Module resolve 

Which work context a new session binds.

One CAR can hold logins for several organizations at once. Each session binds exactly one WorkContext (or none, for personal work) when it is created, and this module is the single rule that picks it.

Hard constraints hold against every source, including an explicit choice and an attested inbound request:

• a session inside a repository that declares an org binds that org;
• the org is in the agent’s permitted set (or the session is personal and the agent allows personal work);
• a signed-in login holds the org, and exactly one does.

Sources fill in the context, first match wins: an attested inbound context, an explicit choice, the repository’s org, the agent’s default, the user’s default org, then personal. The user’s default is a preference among the orgs an agent may already work in: it applies only to an agent permitted there, so setting a default org never enrolls an agent that never joined one, and an agent with no organization settings keeps running personal work exactly as it did before.

A refusal never falls back. The defaults fill in a context nobody named; they are never a way around a failed constraint, because the failure being prevented is work for one organization quietly running — and billing, and remembering — as another.

The rule is pure: no clock, network, filesystem or credential store. The caller supplies what it read, and afterwards proves it can mint a token for the chosen context before the session starts.

Structs

AgentOrganizations

The agent’s organization settings, as its definition declares them.

Inputs

Everything the rule reads. Borrowed, so a caller can resolve repeatedly without cloning the held-login index.

Resolved

The binding a session starts with.

Enums

Explicit

What the person or host explicitly asked for when creating the session.

Permitted

Which orgs an agent may work in.

Refusal

Why a session cannot start. Each message names the fix.

RepositoryOrg

The org a repository declares in its .car/config.toml.

Source

Which source supplied the context.

Functions

resolve

Pick the context a new session binds, or say why none can be.