@coreplane/switchboard 1.239.0 → 1.241.0

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.239.0",
+  "version": "1.241.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.239.0",
+      "version": "1.241.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -34,6 +34,7 @@
       "devDependencies": {
         "@earendil-works/pi-coding-agent": "0.85.1",
         "@eslint/js": "^10.0.1",
+        "@opencode/cli": "^2.0.3",
         "@opencode/protocol": "2.0.3",
         "@opencode/schema": "2.0.3",
         "@types/node": "^24.0.0",
@@ -6242,6 +6243,209 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@opencode/cli": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli/-/cli-2.0.3.tgz",
+      "integrity": "sha512-FC4+2a5kwdKS2o/pIcGCscpSQB7PuhBObwGMfqnx/2XtoaZBMtSq/99nuEdeDNAFvy1qyK6mp2hwvoiMWsiI4w==",
+      "cpu": [
+        "arm64",
+        "x64"
+      ],
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "os": [
+        "darwin",
+        "linux",
+        "win32"
+      ],
+      "bin": {
+        "opencode": "bin/opencode.exe",
+        "opencode2": "bin/opencode.exe"
+      },
+      "optionalDependencies": {
+        "@opencode/cli-darwin-arm64": "2.0.3",
+        "@opencode/cli-darwin-x64": "2.0.3",
+        "@opencode/cli-darwin-x64-baseline": "2.0.3",
+        "@opencode/cli-linux-arm64": "2.0.3",
+        "@opencode/cli-linux-arm64-musl": "2.0.3",
+        "@opencode/cli-linux-x64": "2.0.3",
+        "@opencode/cli-linux-x64-baseline": "2.0.3",
+        "@opencode/cli-linux-x64-baseline-musl": "2.0.3",
+        "@opencode/cli-linux-x64-musl": "2.0.3",
+        "@opencode/cli-windows-arm64": "2.0.3",
+        "@opencode/cli-windows-x64": "2.0.3",
+        "@opencode/cli-windows-x64-baseline": "2.0.3"
+      }
+    },
+    "node_modules/@opencode/cli-darwin-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-arm64/-/cli-darwin-arm64-2.0.3.tgz",
+      "integrity": "sha512-2JzNaHmMHUCk2uLXo2kCKCs81KOzErt7V7ypFFp5hUCIXRPjt9D7C5CKsz2GKWfpHRivUKILKrfUS9MpYzfq6A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-darwin-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-x64/-/cli-darwin-x64-2.0.3.tgz",
+      "integrity": "sha512-dMAH/N5KD10Wlct2BbCa8tEV6SiPgBg1kF9Ud7N7ZUctMEeGoz3fqZTrcGrQz7yoAkyyHhGgq+gmxqobwrAhhg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-darwin-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-x64-baseline/-/cli-darwin-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-sm9ZjG2KOk/v4ht6WHAo+pAeOfxnnImwT5rFWNIn15fVlXncbWH2QmKWDC3Nf/h7vpgeghZ1UBbBmo8fP3lBCA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-arm64/-/cli-linux-arm64-2.0.3.tgz",
+      "integrity": "sha512-q3QhCIW5CxkmJjzKI6GXJ89M0OF9lOsi1e3e4YTvQL6Htv0S7eHyZ+3Wg0UYQaoYqegAf3vBoYiPR3Z9ieIVrQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-arm64-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.0.3.tgz",
+      "integrity": "sha512-cif0oXReK/lVZ9kFplNc3XTNM3uuAKLIgcfcEIVMbjTivLzdHe0O5Dp8y7rakJOdXqQ5yM1k6oP8kP2rfpitxg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64/-/cli-linux-x64-2.0.3.tgz",
+      "integrity": "sha512-H8m5m4g1Z/zkx1O8+pos7euLYpY/zgc5NTdUbZZ7Dh8xQ35qoHCnJjt9H8Y1hnpm4ClNKDVHmEISw/qPiskX5A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-baseline/-/cli-linux-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-14CFor+PFx7tPAFOB3uEcg2EOQZNB1gK4uit4p8gfN30FK7kwNHBjs/m79QGICPMjwZrCOVdZ3ZiI+AgbjanjA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-baseline-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-baseline-musl/-/cli-linux-x64-baseline-musl-2.0.3.tgz",
+      "integrity": "sha512-AYMNzjwPU63FjqjKLEm61s2tBL7+yipt/lzn+2eMpPHYGggV2urJH9TEME2+mReENeYFfOSItPR7gWLX1p2g5A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-musl/-/cli-linux-x64-musl-2.0.3.tgz",
+      "integrity": "sha512-YDZCk0MddTJ8lDwlEmE5bVWF5R13nDpLEQPcCA5IY2njB/y2g6UaAiIVbJE1rVmFd7/Z7JmyB2X3z60uk3C/dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-arm64/-/cli-windows-arm64-2.0.3.tgz",
+      "integrity": "sha512-WQuojS+6O6YNlRsal9kbePiEEv4hZHVL7l7ILRnlyZSLx7M2ynTOUahtGzC42AbdH9sdIa4OGQDmDwcbfCqHuA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-x64/-/cli-windows-x64-2.0.3.tgz",
+      "integrity": "sha512-4pCiryt3LZG4dCkhvDOiTttzBECE36HUKe5uwCSAu9Ny7Sh2H1iVw1XFKo3QYqh6XdkWa9Uyza0lqLB6SSAGTw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-x64-baseline/-/cli-windows-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-9R6QdvoEd6bxv+Izi2kwg+85Mc3lCoTRgAsTZpNadVaRgAcU8vzEjjgrzFM6gLr8j+65EgG7vtP1gCVhfyQRwg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@opencode/protocol": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@opencode/protocol/-/protocol-2.0.3.tgz",
@@ -20241,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.239.0",
+      "version": "1.241.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.239.0",
+  "version": "1.241.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -91,6 +91,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.1",
     "@eslint/js": "^10.0.1",
+    "@opencode/cli": "^2.0.3",
     "@opencode/protocol": "2.0.3",
     "@opencode/schema": "2.0.3",
     "@types/node": "^24.0.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.239.0",
-  "commit": "f8a99fe783b535df45b729baf09bf69557962c3a",
-  "builtAt": "2026-09-16T23:24:01.904Z"
+  "version": "1.241.0",
+  "commit": "645b2a6d20ac39178acdb7c412a6a72f6013771c",
+  "builtAt": "2026-09-17T01:34:41.433Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -133,6 +133,23 @@ export interface AgentDef {
 // and rendered against the head sha at render time, so a repush is a
 // re-render by Switchboard — the agent only resubmits when the CONTENT (line
 // numbers included) changed.
+/** The status-card rule every tool-running preset carries (docs/reference/specs/run-visibility.md
+ *  item 2). One sentence in one place: the card shows the command running right
+ *  now beside the checklist, so the checklist's markers must be facts — ✱ from
+ *  the item's first command, ✓ only once its result has been read — or the two
+ *  contradict each other on the card. `examples` are the preset's own outcome
+ *  phrasings; the rule itself never varies by preset. */
+export function statusCardRule(examples = '"Implement the fix", "Run the test suite"'): string {
+  return (
+    "Maintain the user-facing status card with the update_status tool. Post your plan as a checklist (○ pending) as soon as you have it, " +
+    "then keep it truthful at every moment: the markers are facts, not intentions. Mark an item ✱ when you issue the first command that does it, " +
+    "and ✓ only after you have read the result that proves it happened — never in the same turn as the command, never because you intend to run it next, " +
+    "never for a reporting or posting step you have not done. The order is: mark the item ✱, run its commands, read the result, then mark it ✓ and the next item ✱. " +
+    "The card shows the command running right now beside your checklist, so a ✓ item whose command is still running reads as a lie. " +
+    `Items are short outcomes (${examples}), never commands. This is the only progress the user sees while you work.`
+  );
+}
+
 const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. Content contract per field (each renders as its own section): prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. Keep each field concise, not padded.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in whatWhy), add what you changed, and anchor the Tour at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title**: the PR title — one line naming the change, specific enough to pick out of a PR list.
@@ -237,7 +254,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule('"Clone repo and read the diff", "Run the test suite"')}
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -280,7 +297,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule()}
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
 ${FENCED_CONTENT_RULE}
@@ -319,7 +336,7 @@ ${SHOW_FILES}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
+${statusCardRule()}
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
 ${FENCED_CONTENT_RULE}
@@ -384,7 +401,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -417,7 +434,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -451,7 +468,7 @@ ${REVIEW_VERDICT_INSTRUCTION}
 
 ${NOTEPAD}
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
+${statusCardRule('"Gather the diff and the files", "Analyze the change", "Post the verdict"')}
 
 ${FENCED_CONTENT_RULE}
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -469,7 +486,7 @@ How to work:
 2. Prefer primary sources; corroborate a surprising claim with a second source.
 3. Answer concisely and cite the URLs (or repo paths) you used. If sources conflict or you couldn't verify something, say so plainly. If web search is unconfigured, use web_fetch / the GitHub tools on what you have and say search was unavailable.
 
-Maintain the user-facing status card with the update_status tool: post a short checklist (○ pending) after you plan, and update items as they start (✱) and finish (✓ — only once they actually happened).
+${statusCardRule('"Search the sources", "Write the answer"')}
 
 ${FENCED_CONTENT_RULE}
 Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack — lead with the answer, then supporting detail and sources.`;
@@ -485,6 +502,8 @@ Answer directly and concisely. Use Slack-friendly formatting (no markdown header
 
 Your tools work without a workspace: the GitHub tools — \`github_repos\` (the org repositories you can reach), \`github_tree\` / \`github_file\` / \`github_search_code\` (browse, read, search their code and docs, private repos included), \`github_issue_list\` / \`github_issue_get\` (read issues), \`github_issue_create\` / \`github_issue_update\` / \`github_issue_comment\` / \`github_issue_delete\` (act on issues) — and \`web_fetch\` (read a public URL). Use them: when the user names a repo loosely ("the switchboard app"), resolve it with github_repos (or the thread) rather than asking; when asked about one of our repos, read it before answering. Report exactly what a tool did (issue number + URL) — never claim an action you did not perform, and never fabricate file contents, URLs, or command output.
 
+${statusCardRule('"Read the issue and its thread", "Post the comment"')} A one-step answer needs no checklist; post one when the request has steps the person would wait on.
+
 You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web. Other Switchboard agents can: for code changes or PRs tell the user to re-send with \`agent:coding\`; for a PR review, \`agent:review\`; for a web-research question, \`agent:research\` (e.g. "\`agent:coding fix the failing login test in acme/api\`", "\`agent:research compare X and Y\`"). Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
 
 // The explore agent (docs/reference/specs/agent-explore.md): a long, read-only
@@ -512,7 +531,7 @@ READ-ONLY: NEVER open a pull request, and never commit or push — no branch, no
 
 You cannot attach or post files: your whole answer is text. Never say a file is attached or below — name its path in the workspace and describe it (what it shows, its size) instead; a person who needs the file itself asks \`agent:coding\`, which can attach.
 
-Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending) once you have it, and update items as they start (✱) and finish (✓ — only after they actually happened). Items are short outcomes ("Clone and install", "Time the full suite"), never commands.
+${statusCardRule('"Clone and install", "Time the full suite"')}
 
 ${NOTEPAD}
 

package/dist/assets/src/core/authz/actor.ts

@@ -76,12 +76,35 @@ export function resolveActor(input: ActorInput, grantsFor: GrantsLookup): Actor
   return { kind: kindFor(input.surface), id, grants: grantsFor(id), ...(origin ? { origin } : {}) };
 }
 
+/** The identity fields a bound credential's message carries (`IncomingMessage`). */
+interface BoundFields {
+  /** The credential's actor id when the sender is the person it is bound to. */
+  authenticatedAs?: string;
+  userName?: string;
+}
+
+/** The actor id whose grants govern a chat message: the credential that
+ *  authenticated it when it was bound to a person (`authenticatedAs`), else
+ *  the sender. Every `canRunAgent` / `canUseRepo` / `canManageRepos` /
+ *  `canEditChannelConfig` question in the dispatch path asks about THIS id,
+ *  never `msg.userId`: naming the person on a run must not lend the run the
+ *  person's grants (authorization.md item 15). A relayed message (`postedBy`)
+ *  is out of scope here — its gates are item 14's. */
+export function grantsSubject(msg: { userId: string; authenticatedAs?: string }): string {
+  return msg.authenticatedAs ?? msg.userId;
+}
+
 const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
   slack: "slack",
   http: "http",
   mcp: "mcp",
   cli: "cli",
   schedule: "schedule",
+  // The web chat (record 0043): a browser session speaks as text, so its
+  // `access:<sub>` is a chat credential too — the browser actor, its baseline
+  // and its entry. A service token never reaches the chat (the dashboard gate
+  // serves it `/api/*` only), so `access:svc:` is no chat surface.
+  access: "access-browser",
 };
 
 /** A chat message's `userId` is already namespaced by its adapter (`slack:U…`,
@@ -89,11 +112,24 @@ const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
  *  A namespace this module does not know stays a `user` with the id as given —
  *  its grants are whatever config names for that id, never a guess. */
 export function resolveChatActor(
-  msg: { userId: string; channelId: string; threadKey: string; postedBy?: string },
+  msg: { userId: string; channelId: string; threadKey: string; postedBy?: string } & BoundFields,
   grantsFor: GrantsLookup,
 ): Actor {
   const person = resolveNamespacedActor(msg.userId, msg, grantsFor);
-  if (msg.postedBy === undefined) return person;
+  if (msg.postedBy === undefined) {
+    if (msg.authenticatedAs === undefined || msg.authenticatedAs === msg.userId) return person;
+    // A credential bound to a person (authorization.md item 15): the adapter
+    // proved the credential and config bound it to the person, so the actor IS
+    // the credential — its kind, its id, its grants, exactly as an unbound
+    // token's — and the person is its `self` and `asUser`, the same
+    // identity-not-authority link a dashboard session carries (record 0042).
+    const credential = resolveNamespacedActor(msg.authenticatedAs, msg, grantsFor);
+    return {
+      ...credential,
+      self: [credential.id, msg.userId],
+      asUser: { id: msg.userId, ...(msg.userName !== undefined ? { name: msg.userName } : {}) },
+    };
+  }
   // A request an app posted for a person (slack-channel.md item 13): the
   // message text named the person, and text is forgeable, so the person's
   // grants alone must never govern. The actor is the app, acting on the

package/dist/assets/src/core/authz/grants.ts

@@ -62,10 +62,20 @@ export const CHAT_OPEN_ACTIONS: readonly string[] = [
   "mcp:write",
 ];
 
-/** What an Access browser session holds implicitly: every registered
- *  group's read — never a write, never an exec. */
-export function browserReadActions(commandGroups: readonly string[]): Set<string> {
-  return new Set(commandGroups.map((g) => `${g}:read`));
+/** The two writes a browser session holds beside its reads (record 0043): the
+ *  same personal writes every Slack user holds (`CHAT_OPEN_ACTIONS`), because
+ *  the web chat makes a browser session a chat user — `memory remember` and
+ *  `mcp add` for its own tier. The tier rows still decide the target: a shared
+ *  tier needs the grant it always needed. */
+export const BROWSER_WRITE_ACTIONS: readonly string[] = ["memory:write", "mcp:write"];
+
+/** What an Access browser session holds implicitly: every registered group's
+ *  read plus the two personal chat writes — never another write, never an exec.
+ *  No groups known (a process that registered no commands) → nothing at all,
+ *  fail-closed: the writes ride with the catalogue they belong to. */
+export function browserActions(commandGroups: readonly string[]): Set<string> {
+  if (commandGroups.length === 0) return new Set();
+  return new Set([...commandGroups.map((g) => `${g}:read`), ...BROWSER_WRITE_ACTIONS]);
 }
 
 // ---- the native `grants` block ----------------------------------------------
@@ -243,8 +253,9 @@ export interface GrantsTable {
   surfaces: Map<string, Grants>;
   /** What every `slack:` user holds, listed or not: the open chat commands and `agent:run:<name>` for every unrestricted agent. */
   everyone: Grants;
-  /** What every Access browser session (`access:<sub>`, never `access:svc:`) holds: each registered group's read. */
-  browserReads: Grants;
+  /** What every Access browser session (`access:<sub>`, never `access:svc:`) holds:
+   *  each registered group's read and the two personal chat writes. */
+  browser: Grants;
   restrict: Restriction;
 }
 
@@ -253,9 +264,9 @@ export interface GrantsTable {
  *  `<group>:read`. Every other namespace (`schedule:`, `access:svc:`, `http:`,
  *  `mcp:`) is a credential or a job that holds exactly what names it — an
  *  unlisted one is `NO_GRANTS` (fail-closed). */
-export function namespaceBaseline(actorId: string, table: Pick<GrantsTable, "everyone" | "browserReads">): Grants {
+export function namespaceBaseline(actorId: string, table: Pick<GrantsTable, "everyone" | "browser">): Grants {
   if (actorId.startsWith("slack:")) return table.everyone;
-  if (actorId.startsWith("access:") && !actorId.startsWith("access:svc:")) return table.browserReads;
+  if (actorId.startsWith("access:") && !actorId.startsWith("access:svc:")) return table.browser;
   return NO_GRANTS;
 }
 
@@ -271,7 +282,7 @@ export function grantsTable(source: GrantsSource): GrantsTable {
   const openAgents = (source.agentNames ?? []).filter((a) => !restrict.agents.has(a)).map(agentRunAction);
   const baselines = {
     everyone: { ...NO_GRANTS, actions: new Set([...CHAT_OPEN_ACTIONS, ...openAgents]) },
-    browserReads: { ...NO_GRANTS, actions: browserReadActions(source.commandGroups ?? []) },
+    browser: { ...NO_GRANTS, actions: browserActions(source.commandGroups ?? []) },
   };
   const grants = new Map<string, Grants>();
   const surfaces = new Map<string, Grants>();

package/dist/assets/src/core/authz/policy.ts

@@ -81,6 +81,12 @@ export const POLICY: readonly Rule[] = [
   // `friction propose` files issues: the repo-management gate, now the `friction:write` grant.
   { action: "friction:write", resource: "command", when: [grant("friction:write")] },
 
+  // ── costs ────────────────────────────────────────────────────────────────
+  // `costs snapshot` reads both billing providers and replaces what every
+  // viewer of the costs page sees: the grant, never a baseline (the admins'
+  // `all` and a named `grants` entry hold it).
+  { action: "costs:write", resource: "command", when: [grant("costs:write")] },
+
   // ── repos ────────────────────────────────────────────────────────────────
   { action: "repo:read", resource: "command", when: [grant("repo:read")] },
   { action: "repo:write", resource: "repo", when: [grant("repo:write")] },

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,6 +8,8 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
+import type { AddressSeverity, AddressSeveritySource } from "../ship/coordinator.js";
+
 // A coordinator is a Workflow instance in the shim Worker whose children are
 // ordinary `dispatch()` runs as the requesting user. It holds no credential of
 // its own: every step is a call into the bot with the `coordinator` bearer,
@@ -78,6 +80,22 @@ export function runFinishedEventType(runId: string): string {
   return `${RUN_FINISHED_EVENT_PREFIX}${runId}`;
 }
 
+/** The event the bot's GitHub check-run intake sends a merge-waiting parent:
+ *  the type carries the head sha (hex — inside the platform's alphabet), so a
+ *  driver waiting at that head matches its own event and any other head's is
+ *  buffered harmlessly. */
+export const CHECKS_SETTLED_EVENT_PREFIX = "checks-settled-";
+export function checksSettledEventType(headSha: string): string {
+  return `${CHECKS_SETTLED_EVENT_PREFIX}${headSha}`;
+}
+
+/** What the checks-settled event carries — the head and a clock; the parent
+ *  re-asks the merge door before it acts, so nothing more rides here. */
+export interface ChecksSettledPayload {
+  headSha: string;
+  settledAt: number;
+}
+
 /** What the event carries — ids, a status and a clock; the parent confirms
  *  through `read-record` before it acts, so nothing more rides here. */
 export interface RunFinishedPayload {
@@ -126,9 +144,12 @@ export function coordinatorFields(tag: CoordinatorTag | undefined): {
 export interface CoordinatorInstance {
   id: string;
   kind: "ship";
-  /** The requesting user (platform-namespaced), whose grants every child is authorized under. */
+  /** The requesting person (platform-namespaced); every child is dispatched as them. */
   userId: string;
   userName?: string;
+  /** The bound credential behind the person (authorization.md item 15), when
+   *  there was one: every child is authorized under ITS grants, as the request was. */
+  authenticatedAs?: string;
   channelId: string;
   channelName?: string;
   /** The requesting thread: where the card lives and where a generated plan's
@@ -153,6 +174,11 @@ export interface CoordinatorInstance {
    *  hand-off, answered by the plan route, checked at the merge door; absent
    *  (a record written before the field existed) reads as `person`. */
   merge?: "runner" | "person";
+  /** The severity to address: resolved once by the hand-off
+   *  (directive > user > channel > org) and written here beside `merge`, so
+   *  the machine reads one value; absent reads as the default (`minor`, org). */
+  addressSeverity?: AddressSeverity;
+  addressSeveritySource?: AddressSeveritySource;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -234,6 +260,7 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
   if (r.kind !== "ship") return false;
   if (!isText(r.userId) || !isText(r.channelId) || !isText(r.threadKey)) return false;
   if (!isOptionalText(r.userName) || !isOptionalText(r.channelName) || !isOptionalText(r.sourceUrl)) return false;
+  if (!isOptionalText(r.authenticatedAs)) return false;
   if (typeof r.repo !== "string" || !REPO_SLUG.test(r.repo)) return false;
   if (!isText(r.branch) || !isOptionalText(r.base)) return false;
   if (!isFinite(r.createdAt)) return false;
@@ -299,6 +326,27 @@ export type RunFinishedSend =
   | { kind: "no-binding"; instance: string }
   | { kind: "failed"; instance: string; type: string; reason: string };
 
+/** The one send per settled head (http-ingress.md item 12): best effort like
+ *  `sendRunFinished` — a refusal is answered, never thrown, and the parent's
+ *  bounded merge wait times out on its own. */
+export async function sendChecksSettled(
+  workflow: WorkflowSender | undefined,
+  instance: string,
+  headSha: string,
+  settledAt: number,
+): Promise<RunFinishedSend> {
+  if (!workflow) return { kind: "no-binding", instance };
+  const type = checksSettledEventType(headSha);
+  const payload: ChecksSettledPayload = { headSha, settledAt };
+  try {
+    const handle = await workflow.get(instance);
+    await handle.sendEvent({ type, payload });
+    return { kind: "sent", instance, type };
+  } catch (err) {
+    return { kind: "failed", instance, type, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /** The one send per committed terminal record (run-history item 47). */
 export async function sendRunFinished(
   workflow: WorkflowSender | undefined,