothing hireable. The test's copy lists the CISO, which holds
-  // only message.send and record.write and no credential.
-  const roleFile = join(p.f.env.MOSAIC_ROLES_DIR, "chief-of-staff.json");
-  const role = JSON.parse(readFileSync(roleFile, "utf8"));
-  role.hireable = ["chief-information-security-officer"];
-  writeFileSync(roleFile, JSON.stringify(role, null, 2));
   const s = await start(t, p);
   const chief = (await s.carry(s.call("instance.launch", { instance: "chief" }).request)).done.run;
   await s.claimed(chief);
@@ -861,15 +857,12 @@ test("row 194 D3 item 5: the chief's session hires with its tool and launches it
     const sent = s.call("message.send", { to: "chief", class: "REQUEST", body: `TOOL ${name} ${JSON.stringify(args)}` }).id;
     return (await until(() => s.call("replies", { id: sent })[0], 30000)).body;
   };
-  const hired = JSON.parse(await ask("hire", { name: "sec-2", definition: "chief-information-security-officer", vars: { model: "claude-sonnet-5-5" }, reason: "a security lead for the review queue" }));
-  assert.ok(hired.transaction, JSON.stringify(hired));
-  const listed = s.call("instances").instances["sec-2"];
-  assert.equal(listed.launched, true);
-  // Hire vars set only model and limits.* (N3). harness and thinking are agent-layer route vars the
-  // human sets, so until then the launch refuses no-route.
-  assert.equal((await ask("launch", { instance: "sec-2" })).split("\n")[0], "refused: no-route");
-  const route = { harness: "pi", model: "claude-sonnet-5-5", thinking: "high" };
-  s.call("instances.set", { revision: s.call("instances").revision, instance: "sec-2", op: "change", vars: route });
+  const role = readTemplate(p.f.env.MOSAIC_ROLES_DIR,"chief-information-security-officer");
+  const hired = JSON.parse(await ask("hire", {op:"hire",level:"org",name:"sec-2",role:{template:role.name,sha256:role.sha256},route:{harness:"pi",model:"claude-sonnet-5-5",thinking:"high"},reason:"a security lead for the review queue"}));
+  assert.ok(hired.id);
+  assert.equal(s.call("instances").instances["sec-2"],undefined,"raise writes nothing");
+  await s.runtime.broker.request(ownerConsole(s.runtime.broker,"acme"),{verb:"hire.resolve.console",args:{id:hired.id,choice:"yes",digest:hired.hire.digest}});
+  assert.equal(s.call("instances").instances["sec-2"].launched,true);
   const launched = JSON.parse(await ask("launch", { instance: "sec-2" }));
   assert.match(launched.run, /^r[0-9a-f]{12}$/);
   assert.deepEqual(s.running("sec-2").map((x) => x.run), [launched.run]);
@@ -878,8 +871,9 @@ test("row 194 D3 item 5: the chief's session hires with its tool and launches it
   assert.equal((await ask("launch", { instance: "NOT A NAME" })).split("\n")[0], "refused: instance-not-listed");
   assert.equal((await ask("launch", { instance: "reviewer" })).split("\n")[0], "refused: instance-not-listed");
   await s.claimed(launched.run);
-  const fired = JSON.parse(await ask("fire", { name: "sec-2", reason: "the review is done" }));
-  assert.ok(fired.transaction, JSON.stringify(fired));
+  const fired = JSON.parse(await ask("fire", {op:"fire",level:"org",name:"sec-2",reason:"the review is done"}));
+  assert.ok(fired.id);
+  await s.runtime.broker.request(ownerConsole(s.runtime.broker,"acme"),{verb:"hire.resolve.console",args:{id:fired.id,choice:"yes",digest:fired.hire.digest}});
   await until(() => s.running("sec-2").length === 0, 30000);
   // A fired instance stays in roles, off the listing, so the chief can't launch it again.
   assert.equal(s.call("instances").instances["sec-2"].launched, false);

packages/harness/src/tools.mjs

@@ -223,21 +223,22 @@ export function typedTools({ resolved, arbiter = false, tracker = false, project
       reason: str("Why the run ends, 1 to 500 characters", { minLength: 1, maxLength: 500 }),
     }, ["role", "reason"]));
   }
-  // Row 194 (#1692, PRD 1.7 REQ-COS-3): the chief of staff's hire and fire, routed within-role. The
-  // broker checks the definition against the role files and the veto on every call.
+  // A4: these propose changes. Only a person with org.hire can approve them.
   if (held.has("role.hire")) {
-    add("hire", "instance.hire", "role.hire", "Hire a new role instance: add it to the organization file under a new name, with a definition your role file lists as hireable. A reason is required, 1 to 500 characters, and goes into the log. vars may set the model key and limits.* keys only. The broker refuses a definition that isn't hireable with definition-not-hireable. Launch the instance afterwards with launch.", obj({
-      name: str("The new instance's name"),
-      definition: str("The role definition it runs"),
-      vars: { type: "object", description: "The instance's vars: model and limits.* keys only" },
-      reason: str("Why you hire it, 1 to 500 characters", { minLength: 1, maxLength: 500 }),
-    }, ["name", "definition", "reason"]));
+    add("hire", "hire.raise", "role.hire", "Raise a hire or role-change decision under role.hire for a person to approve. The broker computes flagged grants and credential lines. Nothing is written until approval against the digest. Only the chief raises these decisions.", obj({
+      op: {type:"string",enum:["hire","change"]}, level:{type:"string",enum:["org","project","root"]},
+      project:str("Project name for project level"), name:str("Instance name"),
+      role:{type:"object",description:"Exactly {template, sha256}, {definition, rev}, or {inline: composition}"},
+      credentials:{type:"array",items:{type:"object"},description:"Requested services and scopes; no credential values"},
+      personality:{type:"object",description:"Draft personality and traits"},
+      route:obj({harness:str("Harness"),model:str("Configured model key"),thinking:str("Thinking level")},["harness","model"]),
+      reason:str("Reason, 1 to 500 characters",{minLength:1,maxLength:500})
+    },["op","level","name","role","route","reason"]));
   }
   if (held.has("role.fire")) {
-    add("fire", "instance.fire", "role.fire", "Fire a role instance: stop its run, then remove it from the organization file. A reason is required, 1 to 500 characters, and goes into the log. The broker refuses an instance the human has kept with instance-kept. It also refuses your own instance.", obj({
-      name: str("Role instance to fire"),
-      reason: str("Why you fire it, 1 to 500 characters", { minLength: 1, maxLength: 500 }),
-    }, ["name", "reason"]));
+    add("fire", "hire.raise", "role.fire", "Raise a fire decision for a person to approve. Approval stops new launches and revokes grants; raising writes no agent configuration.", obj({
+      op:{type:"string",enum:["fire"]},level:{type:"string",enum:["org","project","root"]},project:str("Project name for project level"),name:str("Instance name"),reason:str("Reason, 1 to 500 characters",{minLength:1,maxLength:500})
+    },["op","level","name","reason"]));
   }
   if (held.has("organization.change")) {
     // Row 134 (#1669): organization_revision is the read change_organization's revision comes from.

packages/harness/tests/tools.test.mjs

@@ -64,15 +64,15 @@ test("the chief of staff gets launch, send_message, end_run, hire, fire, change_
 
 // Row 194 (#1692, PRD 1.7 REQ-COS-3): hire and fire send the broker's argument keys, reason required,
 // and only a holder of the grant gets them.
-test("hire and fire send instance.hire and instance.fire under role.hire and role.fire, only for a holder of the grant", (t) => {
+test("hire and fire raise decisions under role.hire and role.fire, only for a holder of the grant", (t) => {
   const tools = typedTools({ resolved: resolvedFor(t, "chief"), tracker: true });
   const hire = tools.find((x) => x.name === "hire");
   const fire = tools.find((x) => x.name === "fire");
-  assert.deepEqual([hire.verb, hire.action, fire.verb, fire.action], ["instance.hire", "role.hire", "instance.fire", "role.fire"]);
-  assert.deepEqual(Object.keys(hire.parameters.properties), ["name", "definition", "vars", "reason"]);
-  assert.deepEqual(hire.parameters.required, ["name", "definition", "reason"]);
-  assert.deepEqual(Object.keys(fire.parameters.properties), ["name", "reason"]);
-  assert.deepEqual(fire.parameters.required, ["name", "reason"]);
+  assert.deepEqual([hire.verb, hire.action, fire.verb, fire.action], ["hire.raise", "role.hire", "hire.raise", "role.fire"]);
+  assert.deepEqual(Object.keys(hire.parameters.properties), ["op", "level", "project", "name", "role", "credentials", "personality", "route", "reason"]);
+  assert.deepEqual(hire.parameters.required, ["op", "level", "name", "role", "route", "reason"]);
+  assert.deepEqual(Object.keys(fire.parameters.properties), ["op", "level", "project", "name", "reason"]);
+  assert.deepEqual(fire.parameters.required, ["op", "level", "name", "reason"]);
   for (const tool of [hire, fire]) {
     assert.equal(tool.parameters.additionalProperties, false);
     assert.deepEqual([tool.parameters.properties.reason.minLength, tool.parameters.properties.reason.maxLength], [1, 500]);

packages/organization/src/agent-copies.mjs

@@ -18,6 +18,7 @@
 
 import { isDeepStrictEqual } from "node:util";
 import { HOST_SERVICE } from "./vocabulary.mjs";
+import { checkDefinitions } from "./definitions.mjs";
 import { loadRole } from "./role.mjs";
 import { resolveAgentLevels } from "./agent-levels.mjs";
 import { mergeVars } from "./vars.mjs";
@@ -44,9 +45,9 @@ export function copyInstanceName(name, project = null) {
 // The credential services a copy of `definition` would need bound in the organization, and whether
 // it needs a tracker bot. The host key comes from a grant record at bus start, never from the file,
 // so it is not one (organization-config.mjs, checkRoles).
-function needs(definition, rolesDir, cache) {
+function needs(definition, rolesDir, cache, definitions = {}) {
   if (!cache.has(definition)) {
-    const role = loadRole(rolesDir, definition);
+    const role = checkDefinitions(definitions,"copy definitions")[definition] ?? loadRole(rolesDir, definition);
     const services = role.credentials.map((c) => c.service).filter((s) => s !== HOST_SERVICE);
     cache.set(definition, [...new Set(services)].sort());
   }
@@ -62,6 +63,8 @@ function needs(definition, rolesDir, cache) {
 // read of the organization file recomputes each project's union without reading the root file.
 export function materializeCopies({ orgId, doc, root, rolesDir }) {
   const rootState = root === null ? "refused" : root.state;
+  const definitions={...(root?.definitions??{}),...(doc.definitions??{})};
+  doc={...doc,definitions};
   const levels = resolveAgentLevels({ orgId, doc, root: root ?? { agents: {} }, rolesDir });
   const rootAgents = {};
   for (const [name, entry] of Object.entries(root?.agents ?? {})) {
@@ -88,7 +91,7 @@ export function materializeCopies({ orgId, doc, root, rolesDir }) {
     if (instance !== null && Object.hasOwn(doc?.roles ?? {}, instance)) return;
     if (refusal) { copies[key] = { ...base, state: "refused", reason: refusal }; return; }
     if (instance === null) { copies[key] = { ...base, state: "refused", reason: `project ${project}: ${agent.name}.${project} is longer than an instance name may be` }; return; }
-    const missing = needs(agent.definition, rolesDir, cache);
+    const missing = needs(agent.definition, rolesDir, cache, definitions);
     copies[key] = missing.length ? { ...base, state: "unbound", missing } : { ...base, state: "instance" };
   };
   // Root copies: the base union's root-level agents. It already leaves out the root assistant (A6),
@@ -104,7 +107,7 @@ export function materializeCopies({ orgId, doc, root, rolesDir }) {
       add(agent, project, union.ok ? null : `project ${project} refuses its agents: ${union.reason}`);
     }
   }
-  return deepFreeze({ org: orgId, root: rootState, rootAgents, copies });
+  return deepFreeze({ org: orgId, root: rootState, rootAgents, copies, ...(Object.keys(definitions).length?{definitions}: {}) });
 }
 
 // The view of a snapshot that leaves the boot: names, levels, definitions, states, the missing
@@ -189,6 +192,7 @@ function projectCopyRefusal(copy, document, levels) {
 // snapshot's view, with each copy's state as it is in this document; a business with no copies and
 // no project agents is plain validateBusinessDocument.
 export function withCopies(document, file, { rolesDir, snapshot, dataRoot = null }) {
+  if(snapshot?.definitions)document={...document,definitions:{...snapshot.definitions,...(document.definitions??{})}};
   const copies = snapshot?.copies ?? {};
   if (Object.keys(copies).length === 0 && !hasProjectAgents(document)) return validateBusinessDocument(document, file, { rolesDir, dataRoot });
   // The document's own refusals come first, whole.
@@ -279,6 +283,7 @@ export function copyOf(business, instance) {
 // Why a copy can't launch, as { code, message }, or null when it can. The message names the agent,
 // its project and the missing services or the refusal, and never a value.
 export function copyRefusal(business, instance) {
+  if(business.roles?.[instance]?.unbound?.length)return {code:"credential-unbound",message:`${instance} has no binding for ${business.roles[instance].unbound.join(", ")}`};
   const copy = copyOf(business, instance);
   if (!copy || copy.state === "instance") return null;
   if (copy.state === "unbound") {

packages/organization/src/agent-levels-write.mjs

@@ -18,6 +18,7 @@ import { join } from 'node:path';
 import { OrgError } from './org-registry.mjs';
 import { assertTrustedConfigDir } from './config-dir-trust.mjs';
 import { ROOT_FILE, checkProjectAgents, checkRootAgents, loadRootAgents, projectUnion, rootAgentsPath } from './agent-levels.mjs';
+import { checkDefinition } from "./definitions.mjs";
 import { canonicalJson, isPlainObject } from './util.mjs';
 import { ID_PATTERN } from './vocabulary.mjs';
 import { REGISTRY } from './vars.mjs';
@@ -163,7 +164,7 @@ async function syncDirectory(dir) {
 // Change one root agent. `entry` is the new entry, null to remove it, or a function of the old
 // entry (undefined when there is none) returning either. Returns the receipt. An error after the
 // rename carries committed: true, so a caller never retries a write that landed.
-export async function changeRootAgent(configDir, { revision, name, entry }, { actor, owner, rolesDir, uid = process.geteuid(), beforeReplace, statFile, syncDirectory: syncDir = syncDirectory } = {}) {
+export async function changeRootAgent(configDir, { revision, name, entry }, { actor, owner, rolesDir, uid = process.geteuid(), beforeReplace, statFile, syncDirectory: syncDir = syncDirectory, approvedDefinition = null, decision = null, assertClean = null } = {}) {
   requireRootOwner(actor, owner);
   if (typeof name !== 'string' || !ID_PATTERN.test(name)) fail('agents-invalid', 'agent name must be an id: lowercase letters, digits, dot, dash or underscore, at most 64');
   if (typeof revision !== 'string' || !REVISION.test(revision)) fail('revision-conflict', 'a root agent change needs the revision it was read at');
@@ -187,8 +188,15 @@ export async function changeRootAgent(configDir, { revision, name, entry }, { ac
     if (value === null && old === undefined) fail('agent-not-found', `root agents.${name} does not exist`);
     if (value !== null && !isPlainObject(value)) fail('agents-invalid', `root agents.${name} must be an object`);
     const next = structuredClone(before.document);
-    if (value === null) delete next.agents[name]; else next.agents[name] = value;
+    if (value === null) {delete next.agents[name];if(decision)next.retired=[...(next.retired??[]),name];} else next.agents[name] = value;
+    if (approvedDefinition) {
+      const {name:def,entry}=approvedDefinition;
+      if(typeof assertClean!=="function")fail("definition-secret-check-required");
+      checkDefinition(def,entry,{assertClean});
+      next.definitions={...(next.definitions??{}),[def]:entry};
+    }
     const changed = changedKeys(old, value ?? undefined);
+    if(approvedDefinition && canonicalJson(before.document.definitions?.[approvedDefinition.name])!==canonicalJson(approvedDefinition.entry))changed.push("definition.rev");
     if (changed.length === 0) fail('no-change', `root agents.${name} is already that`);
     validate(next, rolesDir, value);
     const bytes = JSON.stringify(next, null, 2) + '\n';
@@ -197,7 +205,7 @@ export async function changeRootAgent(configDir, { revision, name, entry }, { ac
     const after = sha256(bytes);
     const line = {
       at: new Date().toISOString(), uid: process.geteuid(), actor: 'owner',
-      verb: value === null ? 'root.agent.remove' : 'root.agent.set', agent: name,
+      verb: value === null ? 'root.agent.remove' : 'root.agent.set', agent: name, ...(decision ? {decision} : {}),
       ...(value === null ? {} : { definition: value.definition }),
       revisionBefore: before.revision, revisionAfter: after, changed,
     };
@@ -257,7 +265,7 @@ export function projectAgentSummary(agents) {
 // `next` may differ from `old` only in projects.<project>.agents.<name>, the project must exist and
 // not be a library, and the project's entries and its union must pass A1's checks. Returns
 // [code, message] or null. `root` is the root level as loadRootAgents reads it.
-export function projectAgentProblem(old, next, { orgId, project, name, entry, rolesDir, root }) {
+export function projectAgentProblem(old, next, { orgId, project, name, entry, rolesDir, root, definitions = old.definitions }) {
   const target = old?.projects?.[project];
   if (!isPlainObject(target)) return ['project-not-found', `projects.${project} does not exist`];
   if (target.kind === 'library') return ['project-agents-library', `projects.${project} is a library project; it takes no agents`];
@@ -276,7 +284,7 @@ export function projectAgentProblem(old, next, { orgId, project, name, entry, ro
   if (canonicalJson(after ?? null) === canonicalJson(target.agents?.[name] ?? null)) return ['no-change', `projects.${project}.agents.${name} is already that`];
   const where = `projects.${project}.agents`;
   let entries;
-  try { entries = checkProjectAgents(next.projects[project].agents ?? {}, { rolesDir, where }); }
+  try { entries = checkProjectAgents(next.projects[project].agents ?? {}, { rolesDir, where, definitions }); }
   catch (error) { if (error?.name !== 'BusinessError') throw error; return ['project-agents-invalid', withoutValues(error.message, entry, where)]; }
   const org = Object.fromEntries(Object.entries(old.roles ?? {}).map(([n, r]) => [n, { definition: r?.definition, vars: r?.vars ?? {} }]));
   try { projectUnion({ orgId, root, org, project: entries, projectId: project }); }

packages/organization/src/agent-levels.mjs

@@ -7,6 +7,7 @@
 
 import { join } from "node:path";
 import { refuse } from "./errors.mjs";
+import { checkDefinitions } from "./definitions.mjs";
 import { loadRole } from "./role.mjs";
 import { checkVars, mergeVars, REGISTRY } from "./vars.mjs";
 import { deepFreeze, isPlainObject, readJsonFile, rejectUnknownKeys, requireDistinctList, requireId, requireObject } from "./util.mjs";
@@ -23,7 +24,8 @@ export function rootAgentsPath(configDir) {
   return join(configDir, ROOT_FILE);
 }
 
-function definitionOf(name, at, rolesDir, cache) {
+function definitionOf(name, at, rolesDir, cache, definitions = {}) {
+  if (typeof name === "string" && name.startsWith("org:") && Object.hasOwn(definitions,name)) return definitions[name];
   requireId(name, `${at}.definition`);
   if (!cache.has(name)) {
     // A role refusal names host paths; this message travels to the Console, so it names none.
@@ -44,10 +46,12 @@ function noBoundKeys(entry, at) {
 // The root file's document. `where` names it in messages, never with a host path.
 export function checkRootAgents(document, { rolesDir, where = "root agents" } = {}) {
   requireObject(document, where);
-  rejectUnknownKeys(document, ["agentsVersion", "agents"], where);
+  rejectUnknownKeys(document, ["agentsVersion", "agents", "definitions", "retired"], where);
   if (document.agentsVersion !== 1) refuse(`${where} requires "agentsVersion": 1`);
   requireObject(document.agents, `${where} agents`);
+  if(document.retired!==undefined)requireDistinctList(document.retired,"root retired",n=>requireId(n,"retired agent"));
   const cache = new Map();
+  const definitions = checkDefinitions(document.definitions, "root agents");
   const agents = {};
   let assistant = null;
   for (const [name, entry] of Object.entries(document.agents)) {
@@ -55,8 +59,8 @@ export function checkRootAgents(document, { rolesDir, where = "root agents" } =
     requireId(name, `${where} agent name`);
     requireObject(entry, at);
     noBoundKeys(entry, at);
-    rejectUnknownKeys(entry, ["definition", "vars", "excludeOrgs"], at);
-    const definition = definitionOf(entry.definition, at, rolesDir, cache);
+    rejectUnknownKeys(entry, ["definition", "vars", "excludeOrgs", "hireDecision"], at);
+    const definition = definitionOf(entry.definition, at, rolesDir, cache, definitions);
     // Each organization's chief is its own (REQ-COS-3): never a root agent.
     if (entry.definition === CHIEF) refuse(`${at}: ${CHIEF} can't be a root agent; each organization has its own chief`);
     if (entry.definition === ASSISTANT) {
@@ -67,10 +71,11 @@ export function checkRootAgents(document, { rolesDir, where = "root agents" } =
       definition: entry.definition,
       title: definition.title,
       vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`),
+      ...(entry.hireDecision ? {hireDecision:entry.hireDecision}: {}),
       excludeOrgs: entry.excludeOrgs === undefined ? [] : requireDistinctList(entry.excludeOrgs, `${at}.excludeOrgs`, (id) => requireId(id, `${at}.excludeOrgs entry`)),
     };
   }
-  return deepFreeze({ agents, assistant });
+  return deepFreeze({ agents, assistant, ...(document.definitions ? {definitions:document.definitions}: {}) });
 }
 
 // The root file. Missing means no root agents; anything else wrong refuses. The same descriptor
@@ -103,7 +108,8 @@ export function loadRootAgents(configDir, { rolesDir } = {}) {
 const INTERSECT = Object.keys(REGISTRY).filter((key) => REGISTRY[key].merge === "intersect");
 
 // One project's `agents` map. Each entry is exactly one of define, narrow or exclude.
-export function checkProjectAgents(agents, { rolesDir, where }) {
+export function checkProjectAgents(agents, { rolesDir, where, definitions = {} }) {
+  definitions = checkDefinitions(definitions,"project definitions");
   requireObject(agents, where);
   const cache = new Map();
   const out = {};
@@ -112,16 +118,16 @@ export function checkProjectAgents(agents, { rolesDir, where }) {
     requireId(name, `${where} agent name`);
     requireObject(entry, at);
     noBoundKeys(entry, at.replace(/^.*?projects\./, "project "));
-    rejectUnknownKeys(entry, ["definition", "vars", "exclude"], at);
+    rejectUnknownKeys(entry, ["definition", "vars", "exclude", "hireDecision"], at);
     if (Object.hasOwn(entry, "exclude")) {
       if (entry.exclude !== true || Object.keys(entry).length !== 1) refuse(`${at}: an exclude entry is exactly {"exclude": true}`);
       out[name] = { form: "exclude" };
       continue;
     }
     if (Object.hasOwn(entry, "definition")) {
-      const definition = definitionOf(entry.definition, at, rolesDir, cache);
+      const definition = definitionOf(entry.definition, at, rolesDir, cache, definitions);
       if (entry.definition === CHIEF || entry.definition === ASSISTANT) refuse(`${at}: ${entry.definition} can't be a project agent`);
-      out[name] = { form: "define", definition: entry.definition, title: definition.title, vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`) };
+      out[name] = { form: "define", definition: entry.definition, title: definition.title, vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`), ...(entry.hireDecision ? {hireDecision:entry.hireDecision}: {}) };
       continue;
     }
     if (!isPlainObject(entry.vars) || Object.keys(entry.vars).length === 0) refuse(`${at}: an entry defines (definition), narrows (vars) or excludes (exclude)`);
@@ -144,7 +150,7 @@ function orgLevels(doc, rolesDir) {
   const projects = {};
   for (const [id, entry] of Object.entries(doc?.projects ?? {})) {
     if (entry?.kind === "library") continue;
-    projects[id] = entry?.agents === undefined ? {} : checkProjectAgents(entry.agents, { rolesDir, where: `projects.${id}.agents` });
+    projects[id] = entry?.agents === undefined ? {} : checkProjectAgents(entry.agents, { rolesDir, where: `projects.${id}.agents`, definitions:doc.definitions });
   }
   return { org, projects };
 }

packages/organization/src/composition.mjs

@@ -7,10 +7,7 @@
 // checks one against a registry (the core set from vocabulary.mjs plus a plugin-declared set) in
 // the seven steps section 4 lists, in order, and returns the lines a human must see flagged.
 //
-// Nothing calls checkComposition yet. HIRE_ALLOWED and unhireableAction (vocabulary.mjs) still
-// bound a hire, and role.mjs and the broker still use them. Slice A4 switches hire over to this
-// validator and removes them. In P1 the plugin set is whatever the caller passes, empty by
-// default; nothing here reads a plugin file (PL1 builds install and the manifest).
+// The broker and approved writer validate every hire with this registry.
 //
 // A refusal names the field and the position at fault. It quotes a value only when that value is
 // a registered name (a core or plugin action, tool, network, service or scope), so no role text,
@@ -50,8 +47,8 @@ export const COMPOSITION_BOUNDS = Object.freeze({
   skills: 64,
 });
 
-// Ruling 8 and R9: a hired agent can't hire or fire, whatever HIRE_ALLOWED says later.
-export const NEVER_HIRED = Object.freeze(["role.hire", "role.fire"]);
+// Ruling 8 and R9: a hired agent cannot hire, fire or change another role.
+export const NEVER_HIRED = Object.freeze(["role.hire", "role.fire", "role.change"]);
 // The role rails (section 3): an action that lets its holder decide for other agents.
 export const RESOLVE_PREFIX = "decision.resolve.";
 

packages/organization/src/definitions.mjs

@@ -102,13 +102,13 @@ export function checkDefinition(name, entry, { assertClean = NO_STORE, where = "
 
 // The resolved role an `org:` instance launches with: loadRole's shape, so the business checks,
 // the resolver and the broker read it as they read a template. Instructions stand in for the
-// contract file (contractPath null). A definition hires nobody: hireable stays empty.
+// contract file (contractPath null). A definition grants no hiring authority.
 function resolved(name, entry, composition) {
   return {
     roleVersion: 2, name: ORG_PREFIX + name, title: name, contract: null, contractPath: null,
     tools: composition.tools, network: composition.network, authority: composition.authority,
     credentials: composition.credentials, messaging: composition.messaging, skills: composition.skills,
-    hireable: [], instructions: composition.instructions, personality: composition.personality,
+    instructions: composition.instructions, personality: composition.personality,
     rev: entry.rev, from: entry.from === undefined ? null : { ...entry.from },
   };
 }
@@ -130,8 +130,10 @@ export function checkDefinitions(definitions, file, options = {}) {
 
 // The instances that name `org:<name>`, sorted.
 export function instancesNaming(document, name) {
-  return Object.entries(document?.roles ?? {})
-    .filter(([, entry]) => entry?.definition === ORG_PREFIX + name).map(([instance]) => instance).sort();
+  const ref=ORG_PREFIX+name;
+  const users=Object.entries(document.roles??{}).filter(([,entry])=>entry.definition===ref).map(([instance])=>instance);
+  for(const [project,p]of Object.entries(document.projects??{}))for(const [instance,entry]of Object.entries(p.agents??{}))if(entry.definition===ref)users.push(`${project}.${instance}`);
+  return users.sort();
 }
 
 // ---- Templates ----
@@ -162,9 +164,10 @@ export function readTemplate(rolesDir, name) {
   } catch {
     refuse(`template ${name} is not valid JSON`);
   }
-  const role = validateRoleDocument(document, file, { hireable: false });
+  const role = validateRoleDocument(document, file);
   if (role.roleVersion !== 2) refuse(`template ${name} is role version 1 and has no contract`);
-  const contract = readFileSync(role.contractPath);
+  let contract;
+  try { contract = readFileSync(role.contractPath); } catch { refuse(`template ${name} contract is unavailable`); }
   return { name, role, contract: contract.toString("utf8"), sha256: frame(json, contract) };
 }
 

packages/organization/src/hire-decisions.mjs

@@ -0,0 +1,232 @@
+// A4: private, pinned proposals; public decision records contain metadata and hashes only.
+// This is a trusted host service, never a worker import or a credential binding writer.
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, lstatSync, openSync, closeSync, fsyncSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { buildRegistry, checkComposition } from './composition.mjs';
+import { compositionOf, entryFromTemplate, readTemplate, templateHashes } from './definitions.mjs';
+import { readRootAgentsFile, changeRootAgent } from './agent-levels-write.mjs';
+import { validateBusinessDocument } from './organization-config.mjs';
+import { canonicalJson, isPlainObject, readJsonFile } from './util.mjs';
+import { ID_PATTERN, NETWORKS } from './vocabulary.mjs';
+import { OrganizationError } from './organization.mjs';
+import { resolveInstance } from './resolve.mjs';
+import { checkRoutes } from './launch-settings.mjs';
+import { VERB_RIGHTS } from './org-rights.mjs';
+import { readRegistry, withRegistryWriter } from './org-registry.mjs';
+const fail = code => { throw new OrganizationError(code); };
+const hash = x => createHash('sha256').update(canonicalJson(x)).digest('hex');
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const keys = (x, allowed, required = []) => { if (!isPlainObject(x) || Object.keys(x).some(k => !allowed.includes(k)) || required.some(k => !Object.hasOwn(x,k))) fail('invalid-request'); };
+const id = x => { if (typeof x !== 'string' || !ID_PATTERN.test(x) || ['human','tester','user'].includes(x)) fail('invalid-request'); };
+const requestKeys = ['op','level','project','name','role','credentials','personality','route','reason'];
+export function authorizeHire(proposal, caller) {
+  if (!caller || caller.agent !== false) fail('human-required');
+  if (!caller.rights?.includes(VERB_RIGHTS['hire.resolve.console'])) fail('right-required');
+  if ((proposal.flagged.length || proposal.credentialLines.length) && caller.owner !== true) fail('hire-owner-required');
+  if (proposal.level === 'root' && caller.instanceOwner !== true) fail('hire-owner-required');
+}
+export function credentialLines(credentials) {
+  return credentials.flatMap(({service,scopes}) => scopes === undefined ? [{service}] : Array.isArray(scopes)
+    ? scopes.map(scope => ({service,scope})) : Object.entries(scopes).flatMap(([group,verbs]) => verbs.map(verb => ({service,scope:`${group}.${verb}`}))));
+}
+const publicOf = p => ({ id:p.id, revision:p.revision, op:p.request.op, level:p.request.level, name:p.request.name,
+  ...(p.request.project === undefined ? {} : {project:p.request.project}), route:p.request.route ?? null,
+  ...(p.entry ? {role:structuredClone(p.entry.role)} : {}),
+  // reason and all free text stay in the private proposal as well.
+  flagged:p.flagged, credentialLines:p.credentialLines, expiresAt:p.expiresAt, digest:hash(p) });
+export function hireDecisions({ writer, rolesDir, configDir, dataRoot, assertClean, system = {}, levels = () => null, catalogueFor = async () => null, registryFor = () => buildRegistry() }) {
+  const home = join(dataRoot,'authority-proposals');
+  let receiptCache;
+  const rootReceipts=()=>{
+    try{
+      const file=join(configDir,'agents-receipts.jsonl'),st=lstatSync(file,{bigint:true});
+      if(!st.isFile() || st.uid!==BigInt(process.getuid()) || (st.mode&0o022n) || st.nlink!==1n)throw new Error('unsafe receipts');
+      const stamp=[st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':');
+      if(receiptCache?.stamp===stamp)return receiptCache.rows;
+      const rows=readFileSync(file,'utf8').trim().split('\n').filter(Boolean).map(JSON.parse);
+      receiptCache={stamp,rows};return rows;
+    }
+    catch(error){if(error.code==='ENOENT')return [];throw error;}
+  };
+  let bootReceipts;
+  try{bootReceipts=rootReceipts();}catch{bootReceipts=null;}
+  const rootRefusal=name=>{
+    try {
+      if(!bootReceipts)return 'root-policy-unreadable';
+      const latest=rootReceipts().filter(r=>r.agent===name).at(-1),boot=bootReceipts.filter(r=>r.agent===name).at(-1);
+      if(latest?.verb==='root.agent.remove')return 'instance-fired';
+      return canonicalJson(latest??null)===canonicalJson(boot??null)?null:'copy-stale';
+    } catch {return 'root-policy-unreadable';}
+  };
+  async function assertRootFireLocal(business,registry=undefined) {
+    if(registry===undefined)registry=await readRegistry({configDir});
+    // Another organization can retain a boot snapshot and live external grants even after
+    // excludeOrgs changes. Without a cross-bus revoke protocol, refuse conservatively.
+    const others=new Set(Object.keys(registry?.orgs??{}));
+    for(const file of readdirSync(join(configDir,'businesses')))if(file.endsWith('.json') && ID_PATTERN.test(file.slice(0,-5)))others.add(file.slice(0,-5));
+    others.delete(business);
+    if(others.size)throw new OrganizationError('root-fire-shared',`root fire requires coordinated revocation in ${[...others].sort().join(', ')}`);
+  }
+  const location = value => { if (!UUID.test(value)) fail('invalid-request'); return join(home,`${value}.json`); };
+  const read = value => { try { return readJsonFile(location(value),'private hire proposal',st=>{if(st.uid!==process.getuid() || st.mode&0o077 || st.nlink!==1)fail('decision-stale');}); } catch { fail('decision-stale'); } };
+  async function prepare(business, input, { id: decision, expiresAt }) {
+    keys(input,requestKeys,['op','level','name','reason']); id(input.name);
+    if (!['hire','fire','change'].includes(input.op) || !['org','project','root'].includes(input.level)) fail('invalid-request');
+    if (typeof input.reason!=='string' || input.reason.trim().length===0 || input.reason.length>500) fail('invalid-request');
+    if (typeof assertClean!=='function') fail('definition-secret-check-required');
+    assertClean(input);
+    if (input.level==='project') id(input.project); else if ('project' in input) fail('invalid-request');
+    if (input.op!=='fire') {
+      keys(input.route,['harness','model','thinking'],['harness','model']);
+      for (const x of Object.values(input.route)) if (typeof x!=='string' || !x || x.length>200) fail('invalid-request');
+      keys(input.role,['template','sha256','definition','rev','inline']);
+      const count=['template','definition','inline'].filter(k=>k in input.role).length;
+      if (count!==1) fail('invalid-request');
+      if ('template' in input.role) { id(input.role.template); if (!/^[a-f0-9]{64}$/.test(input.role.sha256??'') || Object.keys(input.role).length!==2) fail('invalid-request'); }
+      if ('definition' in input.role) { id(input.role.definition); if (!Number.isSafeInteger(input.role.rev) || Object.keys(input.role).length!==2) fail('invalid-request'); }
+      if ('inline' in input.role && Object.keys(input.role).length!==1) fail('invalid-request');
+    } else if (['role','route','credentials','personality'].some(k=>k in input)) fail('invalid-request');
+    const {document:doc,revision} = writer.read(business);
+    const loaded = validateBusinessDocument(doc,`${business}.json`,{rolesDir,dataRoot});
+    let chief=loaded.definitions[doc.roles[doc.launch?.by]?.definition];
+    if(chief) {const resolved=resolveInstance({system,business:loaded,instance:doc.launch.by});chief={...chief,...resolved.limits};}
+    if (!chief) fail('no-chief-of-staff');
+    const root = input.level==='root' ? await readRootAgentsFile(configDir) : null;
+    if(input.level==='root' && input.op==='fire')await assertRootFireLocal(business);
+    if(root?.document.retired?.includes(input.name))fail('organization-instance-retired');
+    const entries = input.level==='root' ? root.document.agents : input.level==='org' ? doc.roles : doc.projects[input.project]?.agents ?? {};
+    if (input.level==='project' && (!doc.projects[input.project] || doc.projects[input.project].kind==='library')) fail('project-agents-invalid');
+    if ((doc.retired??[]).includes(input.name)) fail('organization-instance-retired');
+    if ((doc.launch?.keep??[]).includes(input.name)) fail('instance-kept');
+    if (input.op==='hire' && (doc.launch?.noHire??[]).includes(input.role?.template??input.role?.definition))fail('definition-not-hireable');
+    if ((input.op==='hire') === Object.hasOwn(entries,input.name)) fail(input.op==='hire'?'organization-instance-exists':'organization-unknown-instance');
+    if (input.name===doc.launch?.by || Object.values(doc.arbiters).includes(input.name)) fail('organization-instance-referenced');
+    let entry=null, flagged=[], lines=[];
+    if (input.op!=='fire') {
+      const ref=input.role;
+      if ('template' in ref) { const template=readTemplate(rolesDir,ref.template); if(template.sha256!==ref.sha256) fail('decision-stale'); entry=entryFromTemplate(template); }
+      else if ('definition' in ref) { entry=doc.definitions?.[ref.definition]; if(!entry || entry.rev!==ref.rev) fail('definition-rev-conflict'); entry=structuredClone(entry); }
+      else entry={rev:1,role:{},instructions:''};
+      let c='inline' in ref ? structuredClone(ref.inline) : compositionOf(entry);
+      if ('credentials' in input) c.credentials=structuredClone(input.credentials);
+      if ('personality' in input) c.personality=structuredClone(input.personality);
+      const checked=checkComposition(c,registryFor(doc),chief,{assertClean});
+      const {instructions,personality,...role}=checked.composition;
+      if(role.messaging===null)delete role.messaging;
+      entry={...entry,role,instructions,...(personality===null?{}:{personality})};
+      if(personality===null)delete entry.personality;
+      flagged=checked.flagged; lines=credentialLines(checked.composition.credentials);
+      // Validate the proposed route through the existing host route policy before a proposal
+      // reaches approval. Use a temporary org instance for project/root route validation too.
+      const routeDoc=structuredClone(doc), definition=`hire-${decision}`;
+      routeDoc.definitions={...(routeDoc.definitions??{}),[definition]:entry};
+      routeDoc.roles[input.name]={definition:`org:${definition}`,vars:input.route,hireDecision:decision};
+      const proposed=validateBusinessDocument(routeDoc,`${business}.json`,{rolesDir,dataRoot});
+      checkRoutes({proposed,old:loaded,levels,catalogue:await catalogueFor(business,doc)});
+    }
+    const current=entries[input.name];
+    if(input.op==='fire') {
+      const definition=current?.definition;
+      const value=definition?.startsWith('org:') ? (input.level==='root'?root.document.definitions:doc.definitions)?.[definition.slice(4)] : entryFromTemplate(readTemplate(rolesDir,definition));
+      if(!value)fail('definition-missing');
+      const checked=checkComposition(compositionOf(value),registryFor(doc),chief,{assertClean});
+      flagged=checked.flagged;lines=credentialLines(checked.composition.credentials);
+    }
+    if(input.op==='change' && current?.definition?.startsWith('org:') && input.level!=='root') {
+      const users=Object.entries(doc.roles).filter(([,e])=>e.definition===current.definition).map(([n])=>`org:${n}`);
+      for(const [project,value] of Object.entries(doc.projects))for(const [n,e]of Object.entries(value.agents??{}))if(e.definition===current.definition)users.push(`project:${project}:${n}`);
+      const target=input.level==='org'?`org:${input.name}`:`project:${input.project}:${input.name}`;
+      if(users.some(n=>n!==target))fail('definition-shared');
+    }
+    if(input.op==='change' && input.level==='root' && Object.entries(root.document.agents).some(([name,e])=>name!==input.name && e.definition===current.definition))fail('definition-shared');
+    const targetDefinition=input.op==='change' && current?.definition?.startsWith('org:') ? current.definition.slice(4) : `hire-${decision}`;
+    const p={id:decision,business,revision,rootRevision:root?.revision??null,request:structuredClone(input),entry,definition:targetDefinition,flagged,credentialLines:lines,expiresAt};
+    mkdirSync(home,{recursive:true,mode:0o700});
+    const st=lstatSync(home); if(!st.isDirectory() || st.isSymbolicLink() || st.uid!==process.getuid() || st.mode&0o077)fail('organization-refused');
+    const fd=openSync(location(decision),'wx',0o600);
+    try { writeFileSync(fd,JSON.stringify(p)); fsyncSync(fd); } finally { closeSync(fd); }
+    return publicOf(p);
+  }
+  async function adjusted(business, decision, adjust) {
+    const p=read(decision);
+    if(p.business!==business)fail('decision-stale');
+    if(adjust===undefined)return p;
+    keys(adjust,['role','credentials','route']);
+    if(!p.entry)fail('invalid-request');
+    assertClean(adjust);
+    const before=compositionOf(p.entry), after=structuredClone(before);
+    if(adjust.role!==undefined) {
+      keys(adjust.role,['tools','network','authority','messaging','skills']);
+      Object.assign(after,structuredClone(adjust.role));
+    }
+    if(adjust.credentials!==undefined)after.credentials=structuredClone(adjust.credentials);
+    const doc=writer.read(business).document;
+    const loaded=validateBusinessDocument(doc,`${business}.json`,{rolesDir,dataRoot});
+    const chief=loaded.definitions[doc.roles[doc.launch.by].definition];
+    const resolved=resolveInstance({system,business:loaded,instance:doc.launch.by});
+    const checked=checkComposition(after,registryFor(doc),{...chief,...resolved.limits},{assertClean});
+    const c=checked.composition, subset=(a,b)=>a.every(x=>b.includes(x));
+    if(!subset(c.tools,before.tools) || !subset(c.skills,before.skills??[]) || NETWORKS.indexOf(c.network)>NETWORKS.indexOf(before.network))fail('invalid-request');
+    // Treat the two authority domains literally. Moving an action to the other domain widens it.
+    for(const domain of ['withinRole','crossRole'])if(!subset(c.authority[domain],before.authority[domain]))fail('invalid-request');
+    if(before.messaging)for(const direction of ['sendTo','receiveFrom'])if(!c.messaging || !subset(c.messaging[direction],before.messaging[direction]))fail('invalid-request');
+    if(!subset(credentialLines(c.credentials).map(canonicalJson),credentialLines(before.credentials).map(canonicalJson)))fail('invalid-request');
+    const {instructions,personality,...role}=c;
+    if(role.messaging===null)delete role.messaging;
+    p.entry={...p.entry,role,instructions,...(personality===null?{}:{personality})};
+    p.flagged=checked.flagged;p.credentialLines=credentialLines(c.credentials);
+    if(adjust.route!==undefined) {
+      keys(adjust.route,['harness','model','thinking'],['harness','model']);
+      if(Object.values(adjust.route).some(x=>typeof x!=='string'||!x||x.length>200))fail('invalid-request');
+      p.request.route=structuredClone(adjust.route);
+    }
+    const routeDoc=structuredClone(doc), definition=`hire-${decision}`;
+    routeDoc.definitions={...(routeDoc.definitions??{}),[definition]:p.entry};
+    routeDoc.roles[p.request.name]={definition:`org:${definition}`,vars:p.request.route,hireDecision:decision};
+    checkRoutes({proposed:validateBusinessDocument(routeDoc,`${business}.json`,{rolesDir,dataRoot}),old:loaded,levels,catalogue:await catalogueFor(business,doc)});
+    // Bind the adjustment itself as well as its result. A confirmation cannot be reused for
+    // another edit, even when two edits happen to result in the same primitive set.
+    p.adjust=structuredClone(adjust);
+    return p;
+  }
+  async function check(business, decision, caller) {
+    const p=await adjusted(business,decision,caller.adjust), view=publicOf(p);
+    if (p.business!==business || caller.digest!==view.digest)fail('decision-stale');
+    if(Date.parse(p.expiresAt)<=(caller.now??Date.now)())fail('decision-expired');
+    authorizeHire(view,caller);
+    if(writer.read(business).revision!==p.revision)fail('decision-stale');
+    // Re-run composition against current policy and scan private text again before any effect.
+    if(p.entry) {
+      const doc=writer.read(business).document;
+      const loaded=validateBusinessDocument(doc,`${business}.json`,{rolesDir,dataRoot});
+      const chief=loaded.definitions[doc.roles[doc.launch.by].definition];
+      const resolved=resolveInstance({system,business:loaded,instance:doc.launch.by});
+      const checked=checkComposition(compositionOf(p.entry),registryFor(doc),{...chief,...resolved.limits},{assertClean});
+      if(canonicalJson(checked.flagged)!==canonicalJson(p.flagged))fail('decision-stale');
+      if(p.request.role.template && readTemplate(rolesDir,p.request.role.template).sha256!==p.request.role.sha256)fail('decision-stale');
+    }
+    if(p.rootRevision!==null && (await readRootAgentsFile(configDir)).revision!==p.rootRevision)fail('decision-stale');
+    if(p.request.level==='root' && p.request.op==='fire')await assertRootFireLocal(business);
+    return p;
+  }
+  async function apply(business, decision, caller) {
+    const p=await check(business,decision,caller);
+    const r=p.request;
+    const vars=r.route ? {harness:r.route.harness,model:r.route.model,...(r.route.thinking?{thinking:r.route.thinking}:{})} : {};
+    const currentDoc=r.level==='root'?(await readRootAgentsFile(configDir)).document:writer.read(business).document;
+    const approvedEntry=p.entry?{...p.entry,rev:(currentDoc.definitions?.[p.definition]?.rev??0)+1}:null;
+    const excluded=r.level==='root' && r.op==='change' ? currentDoc.agents[r.name]?.excludeOrgs : undefined;
+    const entry=r.op==='fire'?null:{definition:`org:${p.definition}`,vars,hireDecision:p.id,...(excluded===undefined?{}:{excludeOrgs:excluded})};
+    if(r.level==='root') {
+      const publish=()=>changeRootAgent(configDir,{revision:p.rootRevision,name:r.name,entry},
+        {actor:caller.subject,owner:caller.subject,rolesDir,approvedDefinition:p.entry?{name:p.definition,entry:approvedEntry}:null,decision:p.id,assertClean,beforeReplace:caller.beforeWrite});
+      if(r.op==='fire')return withRegistryWriter(configDir,async registry=>{await assertRootFireLocal(business,registry);return publish();});
+      return publish();
+    }
+    if(r.level==='project') return writer.setProjectAgent(business,{revision:p.revision,project:r.project,name:r.name,entry},caller.actor,
+      {approvedDefinition:p.entry?{name:p.definition,entry:approvedEntry}:null,decision:p.id,assertClean,beforeWrite:caller.beforeWrite});
+    return writer.applyHireDecision(business,p,{actor:caller.actor,assertClean});
+  }
+  return {prepare,templates:()=>({templates:templateHashes(rolesDir).map(({template,sha256})=>({name:template,sha256}))}),preview:async(business,decision,caller)=>{const p=await adjusted(business,decision,caller.adjust);if(Date.parse(p.expiresAt)<=(caller.now??Date.now)())fail('decision-expired');authorizeHire(publicOf(p),caller);return publicOf(p);},rootRefusal,rootActive:name=>rootRefusal(name)===null,check:async(...args)=>{await check(...args);},apply,read: decision => publicOf(read(decision))};
+}

packages/organization/src/index.mjs

@@ -6,9 +6,9 @@
 
 export { OrganizationConfigError, BusinessError } from "./errors.mjs";
 export {
-  ACTIONS, GATED_ONLY, HIRE_ALLOWED, TOOLS, NETWORKS, SERVICES, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
+  ACTIONS, GATED_ONLY, TOOLS, NETWORKS, SERVICES, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
 } from "./vocabulary.mjs";
-export { validateRoleDocument, loadRoleFile, loadRole, unhireableAction } from "./role.mjs";
+export { validateRoleDocument, loadRoleFile, loadRole } from "./role.mjs";
 export { LAYERS, REGISTRY, THINKING, FALLBACK_VARS, checkVars, mergeVars } from "./vars.mjs";
 export { parseCredentialRef, checkCredentialRef } from "./credentials.mjs";
 export {

packages/organization/src/instance-settings.mjs

@@ -22,10 +22,6 @@ const VETO_OPS = ["keep", "unkeep", "nohire", "hire"];
 const SCOPE_KEYS = ["revision", "scope"];
 const id = value => typeof value === "string" && ID_PATTERN.test(value);
 const revisionOk = value => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
-// Row 194 (D2.2, N3): the vars a hire may set, the ones the chief can already set on an instance.
-// Every limits.* key merges by intersection, so it can only narrow.
-const HIRE_VAR = key => key === "model" || key.startsWith("limits.");
-
 // Row 256 (#1761, REQ-COS-3): the END_PROTECTED part of a delete, for one actor. A creative
 // instance is the human's to delete, and any other actor is refused, as row 213 refuses it a
 // change. The assistant is refused for every actor, the human included. The listing's
@@ -347,56 +343,13 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
     return { ...commit(business, old, next, { revision: args.revision, actor }), scope, old: before };
   }
 
-  // Row 194 (#1692, D2.2): the chief's hire, after the broker's identity, grant, allowlist and
-  // hireable checks. args { name, definition, vars? }. A new name is added and listed. A fired name
-  // (declared, not listed) is listed again only with its own definition and no vars. The writer
-  // reads the file as it stands, so a veto or retire written since the broker's copy still counts.
-  function prepareHire(business, args) {
-    const { document: old, revision } = writer.read(business);
-    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
-    const { name, definition } = args;
-    // FED R3 r4 (sage-2557): and user, the granted user's principal, which the broker's load check refuses.
-    if (!id(name) || !id(definition) || name === "human" || name === "tester" || name === "user") throw new OrganizationError("invalid-request");
-    if (Object.hasOwn(args, "vars") && (!isPlainObject(args.vars) || !Object.keys(args.vars).every(HIRE_VAR))) {
-      throw new OrganizationError("invalid-request", "hire vars may set only model and limits keys");
-    }
-    if ((old.launch.noHire ?? []).includes(definition)) throw new OrganizationError("definition-not-hireable");
-    // Row 213 (M10): definitionFor lets a creative definition through for the human's add and
-    // change. A hire is the chief's, so it refuses one here.
-    if (CREATIVE_DEFINITIONS.includes(definition)) {
-      throw new OrganizationError("definition-not-hireable", `${definition} is a creative definition, which only the human adds`);
-    }
-    if ((old.retired ?? []).includes(name)) throw new OrganizationError("organization-instance-retired");
-    if ((old.launch.keep ?? []).includes(name)) throw new OrganizationError("instance-kept");
-    const next = structuredClone(old);
-    if (Object.hasOwn(old.roles, name)) {
-      const fired = !old.launch.instances.includes(name) && old.launch.by !== name;
-      if (!fired || old.roles[name].definition !== definition || Object.hasOwn(args, "vars")) {
-        throw new OrganizationError("organization-instance-exists");
-      }
-    } else {
-      next.roles[name] = { definition, ...(Object.hasOwn(args, "vars") ? { vars: structuredClone(args.vars) } : {}) };
-    }
-    // mos-1585: duplicates refuse before definition eligibility, with no file or credential effect.
-    definitionFor(rolesDir, definition);
-    next.launch.instances.push(name);
-    return { old, next, revision };
-  }
-  // Trusted read-only lifecycle preparation; the writer uses the same checks again.
-  function checkHire(business, args) {
-    return { revision: prepareHire(business, args).revision };
-  }
-  function hire(business, args, { actor, context }) {
-    const { old, next, revision } = prepareHire(business, args);
-    return commit(business, old, next, { revision, actor, context });
-  }
-
   // Row 194 (D2.2 step B): the fire's delist. An instance already delisted is done, so a repeated
   // fire after a failed step C goes on to consume (webby-0011 B2). The checks repeat against the file.
   function fire(business, args, { actor, context }) {
     const { document: old, revision } = writer.read(business);
     const { name } = args;
     fireChecks(old, name);
+    if(args.revision!==undefined && args.revision!==revision)throw new OrganizationError("revision-conflict");
     // Item 8: fire revokes each service of the entry and keeps the store directory (sage-1593).
     const services = Object.keys(old.roles[name].credentials ?? {});
     // webby-0094 N1: an instance already delisted (a hand edit, or a repeat after step B) still has
@@ -473,5 +426,5 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
     return { ...read(business, actor), transaction: receipt.transaction, restart: false };
   }
 
-  return { writer, read, set, checkDelete, checkFire, checkHire, veto, hire, fire, grantScope, grantScopeRead };
+  return { writer, read, set, checkDelete, checkFire, veto, fire, grantScope, grantScopeRead };
 }

packages/organization/src/org-rights.mjs

@@ -67,6 +67,9 @@ export const VERB_RIGHTS = record({
   'decision.preview.console': 'decide',
   'decision.resolve.console': 'decide',
   'hire.resolve.console': 'org.hire',
+  'hire.preview.console': 'org.hire',
+  'hire.start.console': 'org.hire',
+  'hire.templates.console': 'org.hire',
   // #1873 T1: the human verbs on an organization's own definitions.
   'definition.import.console': 'org.hire',
   'definition.edit.console': 'org.hire',

packages/organization/src/organization-config.mjs

@@ -135,7 +135,7 @@ function checkRoles(roles, file, rolesDir, business, hasLibrary, orgDefinitions)
     requireId(instance, `${where} instance name`);
     const at = `${where}.${instance}`;
     requireObject(entry, at);
-    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish", "hosts"], at);
+    rejectUnknownKeys(entry, ["definition", "holder", "vars", "tracker", "credentials", "identity", "publish", "hosts", "hireDecision"], at);
     // #1873 T1: "org:<name>" names one of this file's definitions; anything else is a template.
     const orgName = orgDefinitionName(entry.definition);
     if (orgName === null) requireId(entry.definition, `${at}.definition`);
@@ -147,6 +147,9 @@ function checkRoles(roles, file, rolesDir, business, hasLibrary, orgDefinitions)
     definitions[entry.definition] = definition;
     if (definition.roleVersion !== 2) refuse(`${at}: role definition ${entry.definition} is version 1 and can't back a business role instance`);
     const services = definition.credentials.map((c) => c.service);
+    const hired = typeof entry.hireDecision === 'string' && /^[a-f0-9-]{36}$/.test(entry.hireDecision) && orgName !== null;
+    if (entry.hireDecision !== undefined && !hired) refuse(`${at}.hireDecision must name an approved composition decision`);
+    const missing = hired ? services.filter(s => s !== HOST_SERVICE && !Object.hasOwn(entry.credentials ?? {},s)) : [];
     if (entry.hosts !== undefined) refuse(`${at}.hosts ${HOSTS_MOVED}`);
     // A host.<id> key reference comes from the agent's grant record at bus start (r6 X4), never from here.
     // Row 285 amendment 1 (mos-1580): the chief needs its read reference only for a library.
@@ -157,12 +160,12 @@ function checkRoles(roles, file, rolesDir, business, hasLibrary, orgDefinitions)
     }
     let tracker = null;
     if (services.includes("vikunja")) {
-      if (entry.tracker === undefined) refuse(`${at} needs "tracker" with its Vikunja bot, because ${entry.definition} uses vikunja`);
-      tracker = checkBot(entry.tracker, `${at}.tracker`);
-      if (bots.has(tracker.bot)) refuse(`${at}.tracker.bot ${tracker.bot} is used by another instance`);
-      if (botIds.has(tracker.botId)) refuse(`${at}.tracker.botId ${tracker.botId} is used by another instance`);
-      bots.add(tracker.bot);
-      botIds.add(tracker.botId);
+      if (entry.tracker === undefined && !missing.includes("vikunja")) refuse(`${at} needs "tracker" with its Vikunja bot, because ${entry.definition} uses vikunja`);
+      tracker = missing.includes("vikunja") ? null : checkBot(entry.tracker, `${at}.tracker`);
+      if (tracker && bots.has(tracker.bot)) refuse(`${at}.tracker.bot ${tracker.bot} is used by another instance`);
+      if (tracker && botIds.has(tracker.botId)) refuse(`${at}.tracker.botId ${tracker.botId} is used by another instance`);
+      if(tracker) bots.add(tracker.bot);
+      if(tracker) botIds.add(tracker.botId);
     } else if (entry.tracker !== undefined) {
       refuse(`${at} has "tracker" but ${entry.definition} uses no vikunja credential`);
     }
@@ -171,9 +174,10 @@ function checkRoles(roles, file, rolesDir, business, hasLibrary, orgDefinitions)
       holder: entry.holder === undefined ? null : requireId(entry.holder, `${at}.holder`),
       vars: checkVars(entry.vars ?? {}, "agent", `${at}.vars`),
       tracker,
-      credentials: checkCredentialMap(entry.credentials ?? {}, kinds, `${at}.credentials`,
+      credentials: checkCredentialMap(entry.credentials ?? {}, hired ? kinds.filter(s=>!missing.includes(s)) : kinds, `${at}.credentials`,
         { configDir: dirname(dirname(file)), business, agent: instance }),
     };
+    if(hired) { out[instance].hireDecision=entry.hireDecision; out[instance].unbound=missing; }
     // Row 199 (#1697, design D8, D9 step 2): identity and publish are optional, so today's files
     // load unchanged. publish needs both an identity and a gitea credential; the project ids it
     // names are checked against projects once those are read.
@@ -300,7 +304,7 @@ export function validateOrganizationDocument(document, file, { rolesDir, dataRoo
     rejectUnknownKeys(entry, ["root", "repo", "remote", "git", "agents"], `${file} projects.${id}`);
     // #1873 A1: the project's own agent entries. Checked so a bad entry refuses the whole file, but
     // not copied below: nothing a bus loads sees them; only the Console's agent-levels read does.
-    if (Object.hasOwn(entry, "agents")) checkProjectAgents(entry.agents, { rolesDir, where: `projects.${id}.agents` });
+    if (Object.hasOwn(entry, "agents")) checkProjectAgents(entry.agents, { rolesDir, where: `projects.${id}.agents`, definitions:document.definitions });
     if (typeof entry.root !== "string" || !isAbsolute(entry.root) || normalize(entry.root) !== entry.root || entry.root.includes("\0")) {
       refuse(`${file} projects.${id}.root must be a normalized absolute path`);
     }

packages/organization/src/organization.mjs

@@ -448,7 +448,7 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
   // candidate and the serialized bytes: nothing but that entry changes, the project exists and is not
   // a library, and the project's entries and union pass A1's checks against the current root level.
   // The change log names paths only; the detail names the project, the agent and the form.
-  function setProjectAgent(id, { revision, project, name, entry }, actor) {
+  function setProjectAgent(id, { revision, project, name, entry }, actor, approval = null) {
     requireId(id, "organization id");
     requireId(project, "project id");
     requireId(name, "agent name");
@@ -456,9 +456,17 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
     const root = rootForProjectCheck(dir, rolesDir);
     const guard = (old, document) => {
       const agents = Object.entries(old.roles ?? {}).flatMap(([n, role]) => [n, `${role?.definition}.${n}`]);
-      if (actor !== old.human || actor === "tester" || agents.includes(actor)) fail("human-required");
+      if ((!approval && actor !== old.human) || actor === "tester" || agents.includes(actor)) fail("human-required");
       if (entry === null && old.projects?.[project]?.agents?.[name] === undefined) fail("agent-not-found", `projects.${project}.agents.${name} does not exist`);
-      const problem = projectAgentProblem(old, document, { orgId: id, project, name, entry, rolesDir, root });
+      const checked = structuredClone(document);
+      if (approval?.approvedDefinition) {
+        const { name: def, entry: value } = approval.approvedDefinition;
+        checkDefinition(def, value, { assertClean: approval.assertClean });
+        const expected = { ...(old.definitions ?? {}), [def]: value };
+        if (canonicalJson(document.definitions) !== canonicalJson(expected)) fail("organization-definitions-only");
+        if (old.definitions === undefined) delete checked.definitions; else checked.definitions = old.definitions;
+      }
+      const problem = projectAgentProblem(old, checked, { orgId: id, project, name, entry, rolesDir, root, definitions: document.definitions });
       if (problem) fail(...problem);
     };
     return commit(id, old => {
@@ -467,8 +475,46 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
       const agents = { ...(target.agents ?? {}) };
       if (entry === null) delete agents[name]; else agents[name] = entry;
       const { agents: _drop, ...rest } = target;
-      return { ...old, projects: { ...old.projects, [project]: Object.keys(agents).length ? { ...rest, agents } : rest } };
-    }, { revision, actor, guard, pathsOnly: true, detail: { verb: "project.agents.set", project, agent: name, form: entryForm(entry) } });
+      return { ...old, ...(approval?.approvedDefinition ? {definitions:{...(old.definitions??{}),[approval.approvedDefinition.name]:approval.approvedDefinition.entry}} : {}), projects: { ...old.projects, [project]: Object.keys(agents).length ? { ...rest, agents } : rest } };
+    }, { revision, actor, guard, beforeWrite:approval?.beforeWrite, pathsOnly: true, detail: { verb: "project.agents.set", project, agent: name, form: entryForm(entry), ...(approval?.decision ? {decision:approval.decision}: {}) } });
+  }
+
+  // A4 trusted decision executor: one locked publication of the role, route and definition.
+  // The broker has consumed the matching digest before entering this host-only writer.
+  function applyHireDecision(id, proposal, { actor, assertClean, beforeWrite = null }) {
+    const { request: r, definition, entry, revision } = proposal;
+    if (!proposal.id || r.level !== 'org') fail('invalid-request');
+    const build = old => {
+      if (actor === 'tester' || Object.entries(old.roles).some(([n,e]) => actor === n || actor === `${e.definition}.${n}`)) fail('human-required');
+      if ((old.launch?.keep ?? []).includes(r.name)) fail('instance-kept');
+      if ((old.retired ?? []).includes(r.name)) fail('organization-instance-retired');
+      if (r.name === old.launch?.by || Object.values(old.arbiters).includes(r.name)) fail('organization-instance-referenced');
+      const exists = Object.hasOwn(old.roles,r.name);
+      if ((r.op === 'hire') === exists) fail(r.op === 'hire' ? 'organization-instance-exists' : 'organization-unknown-instance');
+      const next = structuredClone(old);
+      if (r.op === 'fire') {
+        next.launch.instances = next.launch.instances.filter(n => n !== r.name);
+      } else {
+        if (typeof assertClean !== 'function') fail('definition-secret-check-required');
+        const current=old.definitions?.[definition];
+        const value={...entry,rev:current?current.rev+1:1};
+        checkDefinition(definition,value,{assertClean});
+        next.definitions={...(old.definitions??{}),[definition]:value};
+        const {harness:_h,model:_m,thinking:_t,...otherVars}=old.roles[r.name]?.vars??{};
+        const vars={...otherVars,harness:r.route.harness,model:r.route.model,...(r.route.thinking?{thinking:r.route.thinking}:{})};
+        next.roles[r.name]={...(old.roles[r.name]??{}),definition:`org:${definition}`,vars,hireDecision:proposal.id};
+        // Bindings never move between roles. A role change can retain only services it still declares.
+        const services=entry.role.credentials.map(c=>c.service);
+        if(next.roles[r.name].credentials)next.roles[r.name].credentials=Object.fromEntries(Object.entries(next.roles[r.name].credentials).filter(([s])=>services.includes(s)));
+        if(!services.includes('vikunja'))delete next.roles[r.name].tracker;
+        if(!next.launch.instances.includes(r.name))next.launch.instances.push(r.name);
+      }
+      return next;
+    };
+    return commit(id, build, {revision,actor,beforeWrite,pathsOnly:true,guard:(old,next)=>{
+      if(canonicalJson(next)!==canonicalJson(build(old)))fail('organization-definitions-only');
+      projectsProtected(old,next);
+    },context:{decision:proposal.id,digest:proposal.digest??null},detail:{verb:'hire.apply',decision:proposal.id,op:r.op,agent:r.name}});
   }
 
   // Runs `fn({ revision, document })` under the writer lock, after recovery, and nothing else may
@@ -538,5 +584,5 @@ export function organizationWriter({ dir, rolesDir, dataRoot = null, barrier = (
     });
   }
 
-  return { logFile, read, readRaw, write, addProject, setProjectRemote, setProjectAgent, setDefinition, hold, holdAsync, findAddition, record, recover: id => withLock(id, () => recover(id)) };
+  return { logFile, read, readRaw, write, addProject, setProjectRemote, setProjectAgent, setDefinition, applyHireDecision, hold, holdAsync, findAddition, record, recover: id => withLock(id, () => recover(id)) };
 }

packages/organization/src/role.mjs

@@ -9,7 +9,7 @@ import { basename, dirname, join } from "node:path";
 import { refuse } from "./errors.mjs";
 import {
   ACTIONS, GATED_ONLY, TOOLS, NETWORKS, SERVICES, HOST_SERVICE, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
-  CREATIVE_DEFINITIONS, CREATIVE_TOOLS, CREATIVE_ACTIONS, CREATIVE_SERVICE, unhireableAction,
+  CREATIVE_DEFINITIONS, CREATIVE_TOOLS, CREATIVE_ACTIONS, CREATIVE_SERVICE,
 } from "./vocabulary.mjs";
 import {
   requireObject, rejectUnknownKeys, requireId, requireString, requireDistinctList, readJsonFile, deepFreeze,
@@ -20,7 +20,7 @@ import { pluginName } from "../../plugins/src/organization.mjs";
 const CONTRACT_NAME = /^[a-z0-9][a-z0-9._-]{0,60}\.md$/;
 const V1_KEYS = ["roleVersion", "name", "tools", "network"];
 const V2_REQUIRED = ["roleVersion", "name", "title", "contract", "tools", "network", "authority", "credentials"];
-const V2_KEYS = [...V2_REQUIRED, "messaging", "skills", "hireable"];
+const V2_KEYS = [...V2_REQUIRED, "messaging", "skills"];
 const SKILL_NAME = /^[A-Za-z0-9._-]+$/;
 
 function checkTools(tools) {
@@ -78,26 +78,6 @@ function checkSkills(skills) {
   });
 }
 
-// Row 194 (#1692, D2.3): unhireableAction is vocabulary.mjs's, exported here as before.
-export { unhireableAction };
-
-// Row 194 (#1692, D2.3): optional. The role definitions this role may hire, by name. Each one must
-// be a version 2 file in the same directory whose every action is on HIRE_ALLOWED. The named file
-// is validated without its own "hireable" check, so a list can't recurse. A creative definition
-// (row 213, M10) is never hireable: only the human adds one.
-function checkHireable(hireable, file) {
-  const dir = dirname(file);
-  return requireDistinctList(hireable, "role hireable", (name) => {
-    requireId(name, "role hireable entry");
-    if (CREATIVE_DEFINITIONS.includes(name)) refuse(`hireable names ${name}, a creative definition only the human adds`);
-    const path = join(dir, `${name}.json`);
-    if (!existsSync(path)) refuse(`hireable names a definition which has no role file`);
-    const named = validateRoleDocument(readJsonFile(path, `role file ${name}.json`), path, { hireable: false });
-    if (named.roleVersion !== 2) refuse(`hireable names a definition which is role version 1`);
-    const outside = unhireableAction(named);
-    if (outside !== null) refuse(`hireable names ${name}, which holds ${outside} outside the hireable ceiling`);
-  });
-}
 
 function checkGiteaScopes(scopes) {
   const list = requireDistinctList(scopes, "gitea scopes", (scope) => {
@@ -189,9 +169,8 @@ function checkCreative(role) {
 // Validate a parsed role document read from `file`. Returns a frozen role:
 // { roleVersion, name, title, contract, contractPath, tools, network,
 //   authority: { withinRole, crossRole }, credentials: [{ service, scopes }],
-//   messaging: { sendTo, receiveFrom } | null, skills: [name], hireable: [name] }.
-// options.hireable false skips the hireable list's checks of other files (D2.3) and keeps the list.
-export function validateRoleDocument(document, file, options = {}) {
+//   messaging: { sendTo, receiveFrom } | null, skills: [name] }.
+export function validateRoleDocument(document, file) {
   requireObject(document, "role");
   if (document.roleVersion !== 1 && document.roleVersion !== 2) refuse('role "roleVersion" must be 1 or 2');
   rejectUnknownKeys(document, document.roleVersion === 1 ? V1_KEYS : V2_KEYS, "role");
@@ -204,7 +183,7 @@ export function validateRoleDocument(document, file, options = {}) {
     const network = document.network === undefined ? "none" : checkNetwork(document.network);
     return deepFreeze({
       roleVersion: 1, name: document.name, title: null, contract: null, contractPath: null, tools, network,
-      authority: { withinRole: [], crossRole: [] }, credentials: [], messaging: null, skills: [], hireable: [],
+      authority: { withinRole: [], crossRole: [] }, credentials: [], messaging: null, skills: [],
     });
   }
   for (const key of V2_REQUIRED) {
@@ -222,9 +201,6 @@ export function validateRoleDocument(document, file, options = {}) {
     credentials: checkCredentials(document.credentials),
     messaging: document.messaging === undefined ? null : checkMessaging(document.messaging),
     skills: document.skills === undefined ? [] : checkSkills(document.skills),
-    hireable: document.hireable === undefined ? []
-      : options.hireable === false ? requireDistinctList(document.hireable, "role hireable", (name) => requireId(name, "role hireable entry"))
-        : checkHireable(document.hireable, file),
   };
   return deepFreeze(CREATIVE_DEFINITIONS.includes(role.name) ? checkCreative(role) : role);
 }

packages/organization/src/vocabulary.mjs

@@ -46,6 +46,7 @@ export const ACTIONS = Object.freeze([
   // runs and delists it). Hard waits under PRD 1.6 (mos-1017), routed under PRD 1.7 REQ-COS-3.
   "role.hire",
   "role.fire",
+  "role.change",
   "credential.mint",
   "spend",
   "deploy",
@@ -98,6 +99,7 @@ export const ROUTED = Object.freeze([
   // PRD 1.7 REQ-COS-3 (row 194, #1692): the chief's hire and fire, within the bounds the broker checks.
   "role.hire",
   "role.fire",
+  "role.change",
   // PRD 1.16 REQ-WAIT-3 and REQ-LIB-6 (row 285, #1790): a creative agent's library write, within the
   // bounds that paragraph names.
   "library.write",
@@ -110,30 +112,6 @@ export const ROUTED = Object.freeze([
 // git.push.remote, host.sudo (row 210) and deploy; a test pins the list.
 export const GATED_ONLY = Object.freeze(ACTIONS.filter((action) => !ROUTED.includes(action)));
 
-// Row 194 (#1692, D2.3): the chief of staff hires only a definition whose every withinRole and
-// crossRole action is on this list. An allowlist, so an action added to ACTIONS later is never
-// hireable until a reviewed commit adds it here. git.push.remote (row 199) is not on it.
-export const HIRE_ALLOWED = Object.freeze([
-  "message.send",
-  "record.write",
-  "review.request",
-  "task.update.assigned",
-  "task.scope.change",
-  "git.push.working",
-]);
-
-// Row 194 (#1692, D2.3): the first action of a definition's authority that isn't on
-// HIRE_ALLOWED, or null when every one is. role.mjs's hireable check and the broker's hire check
-// use it. It lives here because the session sandbox mounts this file and not role.mjs
-// (seat/src/sandbox.mjs RUNNER_FILES), and the runner imports broker.mjs.
-export function unhireableAction(role) {
-  for (const key of ["withinRole", "crossRole"]) {
-    const outside = role.authority[key].find((action) => !HIRE_ALLOWED.includes(action));
-    if (outside !== undefined) return outside;
-  }
-  return null;
-}
-
 // pi's documented built-in tools; the same list scripts/mosaic-task.mjs
 // accepts for tasks.
 export const BUILTIN_TOOLS = Object.freeze(["read", "write", "edit", "bash", "grep", "find", "ls"]);

packages/organization/tests/chief-of-staff.test.mjs

@@ -22,8 +22,6 @@ const APPROVED = Object.freeze({
   authority: Object.freeze({ withinRole: Object.freeze(["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire", "decision.resolve.technical", "decision.resolve.delivery"]), crossRole: Object.freeze([]) }),
   // Row 285 (#1790, mos-1309 item 5, sage-2915): gitea for the library read grant, read scopes only.
   credentials: Object.freeze([Object.freeze({ service: "gitea", scopes: Object.freeze(["read:repository", "read:user"]) })]),
-  // Row 194 (#1692, Q4, sage-1374): empty until a policy commit after the PRD 1.7 resolve.
-  hireable: Object.freeze([]),
 });
 
 // The fixture business's chief-of-staff instance, which is also its launcher.
@@ -144,7 +142,8 @@ test("the contract names no duty to talk to the human and the pm contract no lau
   assert.doesNotMatch(chief, /\bJason\b/);
   assert.match(chief, /never talk to the user/);
   // Row 194 (#1692, D3 item 5, N3): a hire launches with no restart once the human sets its route.
-  assert.match(chief, /A hire is listed for `launch` at once, with no restart, but it\s+runs only after the human sets its route \(harness and thinking\)/);
+  assert.match(chief, /Approval sets the route/);
+  assert.match(chief, /credential-unbound/);
   const pm = readFileSync(join(REPO_ROLES, "pm.md"), "utf8");
   assert.doesNotMatch(pm, /^- Launch /m);
   assert.match(pm, /You don't launch sessions/);

packages/organization/tests/composition.test.mjs

@@ -4,7 +4,7 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadRole, BusinessError } from "../src/index.mjs";
-import { GATED_ONLY, HIRE_ALLOWED, unhireableAction, ROUTED } from "../src/vocabulary.mjs";
+import { GATED_ONLY, ROUTED } from "../src/vocabulary.mjs";
 import {
   buildRegistry, checkComposition, COMPOSITION_BOUNDS, COMPOSITION_KEYS, FLAG_RESOLVE, FLAG_ABOVE_CHIEF,
 } from "../src/composition.mjs";
@@ -319,7 +319,8 @@ test("a plugin refuses if it reuses a core name or declares a hard wait", () =>
   assert.ok(buildRegistry({ plugins: [{ name: "forge", actions: ["build.run"] }] }).routed.includes("forge.build.run"));
 });
 
-test("HIRE_ALLOWED and unhireableAction stay until A4", () => {
-  assert.ok(Array.isArray(HIRE_ALLOWED) && HIRE_ALLOWED.length > 0);
-  assert.equal(typeof unhireableAction, "function");
+test("A4 removes the legacy hire ceiling", async () => {
+  const vocabulary=await import("../src/vocabulary.mjs");
+  assert.equal(Object.hasOwn(vocabulary,"HIRE_ALLOWED"),false);
+  assert.equal(Object.hasOwn(vocabulary,"unhireableAction"),false);
 });

packages/organization/tests/definitions.test.mjs

@@ -1,12 +1,14 @@
 // #1873 T1: organization definitions and templates (roles-and-rails design sections 4, 5 and 13).
 import test from "node:test";
 import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
 import { appendFileSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { organizationWriter } from "../src/organization.mjs";
 import { validateBusinessDocument } from "../src/organization-config.mjs";
 import { definitionVerbs, DEFINITION_VERBS } from "../src/definition-verbs.mjs";
-import { templateHash, templateHashes, diffDefinition, lineDiff } from "../src/definitions.mjs";
+import { readTemplate, templateHash, templateHashes, diffDefinition, lineDiff } from "../src/definitions.mjs";
 import { resolveInstance } from "../src/resolve.mjs";
 import { ROLE_RIGHTS, VERB_RIGHTS, normalizeRights } from "../src/org-rights.mjs";
 import { businessDoc, rolesCopy, systemFor, tmp, writeJson } from "./helpers.mjs";
@@ -349,3 +351,15 @@ test("T1 a write that adds or changes a definition refuses without the credentia
   // A removal writes no role text, so it needs no secret check.
   assert.equal(unchecked.remove("acme", { revision: rev(f), rev: 1, name: "scout" }, OWNER).removedRev, 1);
 });
+
+test('A4 T1 hand-off: a failed second contract read names the template, never the path', t => {
+  const root=tmp(),rolesDir=rolesCopy(root),read=fs.default.readFileSync;
+  let contracts=0;
+  fs.default.readFileSync=function(file,...args){
+    if(file===join(rolesDir,'reviewer.md') && ++contracts===2)throw new Error(`cannot read ${root}/sk-test-NOT-A-SECRET-1234`);
+    return read(file,...args);
+  };
+  syncBuiltinESMExports();
+  try { assert.throws(()=>readTemplate(rolesDir,'reviewer'),{message:'template reviewer contract is unavailable'}); }
+  finally { fs.default.readFileSync=read;syncBuiltinESMExports();rmSync(root,{recursive:true,force:true}); }
+});

packages/organization/tests/hire-decisions.test.mjs

@@ -0,0 +1,164 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { hireDecisions, authorizeHire } from '../src/hire-decisions.mjs';
+import { organizationWriter } from '../src/organization.mjs';
+import { readTemplate } from '../src/definitions.mjs';
+import { loadBusiness } from '../src/organization-config.mjs';
+import { businessDoc, rolesCopy, writeJson } from './helpers.mjs';
+const INLINE = { tools: ['read'], network: 'none', authority: { withinRole: [], crossRole: [] }, credentials: [], instructions: 'Read carefully. sk-test-NOT-A-SECRET-1234' };
+const OWNER = { actor: 'jason', agent: false, rights: ['org.hire'], owner: true, instanceOwner: true, subject: { provider: 'test', iss: 'https://test', sub: 'owner' } };
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'a4-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root), file = writeJson(join(root,'businesses/demo.json'), {...businessDoc(root,'demo'),plugins:{harness:['pi']}});
+  const writer = organizationWriter({ dir: root, rolesDir });
+  const dataRoot = join(root, 'data'); mkdirSync(dataRoot, { mode: 0o700 });
+  const service = hireDecisions({ writer, rolesDir, configDir: root, dataRoot, assertClean: () => {} });
+  const request = (extra = {}) => ({ op: 'hire', level: 'org', name: 'scout', role: { inline: INLINE }, route: { harness: 'pi', model: 'claude-opus-5-5' }, reason: 'Need a reader', ...extra });
+  const prepare = (extra, id = '11111111-1111-4111-8111-111111111111') => service.prepare('demo', request(extra), { id, expiresAt: '2099-01-01T00:00:00.000Z' });
+  return { root, rolesDir, file, writer, service, prepare, request };
+}
+test('A4 composition flags and credential lines are computed, never supplied; public records omit instructions', async t => {
+  const { prepare } = setup(t);
+  for (const field of ['flagged','credentialLines','digest','expiresAt']) await assert.rejects(prepare({ [field]: [] }), { code: 'invalid-request' });
+  const p = await prepare();
+  assert.equal(p.flagged.length, 0);
+  assert.ok(!JSON.stringify(p).includes(INLINE.instructions));
+  assert.ok(!JSON.stringify(p).includes('sk-test-NOT-A-SECRET-1234'));
+  const c = await prepare({ role: { inline: { ...INLINE, credentials: [{ service: 'gitea', scopes: ['read:repository'] }] } } }, '22222222-2222-4222-8222-222222222222');
+  assert.deepEqual(c.credentialLines, [{ service: 'gitea', scope: 'read:repository' }]);
+});
+test('A4 only org.hire people resolve; flagged, credential and root decisions need their owner', () => {
+  const member = { ...OWNER, owner: false, instanceOwner: false };
+  const plain = { level: 'org', flagged: [], credentialLines: [] };
+  assert.doesNotThrow(() => authorizeHire(plain, member));
+  for (const p of [{ ...plain, flagged: [{ field: 'tools' }] }, { ...plain, credentialLines: [{ service: 'gitea' }] }, { ...plain, level: 'root' }]) assert.throws(() => authorizeHire(p, member), { code: 'hire-owner-required' });
+  assert.throws(() => authorizeHire(plain, { ...OWNER, rights: ['decide'] }), { code: 'right-required' });
+  assert.throws(() => authorizeHire(plain, { ...OWNER, agent: true }), { code: 'human-required' });
+});
+test('A4 org approval writes the pinned definition, route and a values-free writer receipt', async t => {
+  const { prepare, service, writer, root, file } = setup(t);
+  const p = await prepare();
+  const before = readFileSync(file);
+  await assert.rejects(service.apply('demo', p.id, { ...OWNER, digest: '0'.repeat(64) }), { code: 'decision-stale' });
+  assert.deepEqual(readFileSync(file), before);
+  await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  const doc = writer.read('demo').document;
+  assert.equal(doc.roles.scout.definition, 'org:hire-11111111-1111-4111-8111-111111111111');
+  assert.equal(doc.roles.scout.vars.model, 'claude-opus-5-5');
+  assert.ok(doc.launch.instances.includes('scout'));
+  const log = readFileSync(join(root,'businesses/.history/demo/changes.jsonl'),'utf8');
+  assert.ok(log.includes(p.id)); assert.ok(!log.includes(INLINE.instructions)); assert.ok(!log.includes('sk-test-NOT-A-SECRET-1234'));
+});
+test('A4 approved credential hires stay unbound until all requested bindings exist', async t => {
+  const { prepare, service, root, rolesDir } = setup(t);
+  const p = await prepare({ role: { inline: { ...INLINE, credentials: [{ service: 'gitea', scopes: ['read:repository'] }] } } });
+  await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  const loaded = loadBusiness('demo',{ dir: root, rolesDir });
+  assert.deepEqual(loaded.roles.scout.unbound, ['gitea']);
+});
+test('A4 project approval uses the project writer and changes only its agent plus the pinned definition', async t => {
+  const { prepare, service, writer } = setup(t);
+  const before = writer.read('demo').document;
+  const p = await prepare({ level: 'project', project: 'stack' });
+  await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  const after = writer.read('demo').document;
+  assert.deepEqual(after.roles, before.roles);
+  assert.deepEqual(after.launch, before.launch);
+  assert.equal(after.projects.stack.agents.scout.vars.harness, 'pi');
+});
+test('A4 root approval uses A2 root writer, records decision id and leaves the organization unchanged', async t => {
+  const { prepare, service, writer, root } = setup(t);
+  const before = writer.read('demo').revision;
+  const p = await prepare({ level: 'root' });
+  await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  assert.equal(writer.read('demo').revision, before);
+  const doc = JSON.parse(readFileSync(join(root,'agents.json')));
+  assert.equal(doc.agents.scout.vars.model, 'claude-opus-5-5');
+  assert.ok(readFileSync(join(root,'agents-receipts.jsonl'),'utf8').includes(p.id));
+});
+test('A4 change applies a T1 template update to an in-use definition; direct edits still refuse', async t => {
+  const { root, rolesDir, file, writer, service, prepare } = setup(t);
+  const p = await prepare(); await service.apply('demo', p.id, { ...OWNER, digest: p.digest });
+  const name = writer.read('demo').document.roles.scout.definition.slice(4);
+  const old = writer.read('demo');
+  assert.throws(() => writer.setDefinition('demo', name, e => ({ ...e, instructions: 'changed' }), { actor: 'jason', revision: old.revision, rev: 1, assertClean: () => {} }), { code: 'definition-in-use' });
+  const template = readTemplate(rolesDir,'reviewer');
+  const change = await service.prepare('demo',{ op: 'change', level: 'org', name: 'scout', role: { template: 'reviewer', sha256: template.sha256 }, route: { harness: 'pi', model: 'claude-opus-5-5' }, reason: 'Apply current template' }, { id: '22222222-2222-4222-8222-222222222222', expiresAt: '2099-01-01T00:00:00.000Z' });
+  await service.apply('demo',change.id,{ ...OWNER,digest:change.digest });
+  assert.equal(writer.read('demo').document.definitions[name].rev,2);
+  assert.equal(writer.read('demo').document.definitions[name].from.sha256,template.sha256);
+});
+
+test('A4 reserved names and invalid routes refuse before publication', async t => {
+  const {prepare,writer}=setup(t),before=writer.read('demo').revision;
+  for(const name of ['human','tester','user'])await assert.rejects(prepare({name}),{code:'invalid-request'});
+  await assert.rejects(prepare({route:{harness:'pi',model:'unconfigured'}}),/selects an unknown model/);
+  assert.equal(writer.read('demo').revision,before);
+});
+
+test('A4 human adjustments are digest bound, remove grants and credentials, and never widen', async t => {
+  const {service,prepare,writer}=setup(t);
+  const original={...INLINE,tools:['read','bash'],network:'open',authority:{withinRole:['git.merge.protected'],crossRole:[]},credentials:[{service:'gitea',scopes:['read:repository']}]};
+  const p=await prepare({role:{inline:original}});
+  const adjust={role:{tools:['read'],network:'none',authority:{withinRole:[],crossRole:[]}},credentials:[],route:{harness:'pi',model:'claude-sonnet-5-5'}};
+  const view=await service.preview('demo',p.id,{...OWNER,adjust});
+  assert.notEqual(view.digest,p.digest);assert.deepEqual(view.flagged,[]);assert.deepEqual(view.credentialLines,[]);
+  await assert.rejects(service.apply('demo',p.id,{...OWNER,adjust,digest:p.digest}),{code:'decision-stale'});
+  for(const bad of [{role:{tools:['read','write']}},{role:{authority:{withinRole:[],crossRole:['git.merge.protected']}}},{credentials:[{service:'gitea',scopes:['write:repository']}]},{role:{instructions:'different'}}])
+    await assert.rejects(service.preview('demo',p.id,{...OWNER,adjust:bad}),{code:'invalid-request'});
+  await service.apply('demo',p.id,{...OWNER,adjust,digest:view.digest});
+  const doc=writer.read('demo').document,entry=doc.definitions[doc.roles.scout.definition.slice(4)];
+  assert.deepEqual(entry.role.tools,['read']);assert.deepEqual(entry.role.credentials,[]);assert.equal(entry.role.network,'none');
+  assert.equal(entry.instructions,INLINE.instructions);assert.equal(doc.roles.scout.vars.model,'claude-sonnet-5-5');
+});
+
+test('A4 changed root copies lose broker admission until a fresh boot snapshot',async t=>{
+ const {service,prepare}=setup(t);
+ assert.equal(service.rootActive('scout'),true);
+ const p=await prepare({level:'root'});await service.apply('demo',p.id,{...OWNER,digest:p.digest});
+ assert.equal(service.rootActive('scout'),false,'an old boot cannot keep an earlier root policy after a decision write');
+});
+
+test('A4 a changed route clears the previous thinking override when approval omits it',async t=>{
+ const {file,writer,prepare,service}=setup(t);
+ const doc=writer.read('demo').document;doc.roles.scout={definition:'security-reviewer',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};doc.launch.instances.push('scout');writeJson(file,doc);
+ const p=await prepare({op:'change'});await service.apply('demo',p.id,{...OWNER,digest:p.digest});
+ assert.equal(Object.hasOwn(writer.read('demo').document.roles.scout.vars,'thinking'),false);
+});
+
+test('A4 a root role change preserves the owner-set organization exclusions',async t=>{
+ const {root,prepare,service}=setup(t);
+ writeJson(join(root,'agents.json'),{agentsVersion:1,agents:{scout:{definition:'security-reviewer',vars:{harness:'pi',model:'claude-opus-5-5'},excludeOrgs:['elsewhere']}}});
+ const p=await prepare({op:'change',level:'root'});await service.apply('demo',p.id,{...OWNER,digest:p.digest});
+ assert.deepEqual(JSON.parse(readFileSync(join(root,'agents.json'))).agents.scout.excludeOrgs,['elsewhere']);
+});
+
+test('A4 root fire refuses other organizations before proposal and again before publication',async t=>{
+ const {root,prepare,service,writer}=setup(t);
+ writeJson(join(root,'agents.json'),{agentsVersion:1,agents:{scout:{definition:'security-reviewer'}}});
+ const fire=id=>service.prepare('demo',{op:'fire',level:'root',name:'scout',reason:'Finished'}, {id,expiresAt:'2099-01-01T00:00:00.000Z'});
+ const pending=await fire('11111111-1111-4111-8111-111111111111');
+ const before=readFileSync(join(root,'agents.json'));
+ writeJson(join(root,'businesses/other.json'),businessDoc(root,'other'));
+ await assert.rejects(service.apply('demo',pending.id,{...OWNER,digest:pending.digest}),{code:'root-fire-shared'});
+ assert.deepEqual(readFileSync(join(root,'agents.json')),before);
+ await assert.rejects(fire('22222222-2222-4222-8222-222222222222'),{code:'root-fire-shared'});
+ assert.ok(writer.read('demo').revision);
+});
+
+test('A4 root snapshot refusals distinguish changed, fired and unreadable policy',async t=>{
+ const {root,service}=setup(t),file=join(root,'agents-receipts.jsonl');
+ assert.equal(service.rootRefusal('scout'),null);
+ writeFileSync(file,JSON.stringify({agent:'scout',verb:'root.agent.set'})+'\n',{mode:0o600});
+ assert.equal(service.rootRefusal('scout'),'copy-stale');
+ writeFileSync(file,JSON.stringify({agent:'scout',verb:'root.agent.remove'})+'\n');
+ assert.equal(service.rootRefusal('scout'),'instance-fired');
+ writeFileSync(file,'invalid json\n');
+ assert.equal(service.rootRefusal('scout'),'root-policy-unreadable');
+ const broken=hireDecisions({writer:{},configDir:root,dataRoot:join(root,'data')});
+ assert.equal(broken.rootRefusal('scout'),'root-policy-unreadable');
+});

packages/organization/tests/instance-settings.test.mjs

@@ -142,13 +142,7 @@ test("row 165 refuses each validation failure and leaves the file's bytes alone"
   refuses(f, { instance: "tester", op: "add", definition: "merge-gate" }, "invalid-request");
   // FED R3 (dewey-0777): and user, the granted user's principal.
   refuses(f, { instance: "user", op: "add", definition: "merge-gate" }, "invalid-request");
-  // FED R3 r4 (sage-2557): row 194's hire refuses the same three names, and leaves the file alone.
-  for (const name of ["human", "tester", "user"]) {
-    const bytes = readFileSync(f.file, "utf8");
-    assert.throws(() => f.settings.hire("acme", { name, definition: "security-reviewer" }, { actor: "chief", context: {} }),
-      e => e.code === "invalid-request", name);
-    assert.equal(readFileSync(f.file, "utf8"), bytes, name);
-  }
+  // A4 decision-path name refusals are covered by hire-decisions.test.mjs.
   const one = fixture(doc => { doc.launch.instances = ["coder"]; });
   refuses(one, { instance: "coder", op: "change", launch: false }, "BusinessError");
   const none = fixture(doc => { delete doc.launch; });
@@ -171,8 +165,7 @@ test("T19 add of a credentialed definition writes store references dated today,
   refuses(f, add("reviewer-2", "reviewer", { tracker: { bot: "bot-acme-sync", botId: 40 } }), "organization-tracker-bot-taken");
   refuses(f, add("sec-1", "security-reviewer", { tracker: { bot: "bot-acme-sec-1", botId: 40 } }), "invalid-request");
   refuses(f, { instance: "coder", op: "change", vars: {}, tracker: { bot: "bot-acme-coder-2", botId: 40 } }, "invalid-request");
-  assert.throws(() => f.settings.hire("acme", { name: "reviewer-3", definition: "reviewer" }, { actor: "chief", context: {} }),
-    e => e.code === "organization-credentials-out-of-scope");
+
 
   const today = new Date().toISOString().slice(0, 10);
   const done = f.settings.set("acme", { revision: f.settings.read("acme").revision, ...add("reviewer-2", "reviewer", { tracker: { bot: "bot-acme-reviewer-2", botId: 40 } }) }, "jason");

packages/organization/tests/lifecycle-settings.test.mjs

@@ -48,7 +48,6 @@ function refuses(f, act, code) {
 }
 const del = (f, instance, extra = {}) => () => f.settings.set("acme", { revision: f.revision(), instance, op: "delete", ...extra }, "jason");
 const veto = (f, op, name, actor = "human") => f.settings.veto("acme", { revision: f.revision(), op, name }, actor);
-const hire = (f, args) => f.settings.hire("acme", args, { actor: "chief", context: CONTEXT });
 const fire = (f, name) => f.settings.fire("acme", { name }, { actor: "chief", context: CONTEXT });
 
 test("T6 delete refuses in the design's order and leaves the file's bytes alone", () => {
@@ -101,7 +100,7 @@ test("T6 a clean delete removes the entry and its own references, adds retired,
   assert.ok(entry.changes.some(c => c.path === "retired" && c.oldPresent === false));
   refuses(f, () => f.settings.set("acme", { revision: f.revision(), instance: "sec-1", op: "add", definition: "security-reviewer" }, "jason"),
     "organization-instance-retired");
-  refuses(f, () => hire(f, { name: "sec-1", definition: "security-reviewer" }), "organization-instance-retired");
+  assert.equal(f.settings.hire, undefined, "direct hire writer removed; decisions are covered in hire-decisions.test.mjs");
   refuses(f, del(f, "sec-1"), "organization-unknown-instance");
 });
 
@@ -150,57 +149,6 @@ test("T7 veto refuses an unknown or END_PROTECTED keep, a bad request, a stale r
   refuses(none, () => veto(none, "nohire", "coder"), "organization-launch-not-configured");
 });
 
-test("D2.2 hire adds and lists a new instance, logs the chief's context, and sets only model and limits", () => {
-  const f = fixture();
-  const done = hire(f, { name: "sec-2", definition: "security-reviewer", vars: { model: "claude-sonnet-5-5" } });
-  assert.deepEqual(done.instances["sec-2"], {
-    definition: "security-reviewer", vars: { model: "claude-sonnet-5-5" }, launched: true, launcher: false, protected: false, kept: false, endProtected: false,
-  });
-  assert.equal(done.restart, false);
-  assert.deepEqual(f.onDisk().launch.instances, ["coder", "reviewer", "sec-1", "sec-2"]);
-  const entry = f.log().at(-1);
-  assert.equal(entry.actor, "chief");
-  assert.deepEqual(entry.context, CONTEXT);
-  assert.equal(entry.transaction, done.transaction);
-  assert.equal(f.validate().status, 0);
-  for (const vars of [{ harness: "pi" }, { model: "claude-sonnet-5-5", thinking: "high" }, []]) {
-    refuses(f, () => hire(f, { name: "sec-3", definition: "security-reviewer", vars }), "invalid-request");
-  }
-  for (const args of [{ name: "Bad Name", definition: "security-reviewer" }, { name: "human", definition: "security-reviewer" },
-    { name: "tester", definition: "security-reviewer" }, { name: "sec-3", definition: "Bad Name" }]) {
-    refuses(f, () => hire(f, args), "invalid-request");
-  }
-  refuses(f, () => hire(f, { name: "sec-3", definition: "security-reviewer", vars: { model: "not-in-the-table" } }), "BusinessError");
-  refuses(f, () => hire(f, { name: "coder-2", definition: "coder" }), "organization-credentials-out-of-scope");
-  refuses(f, () => hire(f, { name: "asst-2", definition: "assistant" }), "organization-definition-refused");
-  refuses(f, () => hire(f, { name: "sec-3", definition: "no-such-role" }), "BusinessError");
-});
-
-test("D2.2 hire refuses noHire, a kept name and a listed name, and re-lists a fired one only as it was", () => {
-  const f = fixture(doc => {
-    doc.launch.noHire = ["merge-gate"];
-    doc.roles["sec-2"] = { definition: "security-reviewer", vars: { model: "claude-sonnet-5-5" } };
-    doc.roles["sec-3"] = { definition: "security-reviewer" };
-    doc.launch.keep = ["sec-3"];
-  });
-  refuses(f, () => hire(f, { name: "gate-1", definition: "merge-gate" }), "definition-not-hireable");
-  // Row 213 (M10): a creative definition is the human's to add, never the chief's to hire.
-  for (const definition of CREATIVE_DEFINITIONS) refuses(f, () => hire(f, { name: "muse-1", definition }), "definition-not-hireable");
-  refuses(f, () => hire(f, { name: "sec-3", definition: "security-reviewer" }), "instance-kept");
-  refuses(f, () => hire(f, { name: "sec-1", definition: "security-reviewer" }), "organization-instance-exists");
-  refuses(f, () => hire(f, { name: "chief", definition: "chief-of-staff" }), "organization-instance-exists");
-  // sec-2 is declared and not listed: fired. Only its own definition with no vars lists it again.
-  refuses(f, () => hire(f, { name: "sec-2", definition: "merge-gate" }), "definition-not-hireable");
-  veto(f, "hire", "merge-gate");
-  refuses(f, () => hire(f, { name: "sec-2", definition: "merge-gate" }), "organization-instance-exists");
-  refuses(f, () => hire(f, { name: "sec-2", definition: "security-reviewer", vars: { model: "claude-opus-5-5" } }), "organization-instance-exists");
-  const done = hire(f, { name: "sec-2", definition: "security-reviewer" });
-  assert.equal(done.instances["sec-2"].launched, true);
-  assert.deepEqual(f.onDisk().roles["sec-2"], { definition: "security-reviewer", vars: { model: "claude-sonnet-5-5" } });
-  const none = fixture(doc => { delete doc.launch; });
-  refuses(none, () => hire(none, { name: "sec-9", definition: "security-reviewer" }), "organization-launch-not-configured");
-});
-
 test("D2.2 fire delists and keeps the entry, a repeat is done with no write, and each refusal holds", () => {
   const f = fixture(doc => {
     doc.roles.assistant = { definition: "assistant", holder: "mos" };

packages/organization/tests/org-rights.test.mjs

@@ -60,6 +60,9 @@ const VERBS = {
   'decision.preview.console': 'decide',
   'decision.resolve.console': 'decide',
   'hire.resolve.console': 'org.hire',
+  'hire.preview.console': 'org.hire',
+  'hire.start.console': 'org.hire',
+    'hire.templates.console': 'org.hire',
   'definition.import.console': 'org.hire',
   'definition.edit.console': 'org.hire',
   'definition.invent.console': 'org.hire',

packages/organization/tests/path-redaction.test.mjs

@@ -114,14 +114,10 @@ test('loadRoleFile: a file name outside the id pattern is not quoted', (t) => {
   assert.throws(() => loadRoleFile(file), refusal('role file not found', { exitCode: 4, paths: [file] }));
 });
 
-test('loadRoleFile: a hireable entry whose file is invalid JSON is named by its checked name', (t) => {
-  const dir = join(under(t), 'roles');
-  mkdirSync(dir);
-  const chief = JSON.parse(readFileSync(join(REPO_ROLES, 'chief-of-staff.json'), 'utf8'));
-  writeJson(join(dir, 'chief-of-staff.json'), { ...chief, hireable: ['coder'] });
-  copyFileSync(join(REPO_ROLES, 'chief-of-staff.md'), join(dir, 'chief-of-staff.md'));
+test('loadRoleFile: invalid JSON is named by its checked file name', (t) => {
+  const dir = under(t);
   writeJson(join(dir, 'coder.json'), '{not json');
-  assert.throws(() => loadRole(dir, 'chief-of-staff'), refusal('role file coder.json is not valid JSON', { exitCode: 2, paths: [dir] }));
+  assert.throws(() => loadRole(dir, 'coder'), refusal('role file coder.json is not valid JSON', { exitCode: 2, paths: [dir] }));
 });
 
 test('loadBusiness: a missing business file is named by its checked id', (t) => {

packages/organization/tests/role.test.mjs

@@ -2,7 +2,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { existsSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { loadRole, loadRoleFile, validateRoleDocument, ACTIONS, GATED_ONLY, HIRE_ALLOWED, BusinessError } from "../src/index.mjs";
+import { loadRole, loadRoleFile, validateRoleDocument, ACTIONS, GATED_ONLY,  BusinessError } from "../src/index.mjs";
 import { REPO_ROLES, tmp, writeJson } from "./helpers.mjs";
 import { CREATIVE_DEFINITIONS } from "../src/vocabulary.mjs";
 
@@ -277,67 +277,7 @@ test("M1: a creative role file wider than read and answer is refused", () => {
   refuses(creative("companion", { roleVersion: 1, title: undefined, contract: undefined, authority: undefined, credentials: undefined, messaging: undefined }), /^creative role companion must be version 2$/);
 });
 
-// Row 194 (#1692, D2.3, T8c): the chief's hireable list, checked at load against HIRE_ALLOWED.
-// Each refused action is looped from the lists, not typed by hand.
-const REFUSED_FOR_HIRE = ACTIONS.filter((action) => !HIRE_ALLOWED.includes(action) && !GATED_ONLY.includes(action));
-
-function hireDir(definitions) {
-  const dir = tmp();
-  for (const [name, doc] of Object.entries(definitions)) {
-    writeFileSync(join(dir, `${name}.md`), "# contract\n\n## Authority\n");
-    writeJson(join(dir, `${name}.json`), doc === 1 ? { roleVersion: 1, name, tools: ["read"] } : {
-      roleVersion: 2, name, title: name, contract: `${name}.md`, tools: ["read"], network: "none",
-      authority: { withinRole: doc.withinRole ?? ["message.send"], crossRole: doc.crossRole ?? [] }, credentials: [],
-      ...(doc.hireable === undefined ? {} : { hireable: doc.hireable }),
-    });
-  }
-  return dir;
-}
-
-test("hireable: HIRE_ALLOWED is exactly the six plain work actions, and every one is routed", () => {
-  assert.deepEqual([...HIRE_ALLOWED], ["message.send", "record.write", "review.request", "task.update.assigned",
-    "task.scope.change", "git.push.working"]);
-  assert.ok(Object.isFrozen(HIRE_ALLOWED));
-  for (const action of HIRE_ALLOWED) assert.ok(ACTIONS.includes(action) && !GATED_ONLY.includes(action), action);
-  assert.ok(!HIRE_ALLOWED.includes("git.push.remote"));
-  assert.ok(REFUSED_FOR_HIRE.length >= 15, "the loop covers the routed actions outside the list");
-});
-
-test("hireable: a list naming a definition that holds any refused action refuses at load, one case per action", () => {
-  for (const action of REFUSED_FOR_HIRE) {
-    for (const key of ["withinRole", "crossRole"]) {
-      const dir = hireDir({ chief: { hireable: ["worker"] }, worker: { [key]: [action], ...(key === "crossRole" ? { withinRole: [] } : {}) } });
-      refuses(() => loadRole(dir, "chief"), /hireable names worker, which holds [a-z.]+ outside the hireable ceiling$/);
-    }
-  }
-});
-
-test("hireable: a mixed definition refuses, a clean list loads, and the named file's own hireable isn't read", () => {
-  const mixed = hireDir({ chief: { hireable: ["worker"] }, worker: { withinRole: ["message.send", "role.launch"] } });
-  refuses(() => loadRole(mixed, "chief"), /hireable names worker, which holds [a-z.]+ outside the hireable ceiling/);
-  const clean = hireDir({
-    chief: { hireable: ["worker", "helper"] },
-    worker: { withinRole: [...HIRE_ALLOWED] },
-    // helper's own list names a definition that doesn't exist. Only the chief's list is checked.
-    helper: { withinRole: ["record.write"], hireable: ["nobody"] },
-  });
-  assert.deepEqual(loadRole(clean, "chief").hireable, ["worker", "helper"]);
-  assert.ok(Object.isFrozen(loadRole(clean, "chief").hireable));
-  refuses(() => loadRole(clean, "helper"), /hireable names a definition which has no role file/);
-});
-
-test("hireable: a missing, version 1, duplicate or badly named entry refuses, and the key is optional", () => {
-  refuses(() => loadRole(hireDir({ chief: { hireable: ["ghost"] } }), "chief"), /hireable names a definition which has no role file/);
-  refuses(() => loadRole(hireDir({ chief: { hireable: ["old"] }, old: 1 }), "chief"), /hireable names a definition which is role version 1/);
-  // Row 213 (M10): a creative definition refuses by name, before its file is read.
-  for (const name of CREATIVE_DEFINITIONS) {
-    refuses(() => loadRole(hireDir({ chief: { hireable: [name] } }), "chief"), /hireable names [a-z-]+, a creative definition only the human adds$/);
-  }
-  refuses(() => loadRole(hireDir({ chief: { hireable: ["w", "w"] }, w: {} }), "chief"), /duplicate entry in role hireable/);
-  refuses(() => loadRole(hireDir({ chief: { hireable: ["../w"] } }), "chief"), /role hireable entry/);
-  refuses(() => loadRole(hireDir({ chief: { hireable: "w" } }), "chief"), /role hireable must be an array/);
-  assert.deepEqual(loadRole(hireDir({ chief: {} }), "chief").hireable, []);
-  assert.deepEqual(loadRole(REPO_ROLES, "chief-of-staff").hireable, []);
-  // A version 1 file can't carry the key.
-  refuses(() => validateRoleDocument({ roleVersion: 1, name: "r", tools: ["read"], hireable: [] }, join(tmp(), "r.json")), /unsupported role key/);
+test("A4 removes the hireable key from shipped and custom roles", () => {
+  assert.equal(Object.hasOwn(loadRole(REPO_ROLES,"chief-of-staff"),"hireable"),false);
+  refuses(() => check({hireable:[]}),/unsupported role key/);
 });

packages/organization/tests/safe-names.test.mjs

@@ -39,20 +39,8 @@ test('overlapping authority lists name every known action; invalid entries stop
   refusal(role(t, d => { d.authority = { withinRole: ['message.send', 'record.write'], crossRole: ['message.send', 'record.write'] }; }), ['message.send', 'record.write']);
   refusal(role(t, d => { d.authority = { withinRole: [bad], crossRole: [bad] }; }));
 });
-for (const kind of ['creative', 'outside']) test(`hireable ${kind} names a known definition; invalid name stops first`, t => {
-  const edit = (d, root) => {
-    const name = kind === 'creative' ? 'companion' : 'helper';
-    d.hireable = [name];
-    if (kind === 'outside') writeFileSync(join(root, 'helper.json'), JSON.stringify({ ...d, name, hireable: [], authority: { withinRole: ['role.hire'], crossRole: [] } }));
-  };
-  refusal(role(t, edit), kind === 'creative' ? ['companion'] : ['helper', 'role.hire']);
-  refusal(role(t, d => { d.hireable = [badId]; }), [], badId, /role hireable entry must match/);
-});
-test('hireable wider action rejects unknown action before naming it', t => {
-  refusal(role(t, (d, root) => {
-    d.hireable = ['helper'];
-    writeFileSync(join(root, 'helper.json'), JSON.stringify({ ...d, name: 'helper', hireable: [], authority: { withinRole: [bad], crossRole: [] } }));
-  }));
+test('removed hireable key refuses without echoing its value', t => {
+  refusal(role(t, d => { d.hireable = [badId]; }), ['hireable'], badId, /unsupported role key/);
 });
 test('gitea category conflict names the checked category; invalid scope stops first', t => {
   refusal(role(t, d => { d.credentials = [{ service: 'gitea', scopes: ['read:issue', 'write:issue'] }]; }), ['issue']);

packages/webui/src/decision-http.mjs

@@ -7,7 +7,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { BusReadError, subjectOk } from './bus.mjs';
 
-export const DECISION_ROUTE = /^\/api\/decisions\/([^/]*)\/(confirmation|resolve)$/;
+export const DECISION_ROUTE = /^\/api\/decisions\/([^/]*)\/(confirmation|resolve|start|templates)$/;
 // The endpoint contract, design section 4. Each refusal is one of these, never a 200.
 export const DECISION_REFUSALS = Object.freeze({
   'sign-in-required': [401, 'Sign in again before answering.'],
@@ -22,6 +22,10 @@ export const DECISION_REFUSALS = Object.freeze({
   'decision-not-found': [404, 'This decision is unavailable.'],
   'decision-not-eligible': [403, 'Answer this decision with mosaic decide.'],
   'decision-closed': [409, 'This decision is no longer open. Refresh the inbox.'],
+  'hire-owner-required': [403, 'Only the owner may approve these grants or a root agent.'],
+  'right-required': [403, 'This decision needs org.hire.'],
+  'decision-expired': [409, 'This decision expired. Ask for a fresh proposal.'],
+  'hire-resolution-required': [403, 'Use the hire approval path.'],
   'decision-stale': [409, 'The choices changed. Review the decision again.'],
   'confirmation-required': [409, 'Review and confirm this answer again.'],
   'confirmation-unavailable': [503, 'Confirmation is unavailable. Try again later.'],
@@ -36,7 +40,7 @@ const BUS_CODES = {
   'peercred-required': 'peercred-required',
   'decision-not-found': 'decision-not-found', 'decision-not-eligible': 'decision-not-eligible',
   'decision-closed': 'decision-closed', 'decision-stale': 'decision-stale', 'invalid-choice': 'decision-stale',
-  'invalid-request': 'invalid-request',
+  'invalid-request': 'invalid-request', 'hire-owner-required':'hire-owner-required','right-required':'right-required','decision-expired':'decision-expired','hire-resolution-required':'hire-resolution-required',
 };
 const BODY_MAX = 4096;
 const TOKEN = /^[a-f0-9]{64}$/;
@@ -75,13 +79,13 @@ export function createConfirmations({ ttlMs = 120000, max = 1024, now = Date.now
   };
 }
 
-async function readBody(req) {
+async function readBody(req, max = BODY_MAX) {
   if (one(req, 'content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json') return { code: 'invalid-request' };
   const chunks = [];
   let size = 0;
   for await (const chunk of req) {
     size += chunk.length;
-    if (size > BODY_MAX) return { code: 'request-too-large' };
+    if (size > max) return { code: 'request-too-large' };
     chunks.push(chunk);
   }
   try {
@@ -93,6 +97,7 @@ const option = o => o && typeof o.key === 'string' && o.key.length > 0 && typeof
 const options = list => Array.isArray(list) && list.length >= 2 && list.length <= 9 && list.every(option) && new Set(list.map(o => o.key)).size === list.length;
 function preview(v, id) {
   if (!v || v.id !== id || typeof v.business !== 'string' || !DIGEST.test(v.digest ?? '')) return false;
+  if(v.kind==='hire')return options(v.options) && Array.isArray(v.flagged) && Array.isArray(v.credentialLines) && typeof v.expiresAt==='string';
   if (v.kind === 'decision') return options(v.options) && !['grant', 'approve', 'deny'].some(k => k in v);
   // Retain the existing grant preview fields, including previews from an older pinned broker.
   return (v.kind === undefined || v.kind === 'grant') && option(v.approve) && option(v.deny) &&
@@ -113,7 +118,7 @@ export async function decisionHTTP(req, res, { path, decide, session, live, conf
   if (one(req, 'origin') !== decide.origin || one(req, 'sec-fetch-site') !== 'same-origin') return decisionRefuse(res, 'cross-origin');
   const line = (outcome) => log(`${new Date().toISOString()} decide user=${JSON.stringify(String(session.name ?? '').slice(0, 64))} decision=${JSON.stringify(String(id ?? '').slice(0, 64))} step=${step} ${outcome}`);
   const refuse = (code) => { line(`error=${code}`); return decisionRefuse(res, code); };
-  const { value, code } = await readBody(req);
+  const { value, code } = await readBody(req, step==='start'?32768:BODY_MAX);
   if (code) return refuse(code);
   if (!subjectOk(id)) return refuse('decision-not-found');
   const subject = { provider: session.provider, iss: session.iss, sub: session.sub };
@@ -121,22 +126,35 @@ export async function decisionHTTP(req, res, { path, decide, session, live, conf
     const c = err instanceof BusReadError ? BUS_CODES[err.code] : undefined;
     return c ?? open;
   };
+  if(step==='start' || step==='templates') {
+    const allowed=step==='start'?['business','hire']:['business'];
+    if(id!=='hire' || Object.keys(value).length!==allowed.length || Object.keys(value).some(k=>!allowed.includes(k)) || !subjectOk(value.business))return refuse('invalid-request');
+    if(live()!==session)return refuse('sign-in-required');
+    try {
+      const result=await decide.call(step==='start'?'hire.start.console':'hire.templates.console',step==='start'?value.hire:{},{subject,business:value.business});
+      if(step==='start' && (typeof result?.id!=='string'||result.op!=='resolved'||result.choice!=='yes'))return refuse('outcome-unknown');
+      if(step==='templates' && !Array.isArray(result?.templates))return refuse('confirmation-unavailable');
+      line(step==='start'?'hire=recorded':'templates=read');
+      return json(res,200,step==='start'?{id:result.id,op:result.op,choice:result.choice}:result);
+    } catch(err) {return refuse(busCode(err,step==='start'?'outcome-unknown':'confirmation-unavailable'));}
+  }
   if (step === 'confirmation') {
-    if (Object.keys(value).length !== 1 || typeof value.choice !== 'string') return refuse('invalid-request');
+    if (Object.keys(value).some(k=>!['choice','adjust'].includes(k)) || typeof value.choice !== 'string') return refuse('invalid-request');
     if (live() !== session) return refuse('sign-in-required');
     let v;
-    try { v = await decide.call('decision.preview.console', { id }, { subject }); } catch (err) { return refuse(busCode(err, 'confirmation-unavailable')); }
+    try { v = await decide.call(value.adjust===undefined?'decision.preview.console':'hire.preview.console', { id,...(value.adjust===undefined?{}:{adjust:value.adjust}) }, { subject }); } catch (err) { return refuse(busCode(err, 'confirmation-unavailable')); }
     if (!preview(v, id)) return refuse('confirmation-unavailable');
-    const ordinary = v.kind === 'decision';
+    const ordinary = v.kind === 'decision' || v.kind === 'hire';
     const chosen = (ordinary ? v.options : [v.approve, v.deny]).find(o => o.key === value.choice);
     if (!chosen) return refuse('decision-stale');
     const action = ordinary ? 'answer' : value.choice === v.approve.key ? 'approve' : 'deny';
     if (live() !== session) return refuse('sign-in-required');
-    const confirmation = confirmations.issue({ session, business: v.business, decision: id, choice: value.choice, digest: v.digest });
+    if(value.adjust!==undefined && v.kind!=='hire')return refuse('invalid-request');
+    const confirmation = confirmations.issue({ session, business: v.business, decision: id, choice: value.choice, digest: v.digest, ...(v.kind==='hire'?{kind:'hire',...(value.adjust===undefined?{}:{adjust:structuredClone(value.adjust)})}:{}) });
     if (!confirmation) return refuse('confirmation-unavailable');
     line(`action=${action}`);
     return json(res, 200, { id, question: typeof v.question === 'string' ? v.question : '', action, choice: value.choice, text: chosen.text,
-      ...(ordinary ? { kind: 'decision' } : { grant: v.grant }), confirmation });
+      ...(v.kind==='hire'?{kind:'hire',flagged:v.flagged,credentialLines:v.credentialLines,expiresAt:v.expiresAt}:ordinary ? { kind: 'decision' } : { grant: v.grant }), confirmation });
   }
   const keys = Object.keys(value);
   if (keys.length !== 2 || !keys.includes('choice') || !keys.includes('confirmation') || typeof value.choice !== 'string') return refuse('invalid-request');
@@ -146,7 +164,7 @@ export async function decisionHTTP(req, res, { path, decide, session, live, conf
   if (live() !== session) return refuse('sign-in-required');
   let r;
   try {
-    r = await decide.call('decision.resolve.console', { id, choice: held.choice, digest: held.digest }, { subject, business: held.business });
+    r = await decide.call(held.kind==='hire'?'hire.resolve.console':'decision.resolve.console', { id, choice: held.choice, digest: held.digest,...(held.adjust===undefined?{}:{adjust:held.adjust}) }, { subject, business: held.business });
   } catch (err) { return refuse(busCode(err, 'outcome-unknown')); }
   if (r?.id !== id || r.op !== 'resolved' || r.choice !== held.choice) return refuse('outcome-unknown');
   line(`choice=${JSON.stringify(held.choice.slice(0, 64))}${r.grant ? ` grant=${r.grant}` : ''}`);

packages/webui/src/public/bus.css

@@ -60,3 +60,11 @@ table.s1-roles td,table.s1-roles th { overflow-wrap:normal; word-break:normal; }
   table.s1-roles { min-width: 0; width: 100%; table-layout: fixed; }
   table.s1-roles td, table.s1-roles th { overflow-wrap: anywhere; }
 }
+/* A4: use the Console's controls for authority proposals and keep grant labels beside their checkboxes. */
+#hire-start form,#hire-adjust{max-width:680px}
+#hire-start form>label,#hire-adjust>label{display:grid;gap:5px;margin:12px 0;color:var(--text)}
+#hire-start input,#hire-adjust>label input{width:100%;min-width:0;min-height:40px;padding:8px 10px;border:1px solid var(--border);border-radius:6px;background:var(--surface);color:var(--text);font:inherit}
+#hire-adjust{margin:12px 0}
+#hire-adjust fieldset{display:flex;flex-wrap:wrap;gap:8px 18px;margin:12px 0;padding:10px;border:1px solid var(--border);border-radius:6px}
+#hire-adjust fieldset label{display:inline-flex;align-items:center;gap:8px;overflow-wrap:anywhere}
+#hire-adjust input[type=checkbox]{width:18px;min-width:18px;height:18px;min-height:18px;margin:0}

packages/webui/src/public/bus.js

@@ -302,7 +302,7 @@
   // Inbox
   function decisionCard(d) {
     return `<li class="wait-item s1-dec${d.blocking ? ' is-attn' : ''}"><div class="wait-head"><a href="#/inbox/${enc(d.id)}" class="s1-dec-open">${txt(first(d.question))}</a></div>
-      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}${canDecide && d.console ? ` ${badge(d.console.kind === 'decision' ? 'Answer here' : 'Approve or Deny here', 'ok')}` : ''}</p>
+      <p class="s1-badges">${d.blocking ? blockChip('blocking') : ''}${chip(d.class, d.action)}${canDecide && d.console ? ` ${badge(['decision','hire'].includes(d.console.kind) ? 'Answer here' : 'Approve or Deny here', 'ok')}` : ''}</p>
       <p class="small s1-auth">${approves(d.authorization)}</p>
       ${window.MosaicInbox?.cardMeta?.(d) ?? `<p class="small muted">Raised by ${txt(d.raised_by_role)} ${when(d.at)}</p>`}<p class="small muted">${d.task_ref ? ` · task ${taskLink(d.task_ref)}` : ''}${d.requirement_ref ? ` · ${txt(d.requirement_ref)}` : ''}</p></li>`;
   }
@@ -396,7 +396,72 @@
   let canDecide = false, ssoOn = false, answer = null;
   document.addEventListener('mosaic-signed-out', () => { answer = null; });
   const ACTIONS = { approve: 'Approve', deny: 'Deny' };
-  const answerChoices = c => c.kind === 'decision'
+  const hireLines = c => c?.kind !== 'hire' ? '' : `<h3>Flagged grants — owner approval required</h3><ul>${c.flagged.map(l=>`<li>${txt(l.field)}: ${txt(l.value)}</li>`).join('')||'<li>None</li>'}</ul><h3>Requested credential scopes — owner approval required</h3><ul>${c.credentialLines.map(l=>`<li>${txt(l.service)}${l.scope?`: ${txt(l.scope)}`:''}</li>`).join('')||'<li>None</li>'}</ul><p>Expires ${txt(c.expiresAt)}</p>`;
+  const hireAdjustment = c => {
+    if(c?.kind!=='hire' || !c.role)return '';
+    const list=(key,values)=>(values??[]).map((v,i)=>`<label><input type="checkbox" data-hire-list="${esc(key)}" data-index="${i}" checked> ${txt(v)}</label>`).join(' ');
+    return `<details id="hire-adjust"><summary>Adjust before approving</summary><p>Remove grants or credentials below. Additional grants need a new decision.</p>
+      <fieldset><legend>Tools</legend>${list('tools',c.role.tools)}</fieldset>
+      ${['withinRole','crossRole'].map(k=>`<fieldset><legend>${k==='withinRole'?'Within this role':'Across roles'}</legend>${list(k,c.role.authority[k])}</fieldset>`).join('')}
+      <label>Network <select id="hire-network">${['none','api-only','open'].filter((_,i)=>i<=['none','api-only','open'].indexOf(c.role.network)).map(n=>`<option${n===c.role.network?' selected':''}>${n}</option>`).join('')}</select></label>
+      <fieldset><legend>Skills</legend>${list('skills',c.role.skills)}</fieldset>
+      <fieldset><legend>Credentials</legend>${c.credentialLines.map((line,i)=>`<label><input type="checkbox" data-hire-credential="${i}" checked> ${txt(line.service)}${line.scope?`: ${txt(line.scope)}`:''}</label>`).join(' ')||'None'}</fieldset>
+      <label>Harness <input id="hire-route-harness" value="${esc(c.route.harness)}" maxlength="200"></label>
+      <label>Model <input id="hire-route-model" value="${esc(c.route.model)}" maxlength="200"></label>
+      <label>Thinking <input id="hire-route-thinking" value="${esc(c.route.thinking??'')}" maxlength="200"></label></details>`;
+  };
+  function collectHireAdjustment(c) {
+    if(!$('hire-adjust') || !c.role)return undefined;
+    const selected=(key,values)=>(values??[]).filter((_,i)=>document.querySelector(`[data-hire-list="${key}"][data-index="${i}"]`)?.checked);
+    const kept=new Set([...document.querySelectorAll('[data-hire-credential]:checked')].map(e=>Number(e.dataset.hireCredential)));
+    const lines=c.credentialLines.filter((_,i)=>kept.has(i));
+    const credentials=c.role.credentials.flatMap(e=>{
+      const held=lines.filter(l=>l.service===e.service);if(!held.length)return [];
+      if(e.scopes===undefined)return [e];
+      const scopes=Array.isArray(e.scopes)?e.scopes.filter(scope=>held.some(l=>l.scope===scope)):
+        Object.fromEntries(Object.entries(e.scopes).map(([group,verbs])=>[group,verbs.filter(v=>held.some(l=>l.scope===`${group}.${v}`))]).filter(([,v])=>v.length));
+      return [{service:e.service,scopes}];
+    });
+    const thinking=$('hire-route-thinking').value.trim();
+    return {role:{tools:selected('tools',c.role.tools),network:$('hire-network').value,authority:Object.fromEntries(['withinRole','crossRole'].map(k=>[k,selected(k,c.role.authority[k])])),skills:selected('skills',c.role.skills)},credentials,
+      route:{harness:$('hire-route-harness').value.trim(),model:$('hire-route-model').value.trim(),...(thinking?{thinking}:{})}};
+  }
+  const HIRE_START_LABEL='Record and approve';
+  let hireDraft={op:'hire',level:'org'},hireTemplates=[],hireBusy=false,hireStatus='';
+  function hireStartHtml() {
+    if(!canDecide)return '';
+    const d=hireDraft,off=hireBusy?' disabled':'';
+    const input=(key,label,extra='')=>`<label>${label} <input data-hire-field="${key}" value="${esc(d[key]??'')}" maxlength="${key==='reason'?500:200}" ${extra}${off}></label>`;
+    return `<section class="panel" id="hire-start"><h2>Hire, fire or change an agent</h2><form id="hire-start-form">
+      ${input('business','Organization','required')}<button type="button" class="btn" data-hire-load${off}>Read role templates</button>
+      <label>Operation <select data-hire-field="op"${off}>${['hire','fire','change'].map(v=>`<option${d.op===v?' selected':''}>${v}</option>`).join('')}</select></label>
+      <label>Level <select data-hire-field="level"${off}>${['org','project','root'].map(v=>`<option${d.level===v?' selected':''}>${v}</option>`).join('')}</select></label>
+      ${input('project','Project (project level only)')}${input('name','Agent name','required')}
+      <label>Role template <select data-hire-field="template"${off}><option value="">Choose a template</option>${hireTemplates.map(t=>`<option value="${esc(t.name)}"${d.template===t.name?' selected':''}>${txt(t.name)}</option>`).join('')}</select></label>
+      ${input('harness','Harness')}${input('model','Model')}${input('thinking','Thinking (optional)')}${input('reason','Reason','required')}
+      <p>Submitting raises and approves one decision. Flagged grants and credentials require the owner; root agents require the instance owner.</p>
+      <button type="submit" class="btn primary"${off}>${hireBusy?'Working…':HIRE_START_LABEL}</button><p id="hire-start-status" role="status">${txt(hireStatus)}</p></form></section>`;
+  }
+  function paintHireStart() {const e=$('hire-start');if(e)e.outerHTML=hireStartHtml();}
+  document.addEventListener('input',e=>{const f=e.target.closest?.('[data-hire-field]');if(f)hireDraft[f.dataset.hireField]=f.value;});
+  document.addEventListener('change',e=>{const f=e.target.closest?.('[data-hire-field]');if(f)hireDraft[f.dataset.hireField]=f.value;});
+  async function hireSubmit(templatesOnly=false) {
+    if(hireBusy || out() || !canDecide)return;
+    const d={...hireDraft},template=hireTemplates.find(t=>t.name===d.template);
+    if(!templatesOnly && d.op!=='fire' && !template){hireStatus='Read and choose a role template first.';paintHireStart();return;}
+    const thinking=d.thinking?.trim(),hire={op:d.op,level:d.level,name:d.name,reason:d.reason,...(d.level==='project'?{project:d.project}:{}),...(d.op==='fire'?{}:{role:{template:template?.name,sha256:template?.sha256},route:{harness:d.harness,model:d.model,...(thinking?{thinking}:{})}})};
+    hireBusy=true;hireStatus='';paintHireStart();
+    const {res,json}=await decidePost(`/api/decisions/hire/${templatesOnly?'templates':'start'}`,{business:d.business,...(templatesOnly?{}:{hire})});
+    hireBusy=false;
+    if(res?.type==='opaqueredirect'){signOut();return;}
+    if(res?.ok && templatesOnly && Array.isArray(json?.templates)){hireTemplates=json.templates;hireStatus=hireTemplates.length?'Templates read.':'No templates available.';}
+    else if(res?.ok && !templatesOnly && json?.op==='resolved'){hireStatus=`Recorded decision ${json.id}.`;}
+    else hireStatus=decideRefusal(res,json,templatesOnly?'confirmation-unavailable':'outcome-unknown').message;
+    paintHireStart();
+  }
+  document.addEventListener('click',e=>{if(e.target.closest?.('[data-hire-load]'))hireSubmit(true);});
+  document.addEventListener('submit',e=>{if(e.target.id==='hire-start-form'){e.preventDefault();hireSubmit();}});
+  const answerChoices = c => ['decision','hire'].includes(c.kind)
     ? c.options.map((o, i) => ({ ...o, step: `option-${i}`, label: o.text }))
     : Object.entries(ACTIONS).map(([step, label]) => ({ ...c[step], step, label }));
   const grantText = g => [`method ${g.method}`, g.agent && `agent ${g.agent}`, g.host && `host ${g.host}`, Array.isArray(g.projects) && g.projects.length && `projects ${g.projects.join(', ')}`].filter(Boolean).map(s => txt(String(s))).join(' · ');
@@ -407,17 +472,17 @@
     let body;
     if (a.result) {
       const r = a.result;
-      body = `<p class="receipt" id="decide-status" tabindex="-1">${r.kind === 'decision' ? 'Recorded' : r.action === 'approve' ? 'Approved' : 'Denied'}: you chose “${txt(r.choice)}”, ${txt(r.text)}.${r.kind === 'decision' ? '' : ` ${r.grant === 'started' ? 'The grant executor started.' : r.action === 'approve' ? 'The bus started no grant for it.' : 'Nothing starts for a denial.'}`} History below shows it once the bus is read again.</p>${window.MosaicInbox?.receipt?.(r, a.decision) ?? ''}`;
+      body = `<p class="receipt" id="decide-status" tabindex="-1">${['decision','hire'].includes(r.kind) ? 'Recorded' : r.action === 'approve' ? 'Approved' : 'Denied'}: you chose “${txt(r.choice)}”, ${txt(r.text)}.${['decision','hire'].includes(r.kind) ? '' : ` ${r.grant === 'started' ? 'The grant executor started.' : r.action === 'approve' ? 'The bus started no grant for it.' : 'Nothing starts for a denial.'}`} History below shows it once the bus is read again.</p>${window.MosaicInbox?.receipt?.(r, a.decision) ?? ''}`;
     } else if (a.confirm) {
       const c = a.confirm, label = `Confirm ${c.action}`;
       body = `<div class="s1-confirm" role="group" aria-labelledby="b-confirm"><h3 id="b-confirm" class="small">${label}</h3>
-        ${window.MosaicInbox?.detailMeta?.(a.decision) ?? ''}${window.MosaicInbox?.receipt?.(c, a.decision) ?? ''}<dl class="kv"><dt>Id</dt><dd><code>${txt(c.id)}</code></dd><dt>Question</dt><dd class="s1-q">${txt(c.question)}</dd><dt>Answer</dt><dd><b class="s1-key">${txt(c.choice)}</b> ${txt(c.text)}</dd>${c.kind === 'decision' ? '' : `<dt>Grant</dt><dd>${grantText(c.grant)}</dd>`}</dl>
-        <p class="small muted">${c.kind === 'decision' ? 'Confirm to record this choice.' : c.action === 'approve' ? 'Approving starts this grant.' : 'Denying starts nothing.'} This confirmation works once and lasts two minutes.</p>
+        ${window.MosaicInbox?.detailMeta?.(a.decision) ?? ''}${window.MosaicInbox?.receipt?.(c, a.decision) ?? ''}${hireLines(c)}<dl class="kv"><dt>Id</dt><dd><code>${txt(c.id)}</code></dd><dt>Question</dt><dd class="s1-q">${txt(c.question)}</dd><dt>Answer</dt><dd><b class="s1-key">${txt(c.choice)}</b> ${txt(c.text)}</dd>${['decision','hire'].includes(c.kind) ? '' : `<dt>Grant</dt><dd>${grantText(c.grant)}</dd>`}</dl>
+        <p class="small muted">${['decision','hire'].includes(c.kind) ? 'Confirm to record this choice.' : c.action === 'approve' ? 'Approving starts this grant.' : 'Denying starts nothing.'} This confirmation works once and lasts two minutes.</p>
         <div class="s1-cmd"><button type="button" class="btn primary" data-decide="confirm"${off}>${a.pending ? 'Answering…' : label}</button><button type="button" class="btn" data-decide="cancel"${off}>Cancel</button></div></div>`;
     } else {
       const choices = answerChoices(a.console);
-      body = `<ul class="s1-plain">${choices.map(o => `<li>${a.console.kind === 'decision' ? '' : `<b>${txt(o.label)}</b> chooses `}<b class="s1-key">${txt(o.key)}</b> ${txt(o.text)}</li>`).join('')}</ul>
-        <p class="small muted">${a.console.kind === 'decision' ? '' : `Grant: ${grantText(a.console.grant)}. `}Each button opens a confirmation first. Nothing is answered until you confirm.</p>
+      body = `${hireLines(a.console)}${hireAdjustment(a.console)}<ul class="s1-plain">${choices.map(o => `<li>${['decision','hire'].includes(a.console.kind) ? '' : `<b>${txt(o.label)}</b> chooses `}<b class="s1-key">${txt(o.key)}</b> ${txt(o.text)}</li>`).join('')}</ul>
+        <p class="small muted">${['decision','hire'].includes(a.console.kind) ? '' : `Grant: ${grantText(a.console.grant)}. `}Each button opens a confirmation first. Nothing is answered until you confirm.</p>
         <div class="s1-cmd">${choices.map(o => `<button type="button" class="btn${o.step === 'approve' ? ' primary' : ''}" data-decide="${o.step}"${off}>${a.pending === o.step ? 'Checking…' : txt(o.label)}</button>`).join('')}</div>`;
     }
     const e = a.error;
@@ -454,15 +519,16 @@
     if (out()) { a.confirm = null; a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); return; }
     const selected = answerChoices(a.console).find(o => o.step === step);
     if (selected) {
-      const choice = selected.key, ordinary = a.console.kind === 'decision';
+      const choice = selected.key, ordinary = ['decision','hire'].includes(a.console.kind);
+      const adjust=choice==='yes'?collectHireAdjustment(a.console):undefined;
       a.pending = step; a.error = null; a.confirm = null; paintDecide();
-      const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/confirmation`, { choice });
+      const { res, json } = await decidePost(`/api/decisions/${enc(a.id)}/confirmation`, { choice,...(adjust===undefined?{}:{adjust}) });
       a.pending = null;
       // The page moved to another decision meanwhile: its confirmation is dropped, never shown.
       if (answer !== a) { if (res?.type === 'opaqueredirect') signOut(); return; }
       if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering.' }; paintDecide('#decide-status'); signOut(); return; }
       if (res?.ok && json?.id === a.id && json.action === (ordinary ? 'answer' : step) && json.choice === choice && typeof json.text === 'string' && typeof json.confirmation === 'string' &&
-          (ordinary ? json.kind === 'decision' && !json.grant : json.grant && typeof json.grant.method === 'string')) {
+          (ordinary ? ['decision','hire'].includes(json.kind) && !json.grant : json.grant && typeof json.grant.method === 'string')) {
         a.confirm = json; paintDecide('[data-decide="confirm"]'); announce(`Confirm ${json.action}: ${json.text}`);
       } else { a.error = decideRefusal(res, json, 'confirmation-unavailable'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
       return;
@@ -477,10 +543,12 @@
     if (res?.type === 'opaqueredirect') { a.error = { code: 'sign-in-required', message: 'Sign in again before answering. The sign-in proxy redirected the answer, so it never reached the Console.' }; paintDecide('#decide-status'); signOut(); return; }
     if (res?.ok && json?.id === a.id && json.op === 'resolved' && json.choice === c.choice) {
       a.result = { kind: c.kind, action: c.action, choice: c.choice, text: c.text, grant: json.grant ?? null, grantDetails: c.grant ?? null };
-      paintDecide('#decide-status'); announce(c.kind === 'decision' ? 'Recorded' : c.action === 'approve' ? 'Approved' : 'Denied'); render(false);
+      paintDecide('#decide-status'); announce(['decision','hire'].includes(c.kind) ? 'Recorded' : c.action === 'approve' ? 'Approved' : 'Denied'); render(false);
     } else { a.error = decideRefusal(res, json, 'outcome-unknown'); paintDecide('#decide-status'); announce(`Not answered: ${a.error.message}`); }
   }
   async function inboxView(get) {
+    await configRead;
+    if(!hireDraft.business && window.MosaicOrg?.id)hireDraft.business=window.MosaicOrg.id;
     // The broker orders gated first, then oldest; lift blocking ones to the top.
     const rows = (await get('inbox')).slice().sort((a, b) => (b.blocking - a.blocking) || String(a.at).localeCompare(String(b.at)));
     countInbox(rows);
@@ -489,6 +557,7 @@
       : 'Decisions are answered in a terminal with <code>mosaic decide</code>; Console only shows them.';
     return `${head('Inbox', `${readNote(get)} ${answered}`)}
       ${await composer(get)}
+      ${hireStartHtml()}
       <h2 id="b-for-you">Open decisions <span class="count">${rows.length}</span></h2>${body}
       <p class="small muted">Open a decision for its seen, DM and closing history.</p>`;
   }
@@ -527,7 +596,7 @@
     if (answer?.id === d.id) answer.decision = d;
     const options = `<ol class="s1-opts">${d.options.map(o => {
       const cmd = `mosaic decide ${d.id} ${o.key}`, chosen = c?.choice === o.key, approving = d.authorization?.approvalChoice === o.key;
-      const copy = !answerable ? '' : SAFE.test(String(d.id)) && SAFE.test(String(o.key))
+      const copy = !answerable || open?.console?.kind==='hire' ? '' : SAFE.test(String(d.id)) && SAFE.test(String(o.key))
         ? `<div class="s1-cmd"><code>${txt(cmd)}</code><button type="button" class="btn" data-copy="${esc(cmd)}" aria-label="Copy the command for option ${txt(o.key)}">Copy</button></div>`
         : '<p class="small muted">This option has no command here: its key is not a plain identifier.</p>';
       return `<li class="s1-opt"><p><b class="s1-key">${txt(o.key)}</b> ${txt(o.text)} ${approving ? badge(`approves ${d.authorization.action}`, 'attn') : ''}${o.key === d.recommendation ? badge('recommended', 'ok') : ''}${chosen ? badge('chosen', 'ok') : ''}</p>${copy}</li>`;
@@ -539,7 +608,7 @@
     const why = !answerable || isTester || canDecide ? ''
       : ssoOn ? ' This Console is read-only for decisions: it was started without writes enabled (--send), so answers go through a terminal.'
         : ' Answering a decision from the Console needs sign-in (--sso) and writes enabled (--send).';
-    const help = eligible ? '<p class="small muted">Choose an answer in the panel above. You can also run one of these in a terminal. Copy only puts the command on your clipboard.</p>'
+    const help = open?.console?.kind==='hire' ? '<p class="small muted">Hire, fire and role changes are answered in the Console by a person with org.hire.</p>' : eligible ? '<p class="small muted">Choose an answer in the panel above. You can also run one of these in a terminal. Copy only puts the command on your clipboard.</p>'
       : answerable ? `<p class="small muted">To answer, run one of these in a terminal. Copy only puts the command on your clipboard. Console sends nothing.${why}</p>`
       : !c ? `<p class="small muted">This decision is routed to ${txt(d.routeTo)}, not to you, so Console offers no command for it.</p>` : '';
     return `${head(`Decision ${txt(short(d.id))}`, status)}

packages/webui/tests/decision-http.test.mjs

@@ -37,7 +37,7 @@ function setup({ answer = () => ({ ...PREVIEW }), resolve = (a) => ({ id: a.id,
       origin: ORIGIN,
       call: async (verb, args, ctx) => {
         calls.push({ verb, args, ctx });
-        return verb === 'decision.preview.console' ? answer(args) : resolve(args);
+        return ['decision.preview.console','hire.preview.console'].includes(verb) ? answer(args) : resolve(args);
       },
     },
   };
@@ -264,3 +264,31 @@ test('confirmations expire after the TTL, cap at the limit without dropping a li
   assert.equal(store.consume(undefined, bind), null);
   assert.equal(store.consume('A'.repeat(64), bind), null);
 });
+
+test('A4 hire confirmation carries computed lines and resolves through org.hire, never decide',async()=>{
+  const flagged=[{field:'tools',value:'bash',reasons:['above-chief']}],credentialLines=[{service:'gitea',scope:'read:repository'}];
+  const s=setup({answer:()=>({id:'d1',business:'demo',kind:'hire',question:'hire scout?',digest:DIGEST,options:[{key:'yes',text:'Approve'},{key:'no',text:'Deny'}],flagged,credentialLines,expiresAt:'2099-01-01T00:00:00.000Z'}),resolve:a=>({id:a.id,op:'resolved',choice:a.choice})});
+  const c=await s.confirm('yes');assert.equal(c.status,200);
+  assert.deepEqual(c.json().flagged,flagged);assert.deepEqual(c.json().credentialLines,credentialLines);
+  const r=await s.resolve({choice:'yes',confirmation:c.json().confirmation});assert.equal(r.status,200);
+  assert.equal(s.calls[1].verb,'hire.resolve.console');
+});
+
+test('A4 Console start carries the signed-in subject and org, records once and never retries',async()=>{
+  const s=setup({resolve:()=>({id:'new-hire',op:'resolved',choice:'yes'})});
+  const hire={op:'hire',level:'org',name:'scout',reason:'Need help',role:{template:'coder',sha256:DIGEST},route:{harness:'pi',model:'claude-opus-5-5'}};
+  const r=await s.run('/api/decisions/hire/start',request({body:{business:'demo',hire}}));
+  assert.equal(r.status,200,r.text);assert.equal(s.calls.length,1);
+  assert.equal(s.calls[0].verb,'hire.start.console');assert.deepEqual(s.calls[0].args,hire);assert.equal(s.calls[0].ctx.business,'demo');
+  refused(await s.run('/api/decisions/hire/start',request({body:{business:'demo',hire},headers:{origin:['https://elsewhere.test']}})),'cross-origin');
+  assert.equal(s.calls.length,1);
+});
+test('A4 confirmation holds the exact human adjustment, so resolve cannot substitute it',async()=>{
+  const adjust={role:{tools:['read']},credentials:[]};
+  const s=setup({answer:()=>({...ORDINARY,kind:'hire',flagged:[],credentialLines:[],expiresAt:'2099-01-01T00:00:00.000Z'}),resolve:a=>({id:a.id,op:'resolved',choice:a.choice})});
+  const c=await s.run('/api/decisions/d1/confirmation',request({body:{choice:'new/autonomous',adjust}}));
+  assert.equal(c.status,200,c.text);assert.deepEqual(s.calls[0].args,{id:'d1',adjust});
+  assert.equal(s.calls[0].verb,'hire.preview.console');
+  const r=await s.resolve({choice:'new/autonomous',confirmation:c.json().confirmation});
+  assert.equal(r.status,200,r.text);assert.deepEqual(s.calls[1].args.adjust,adjust);
+});

packages/webui/tests/fixtures/rename-a/business-response.json

@@ -36,6 +36,7 @@
       "instance.name",
       "role.hire",
       "role.fire",
+      "role.change",
       "credential.mint",
       "spend",
       "deploy",
@@ -89,6 +90,7 @@
           "instance.name": "gated",
           "role.hire": "gated",
           "role.fire": "gated",
+          "role.change": "gated",
           "credential.mint": "gated",
           "spend": "gated",
           "deploy": "gated",
@@ -137,6 +139,7 @@
           "instance.name": "gated",
           "role.hire": "gated",
           "role.fire": "gated",
+          "role.change": "gated",
           "credential.mint": "gated",
           "spend": "gated",
           "deploy": "gated",
@@ -186,6 +189,7 @@
           "instance.name": "gated",
           "role.hire": "gated",
           "role.fire": "gated",
+          "role.change": "gated",
           "credential.mint": "gated",
           "spend": "gated",
           "deploy": "gated",
@@ -232,6 +236,7 @@
           "instance.name": "gated",
           "role.hire": "gated",
           "role.fire": "gated",
+          "role.change": "gated",
           "credential.mint": "gated",
           "spend": "gated",
           "deploy": "gated",
@@ -278,6 +283,7 @@
           "instance.name": "within",
           "role.hire": "within",
           "role.fire": "within",
+          "role.change": "gated",
           "credential.mint": "gated",
           "spend": "gated",
           "deploy": "gated",

packages/webui/tests/hire-console-browser.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {fixture} from './fixture.mjs';
+import {mkdir} from 'node:fs/promises';
+import {join} from 'node:path';
+import {browser} from './browser.mjs';
+for(const width of [1440,390])test(`A4 Console hire start and narrowed confirmation at ${width}px`,{timeout:120000},async t=>{
+ const f=await fixture(),b=await browser({machine:false});t.after(async()=>{await b.close();await f.close();});
+ await b.call('Page.addScriptToEvaluateOnNewDocument',{source:`(()=>{
+ const real=fetch;window.__posts=[];
+ const hire={id:'d1',kind:'hire',op:'hire',level:'org',name:'scout',route:{harness:'pi',model:'fixture-model'},flagged:[{field:'tools',value:'bash',reasons:['above-chief']}],credentialLines:[{service:'gitea',scope:'read:repository'}],expiresAt:'2099-01-01T00:00:00.000Z',digest:'a'.repeat(64),role:{tools:['read','bash'],network:'none',authority:{withinRole:[],crossRole:[]},credentials:[{service:'gitea',scopes:['read:repository']}],skills:[]},options:[{key:'yes',text:'Approve'},{key:'no',text:'Deny'}]};
+ const d={id:'d1',at:'2026-11-11T00:00:00.000Z',raised_by_role:'chief',raised_by_run:'chief-run',class:'gated',action:'role.hire',route_to:'human',question:'Hire scout?',options:hire.options,blocking:false,console:hire};
+ const json=v=>new Response(JSON.stringify(v),{headers:{'content-type':'application/json'}});
+ window.fetch=async(url,init={})=>{
+ const p=new URL(url,location.href).pathname;
+ if(p==='/api/config')return json({sso:true,send:true,decide:true});
+ if(p==='/api/business')return json({business:{id:'demo',projects:[]}});
+ if(p==='/api/bus/inbox')return json({rows:[d]});
+ if(p==='/api/bus/trail')return json({rows:[{...d,table:'decisions'}]});
+ if(p==='/api/bus/agents'||p==='/api/bus/messages'||p==='/api/chat/projects'||p==='/api/chat/threads')return json({rows:[]});
+ if(p.startsWith('/api/decisions/')){
+ const body=JSON.parse(init.body);window.__posts.push({p,body});
+ if(p.endsWith('/templates'))return json({templates:[{name:'coder',sha256:'b'.repeat(64)}]});
+ if(p.endsWith('/start'))return json({id:'started',op:'resolved',choice:'yes'});
+ if(p.endsWith('/confirmation'))return json({id:'d1',kind:'hire',action:'answer',question:'Hire scout?',choice:body.choice,text:'Approve',flagged:[],credentialLines:[],expiresAt:hire.expiresAt,confirmation:'c'.repeat(64)});
+ return json({id:'d1',op:'resolved',choice:body.choice});
+ }
+ if(p==='/api/processing'||p==='/api/bus-status')return json({error:'unavailable'});
+ return real(url,init);
+ };
+ })()`});
+ const shots=async(state,selector)=>{if(!process.env.MOSAIC_UX_SHOTS)return;await mkdir(process.env.MOSAIC_UX_SHOTS,{recursive:true});for(const mode of ['light','dark']){await b.evaluate(`document.documentElement.dataset.mode=${JSON.stringify(mode)};document.querySelector(${JSON.stringify(selector)}).scrollIntoView({block:'start'})`);await b.screenshot(join(process.env.MOSAIC_UX_SHOTS,`hire-${state}-${width}-${mode}.png`));}};
+ const wait=expr=>b.evaluate(`(async()=>{for(let i=0;i<150;i++){if(${expr})return;await new Promise(r=>setTimeout(r,50));}throw Error('Timed out: '+${JSON.stringify(expr)})})()`);
+ await b.viewport(width,width===390?844:900);await b.navigate(f.base+'/#/inbox');await wait('document.querySelector("#hire-start-form")');
+ await b.evaluate(`document.querySelector('[data-hire-field="business"]').value='demo';document.querySelector('[data-hire-field="business"]').dispatchEvent(new Event('input',{bubbles:true}));document.querySelector('[data-hire-load]').click()`);
+ await wait('document.querySelector("[data-hire-field=template] option[value=coder]")');
+ await shots('start','#hire-start');
+ await b.evaluate(`for(const [k,v] of Object.entries({name:'scout',template:'coder',harness:'pi',model:'fixture-model',reason:'Need a coder'})){const e=document.querySelector('[data-hire-field="'+k+'"]');e.value=v;e.dispatchEvent(new Event('input',{bubbles:true}));}document.querySelector('#hire-start-form').requestSubmit()`);
+ await wait('document.querySelector("#hire-start-status")?.textContent.includes("Recorded")');
+ let posts=await b.evaluate('window.__posts');assert.equal(posts.filter(x=>x.p.endsWith('/start')).length,1);assert.equal(posts.find(x=>x.p.endsWith('/start')).body.hire.role.sha256,'b'.repeat(64));
+ await b.navigate(f.base+'/#/inbox/d1');await wait('document.querySelector("#hire-adjust")');
+ assert.doesNotMatch(await b.evaluate("document.querySelector('#b-o').parentElement.textContent"),/mosaic decide/);
+ await b.evaluate("document.querySelector('#hire-adjust').open=true");await shots('adjust','#hire-adjust');
+ await b.evaluate(`document.querySelector('[data-hire-list="tools"][data-index="1"]').checked=false;document.querySelector('[data-hire-credential]').checked=false;document.querySelector('[data-decide="option-0"]').click()`);
+ await wait('document.querySelector("[data-decide=confirm]")');posts=await b.evaluate('window.__posts');const confirm=posts.find(x=>x.p.endsWith('/confirmation'));
+ assert.deepEqual(confirm.body.adjust.role.tools,['read']);assert.deepEqual(confirm.body.adjust.credentials,[]);
+ assert.equal(await b.evaluate('document.documentElement.scrollWidth<=innerWidth'),true);await shots('confirm','#decide-section');
+ await b.evaluate('document.querySelector("[data-decide=confirm]").click()');await wait('document.querySelector("#decide-status")?.textContent.startsWith("Recorded")');
+ posts=await b.evaluate('window.__posts');assert.deepEqual(Object.keys(posts.find(x=>x.p.endsWith('/resolve')).body).sort(),['choice','confirmation']);
+});

packages/webui/tests/shell.test.mjs

@@ -61,11 +61,13 @@ test('shipped strings are unchanged, and the web keeps its write boundary', () =
   // instance add or change to /api/instances, row 65 the routing table's save to /api/routes,
   // and the provider switch writes only the model-provider plugin setting.
   // The owner's Initialize project records button (E2E round 4) posts an empty body to the org setup records route.
+  // A4 adds one person-initiated authority path through decidePost; it shares the signed-in
+  // Console transport and never uses an instance writer directly. Its label is derived too.
   assert.doesNotMatch(src, /<button[^>]*>[^<]*(Resolve|Decide|Approve)/i);
   const writes = read('bus.js').toString().match(/fetch\([^;]*method:\s*['"](POST|PUT|PATCH|DELETE)[^;]*;/g) ?? [];
   assert.deepEqual(writes, ["fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });", "fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), cache: 'no-store', redirect: 'manual' });", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/settings',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision,reset:[JSON.parse(path)]}),cache:'no-store',redirect:'manual'});", "fetch(url,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/instances',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/proxy/plugins/set',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision:harnessSettings.revision,plugins:{harness:selected}}),cache:'no-store',redirect:'manual'});", "fetch('/api/proxy/plugins/set',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({revision:settings.revision,plugins:{'model-provider':next}}),cache:'no-store',redirect:'manual'});", "fetch('/api/routes',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(payload),cache:'no-store',redirect:'manual'});", "fetch('/api/project-file', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(sent), cache: 'no-store', redirect: 'manual' });", "fetch('/api/bus/message', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ to, body: text }), cache: 'no-store', redirect: 'manual' });"]);
   assert.equal(read('bus.js').toString().split(/method:/).length - 1, 11);
-  assert.deepEqual([...read('bus.js').toString().matchAll(/decidePost\(([^,]*),/g)].map(m => m[1]), ['url', '`/api/decisions/${enc(a.id)}/confirmation`', '`/api/decisions/${enc(a.id)}/resolve`']);
+  assert.deepEqual([...read('bus.js').toString().matchAll(/decidePost\(([^,]*),/g)].map(m => m[1]), ["`/api/decisions/hire/${templatesOnly?'templates':'start'}`", 'url', '`/api/decisions/${enc(a.id)}/confirmation`', '`/api/decisions/${enc(a.id)}/resolve`']);
   // Row 155 (#1649): the one fetch(url, ...) posts only to these three routes, each a literal.
   // Row 176 (#1674): the tester name form adds a second /api/name caller.
   assert.deepEqual([...read('bus.js').toString().matchAll(/assistantPost\(([^,]*),/g)].map(m => m[1]), ['url', "'/api/settings'", "'/api/name'", "'/api/assistant-stop'", "'/api/name'"]);

roles/chief-of-staff.json

@@ -9,6 +9,5 @@
     "withinRole": ["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire", "decision.resolve.technical", "decision.resolve.delivery"],
     "crossRole": []
   },
-  "credentials": [{"service": "gitea", "scopes": ["read:repository", "read:user"]}],
-  "hireable": []
+  "credentials": [{"service": "gitea", "scopes": ["read:repository", "read:user"]}]
 }

roles/chief-of-staff.md

@@ -1,7 +1,7 @@
 # Role contract: chief of staff (chief-of-staff)
 
 You hold the `chief-of-staff` role for one business. You run the
-organization. You hire and terminate role instances, you own the
+organization. You raise hire, fire and role-change decisions for a person to approve, you own the
 organization's structure and you are the only role that launches
 sessions. You take work from the assistant and assign it through the
 roles that do it. You never talk to the user. You don't write the
@@ -13,8 +13,7 @@ product's code, you don't review it and you don't create tasks yourself.
   assistant → chief → PM intake and chief → assistant artifact delivery intact. Relay to PM with send_message in_reply_to the assistant message you received and preserve the original request ID from its header.
   A durable continuation names its request, revision, phase, evidence and next
   typed operation. Launch existing configured PM/CTO/coder/reviewer instances
-  through `launch` under the current grants and limits. Do not hire them through
-  your empty hireable list, relay a user command, or ask PM to launch.
+  through `launch` under the current grants and limits. Raise a hire decision when a new agent is needed; a person approves it. Do not relay a user command or ask PM to launch.
 - For new-project intake, the owner's mode/resource-plan decision already has
   action `project.bootstrap`. Confirming a new-project choice authorizes its
   bound plan; lifecycle settle checks the decision and bootstraps it without an
@@ -50,14 +49,15 @@ product's code, you don't review it and you don't create tasks yourself.
   holds them and what they may do. To terminate a role instance, raise a
   `role.revoke` decision, naming the instance and saying why. Change the
   launch limits, the model table and the model each instance runs with
-  the `change_organization` tool. Hire an instance with `hire` and fire
-  one with `fire`, each with a reason; you can hire only a definition
-  your role file lists as hireable, and never an instance the human
-  kept. A hire is listed for `launch` at once, with no restart, but it
-  runs only after the human sets its route (harness and thinking); until
-  then `launch` refuses it `no-route`. A fired instance stays in the file
-  off the list, so `launch` refuses it. To change what an instance may
-  do, raise a `policy.change` decision.
+  the `change_organization` tool. Use `hire` to raise a hire or role-change
+  decision under `role.hire`, and `fire` to raise a fire decision under
+  `role.fire`, each with a reason. Nothing
+  changes until a person with `org.hire` approves the pinned decision. The
+  broker computes grants above your own as flagged lines; those and every
+  credential line need the owner. Only you raise these decisions; a hired
+  agent cannot hire. Approval sets the route. Launch refuses
+  `credential-unbound` until the requested services are bound. Never hire,
+  fire or replace an instance the human kept.
 - You and the human are the ones who configure and stop the assistant.
   Change its vars, its tracker or its definition with
   `change_organization` and `assistants`; its holder and credentials