@anthusai/papyrus 1.10.0 → 1.12.0

package/amplify/functions/category-action/handler.ts

@@ -4,12 +4,25 @@ import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
 import { putJsonModelPayload, putTextModelPayload, readJsonModelPayload } from "../shared/model-payloads";
-import { referenceCurationMetadata } from "../shared/reference-curation-metadata";
+import { curationActorKind, referenceCurationMetadata } from "../shared/reference-curation-metadata";
+import {
+  CURATION_DELEGATION_OWNER_TYPE,
+  CURATION_DELEGATION_PAYLOAD_KIND,
+  delegationExpiry,
+  delegationRefusalMessage,
+  delegationVerdict,
+  newDelegationToken,
+  type CurationDelegation,
+} from "../shared/curation-delegation";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
+type CreateCurationDelegationHandler = Schema["createCurationDelegation"]["functionHandler"];
+type RevokeCurationDelegationHandler = Schema["revokeCurationDelegation"]["functionHandler"];
+type ListCurationDelegationsHandler = Schema["listCurationDelegations"]["functionHandler"];
+type RecordDelegatedCurationHandler = Schema["recordDelegatedCuration"]["functionHandler"];
 type ReferenceQualityHandler = Schema["setReferenceQualityRating"]["functionHandler"];
-type ReferenceInsightHandler = Schema["createReferenceInsight"]["functionHandler"];
+type ReferenceNoteHandler = Schema["createReferenceNote"]["functionHandler"];
 type MoveReferenceCorpusHandler = Schema["moveReferenceCorpus"]["functionHandler"];
 type StartReferenceCurationHandler = Schema["startReferenceCuration"]["functionHandler"];
 type GetReferenceCurationStatusHandler = Schema["getReferenceCurationStatus"]["functionHandler"];
@@ -23,8 +36,12 @@ type ReviewReferenceTopicLabelHandler = Schema["reviewReferenceTopicLabel"]["fun
 type CategoryActionEvent =
   | Parameters<ReviewHandler>[0]
   | Parameters<ReferenceCurationHandler>[0]
+  | Parameters<CreateCurationDelegationHandler>[0]
+  | Parameters<RevokeCurationDelegationHandler>[0]
+  | Parameters<ListCurationDelegationsHandler>[0]
+  | Parameters<RecordDelegatedCurationHandler>[0]
   | Parameters<ReferenceQualityHandler>[0]
-  | Parameters<ReferenceInsightHandler>[0]
+  | Parameters<ReferenceNoteHandler>[0]
   | Parameters<MoveReferenceCorpusHandler>[0]
   | Parameters<StartReferenceCurationHandler>[0]
   | Parameters<GetReferenceCurationStatusHandler>[0]
@@ -88,8 +105,12 @@ export const handler = async (event: CategoryActionEvent) => {
   }
   if (fieldName === "reviewSteeringProposal") return reviewSteeringProposal(event as Parameters<ReviewHandler>[0]);
   if (fieldName === "reviewReferenceCuration") return reviewReferenceCuration(event as Parameters<ReferenceCurationHandler>[0]);
+  if (fieldName === "createCurationDelegation") return createCurationDelegation(event as Parameters<CreateCurationDelegationHandler>[0]);
+  if (fieldName === "revokeCurationDelegation") return revokeCurationDelegation(event as Parameters<RevokeCurationDelegationHandler>[0]);
+  if (fieldName === "listCurationDelegations") return listCurationDelegations(event as Parameters<ListCurationDelegationsHandler>[0]);
+  if (fieldName === "recordDelegatedCuration") return recordDelegatedCuration(event as Parameters<RecordDelegatedCurationHandler>[0]);
   if (fieldName === "setReferenceQualityRating") return setReferenceQualityRating(event as Parameters<ReferenceQualityHandler>[0]);
-  if (fieldName === "createReferenceInsight") return createReferenceInsight(event as Parameters<ReferenceInsightHandler>[0]);
+  if (fieldName === "createReferenceNote") return createReferenceNote(event as Parameters<ReferenceNoteHandler>[0]);
   if (fieldName === "moveReferenceCorpus") return moveReferenceCorpus(event as Parameters<MoveReferenceCorpusHandler>[0]);
   if (fieldName === "startReferenceCuration") return startReferenceCuration(event as Parameters<StartReferenceCurationHandler>[0]);
   if (fieldName === "getReferenceCurationStatus") return getReferenceCurationStatus(event as Parameters<GetReferenceCurationStatusHandler>[0]);
@@ -162,7 +183,10 @@ async function reviewSteeringProposal(event: Parameters<ReviewHandler>[0]) {
   };
 }
 
-async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandler>[0]) {
+async function reviewReferenceCuration(
+  event: Parameters<ReferenceCurationHandler>[0],
+  delegation: { delegationId: string; relayedBy: string; instruction: string } | null = null,
+) {
   const client = await getDataClient();
   const referenceId = normalizeRequiredString(event.arguments.referenceId, "referenceId");
   const action = normalizeReferenceCurationAction(event.arguments.action);
@@ -234,6 +258,8 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
       referenceLineageId,
       decisionRelationId: normalizeOptionalString(event.arguments.decisionRelationId),
       shareable: event.arguments.shareable ?? null,
+      actorKind: delegation ? "human" : curationActorKind(event.identity),
+      delegation,
     }),
     { filename: "metadata.json", now },
   );
@@ -300,6 +326,150 @@ async function reviewReferenceCuration(event: Parameters<ReferenceCurationHandle
   };
 }
 
+function requireSignedInPerson(event: { identity?: unknown }): { sub: string; label: string; isAdmin: boolean } {
+  if (curationActorKind(event.identity) !== "human") {
+    throw new Error("Only a person signed in to the Newsroom can manage curation delegations.");
+  }
+  const identity = event.identity as { sub?: unknown; claims?: Record<string, unknown> };
+  const claims = identity.claims ?? {};
+  const groups = Array.isArray(claims["cognito:groups"]) ? (claims["cognito:groups"] as unknown[]) : [];
+  return {
+    sub: normalizeRequiredString(claims.sub ?? identity.sub, "identity.sub"),
+    label: normalizeOptionalString(claims.email) ?? normalizeOptionalString(claims.name) ?? "Newsroom editor",
+    isAdmin: groups.includes("admin"),
+  };
+}
+
+async function readCurationDelegation(client: DataClient, delegationId: string): Promise<CurationDelegation | null> {
+  const stored = await readJsonModelPayload(client as any, "knowledgeRawPayload", delegationId, "raw_payload", CURATION_DELEGATION_PAYLOAD_KIND);
+  return stored ? (stored as unknown as CurationDelegation) : null;
+}
+
+async function writeCurationDelegation(client: DataClient, delegation: CurationDelegation, now: string, created: boolean) {
+  const input = {
+    id: delegation.delegationId,
+    ownerType: CURATION_DELEGATION_OWNER_TYPE,
+    ownerId: delegation.grantorSub,
+    payloadKind: CURATION_DELEGATION_PAYLOAD_KIND,
+    createdAt: delegation.createdAt,
+    updatedAt: now,
+  };
+  if (created) {
+    await requireDataResult(client.models.KnowledgeRawPayload.create(input), "create curation delegation");
+  } else {
+    await requireDataResult(client.models.KnowledgeRawPayload.update(input), "update curation delegation");
+  }
+  await putJsonModelPayload(
+    client as any,
+    { ownerKind: "knowledgeRawPayload", ownerId: delegation.delegationId },
+    "raw_payload",
+    CURATION_DELEGATION_PAYLOAD_KIND,
+    delegation as unknown as Record<string, unknown>,
+    { filename: "curation-delegation.json", now },
+  );
+}
+
+function delegationResult(delegation: CurationDelegation, token: string | null) {
+  return {
+    ok: true,
+    delegationId: delegation.delegationId,
+    token,
+    agentLabel: delegation.agentLabel,
+    grantorLabel: delegation.grantorLabel,
+    expiresAt: delegation.expiresAt,
+    revokedAt: delegation.revokedAt,
+  };
+}
+
+async function createCurationDelegation(event: Parameters<CreateCurationDelegationHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const now = new Date().toISOString();
+  const delegationId = `curation-delegation-${randomUUID()}`;
+  const { token, tokenHash } = newDelegationToken(delegationId);
+  const delegation: CurationDelegation = {
+    delegationId,
+    tokenHash,
+    grantorSub: person.sub,
+    grantorLabel: person.label,
+    agentLabel: normalizeRequiredString(event.arguments.agentLabel, "agentLabel"),
+    createdAt: now,
+    expiresAt: delegationExpiry(now, event.arguments.hours),
+    revokedAt: null,
+  };
+  await writeCurationDelegation(client, delegation, now, true);
+  return delegationResult(delegation, token);
+}
+
+async function revokeCurationDelegation(event: Parameters<RevokeCurationDelegationHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const delegation = await readCurationDelegation(client, normalizeRequiredString(event.arguments.delegationId, "delegationId"));
+  if (!delegation) throw new Error("That delegation was not found.");
+  if (delegation.grantorSub !== person.sub && !person.isAdmin) throw new Error("Only the person who granted a delegation can revoke it.");
+  const now = new Date().toISOString();
+  const revoked = { ...delegation, revokedAt: delegation.revokedAt ?? now };
+  await writeCurationDelegation(client, revoked, now, false);
+  return delegationResult(revoked, null);
+}
+
+async function listCurationDelegations(event: Parameters<ListCurationDelegationsHandler>[0]) {
+  const person = requireSignedInPerson(event);
+  const client = await getDataClient();
+  const delegations: CurationDelegation[] = [];
+  let nextToken: string | null | undefined;
+  do {
+    const page: any = await (client.models.KnowledgeRawPayload as any).listKnowledgeRawPayloadsByOwnerAndKind(
+      { ownerId: person.sub, payloadKind: { eq: CURATION_DELEGATION_PAYLOAD_KIND } },
+      { nextToken },
+    );
+    assertNoDataErrors(page.errors, "list curation delegations");
+    for (const payload of page.data ?? []) {
+      const delegation = await readCurationDelegation(client, payload.id);
+      if (delegation) delegations.push(delegation);
+    }
+    nextToken = page.nextToken;
+  } while (nextToken);
+  return delegations
+    .sort((first, second) => second.createdAt.localeCompare(first.createdAt))
+    .map((delegation) => delegationResult(delegation, null));
+}
+
+async function recordDelegatedCuration(event: Parameters<RecordDelegatedCurationHandler>[0]) {
+  const client = await getDataClient();
+  const now = new Date().toISOString();
+  const delegationId = normalizeRequiredString(event.arguments.delegationId, "delegationId");
+  const agentLabel = normalizeRequiredString(event.arguments.agentLabel, "agentLabel");
+  const delegation = await readCurationDelegation(client, delegationId);
+  const verdict = delegationVerdict(delegation, {
+    token: normalizeRequiredString(event.arguments.delegationToken, "delegationToken"),
+    agentLabel,
+    now,
+  });
+  if (!verdict.ok || !delegation) {
+    throw new Error(delegationRefusalMessage(verdict.ok ? "unknown-token" : verdict.reason));
+  }
+  const instruction = normalizeRequiredString(event.arguments.instruction, "instruction").slice(0, 2000);
+  const namedPerson = normalizeRequiredString(event.arguments.onBehalfOf, "onBehalfOf");
+  if (namedPerson.toLowerCase() !== delegation.grantorLabel.toLowerCase()) {
+    throw new Error(`That delegation was granted by ${delegation.grantorLabel}, not ${namedPerson}.`);
+  }
+  const onBehalfOfPerson = {
+    ...event,
+    arguments: {
+      referenceId: event.arguments.referenceId,
+      action: event.arguments.action,
+      note: event.arguments.note,
+      reasonCode: event.arguments.reasonCode,
+      decisionRelationId: event.arguments.decisionRelationId,
+      shareable: event.arguments.shareable,
+      actorSub: delegation.grantorSub,
+      actorLabel: delegation.grantorLabel,
+    },
+  } as unknown as Parameters<ReferenceCurationHandler>[0];
+  return reviewReferenceCuration(onBehalfOfPerson, { delegationId, relayedBy: agentLabel, instruction });
+}
+
 async function setReferenceQualityRating(event: Parameters<ReferenceQualityHandler>[0]) {
   const client = await getDataClient();
   const referenceId = normalizeRequiredString(event.arguments.referenceId, "referenceId");
@@ -403,7 +573,7 @@ async function setReferenceQualityRating(event: Parameters<ReferenceQualityHandl
   };
 }
 
-async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>[0]) {
+async function createReferenceNote(event: Parameters<ReferenceNoteHandler>[0]) {
   const client = await getDataClient();
   const referenceId = normalizeRequiredString(event.arguments.referenceId, "referenceId");
   const summary = normalizeRequiredString(event.arguments.summary, "summary");
@@ -414,10 +584,10 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
   const actorLabel = normalizeOptionalString(event.arguments.actorLabel) ?? getIdentityLabel(event);
   const actor = actorLabel ?? actorSub ?? "Papyrus newsroom";
   const referenceLineageId = normalizeOptionalString(reference.lineageId) ?? referenceId;
-  const messageId = `message-reference-insight-${safeId(referenceLineageId)}-${now.replace(/[^0-9TZ]/g, "")}-${randomUUID().slice(0, 8)}`;
+  const messageId = `message-reference-note-${safeId(referenceLineageId)}-${now.replace(/[^0-9TZ]/g, "")}-${randomUUID().slice(0, 8)}`;
   const relationId = `semantic-relation-${hashStable([
     `message#${messageId}`,
-    "insight_about",
+    "note_about",
     `reference#${referenceId}`,
   ]).slice(0, 24)}`;
 
@@ -425,7 +595,7 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
     client.models.Message.create({
       ...buildCanonicalMessageInput({
         id: messageId,
-        messageKind: "insight",
+        messageKind: "note",
         messageDomain: "knowledge",
         summary,
         source: "newsroom",
@@ -436,7 +606,7 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
       threadId: messageId,
       sequenceNumber: 1,
     }),
-    "create insight Message",
+    "create note Message",
   );
   await putTextModelPayload(
     client as any,
@@ -452,7 +622,7 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
     "metadata",
     "metadata",
     {
-      kind: "reference.insight.created",
+      kind: "reference.note.created",
       targetKind: "reference",
       targetId: referenceId,
       targetLineageId: referenceLineageId,
@@ -463,8 +633,8 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
     client.models.SemanticRelation.create({
       id: relationId,
       relationState: "current",
-      predicate: "insight_about",
-      ...semanticRelationTypeFieldsForPredicate("insight_about"),
+      predicate: "note_about",
+      ...semanticRelationTypeFieldsForPredicate("note_about"),
       subjectKind: "message",
       subjectId: messageId,
       subjectLineageId: messageId,
@@ -476,7 +646,7 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
       subjectStateKey: semanticStateKey("message", messageId),
       objectStateKey: semanticStateKey("reference", referenceLineageId),
       objectSubjectStateKey: `${semanticStateKey("reference", referenceLineageId)}#message`,
-      predicateObjectStateKey: `insight_about#${semanticStateKey("reference", referenceLineageId)}`,
+      predicateObjectStateKey: `note_about#${semanticStateKey("reference", referenceLineageId)}`,
       subjectVersionKey: semanticVersionKey("message", messageId),
       objectVersionKey: semanticVersionKey("reference", referenceId),
       score: 1,
@@ -492,17 +662,17 @@ async function createReferenceInsight(event: Parameters<ReferenceInsightHandler>
       updatedAt: now,
       newsroomFeedKey: "semanticRelations",
       metadata: JSON.stringify({
-        kind: "reference.insight",
+        kind: "reference.note",
         summary,
         actor,
       }),
     }),
-    "create insight_about relation",
+    "create note_about relation",
   );
   await updateNewsroomSummaryForSemanticRelationDelta(
     client,
     {
-      relationTypeKey: "insight_about",
+      relationTypeKey: "note_about",
       relationDomain: "commentary",
       subjectKind: "message",
       objectKind: "reference",
@@ -1497,10 +1667,10 @@ function semanticRelationTypeFieldsForPredicate(predicate: string): {
       relationDomain: "curation",
     };
   }
-  if (predicate === "insight_about") {
+  if (predicate === "note_about") {
     return {
-      relationTypeId: "semantic-relation-type-insight-about",
-      relationTypeKey: "insight_about",
+      relationTypeId: "semantic-relation-type-note-about",
+      relationTypeKey: "note_about",
       relationDomain: "knowledge",
     };
   }

package/amplify/functions/console-chat-responder/src/main.rs

@@ -2190,7 +2190,7 @@ fn build_openai_messages(
 ) -> Vec<Value> {
     let mut messages = vec![json!({
         "role": "system",
-        "content": "You are Papyrus, an editorial assistant for an autonomous newsroom. Be concise, accurate, and concrete. Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable insight, recommend creating an insight Message instead of making every chat turn canonical knowledge. Use execute_tactus for Papyrus runtime work. Distinguish references from assignments: Reference.* is for scholarly sources; Assignment.* is for newsroom work items (research, curation, intake). When the user provides a URL and asks to add, register, or file a reference, immediately call Reference.create{ url = \"<url>\", title = \"<optional>\", apply = true }—do not use Reference.register, papyrus.reference.create, or Assignment.create unless they asked for research work. For \"most recent references\" or similar, immediately call Reference.list{ limit = <count>, order = \"newest\" } and summarize. For \"last/latest/most recent research assignment\" (or \"research assignment\" without a specific id), immediately call Assignment.list{ type = \"research\", limit = 1 } (includes research.edition-candidate, research.tavily-deep, and other research.* types), then Assignment.get{ id = \"<that id>\" } if the user wants detail—do not use Reference.list and do not list all assignment types (curation.reference-intake is not a research assignment). To create research work, use Assignment.create{ type = \"research\", title = \"...\", apply = true }."
+        "content": "You are Papyrus, an editorial assistant for an autonomous newsroom. Be concise, accurate, and concrete. Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable note, recommend creating a note Message instead of making every chat turn canonical knowledge. Use execute_tactus for Papyrus runtime work. Distinguish references from assignments: Reference.* is for scholarly sources; Assignment.* is for newsroom work items (research, curation, intake). When the user provides a URL and asks to add, register, or file a reference, immediately call Reference.create{ url = \"<url>\", title = \"<optional>\", apply = true }—do not use Reference.register, papyrus.reference.create, or Assignment.create unless they asked for research work. For \"most recent references\" or similar, immediately call Reference.list{ limit = <count>, order = \"newest\" } and summarize. For \"last/latest/most recent research assignment\" (or \"research assignment\" without a specific id), immediately call Assignment.list{ type = \"research\", limit = 1 } (includes research.edition-candidate, research.tavily-deep, and other research.* types), then Assignment.get{ id = \"<that id>\" } if the user wants detail—do not use Reference.list and do not list all assignment types (curation.reference-intake is not a research assignment). To create research work, use Assignment.create{ type = \"research\", title = \"...\", apply = true }."
     })];
     if !static_prompt.publication_mission.trim().is_empty() {
         messages.push(json!({

package/amplify/functions/content-actions/handler.py

@@ -22,6 +22,7 @@ from papyrus_content.rebuild_trigger import (
     trigger_rebuild,
     trigger_staging_build,
 )
+from papyrus_content.story_reporting import save_story_version
 from papyrus_content.publishing import (
     ItemFields,
     PublishError,
@@ -188,6 +189,28 @@ def run_projection_task(task: dict) -> dict:
 
 def save_item_draft_action(arguments: dict, actor: str) -> dict:
     client, _claims = create_authoring_client()
+    if arguments.get("newVersion") and arguments.get("id"):
+        existing = client.get_record("Item", arguments["id"])
+        if existing is None:
+            raise PublishError("not-found", "That story was not found.")
+        record = save_story_version(
+            client,
+            existing.get("lineageId") or existing["id"],
+            front_matter_yaml=arguments.get("frontMatterYaml"),
+            body_markus=arguments.get("bodyMarkus") or "",
+            actor=actor,
+            change_reason=arguments.get("changeReason") or "edited in the newsroom",
+        )
+        return {
+            "ok": True,
+            "item": {
+                "id": record["id"],
+                "contentHash": record["contentHash"],
+                "status": record["status"],
+                "slug": record["slug"],
+                "versionNumber": record.get("versionNumber"),
+            },
+        }
     fields = ItemFields(
         type=arguments["type"],
         slug=arguments["slug"],

package/amplify/functions/content-actions/requirements.txt

@@ -1,5 +1,5 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.5.1
+anthus-markus==0.7.0
 Pillow>=11.3,<12
 awscrt>=0.23,<1

package/amplify/functions/content-actions/resource.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { pythonLambdaCode } from "../shared/python-bundle.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/functions/content-actions/resource.ts

@@ -10,7 +10,7 @@ import { pythonLambdaCode, type SiteBundleFile } from "../shared/python-bundle";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../../..");
 
-export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
+export const contentActionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12", "awscrt>=0.23,<1"];
 
 function installCheckoutRequirements(outputDir: string): void {
   const requirementsPath = path.join(projectRoot, "amplify/functions/content-actions/requirements.txt");

package/amplify/functions/renditions/requirements.txt

@@ -1,4 +1,4 @@
 PyYAML>=6.0.2,<7
 citeproc-py>=0.8.2,<1
-anthus-markus==0.5.1
+anthus-markus==0.7.0
 Pillow>=11.3,<12

package/amplify/functions/shared/curation-delegation.ts

@@ -0,0 +1,67 @@
+import { createHash, randomBytes } from "node:crypto"
+
+export const CURATION_DELEGATION_PAYLOAD_KIND = "curation-delegation"
+export const CURATION_DELEGATION_OWNER_TYPE = "curationDelegation"
+export const DEFAULT_DELEGATION_HOURS = 8
+export const MAXIMUM_DELEGATION_HOURS = 72
+
+export type CurationDelegation = {
+  delegationId: string
+  tokenHash: string
+  grantorSub: string
+  grantorLabel: string
+  agentLabel: string
+  createdAt: string
+  expiresAt: string
+  revokedAt: string | null
+}
+
+export type DelegationVerdict =
+  | { ok: true }
+  | { ok: false; reason: "unknown-token" | "wrong-agent" | "revoked" | "expired" }
+
+export function hashDelegationToken(token: string): string {
+  return createHash("sha256").update(token, "utf8").digest("hex")
+}
+
+export function newDelegationToken(delegationId: string): { token: string; tokenHash: string } {
+  const token = `${delegationId}~${randomBytes(24).toString("base64url")}`
+  return { token, tokenHash: hashDelegationToken(token) }
+}
+
+export function delegationIdFromToken(token: string): string | null {
+  const separator = token.indexOf("~")
+  return separator > 0 ? token.slice(0, separator) : null
+}
+
+export function delegationExpiry(now: string, hours: number | null | undefined): string {
+  const requested = hours ?? DEFAULT_DELEGATION_HOURS
+  if (!Number.isFinite(requested) || requested <= 0 || requested > MAXIMUM_DELEGATION_HOURS) {
+    throw new Error(`A delegation lasts between 1 and ${MAXIMUM_DELEGATION_HOURS} hours.`)
+  }
+  return new Date(Date.parse(now) + requested * 3_600_000).toISOString()
+}
+
+export function delegationVerdict(
+  delegation: CurationDelegation | null,
+  presented: { token: string; agentLabel: string; now: string },
+): DelegationVerdict {
+  if (!delegation || delegation.tokenHash !== hashDelegationToken(presented.token)) {
+    return { ok: false, reason: "unknown-token" }
+  }
+  if (delegation.agentLabel.trim().toLowerCase() !== presented.agentLabel.trim().toLowerCase()) {
+    return { ok: false, reason: "wrong-agent" }
+  }
+  if (delegation.revokedAt) return { ok: false, reason: "revoked" }
+  if (Date.parse(delegation.expiresAt) <= Date.parse(presented.now)) return { ok: false, reason: "expired" }
+  return { ok: true }
+}
+
+export function delegationRefusalMessage(reason: Exclude<DelegationVerdict, { ok: true }>["reason"]): string {
+  return {
+    "unknown-token": "That delegation token is not recognized.",
+    "wrong-agent": "That delegation was granted to a different agent.",
+    "revoked": "That delegation was revoked.",
+    "expired": "That delegation has expired. Ask the person for a new one.",
+  }[reason]
+}

package/amplify/functions/shared/reference-curation-metadata.ts

@@ -12,6 +12,21 @@ export type ReferenceCurationMetadataInput = {
   referenceLineageId: string
   decisionRelationId?: string | null
   shareable?: boolean | null
+  actorKind?: CurationActorKind | null
+  delegation?: { delegationId: string; relayedBy: string; instruction: string } | null
+}
+
+export type CurationActorKind = "human" | "service"
+
+/**
+ * A curation is human only when the caller signed in through the user pool, so
+ * AppSync supplied a verified subject claim. Request arguments never decide it;
+ * IAM-signed service callers and agents have no such claim.
+ */
+export function curationActorKind(identity: unknown): CurationActorKind {
+  const claims = (identity as {claims?: Record<string, unknown>} | null | undefined)?.claims
+  const subject = claims?.sub
+  return typeof subject === "string" && subject.trim() !== "" ? "human" : "service"
 }
 
 export function referenceCurationMetadata(input: ReferenceCurationMetadataInput): Record<string, unknown> {
@@ -23,6 +38,11 @@ export function referenceCurationMetadata(input: ReferenceCurationMetadataInput)
     curationReasonCode: input.reasonCode,
     referenceId: input.referenceId,
     referenceLineageId: input.referenceLineageId,
+    ...(input.actorKind ? {actorKind: input.actorKind} : {}),
+    ...(input.delegation
+      ? {attestation: "delegated", relayedBy: input.delegation.relayedBy, delegationId: input.delegation.delegationId,
+         instruction: input.delegation.instruction}
+      : {}),
     ...(decisionRelationId ? {decisionRelationId} : {}),
     ...(decisionRelationId ? {shareable: input.shareable === true} : {}),
   }

package/amplify/functions/shared/slack-events.ts

@@ -69,9 +69,9 @@ export function slackAgentInstructions(): string {
     "",
     "Be concise, accurate, and concrete. Slack has no web UI: do not use papyrus.web.navigate, papyrus.web.current_location, or assume the user can see papyrus:// pages.",
     "",
-    "Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable insight, recommend creating an insight Message instead of making every chat turn canonical knowledge.",
+    "Raw console chat turns are working memory and are excluded from default semantic searches unless explicitly requested. When a chat produces durable note, recommend creating a note Message instead of making every chat turn canonical knowledge.",
     "",
-    "Respond openly to questions, commands, and discussion—the same conversational stance as the web console. Do not treat every message as a citation submission. Register references or create insights only when the user shares URLs/DOIs or asks you to file, summarize, or comment on specific material.",
+    "Respond openly to questions, commands, and discussion—the same conversational stance as the web console. Do not treat every message as a citation submission. Register references or create notes only when the user shares URLs/DOIs or asks you to file, summarize, or comment on specific material.",
     "",
     'For requests like "most recent references" or "tell me about recent references", do not ask clarifying questions first: immediately call execute_tactus with a Reference.list snippet, then summarize the results.',
     "",

package/amplify/publication/renditions-function.js

@@ -11,7 +11,7 @@ import { pythonLambdaCode } from "../functions/shared/python-bundle.js";
 import { RENDITIONS_EPHEMERAL_STORAGE_MB, RENDITIONS_MEDIA_PREFIX, RENDITIONS_MEMORY_MB, RENDITIONS_TIMEOUT_SECONDS, renditionsEnvironment, renditionsEventPattern, } from "./renditions-settings.js";
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 function installCheckoutRequirements(outputDir) {
     const requirementsPath = path.join(projectRoot, "amplify/functions/renditions/requirements.txt");
     execSync(`python3 -m pip install -r "${requirementsPath}" -t "${outputDir}" --no-cache-dir --platform manylinux2014_aarch64 --implementation cp --python-version 3.12 --only-binary=:all: --ignore-requires-python`, { cwd: projectRoot, stdio: "inherit" });

package/amplify/publication/renditions-function.ts

@@ -22,7 +22,7 @@ import {
 const dirname = path.dirname(fileURLToPath(import.meta.url));
 const projectRoot = path.resolve(dirname, "../..");
 
-export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.5.1", "Pillow>=11.3,<12"];
+export const renditionsRequirements = ["PyYAML>=6.0.2,<7", "citeproc-py>=0.8.2,<1", "anthus-markus==0.7.0", "Pillow>=11.3,<12"];
 
 export type RenditionsFunctionProps = {
   siteBucket: s3.IBucket;

package/app/api/local-preview/derive/route.ts

@@ -0,0 +1,28 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { NextResponse } from "next/server";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * Local preview only: derives a story's Markus body through the real Python engine so directives render.
+ * Set PAPYRUS_PREVIEW_PYTHON to a Python that has Papyrus and its Markus extra installed.
+ */
+export async function POST(request: Request) {
+  if (process.env.NEXT_PUBLIC_PAPYRUS_LOCAL_PREVIEW !== "1") return new NextResponse(null, { status: 404 });
+  const python = process.env.PAPYRUS_PREVIEW_PYTHON?.trim();
+  if (!python) return NextResponse.json({ error: "PAPYRUS_PREVIEW_PYTHON is not set." }, { status: 501 });
+  const input = await request.text();
+  const script = path.join(process.cwd(), "scripts", "local-preview-derive.py");
+  const output = await new Promise<string>((resolve, reject) => {
+    const child = spawn(python, [script], { env: process.env });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", chunk => { stdout += chunk; });
+    child.stderr.on("data", chunk => { stderr += chunk; });
+    child.on("error", reject);
+    child.on("close", code => code === 0 ? resolve(stdout) : reject(new Error(stderr || `derive exited with ${code}`)));
+    child.stdin.end(input);
+  }).catch((reason: unknown) => JSON.stringify({ error: reason instanceof Error ? reason.message : "derive failed" }));
+  return new NextResponse(output, { headers: { "content-type": "application/json" } });
+}

package/app/api/local-preview/media/route.ts

@@ -0,0 +1,25 @@
+import { spawn } from "node:child_process";
+import { NextResponse } from "next/server";
+
+export const dynamic = "force-dynamic";
+
+const CONTENT_TYPES: Record<string, string> = { jpg: "image/jpeg", jpeg: "image/jpeg", png: "image/png", gif: "image/gif", webp: "image/webp", svg: "image/svg+xml", avif: "image/avif" };
+
+/**
+ * Local preview only: streams one story image from the publication's storage bucket so the previews show real figures.
+ * Set PAPYRUS_PREVIEW_MEDIA_BUCKET to the bucket; the server's AWS credentials do the reading.
+ */
+export async function GET(request: Request) {
+  if (process.env.NEXT_PUBLIC_PAPYRUS_LOCAL_PREVIEW !== "1") return new NextResponse(null, { status: 404 });
+  const bucket = process.env.PAPYRUS_PREVIEW_MEDIA_BUCKET?.trim();
+  const key = new URL(request.url).searchParams.get("key") ?? "";
+  if (!bucket) return NextResponse.json({ error: "PAPYRUS_PREVIEW_MEDIA_BUCKET is not set." }, { status: 501 });
+  if (!/^media\/[A-Za-z0-9_\-./]+$/.test(key) || key.includes("..")) return new NextResponse(null, { status: 400 });
+  const extension = key.split(".").pop()?.toLowerCase() ?? "";
+  const child = spawn("aws", ["s3", "cp", `s3://${bucket}/${key}`, "-"], { env: process.env });
+  const chunks: Buffer[] = [];
+  child.stdout.on("data", chunk => chunks.push(chunk));
+  const exitCode = await new Promise<number>(resolve => { child.on("close", code => resolve(code ?? 1)); child.on("error", () => resolve(1)); });
+  if (exitCode !== 0) return new NextResponse(null, { status: 404 });
+  return new NextResponse(Buffer.concat(chunks), { headers: { "content-type": CONTENT_TYPES[extension] ?? "application/octet-stream", "cache-control": "private, max-age=300" } });
+}