Send somebody a coworker, and grant it nothing on arrival - #299

… own tables

…te does on the trail

… and install it granting nothing

…model

…tes never mount

The routes were wired into createApp behind an optional dependency and the composition root never
constructed one, so /api/templates answered 404 on a real server while every route test passed: the
tests build the app directly and hand it the dependency the process never had.

Assembled here rather than inside createApp because the installer needs the vault, the plugin store,
the trail and this deployment's endpoint policy, and each of those already exists exactly once in
this file. The endpoint policy is deliberately the same pair agentFetch is given: an address
registered by an import must be held to exactly what an address registered through /api/agents is.

A connector id was checked for length and nothing else, so a template could file a real tool ref as
one. With no tools under it the per-tool check that a ref belongs to its connector never runs, so
`id: google-drive/read_file_content` parsed cleanly and arrived where the server and the profile
screen both re-derive connector-from-tool by looking for a slash.

The invisible-character refusal is now the Unicode property classes rather than an enumerated list,
which had drifted nine blocks narrower than the sentence it defends and let the first sixteen
variation selectors through. Lengths are measured in the units the edit form measures them in, so a
template can no longer install a Bot its owner cannot then save.

The grant route read the ref and never the ledger row's status, so an ask the consent screen had
described as "nothing will be granted and nothing will be written", and the profile as "there is
nothing yet to grant", sat beside a button that wrote a live MCP grant.

Two guards, and the overlap is load-bearing. The status guard refuses an ask that was unavailable
when the person read it, because somebody connecting that server afterwards is not their consent.
The live re-check refuses a ref whose server or tool is absent right now, because the stored status
is a snapshot from resolve time and a grant for a server that does not exist is invisible on every
screen until the day one appears under that id.

The endpoint check and the byte-identical guard behind `reuse` both had no test, so either could
have been deleted and the suite would have stayed green. Two skills in one template can no longer
plan into the same slug, an imported Bot keeps the avatar its template named, and reuse of a skill
somebody else owns falls through to a suffix rather than quietly attaching theirs.

The audit write went to the pool while the caller held a transaction on a pooled connection, so
every import needed two at once and enough concurrent ones would wait on each other.

…be refused

Name and title were truncated on the consent screen and both are concatenated into the standing role
the model is given, so a stranger could write two hundred characters into a field the reviewer saw
forty of. Nothing model-visible is clipped now.

A deployment in dry-run enforces nothing, so it gets the amber warning rather than the reassuring
block. A key typed for one template is no longer carried to the next one's address. The audit page
knows the template events, so a refused import reads as refused rather than as allowed.

bun test runs every file in one process, so a pool left open is held for the rest of the suite. Six
new files opened one and never closed it, and past a certain point PostgreSQL stops handing out
connections — which does not read as a connection limit, it reads as the run dying at whatever file
happened to be next. On CI it died at a different one each time and printed no summary at all.

Every other integration test here already closes. These now do too, after their cleanup rather than
before it.

The sign-in test assigns a window with a location and nothing else. That was harmless while nothing
in the suite installed a DOM; the rendered tests here do, and overwriting a registered window leaves
document defined and window.history undefined. app/src/router.tsx builds its history at module scope
from exactly that pair, so it threw while being imported by whichever file reached it next, and took
that file's tests with it.

…erstands

A template says shell, files, browser, hosts and mcp in a closed vocabulary; this turns that into
CEL the gateway evaluates like any other rule. A template never writes CEL, and could not: the
vocabulary has no way to say anything but less.

Three properties, each with a reason. The Bot is the LEADING conjunct because cel-js short-circuits
and an unscoped clause that throws refuses every action for every Bot rather than for the one named.
Host lists compile to equality and never to a pattern, because the matches helper throws on a bad
pattern and a throwing deny counts as a match. And every clause is evaluated against ten neutral
contexts before it is stored, through the same engine that will judge it, so a malformed one is
refused rather than written.

The emitter refuses a value it cannot write verbatim rather than escaping it: cel-js does not decode
escape sequences, so an escaped literal would be a rule that silently never matches the host it names.

The clauses are written in the same transaction that creates the Bot, and composed into the policy
the gateway reads rather than into the array an administrator edits.

Never into action_policy.deny, and the reason is a lost update nobody would see: that array is
replaced wholesale from a screen snapshot with no version column, so a clause stored there is erased
the next time somebody saves an unrelated rule. Separate storage makes that impossible. Retracting an
import lifts its ceiling the same way it takes back its grants.

The consent screen said a deployment does not yet enforce what a template declares. That was true and
is not any more, so it says what it now does instead. The separate warning about a deployment whose
policy still allows every action stays: a ceiling only ever subtracts, and a Bot held to browsing on
a deployment that permits everything is still a Bot that can browse.

Boundaries lists the generated clauses in a group of their own, grouped by the coworker, and offers
no way to edit them there — they are not in the array that screen posts.

…nned to

Two sources, and nothing is fetched from the network unless an administrator registers one.

The directory in the image is read per file rather than as a package. The tenant loader refuses to
boot on a malformed file, which is right for an operator's own configuration and wrong for a
directory of many authors' work: one bad file names itself in the log and the rest still load.

A git source is pinned to a commit, allowlisted by an environment variable that ships empty and that
no screen can widen, and fetched server-side so the browser never acquires a third-party origin and
the source never sees an end user's address. Moving the pin is the only update mechanism, it is an
administrator's deliberate act, and it changes nothing already installed.

…wser

Installing from the gallery re-reads the template server-side and refuses a digest that no longer
names that entry, so what is installed is what the deployment holds rather than what was posted back
to it. There is no way to publish into the gallery over HTTP: publishing is a git push.

The gallery lists what this deployment offers with the author rendered as a claim and no counts and
no ratings — there is nothing to count and a count is a thing to forge. Admin gains a page listing
every import, what it asked for, the ceiling it applied, and Retract.

bun test runs every file in one process, and parts of the component library decide at module scope
whether they have a browser at all — a portal that concludes it has none stays switched off for the
whole run. This file loads the app's entire route tree, so whichever order the suite was walked in,
it decided that for everybody: the admin dialog tests failed here while the dialog opened correctly
in a browser.

The import is dynamic so the registration stays in front of it. The file already needed browser
globals; it was getting them by accident from whichever rendering test happened to run first.

A values file written before this key existed must still render, and the chart proves that by
rendering without each key added since v0.0.5. Emitted unconditionally it produced an environment
variable with an empty value, which is not the same as an absent one: the server's own default
resolves to this same directory, and an empty string is a deployment told to read templates from
nowhere.

The boundary route answered with the composed policy, so a clause an import applied appeared in the
list the screen edits, with a Remove button beside it. Saving filters those clauses back out, so the
button succeeded, changed nothing, and left the rule enforced with nothing on screen saying why. A
screen that offers an action it will not take is worse than one that does not offer it.

Two readers now: get is what the engine enforces, authored is what a person wrote. The clauses are
still on the same page, in the read-only group that explains where they came from.

The test that covered this asserted the composed value, so it agreed with the bug rather than
catching it. It now asserts the editable list is the operator's own.

Every template drew the same box icon, so a dozen of them were a dozen identical rows and the eye had
nothing to land on. A card now carries the drawing the coworker will actually have — the same seed,
so the card previews what importing produces — over a wash taken from that seed, which makes one
template distinguishable from another before either name is legible.

A grid and a wider shell, which is the one place this feature leaves the layout every other screen
uses, and the reason is the same one the audit log has: this is the only browse surface in the
product. Somebody is comparing coworkers they have never seen against each other, and at prose width
that comparison is a scroll.

WHAT WAS NOT TAKEN from the reference. No install count, no downloads, no stars, no rating, no
featured badge, no price. They are most of what gives a marketplace its density and this one cannot
draw a single one honestly: nothing here counts anything, there is no service to count on, and a
number supplied by the author of the thing being judged is worse than no number. The space they would
have taken goes to the claim, the summary, and what the template asks for.

The card also survives a server that has not rolled yet: an absent avatar seed falls back to the slug
rather than taking the page down, which is what reading .length off undefined did.