@agent-native/core 0.210.2 → 0.211.0-nightly-20261020183616

package/dist/secrets/routes.d.ts

@@ -57,31 +57,31 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
     errorCode?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error?: undefined;
     errorCode?: undefined;
     ok: boolean;
     status: string;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;
     removed: boolean;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/action-approval.d.ts

@@ -0,0 +1,15 @@
+import { actionCallIntent, ActionContractError, preparedCallNeedsApproval, type ActionCaller, type ActionRunContext } from "../action.js";
+/**
+ * The refusal for an HTTP call that needs approval. No HTTP caller can grant
+ * approval: it is given in the app's UI, or in an agent chat or MCP flow that
+ * runs the action in-process.
+ */
+export declare function actionApprovalRequiredError(name: string, caller: ActionCaller, serviceIdentity: boolean): ActionContractError;
+/**
+ * For a dispatcher that runs `entry.run` directly instead of a prepared call
+ * (the generated worker entry): the refusal when this call needs approval.
+ * Arguments that fail validation get no refusal here; the run refuses them.
+ */
+export declare function directHttpActionApprovalRefusal(entry: Parameters<typeof actionCallIntent>[0] & Parameters<typeof preparedCallNeedsApproval>[0], params: unknown, ctx: ActionRunContext & {
+    actionName: string;
+}): Promise<ActionContractError | null>;

package/dist/server/action-approval.js

@@ -0,0 +1,39 @@
+import { actionCallIntent, ActionContractError, preparedCallNeedsApproval, } from "../action.js";
+import { UI_CAPABILITY_REQUIRED_ERROR_CODE } from "../shared/action-error-codes.js";
+/**
+ * The refusal for an HTTP call that needs approval. No HTTP caller can grant
+ * approval: it is given in the app's UI, or in an agent chat or MCP flow that
+ * runs the action in-process.
+ */
+export function actionApprovalRequiredError(name, caller, serviceIdentity) {
+    // The browser client answers this code by minting its UI capability and
+    // retrying once, so the app's own UI is never refused for lacking proof.
+    if (caller === "frontend") {
+        return new ActionContractError(`"${name}" requires approval for these arguments, which only the signed-in app can give.`, { errorCode: UI_CAPABILITY_REQUIRED_ERROR_CODE, statusCode: 403 });
+    }
+    const message = serviceIdentity
+        ? `"${name}" requires human approval for these arguments, and a service identity can never give it. Ask a person to run this action from the app.`
+        : caller === "webmcp"
+            ? `"${name}" requires human approval for these arguments. WebMCP tool calls cannot grant that approval themselves — ask the user to confirm this action in chat, then call it there.`
+            : `"${name}" requires human approval for these arguments, which an HTTP action call cannot grant. Ask the user to approve it in the app's agent chat, or call it as an MCP tool, where the approval flow exists.`;
+    return new ActionContractError(message, {
+        errorCode: "approval_required",
+        statusCode: 409,
+    });
+}
+/**
+ * For a dispatcher that runs `entry.run` directly instead of a prepared call
+ * (the generated worker entry): the refusal when this call needs approval.
+ * Arguments that fail validation get no refusal here; the run refuses them.
+ */
+export async function directHttpActionApprovalRefusal(entry, params, ctx) {
+    if (entry.needsApproval === undefined || entry.needsApproval === false) {
+        return null;
+    }
+    const prepared = await actionCallIntent(entry, params);
+    if (!prepared.valid)
+        return null;
+    return (await preparedCallNeedsApproval(entry, prepared, ctx))
+        ? actionApprovalRequiredError(ctx.actionName, ctx.caller, false)
+        : null;
+}

package/dist/server/action-routes.js

@@ -3,7 +3,7 @@ import "../authorization/check-action.js";
 import { verifyA2ATokenWithClaims } from "../a2a-claims.js";
 import { isA2AIdentityVerificationUnavailableError } from "../a2a/server.js";
 import { actionChangeResource } from "../action-call-classification.js";
-import { actionCallIntent, ActionContractError, isActionContractError, isActionExposedToExternalAgents, isAgentActionStopError, failedCallEmitsChange, recordInvalidActionCall, preparedCallArguments, ranCallEmitsChange, runPreparedActionCall, } from "../action.js";
+import { actionCallIntent, ActionContractError, isActionContractError, isActionExposedToExternalAgents, isAgentActionStopError, failedCallEmitsChange, recordInvalidActionCall, preparedCallArguments, preparedCallNeedsApproval, ranCallEmitsChange, runPreparedActionCall, } from "../action.js";
 import { LLM_CREDENTIAL_KEYS, LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, } from "../agent/engine/credential-errors.js";
 import { isTransientDatabaseError } from "../db/client.js";
 import { declaresFeatureFlagDelegation } from "../feature-flags/a2a-action-route.js";
@@ -13,12 +13,13 @@ import { isWorkspaceAppAccessUnavailable, workspaceAppAccessUnavailableBody, } f
 import { checkWorkspaceAppAccessForRequest } from "../org/workspace-app-access-request.js";
 import { ACTION_BROWSER_PERSIST_ALLOW, ACTION_BROWSER_PERSIST_HEADER, } from "../shared/action-browser-persist.js";
 import { ACTION_CHANGE_MARKER_FAILED, ACTION_CHANGE_MARKER_HEADER, } from "../shared/action-change-marker-header.js";
-import { LLM_PROVIDER_MISSING_ERROR_CODE, LLM_PROVIDER_MISSING_STATUS, } from "../shared/action-error-codes.js";
+import { LLM_PROVIDER_MISSING_ERROR_CODE, LLM_PROVIDER_MISSING_STATUS, UI_CAPABILITY_REQUIRED_ERROR_CODE, } from "../shared/action-error-codes.js";
 import { agentNativeMcpInstructions, agentNativeToolTitle, } from "../shared/agent-mcp-metadata.js";
 import { EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER, allowsMcpDirectoryWidgetReadAction, getMcpDirectoryWidgetReadCapabilityResourceIds, getMcpDirectoryWidgetWriteCapabilityGrant, isExpiredMcpDirectoryWidgetWriteCapability, isMcpDirectoryWidgetCapabilityScope, isMcpDirectoryWidgetReadCapabilityScope, isMcpDirectoryWidgetWriteCapabilityScope, normalizeMcpDirectoryWidgetReadActionArguments, normalizeMcpDirectoryWidgetWriteActionArguments, } from "../shared/embed-auth.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { countActionFailure, countCredentialState, } from "../tracking/failure-counters.js";
 import { redact, redactErrorStack } from "../tracking/redaction.js";
+import { actionApprovalRequiredError } from "./action-approval.js";
 import { ACTION_ROUTE_PREFIX, bindActionBatch } from "./action-batch.js";
 import { notifyActionChangeForResponse } from "./action-change.js";
 import { readBrowserSessionIdHeader, readBrowserTabIdHeader, readAnalyticsClientPlatformHeader, readSyntheticTrafficHeader, resolveAgentRunOrgId, seedAgentRunOwnerContext, } from "./agent-run-context.js";
@@ -150,6 +151,17 @@ function isFrontendActionRequest(event) {
         return false;
     }
 }
+/**
+ * The frontend header is only the client's claim. A request proves it came
+ * from this app's signed-in UI with a same-origin request that carries the
+ * short-lived UI capability the browser minted for the same user.
+ */
+function isProvenUiRequest(event, caller, userEmail) {
+    return (caller === "frontend" &&
+        Boolean(userEmail) &&
+        isSameOriginRequest(event) &&
+        hasUiActionCapability(event, userEmail));
+}
 function getAllowedCorsOrigin(origin) {
     const allowedOrigin = resolveAllowedCorsOrigin(origin, {
         allowedOrigins: readCorsAllowedOrigins(),
@@ -793,16 +805,12 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                             : isFrontendActionRequest(event)
                                 ? "frontend"
                                 : "http");
-                const frontendCaller = requestCaller === "frontend";
-                if (entry.uiOnly === true &&
-                    (!frontendCaller ||
-                        !userEmail ||
-                        !isSameOriginRequest(event) ||
-                        !hasUiActionCapability(event, userEmail))) {
+                const provenUiRequest = isProvenUiRequest(event, requestCaller, userEmail);
+                if (entry.uiOnly === true && !provenUiRequest) {
                     setResponseStatus(event, 403);
                     return {
                         error: "This action can only be called from the signed-in app UI.",
-                        errorCode: "ui_capability_required",
+                        errorCode: UI_CAPABILITY_REQUIRED_ERROR_CODE,
                     };
                 }
                 const timezone = readTimezoneHeader(event);
@@ -1090,25 +1098,22 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                         // Each reader below gets its own copy of the prepared
                         // arguments; this one is for a failure's change marker.
                         params = preparedCallArguments(prepared);
-                        if (caller === "webmcp" && entry.needsApproval !== undefined) {
-                            let mustApprove = false;
-                            try {
-                                mustApprove =
-                                    typeof entry.needsApproval === "function"
-                                        ? Boolean(await entry.needsApproval(preparedCallArguments(prepared), {
-                                            userEmail,
-                                            orgId: orgId ?? null,
-                                            appId: options?.appId,
-                                            caller,
-                                        }))
-                                        : entry.needsApproval === true;
-                            }
-                            catch {
-                                mustApprove = true;
-                            }
-                            if (mustApprove) {
-                                throw new ActionContractError(`"${name}" requires human approval for these arguments. WebMCP tool calls cannot grant that approval themselves — ask the user to confirm this action in chat, then call it there.`, { errorCode: "approval_required", statusCode: 409 });
-                            }
+                        // Approval is given in the app: in its UI, or in an agent chat
+                        // or MCP flow that runs the action in-process. No other HTTP
+                        // caller can grant it. The app's UI is the proven browser app or
+                        // its MCP directory widget, whose capability is scoped to the
+                        // resources and actions the user is working on.
+                        if (!provenUiRequest &&
+                            !directoryWidgetReadAllowed &&
+                            !directoryWidgetWriteAllowed &&
+                            (await preparedCallNeedsApproval(entry, prepared, {
+                                userEmail,
+                                orgId: orgId ?? null,
+                                appId: options?.appId,
+                                caller,
+                                actionName: name,
+                            }))) {
+                            throw actionApprovalRequiredError(name, caller, Boolean(verifiedServiceIdentity));
                         }
                         const result = await runPreparedActionCall(entry, prepared, runContext, execution);
                         // The change follows what ran in the call, with the arguments

package/dist/server/agent-engine-api-key-route.d.ts

@@ -66,7 +66,6 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error: any;
     code: any;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     code?: undefined;
     ok: boolean;
@@ -74,5 +73,6 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,8 +8,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
     scope?: undefined;
 } | {
     ok: boolean;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,9 +1,9 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    models?: undefined;
     ok?: undefined;
+    models?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/edge.d.ts

@@ -15,6 +15,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { createOrgPlugin, defaultOrgPlugin } from "../org/plugin.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { getH3App, awaitBootstrap, markDefaultPluginProvided, type H3AppShim, } from "./framework-request-handler.js";
+export { directHttpActionApprovalRefusal } from "./action-approval.js";
 export { runWithRequestContext } from "./request-context.js";
 export { isSameOriginRequest } from "./request-origin.js";
 export { hasUiActionCapability, mountUiActionCapabilityRoute, } from "./ui-action-capability.js";

package/dist/server/edge.js

@@ -14,6 +14,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { createOrgPlugin, defaultOrgPlugin } from "../org/plugin.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { getH3App, awaitBootstrap, markDefaultPluginProvided, } from "./framework-request-handler.js";
+export { directHttpActionApprovalRefusal } from "./action-approval.js";
 export { runWithRequestContext } from "./request-context.js";
 export { isSameOriginRequest } from "./request-origin.js";
 export { hasUiActionCapability, mountUiActionCapabilityRoute, } from "./ui-action-capability.js";

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/server/workspace-provider-oauth.js

@@ -405,6 +405,7 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
                     ? { externalAccountId: identity.accountId }
                     : {}),
                 ...(identity.config ?? {}),
+                workspaceConnectionScope: flow.scope,
                 ...(providerId === "salesforce"
                     ? {
                         salesforceLoginUrl: flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,

package/dist/shared/action-error-codes.d.ts

@@ -5,3 +5,8 @@
 export declare const LLM_PROVIDER_MISSING_ERROR_CODE = "llm_provider_missing";
 /** 424 Failed Dependency: the request needs an LLM provider that is not connected. */
 export declare const LLM_PROVIDER_MISSING_STATUS = 424;
+/**
+ * 403: the call needs proof it came from the app's signed-in UI. The browser
+ * client mints its UI capability and retries once on this code.
+ */
+export declare const UI_CAPABILITY_REQUIRED_ERROR_CODE = "ui_capability_required";

package/dist/shared/action-error-codes.js

@@ -5,3 +5,8 @@
 export const LLM_PROVIDER_MISSING_ERROR_CODE = "llm_provider_missing";
 /** 424 Failed Dependency: the request needs an LLM provider that is not connected. */
 export const LLM_PROVIDER_MISSING_STATUS = 424;
+/**
+ * 403: the call needs proof it came from the app's signed-in UI. The browser
+ * client mints its UI capability and retries once on this code.
+ */
+export const UI_CAPABILITY_REQUIRED_ERROR_CODE = "ui_capability_required";

package/dist/shared/index.d.ts

@@ -1,6 +1,7 @@
 export { agentChat, type AgentChatMessage, type AgentChatCallOptions, type AgentChatResponse, } from "./agent-chat.js";
 export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, stripAgentChatContextFromMessage, type AgentChatMessageParts, } from "./agent-chat-context.js";
 export { agentEnv, type EnvVar } from "./agent-env.js";
+export { ACTION_BROWSER_PERSIST_ALLOW, ACTION_BROWSER_PERSIST_HEADER, } from "./action-browser-persist.js";
 export { APP_STATUS, DEFAULT_APP_STATUS, getAppStatus, type AppStatus, } from "./app-status.js";
 export { extractOAuthStateAppId, extractOAuthStateProvider, } from "./oauth-state.js";
 export { isGoogleProfileImageUrl } from "./google-profile-image.js";

package/dist/shared/index.js

@@ -1,6 +1,7 @@
 export { agentChat, } from "./agent-chat.js";
 export { appendAgentChatContextToMessage, splitAgentChatContextFromMessage, stripAgentChatContextFromMessage, } from "./agent-chat-context.js";
 export { agentEnv } from "./agent-env.js";
+export { ACTION_BROWSER_PERSIST_ALLOW, ACTION_BROWSER_PERSIST_HEADER, } from "./action-browser-persist.js";
 export { APP_STATUS, DEFAULT_APP_STATUS, getAppStatus, } from "./app-status.js";
 export { extractOAuthStateAppId, extractOAuthStateProvider, } from "./oauth-state.js";
 export { isGoogleProfileImageUrl } from "./google-profile-image.js";

package/dist/templates/chat/.agents/skills/actions/references/action-fields.md

@@ -95,9 +95,9 @@ MCP clients see no `outputSchema` by default. Set `mcpOutputSchema: true` (requi
 
 `authorize` decides whether the caller may run the action at all. It wraps
 `run`, so it holds at **all six dispatch sites** — agent tool, HTTP, frontend
-hook, MCP, A2A, CLI — unlike `needsApproval`, which is honoured only in the
-agent loop. Use `authorize` for "not everyone may do this"; use `needsApproval`
-to ask a human to bless one call a permitted caller is already allowed to make.
+hook, MCP, A2A, CLI. Use `authorize` for "not everyone may do this"; use
+`needsApproval` to ask a human to bless one call a permitted caller is already
+allowed to make.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -140,4 +140,6 @@ export default defineAction({
 
 When the gate is truthy and the call isn't yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. A predicate gates conditionally (e.g. only external recipients) and **fails closed**: a throw is treated as "approval required". It receives its own copy of the prepared snapshot of the validated arguments, defaults applied, and the approval binds to the snapshot's hash, so an approved call runs only with the arguments that were approved (a Date binds by its time). The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's `approvalKey`, and only then does the action run.
 
+Approval is given in the app, so HTTP never grants it. The HTTP action route and the generated Workers entry run a gated call only for the proven app UI (a frontend call from the signed-in user, same origin, holding the short-lived UI capability; `isProvenUiRequest`, the proof `uiOnly` uses) or the app's MCP directory widget. Every other HTTP caller (bearer or API key, MCP OAuth token, org service token, A2A, extension iframe, mobile app) gets `409 approval_required`, and a service identity can never approve. The shared client presents the capability with every write from a signed-in session (minted once per user, reused for nine minutes, never for reads or public pages), so a gated button works on its first request. A call without proof gets `403 ui_capability_required`; the client then re-mints and retries once, which is only the fallback for an expired or rejected capability. Every surface evaluates the gate through `preparedCallNeedsApproval`, so a throwing predicate asks there too. A caller that must run unattended needs a different action, never a bypass of the gate.
+
 **Keep approvals rare** — the default is off and almost every action should leave it off. The canonical example is Mail's `send-email` (`needsApproval: true`). See the `security` skill and the Human Approval doc.

package/dist/templates/default/.agents/skills/actions/references/action-fields.md

@@ -95,9 +95,9 @@ MCP clients see no `outputSchema` by default. Set `mcpOutputSchema: true` (requi
 
 `authorize` decides whether the caller may run the action at all. It wraps
 `run`, so it holds at **all six dispatch sites** — agent tool, HTTP, frontend
-hook, MCP, A2A, CLI — unlike `needsApproval`, which is honoured only in the
-agent loop. Use `authorize` for "not everyone may do this"; use `needsApproval`
-to ask a human to bless one call a permitted caller is already allowed to make.
+hook, MCP, A2A, CLI. Use `authorize` for "not everyone may do this"; use
+`needsApproval` to ask a human to bless one call a permitted caller is already
+allowed to make.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -140,4 +140,6 @@ export default defineAction({
 
 When the gate is truthy and the call isn't yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. A predicate gates conditionally (e.g. only external recipients) and **fails closed**: a throw is treated as "approval required". It receives its own copy of the prepared snapshot of the validated arguments, defaults applied, and the approval binds to the snapshot's hash, so an approved call runs only with the arguments that were approved (a Date binds by its time). The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's `approvalKey`, and only then does the action run.
 
+Approval is given in the app, so HTTP never grants it. The HTTP action route and the generated Workers entry run a gated call only for the proven app UI (a frontend call from the signed-in user, same origin, holding the short-lived UI capability; `isProvenUiRequest`, the proof `uiOnly` uses) or the app's MCP directory widget. Every other HTTP caller (bearer or API key, MCP OAuth token, org service token, A2A, extension iframe, mobile app) gets `409 approval_required`, and a service identity can never approve. The shared client presents the capability with every write from a signed-in session (minted once per user, reused for nine minutes, never for reads or public pages), so a gated button works on its first request. A call without proof gets `403 ui_capability_required`; the client then re-mints and retries once, which is only the fallback for an expired or rejected capability. Every surface evaluates the gate through `preparedCallNeedsApproval`, so a throwing predicate asks there too. A caller that must run unattended needs a different action, never a bypass of the gate.
+
 **Keep approvals rare** — the default is off and almost every action should leave it off. The canonical example is Mail's `send-email` (`needsApproval: true`). See the `security` skill and the Human Approval doc.

package/dist/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -21,7 +21,25 @@ Four phases, in order. Phase 0 comes before any investigation, not after.
 2. **Fix** what the evidence actually proves, at the owning boundary.
 3. **Reply** with useful questions, then recap.
 
-Output is fixes. For every report root this task owns, keep one concise, current same-actor status reply after the latest human message. It names every verified `✅` scope and its evidence, every open scope, and each `🎫` action and owner (or why a mark does not apply). Add and read back root `✅` as soon as direct post-change proof verifies a scope, and root `🎫` as soon as another person or team must act. An `👀` alone never completes the status. Preserve all reaction history, and follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md). Do not reply on person-assigned or `:mag:` items.
+Output is fixes. For every unheld in-scope report root this task owns, keep one concise, current same-actor status reply after the latest human message. It names every verified `✅` scope and its evidence, every open scope, and each `🎫` action and owner (or why a mark does not apply). Add and read back root `✅` as soon as direct post-change proof verifies a scope, and root `🎫` as soon as another person or team must act. An `👀` alone never completes the status. Preserve all reaction history, and follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md). Do not reply on held, person-assigned, or `:mag:` items.
+
+### Read the root marks as history; use the reply for current status
+
+- `👀` records this workflow's claim. It does not mean the report is still open.
+- `✅` records a scope that passed direct post-change proof. Add it as soon as
+  any scope passes, even when another scope remains open; name the verified
+  scope and evidence in the status reply.
+- `🎫` records a distinct action another person must take, including a reporter
+  request. Keep the reaction as history after that action is completed,
+  answered, or abandoned; the current reply must say whether the action is
+  still open or historical.
+- Every owned root needs one current same-actor reply after the latest human
+  reply. Reuse it while the disposition and evidence remain current; do not
+  send a duplicate progress reply on every sweep. The reply names verified
+  scopes, open scopes, human actions and owners, and why either `✅` or `🎫` is
+  absent. An eye-only root is correct when no scope is verified and no separate
+  human action is pending; say whether the next step is this workflow's
+  investigation or no further action.
 
 ## Slack channels and ownership
 
@@ -34,44 +52,93 @@ channel. For a permalink, its channel ID identifies only where the exact linked
 root must appear; it does not limit the cutoff or channel scope. For an
 explicitly narrowed sweep, verify that the active request names every selected
 channel, then record its exact text and IDs in the separate scope-confirmation
-file. `#dev-agent-native-feedback` is not excluded.
+file. A request can select exactly two channels by linking one report in the
+first and directly asking for “the same in” the second, without saying “only.”
+The checker permits one adjacent-transposition typo in that target only when it
+uniquely matches a selected canonical channel; it rejects incidental or quoted
+mentions and prefixes. See [`channel-inventory.md`](references/channel-inventory.md)
+for the scope gate and its confirmation requirements. `#dev-agent-native-feedback`
+is not excluded.
 
 In every scoped channel, run the complete bot-inclusive `slack_search_public`
 scan with only the channel filter and that channel's inclusive lower bound.
-Exhaust every cursor; `slack_read_channel` cannot replace this inventory. Resolve
-each row to its true parent. Read each report's full thread, attachments, and
-root reactions before classifying, claiming, or skipping it. Follow
+Freeze one `windowEndTs` at sweep start and use it for every channel and
+owned-mark search. Messages newer than it belong to the next scheduled sweep;
+never move the boundary to chase arrivals. Exhaust every cursor;
+`slack_read_channel` cannot replace this inventory. Resolve
+each row to its true parent and read the root reactions before opening the thread.
+If another actor owns any workflow mark (`👀`, `✅`, or `🎫`), or this actor owns
+`:mag:`, apply the held-thread boundary below: do not read the thread, react, or
+reply. Otherwise read the report's full thread and attachments before
+classifying or claiming it. Follow
 [`channel-inventory.md`](references/channel-inventory.md) for exact query
-arguments, raw-page receipts, cap recovery, root classification, all-history
-searches for this actor's `👀`, `✅`, and `🎫`, and checker requirements.
+arguments, raw-page receipts, cap recovery, root classification, fixed-window
+source scans, bounded ownership searches for this actor's `👀`, `✅`, and `🎫`,
+and checker requirements. Owned-mark searches use Slack's exact syntax
+`hasmy::eyes:`, `hasmy::white_check_mark:`, or `hasmy::ticket:` with the channel
+filter and the same inclusive `after` and `before` as that channel's source
+scan. Do not widen a finite catch-up request into an all-history audit. A root
+older than `after` is in scope only when an in-window reply links to it. A
+missing trailing colon is not a valid ownership query.
 
 Only the invoking Slack actor's root marks are owned here. Another task's eye
 plus its current open status remains theirs; an explicit handoff naming this
 task and scope is required to transfer investigation. An eye is a permanent
 claim, not proof of open or completed work. A mark on a reply never claims or
-checks off its parent. Before exit, reconcile every owned root in the full
-inventory, including older marks: latest human reply, current status reply,
-verified scopes, open scopes, human/team actions, and exact root reactions.
-Never let a high eye count hide an unchecked verified scope or a missing
-current reply.
+checks off its parent. Before exit, reconcile every in-window root carrying
+this actor's `👀`, `✅`, or `🎫` found by the bounded searches. Also reconcile an
+older root when an in-window reply links to it. For every owned root, compare
+the latest human reply, current status, verified scopes, open scopes, human
+actions, and exact root reactions.
+Never let a high eye count hide a verified scope without `✅` or a missing
+current status reply.
+
+**Held-thread boundary:** A direct root reaction read showing another person's
+`👀`, `✅`, or `🎫` means the thread belongs to that workflow; this actor's
+`:mag:` means this actor opted out. Record the exact root, reaction owners, and
+one reason (`foreign_workflow_mark` or `mag_opt_out`) in `ownershipSkip`, with
+`Skipped` disposition. When this actor owns both `:mag:` and a workflow mark,
+use `mag_opt_out` and preserve the exact root reaction-owner record as history.
+Do not open/read that thread, inspect reply reactions, add or remove reactions,
+or post a reply. Apply the same skip to channel reply
+rows linked to that root. A linked pre-window root without source text remains
+`unclassified`; do not infer its original report from the reply. This explicit
+exception keeps ownership boundaries intact while allowing the rest of the
+window to be reconciled. A foreign `👀` without current status is still held;
+do not read it to decide whether its owner is active.
 
 Only Steve's `:mag:` and `:yes-party:` count (`U0GCV21HC`). When Steve invokes,
-exhaust `hasmy::mag:` and `hasmy::yes-party:` searches; otherwise inspect root
-reactions. `:mag:` opts out and wins over `:yes-party:`. The latter authorizes
-only an otherwise review-only item; it never overrides an assignment or another
+exhaust `hasmy::mag:` and `hasmy::yes-party:` searches within each channel's
+same inclusive cutoff; otherwise inspect root reactions in the requested
+window. `:mag:` opts out and wins over `:yes-party:`. The latter authorizes only
+an otherwise review-only item; it never overrides an assignment or another
 task's claim.
 
 ## Phase 0: claim and reconcile
 
 Resolve known duplicates before claiming. Check ownership, then add and read
 back this task's root `👀` before investigating an eligible unowned report.
-Reconcile every root this actor already owns, including eyes, checks, and
-handoffs from prior runs, before discovering new questions. Keep one concise
-canonical status by the same actor after the latest human message; read back the
-visible reply and root reactions after each write. Use
+Reconcile only owned roots inside this invocation's fixed window and older
+roots explicitly linked by an in-window reply. Never expand a finite sweep to
+all historical roots just because this actor owns an old mark; widen the range
+only when the invocation explicitly requests it or hands off exact roots. Finish
+this bounded reconciliation before discovering new questions. Keep one
+concise canonical status by the same actor after the latest human message; read
+back the visible reply and root reactions after each write. Use
 [`slack-reaction-replies.md`](references/slack-reaction-replies.md) for exact
 status and reaction rules.
 
+**Bounded exit gate:** enumerate the complete candidate set from the fixed
+source window, the three matching owned-mark searches, and older roots linked
+by in-window replies. For every unheld owned root, compare the latest human
+message, current status reply, verified scopes, open scopes, and root marks.
+Add and read back `✅` for each newly verified scope and `🎫` for each distinct
+pending human action; the status reply must follow the latest human message and
+name current evidence, remaining work, and owners. An `👀` with a verified
+scope missing `✅`, a pending human action missing `🎫`, or no current status is
+unfinished. Finish the complete bounded set once, then stop; do not chase
+unrelated historical marks.
+
 Split reports into distinct scopes. Add root `✅` as soon as any named scope
 passes direct post-change proof, even while its PR is open; say **Verified
 locally** and that merge is pending. Use **Fixed** only after merge and direct
@@ -97,11 +164,14 @@ action and owner. Use **Skipped** only for non-defects.
 
 Phase 0 handles new human replies on owned roots first; never hide a newer
 reporter reply behind a mark. Then find prior unanswered questions using the
-exact bot disclosure and the saved channel reply cursor. On a first run, scan
-available history. Exhaust pages, use a one-day overlap for date-only cursors,
-resolve every hit to its parent, and read the full thread after checking
-reactions. Follow [`slack-reaction-replies.md`](references/slack-reaction-replies.md)
-for exact searches, legacy identity handling, and answer criteria.
+exact bot disclosure and the saved channel reply cursor, bounded by this
+invocation's fixed window. On a first run, use the same default five-day window;
+never scan all available history to initialize the cursor. Exhaust pages, use a
+one-day overlap for date-only cursors, resolve every hit to its parent, and read
+the full thread after checking reactions. An older root is eligible only when
+an in-window reply links to it. Follow
+[`slack-reaction-replies.md`](references/slack-reaction-replies.md) for exact
+searches, legacy identity handling, and answer criteria.
 
 A valid answer is a human post after the question, without this workflow's
 disclosure, that addresses the question. Rebuild the evidence and attempt the
@@ -316,15 +386,17 @@ send one concise disposition covering done, remaining, and next action/owner.
 Do not reply again to announce merge, publication, or live beta; answer direct
 reporter follow-ups. End Slack replies with `this was sent from a bot.`.
 
-Replies are one or two sentences: the change or question, its limit, and the next step. Never explain reactions, ledgers, or tickets. Never send **Open**/**pending** or a symptom recap. Ask for reporter input only when it changes the next step; never request supplied evidence or internal access. Keep hashes, branches, CI, publisher, and run details in the recap.
-
-That brevity rule is for a reporter-facing reply. Separately, every root this
-actor marks with `👀`, `✅`, or `🎫` still needs the current same-actor status
-reply required by the Slack reaction reference. One concise reply may serve both
-purposes when it answers the reporter and records the current disposition,
-verified/open scopes, owner/action, and any missing-proof reason. A Slack `🎫`
-reaction tracks a distinct unfinished human/team action; it does not mean an
-external tracker ticket was created or assigned. Never imply that it was.
+Reporter-facing replies are one or two sentences: the change or question, its limit, and the next step. Do not explain workflow mechanics, ledgers, or external tracker tickets. Never send **Open**/**pending** or a symptom recap. Ask for reporter input only when it changes the next step; never request supplied evidence or internal access. Keep hashes, branches, CI, publisher, and run details in the recap.
+
+Every root this actor marks with `👀`, `✅`, or `🎫` also needs the current
+same-actor status reply required by the Slack reaction reference. One concise
+reply may serve both purposes when it answers the reporter and records the
+current disposition, verified/open scopes, owner/action, and any reason a mark
+is absent. This status requirement takes precedence over the reporter-facing
+brevity rule only for those facts; do not explain ledger mechanics or external
+tracker tickets. A Slack `🎫` reaction tracks a distinct human action, not an
+external ticket, and remains as history after the action closes. Never imply
+that an external ticket was created or assigned.
 
 Keep publisher and beta checks in the internal recap after the disposition;
 they do not trigger a second reporter reply.