@dsh-enhanced/assistant-delivery 0.1.66 → 0.1.67

package/lib/service.js

@@ -33,7 +33,7 @@ import { bindingMatchesOwnerRoute, canonicalBackgroundSourceId as canonicalHostB
 import { isExactDeliveryCommand, parseDeliveryCommand } from './session-commands.js';
 import { deliveryT1PreferenceKeys, deliveryT1PreferenceValues } from './learning-command.js';
 import { assertReplyReplayAllowed, blockAgentRepliesForReplay as createReplyReplayBlock, } from './reply-replay.js';
-import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, objectiveStateMessage, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
+import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, parseNaturalOwnerReply, objectiveStateMessage, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
 import { DELIVERY_PREFERENCE_PROJECTION_PROTOCOL, TRUSTED_DELIVERY_PRESENTATION_PRODUCER_PROTOCOL, } from './types.js';
 const trustedDeliveryPreferenceProducers = new WeakSet();
 const deliveryPreferenceProducerProbe = Symbol('assistant-delivery.preference-producer-probe');
@@ -265,6 +265,7 @@ function containsReservedLearningMetadata(metadata) {
     return metadata !== undefined && Object.keys(metadata).some(key => key.startsWith(learningMetadataPrefix));
 }
 export const ownerNotificationWithdrawalProtocol = 'assistant-delivery/owner-notification-withdrawal/v1';
+export const ownerNotificationReplyProtocol = 'assistant-delivery/owner-notification-reply/v1';
 export class AssistantDeliveryError extends Error {
     code;
     constructor(code, message) {
@@ -338,6 +339,16 @@ const configSchema = Schema.object({
     attentionAttachOverCap: Schema.boolean().default(false),
     attentionEnforce: Schema.boolean().default(false),
     ownerReportRouting: Schema.object({ orderAcrossLanes: Schema.boolean().default(false) }),
+    naturalFeedback: Schema.object({
+        coverage: Schema.boolean().default(false),
+        mixedIntent: Schema.boolean().default(false),
+    }),
+    peerAgents: Schema.array(Schema.object({
+        channel: Schema.string().min(1).required(),
+        account: Schema.string().min(1).required(),
+        tenant: Schema.string().min(1).required(),
+        user: Schema.string().min(1).required(),
+    })).default([]),
     ownerRoutes: Schema.array(Schema.object({
         id: Schema.string().min(1).required(),
         conversation: Schema.object({
@@ -696,6 +707,8 @@ export class AssistantDeliveryService extends Service {
     ownerNotificationWithdrawals = new Map();
     /** Live handles issued by `registerOwnerNotificationWithdrawal`, mapped to their (authority, source) key. */
     ownerNotificationWithdrawalHandles = new Map();
+    /** Slice-5 reply consumers, one per (authority, canonical owner-notice source id). */
+    ownerNotificationReplies = new Map();
     foregroundObserver;
     /** Once a live verifier required acceptance, loss of that verifier must not silently bypass it. */
     acceptanceRequired = false;
@@ -2817,6 +2830,16 @@ export class AssistantDeliveryService extends Service {
         return inbox !== undefined && binding !== undefined && inbox.bindingId === binding.id
             && this.isInboundAuthorized(binding, inbox.envelope);
     }
+    /**
+     * Exact owner-configured peer bot, or `undefined`. `senderIsBot` is only the
+     * provider's declaration; the allowlisted tuple is the actual authority.
+     */
+    peerAgentAuthority(envelope) {
+        if (envelope.metadata?.senderIsBot !== 'true')
+            return undefined;
+        return this.config.peerAgents?.find(peer => peer.channel === envelope.channel && peer.account === envelope.account
+            && peer.tenant === envelope.principal.tenant && peer.user === envelope.principal.user);
+    }
     isInboundAuthorized(binding, envelope) {
         if (!this.active)
             return false;
@@ -3251,6 +3274,25 @@ export class AssistantDeliveryService extends Service {
         void this.drainWorkflowTraces();
         return 'recorded';
     }
+    /** Opt-in widened deterministic grammar; off keeps the legacy exact phrases. */
+    widenedNaturalFeedbackCoverage() {
+        return this.config.naturalFeedback?.coverage === true;
+    }
+    /** Splitting one reply into result + continuation requires both opt-ins. */
+    mixedNaturalFeedbackIntent() {
+        return this.config.naturalFeedback?.coverage === true
+            && this.config.naturalFeedback?.mixedIntent === true;
+    }
+    /**
+     * One canonical selection for admission and its later re-derivation fences.
+     * The widened parser is a pure function, so a frozen intent keeps verifying
+     * even after a restart that toggles the opt-in.
+     */
+    naturalObjectiveSelection(text) {
+        return this.widenedNaturalFeedbackCoverage()
+            ? parseNaturalOwnerReply(text)?.status
+            : parseNaturalObjectiveFeedback(text);
+    }
     /**
      * Convert only an authenticated reply to one exact Automation delivery into
      * a trusted objective label. The original run timestamp is retained because
@@ -3259,7 +3301,7 @@ export class AssistantDeliveryService extends Service {
      */
     async dispatchNaturalObjectiveFeedback(binding, envelope) {
         const selection = envelope.kind === 'text' && (envelope.attachments?.length ?? 0) === 0
-            ? parseNaturalObjectiveFeedback(envelope.text) : undefined;
+            ? this.naturalObjectiveSelection(envelope.text) : undefined;
         if (selection === undefined || !this.isOwnerFeedbackController(binding, envelope))
             return;
         const replyTarget = envelope.metadata?.replyToProviderMessageId;
@@ -3375,7 +3417,7 @@ export class AssistantDeliveryService extends Service {
         const naturalMatches = naturalIntent !== undefined && inbox.envelope.kind === 'text'
             && naturalIntent.envelopeHash === inbox.envelopeHash
             && naturalIntent.sourceOutboxId === target.id
-            && parseNaturalObjectiveFeedback(inbox.envelope.text) === naturalIntent.selection
+            && this.naturalObjectiveSelection(inbox.envelope.text) === naturalIntent.selection
             && (parsed.kind === 'objective-status' || (naturalIntent.status === 'frozen'
                 && JSON.stringify(naturalIntent.command) === JSON.stringify(parsed)));
         if ((inbox.envelope.attachments?.length ?? 0) !== 0 || (!typedMatches && !naturalMatches))
@@ -3803,7 +3845,7 @@ export class AssistantDeliveryService extends Service {
         const sessions = ctx.get('sessions');
         const agent = request.agent;
         const events = agent.session.snapshotEvents();
-        const reviewer = approvalReviewerOf(events);
+        const reviewer = approvalReviewerOf(events, agent.session.header.version);
         const reviewRoute = reviewer === 'user'
             ? 'user'
             : reviewer === 'auto-review' && ctx.assistantPolicy.isAutoReviewEscalation(request)
@@ -3942,7 +3984,8 @@ export class AssistantDeliveryService extends Service {
             return next();
         let reviewer;
         try {
-            reviewer = approvalReviewerOf(request.agent.session.snapshotEvents());
+            const session = request.agent.session;
+            reviewer = approvalReviewerOf(session.snapshotEvents(), session.header.version);
         }
         catch {
             return 'unavailable';
@@ -4121,6 +4164,32 @@ export class AssistantDeliveryService extends Service {
         if (!['received', 'authorized'].includes(record.status)) {
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         }
+        // An explicitly allowlisted peer bot enters its own linked-principal lane.
+        // It is still subject to the ordinary Policy ingest decision below and never
+        // receives owner feedback/continuation behavior. The allowlist is re-read
+        // for every provider-declared bot message: removing an entry revokes the
+        // lane even while the old linked principal row is still active.
+        const senderIsBot = envelope.metadata?.senderIsBot === 'true';
+        const peerAuthority = senderIsBot ? this.peerAgentAuthority(envelope) : undefined;
+        if (senderIsBot && peerAuthority === undefined) {
+            record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
+            return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+        }
+        if (peerAuthority !== undefined && !this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
+            const owner = this.deliveryStore.activeOwnerPrincipal();
+            if (owner === undefined) {
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-owner-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+            try {
+                this.deliveryStore.ensurePeerPrincipal(envelope.principal, owner.id, { reauthorize: true });
+            }
+            catch (error) {
+                this.context.logger.warn(`assistant-delivery: peer principal admission failed: ${String(error)}`);
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-principal-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+        }
         if (!this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
             record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
@@ -4225,50 +4294,114 @@ export class AssistantDeliveryService extends Service {
                 const failed = this.deliveryStore.getInbox(record.id);
                 return { duplicate: accepted.duplicate, inboxId: failed.id, status: failed.status };
             }
-            const feedback = this.admitOwnerWorkItemFeedback(record, binding);
-            if (feedback === 'handled') {
+            // Slice 5: a reply to the exact delivered owner-question notice is
+            // consumed here, before any Agent admission. Applied replies are
+            // processed; a transient consumer failure leaves the Inbox pending.
+            const attentionReply = this.inspectOwnerQuestionReply(record, binding);
+            if (attentionReply !== 'none') {
+                const current = this.deliveryStore.getInbox(record.id);
+                return { duplicate: accepted.duplicate, inboxId: current.id, status: current.status };
+            }
+            const feedback = this.inspectOwnerWorkItemFeedback(record, binding);
+            const splitContinuation = feedback.kind !== 'none' && feedback.continuation;
+            if (feedback.kind === 'ready') {
+                // One reply may carry a result and an explicit continuation. They are two
+                // independently fenced decisions: admit both atomically when both lanes
+                // are permitted, otherwise record the result alone and record the reason.
+                let admittedContinuation = false;
+                if (splitContinuation) {
+                    const report = this.prepareWorkItemReply(record, binding);
+                    if (report !== undefined) {
+                        try {
+                            this.deliveryStore.admitOwnerWorkItemFeedbackWithReply({ feedback: feedback.source, binding, report, fence: feedback.fence });
+                            admittedContinuation = true;
+                        }
+                        catch (error) {
+                            // The combined transaction rolled back; fall back to the result lane
+                            // only. A failed result fence re-throws on that fallback, as before.
+                            this.context.logger.warn(`assistant-delivery: mixed owner feedback continuation admission failed: ${String(error)}`);
+                        }
+                    }
+                }
+                if (!admittedContinuation) {
+                    this.deliveryStore.workItemFeedback.admit(feedback.source, feedback.fence);
+                    if (splitContinuation)
+                        this.recordPartialMixedFeedbackAdmission(record, 'continuation-not-admitted');
+                }
+                if (admittedContinuation)
+                    this.notifyWorkItemReplyPending();
                 void this.drainWorkItemFeedback().catch(() => { });
                 return { duplicate: accepted.duplicate, inboxId: record.id, status: 'processed' };
             }
-            if (feedback !== 'ordinary' && this.admitWorkItemReply(record, binding)) {
+            // A pure recognized result never becomes execution when feedback permission
+            // is absent; only an explicit continuation in the same reply may proceed.
+            const continuationAllowed = feedback.kind === 'none'
+                || (feedback.kind === 'ordinary' && splitContinuation);
+            if (continuationAllowed && this.admitWorkItemReply(record, binding)) {
                 const handedOff = this.deliveryStore.getInbox(record.id);
                 this.notifyWorkItemReplyPending();
+                if (feedback.kind === 'ordinary')
+                    this.recordPartialMixedFeedbackAdmission(record, 'feedback-not-admitted');
                 return { duplicate: accepted.duplicate, inboxId: handedOff.id, status: handedOff.status };
             }
+            if (feedback.kind === 'ordinary' && splitContinuation)
+                this.recordPartialMixedFeedbackAdmission(record, 'neither-lane-admitted');
             record = this.deliveryStore.queueInbox(record.id, binding.id);
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         });
     }
+    /**
+     * Deterministic backend classification of one authenticated owner reply to an
+     * exact report. The legacy closed whole-sentence grammar stays in force unless
+     * the widened coverage opt-in is on; no caller text is reinterpreted as an
+     * instruction, and no model is called.
+     */
     parseWorkItemFeedback(envelope) {
         if ((envelope.attachments?.length ?? 0) !== 0)
             return undefined;
         if (envelope.kind === 'text') {
             const text = envelope.text.trim();
-            if (!/^(?:问题解决了|已经解决了|现在解决了|还是不行|还没解决|问题还没解决|撤回刚才的任务反馈|撤回我刚才的任务反馈)[。.!！]?$/u.test(text))
-                return undefined;
-            const value = parseNaturalObjectiveFeedback(text);
-            return value === undefined ? undefined : { kind: 'natural', value };
+            if (!this.widenedNaturalFeedbackCoverage()) {
+                if (!/^(?:问题解决了|已经解决了|现在解决了|还是不行|还没解决|问题还没解决|撤回刚才的任务反馈|撤回我刚才的任务反馈)[。.!！]?$/u.test(text))
+                    return undefined;
+                const value = parseNaturalObjectiveFeedback(text);
+                return value === undefined ? undefined : { selection: { kind: 'natural', value }, continuation: false };
+            }
+            const parsed = parseNaturalOwnerReply(text);
+            return parsed === undefined ? undefined : {
+                selection: { kind: 'natural', value: parsed.status },
+                continuation: parsed.continuation && this.mixedNaturalFeedbackIntent(),
+            };
         }
         const command = parseDeliveryCommand(envelope);
         if (command?.name !== 'feedback')
             return undefined;
         const parsed = parseFeedbackCommand(command.rawInput);
         return ['objective', 'objective-status', 'objective-revision'].includes(parsed.kind)
-            ? { kind: 'explicit', command: parsed } : undefined;
+            ? { selection: { kind: 'explicit', command: parsed }, continuation: false }
+            : undefined;
     }
     workItemFeedbackPermission(binding, registration) {
         return this.policy.evaluate({ subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
             action: 'feedback-work-items', resource: { kind: 'automation', id: registration.continuationAutomationId }, context: { initiator: 'external' } }).effect === 'allow';
     }
-    admitOwnerWorkItemFeedback(inbox, binding) {
-        const registration = this.currentWorkItemReplyConsumer(), selection = this.parseWorkItemFeedback(inbox.envelope);
-        if (!registration || registration.feedbackEnabled !== true || !selection || !inbox.envelope.metadata?.replyToProviderMessageId)
-            return 'none';
+    /**
+     * Inspect one Inbox as an authenticated owner result reply to an exact report.
+     * `ready` carries the frozen source plus its live admission fence; `ordinary`
+     * keeps the historical "recognized result but separate feedback permission
+     * absent" outcome and never admits the result lane by itself. The
+     * `continuation` flag is a deterministic classification only.
+     */
+    inspectOwnerWorkItemFeedback(inbox, binding) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const parsed = this.parseWorkItemFeedback(inbox.envelope);
+        if (!registration || registration.feedbackEnabled !== true || parsed === undefined || !inbox.envelope.metadata?.replyToProviderMessageId)
+            return { kind: 'none' };
         const report = this.deliveryStore.workItemReplies.replyReport(inbox.channel, inbox.account, inbox.envelope.metadata.replyToProviderMessageId);
         if (!report || !['accepted', 'delivered', 'read'].includes(report.outbox.status) || !report.outbox.providerMessageId
             || workItemReplyCanonical(report.outbox.intent.target.conversation) !== workItemReplyCanonical(inbox.envelope.conversation)
             || workItemReplyCanonical(report.outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal))
-            return 'none';
+            return { kind: 'none' };
         let target;
         try {
             target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId, reportRevision: report.target.reportRevision,
@@ -4276,25 +4409,30 @@ export class AssistantDeliveryService extends Service {
                 format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
         }
         catch {
-            return 'none';
+            return { kind: 'none' };
         }
         if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
-            return 'none';
+            return { kind: 'none' };
+        const continuation = parsed.continuation;
         // A recognized result must not be converted into execution when its separate feedback permission is absent.
         if (!this.workItemFeedbackPermission(binding, registration))
-            return 'ordinary';
+            return { kind: 'ordinary', continuation };
         const source = { protocol: 'assistant-delivery/work-item-feedback/v1', inboxId: inbox.id, envelopeHash: inbox.envelopeHash,
             inputText: inbox.envelope.text, inputSha256: createHash('sha256').update(inbox.envelope.text).digest('hex'), admissionCursor: inbox.admissionCursor, occurredAt: inbox.receivedAt,
             owner: target.owner, principalId: externalPrincipalId(binding.principal), binding: { id: binding.id, version: binding.version, generation: binding.generation }, scope: target.scope,
-            target: { outboxId: report.outbox.id, providerMessageId: report.outbox.providerMessageId, itemId: target.itemId, reportRevision: target.reportRevision, reportDigest: target.reportDigest, streamId: target.streamId }, selection,
+            target: { outboxId: report.outbox.id, providerMessageId: report.outbox.providerMessageId, itemId: target.itemId, reportRevision: target.reportRevision, reportDigest: target.reportDigest, streamId: target.streamId }, selection: parsed.selection,
             operationId: `owner-work-item-feedback:${createHash('sha256').update(JSON.stringify([inbox.id, inbox.envelopeHash])).digest('hex')}` };
-        this.deliveryStore.workItemFeedback.admit(source, () => {
+        const fence = () => {
             const current = this.currentWorkItemReplyConsumer(), owner = this.ownerLineageForBinding(binding), active = this.deliveryStore.getBinding(binding.id);
             if (current !== registration || current?.feedbackEnabled !== true || workItemReplyCanonical(owner) !== workItemReplyCanonical(source.owner)
                 || workItemReplyCanonical(active) !== workItemReplyCanonical(binding) || !this.workItemFeedbackPermission(binding, registration))
                 throw new Error('feedback admission authority changed');
-        });
-        return 'handled';
+        };
+        return { kind: 'ready', source, fence, continuation };
+    }
+    /** One deterministic, non-durable record when a mixed reply could only admit one lane. */
+    recordPartialMixedFeedbackAdmission(inbox, reason) {
+        this.context.logger.warn(`assistant-delivery: mixed owner feedback ${inbox.id} admitted partially (${reason})`);
     }
     /** Passing an explicit registration makes this the callback-free final local authority check. */
     workItemFeedbackFence(intent, recorded = false, expectedRegistration) {
@@ -4596,7 +4734,11 @@ export class AssistantDeliveryService extends Service {
             || !/^[a-z][a-z0-9-]{0,54}$/u.test(principal.channel))
             return undefined;
         const key = { channel: principal.channel, account: principal.account, tenant: principal.tenant, user: principal.user };
-        const senderAllowlisted = this.deliveryStore.isAuthorizedPrincipal(key);
+        // Only the owner role is a trusted intake sender. A linked peer bot is
+        // authorized to converse, but its messages must stay `inferred`/filtered
+        // rather than entering the owner work-item allowlist.
+        const principalRecord = this.deliveryStore.getPrincipal(key);
+        const senderAllowlisted = principalRecord?.status === 'active' && principalRecord.role === 'owner';
         // A follow-up counts only from an allowlisted sender replying, in the same
         // conversation, to a delivered WorkItems report.
         let threadFollowUp = false;
@@ -4879,32 +5021,43 @@ export class AssistantDeliveryService extends Service {
             action: 'continue-work-items-from-reply', resource: { kind: 'automation', id: registration.continuationAutomationId },
             context: { initiator: 'external' } }).effect === 'allow';
     }
-    admitWorkItemReply(inbox, binding) {
+    /**
+     * Validate the continuation lane of one reply to an exact report without
+     * writing it. Mixed-intent admission reuses this report inside its combined
+     * transaction; the ordinary path admits it through `admitWorkItemReply`.
+     */
+    prepareWorkItemReply(inbox, binding) {
         const registration = this.currentWorkItemReplyConsumer();
         const envelope = inbox.envelope;
         if (!registration || registration.continuationEnabled === false || envelope.kind !== 'text' || envelope.text.trim().startsWith('/') || !envelope.text
             || (envelope.attachments?.length ?? 0) > 0 || !envelope.metadata?.replyToProviderMessageId)
-            return false;
+            return undefined;
         const report = this.deliveryStore.workItemReplies.replyReport(envelope.channel, envelope.account, envelope.metadata.replyToProviderMessageId);
         const outbox = report?.outbox;
         if (!report || !outbox || !['accepted', 'delivered', 'read'].includes(outbox.status) || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal)
             || workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation))
-            return false;
+            return undefined;
         try {
             const target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId,
                 reportRevision: report.target.reportRevision, bindingId: outbox.intent.bindingId, idempotencyKey: outbox.intent.idempotencyKey,
                 text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
             if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
-                return false;
+                return undefined;
             if (registration.canContinueReport?.({ itemId: target.itemId, reportRevision: target.reportRevision, bindingId: outbox.intent.bindingId,
                 idempotencyKey: outbox.intent.idempotencyKey, text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }) === false)
-                return false;
+                return undefined;
             if (this.currentWorkItemReplyConsumer() !== registration || !this.workItemReplyPermission(binding, registration))
-                return false;
+                return undefined;
         }
         catch {
-            return false;
+            return undefined;
         }
+        return report;
+    }
+    admitWorkItemReply(inbox, binding) {
+        const report = this.prepareWorkItemReply(inbox, binding);
+        if (report === undefined)
+            return false;
         // From here a failed durable handoff is an error, never ordinary fallback.
         this.deliveryStore.workItemReplies.admit(inbox.id, binding, report);
         return true;
@@ -5496,6 +5649,148 @@ export class AssistantDeliveryService extends Service {
             return undefined;
         return Object.freeze({ outboxId: record.id, status: record.status });
     }
+    /**
+     * Register the slice-5 reply consumer for one owner-notice source (see
+     * `OwnerNotificationReply`). The service in the `authority` slot must vouch
+     * for the exact object; one live consumer per (authority, source). A
+     * registration its authority no longer vouches for is superseded by the
+     * next vouched one, so a restarted owner regains its replies without a new
+     * notice. Registering never sends anything and grants no send authority.
+     */
+    registerOwnerNotificationReply(registration) {
+        this.assertActive();
+        if (!registration || registration.protocol !== ownerNotificationReplyProtocol
+            || typeof registration.authority !== 'string' || !ownerNotificationAuthorityPattern.test(registration.authority)
+            || typeof registration.sourceId !== 'string' || typeof registration.idempotencyKeyPrefix !== 'string'
+            || registration.idempotencyKeyPrefix.length < 1 || registration.idempotencyKeyPrefix.length > 128
+            || typeof registration.consume !== 'function') {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid owner notification reply consumer');
+        }
+        const authority = registration.authority;
+        const sourceId = canonicalBackgroundSourceId(registration.sourceId);
+        if (!this.replyVouched(authority, registration))
+            throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply is not owned by its authority');
+        const key = ownerNotificationWithdrawalKey(authority, sourceId);
+        const existing = this.ownerNotificationReplies.get(key);
+        if (existing !== undefined) {
+            if (this.replyVouched(existing.authority, existing.registration))
+                throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply already registered');
+            this.ownerNotificationReplies.delete(key);
+        }
+        const entry = Object.freeze({ authority, sourceId, registration });
+        this.ownerNotificationReplies.set(key, entry);
+        let live = true;
+        return Object.freeze({ unregister: () => {
+                if (!live)
+                    return;
+                live = false;
+                if (this.ownerNotificationReplies.get(key) === entry)
+                    this.ownerNotificationReplies.delete(key);
+            } });
+    }
+    /** The service now in `authority`'s slot vouches for this exact reply registration. */
+    replyVouched(authority, registration) {
+        try {
+            const owner = this.context.get(authority, false);
+            return typeof owner?.ownsOwnerNotificationReply === 'function' && owner.ownsOwnerNotificationReply(registration) === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Slice 5 matcher: bind one authenticated inbound text reply to exactly one
+     * accepted/delivered/read owner notice through `replyToProviderMessageId`,
+     * require the live registered consumer's source and idempotency-key prefix,
+     * an active owner binding/principal with the notice's frozen owner lineage,
+     * and an `allow` external `answer-attention-question` Policy decision. On
+     * `applied` the Inbox is marked processed; `transient` leaves it pending for
+     * a retry. Everything else falls through to ordinary inbound handling.
+     */
+    inspectOwnerQuestionReply(inbox, binding) {
+        this.assertActive();
+        const envelope = inbox.envelope;
+        const replyTo = envelope.metadata?.replyToProviderMessageId;
+        if (typeof replyTo !== 'string' || replyTo.length === 0 || envelope.kind !== 'text' || (envelope.attachments?.length ?? 0) > 0)
+            return 'none';
+        if (typeof envelope.text !== 'string' || envelope.text.length === 0 || Buffer.byteLength(envelope.text, 'utf8') > 256)
+            return 'none';
+        // The reply must come from the active owner binding itself, not another
+        // conversation that happens to quote the provider message id.
+        if (binding.status !== 'active' || externalPrincipalId(binding.principal) !== externalPrincipalId(envelope.principal)
+            || workItemReplyCanonical(envelope.conversation) !== workItemReplyCanonical(binding.conversation))
+            return 'none';
+        const active = this.deliveryStore.getActiveBinding(binding.conversation);
+        if (active?.id !== binding.id)
+            return 'none';
+        const owner = this.deliveryStore.getPrincipal(binding.principal);
+        if (owner?.status !== 'active' || owner.role !== 'owner')
+            return 'none';
+        let outbox;
+        try {
+            outbox = this.deliveryStore.getUniqueOutboxByProviderMessage(inbox.channel, inbox.account, replyTo);
+        }
+        catch {
+            return 'none';
+        }
+        if (outbox === undefined || !['accepted', 'delivered', 'read'].includes(outbox.status))
+            return 'none';
+        const metadata = outbox.intent.metadata;
+        if (metadata?.['dsh.native-notice'] !== 'v1' || typeof metadata['dsh.native-notice.sourceId'] !== 'string'
+            || typeof metadata['dsh.native-notice.withdrawalAuthority'] !== 'string')
+            return 'none';
+        let sourceId;
+        try {
+            sourceId = canonicalBackgroundSourceId(metadata['dsh.native-notice.sourceId']);
+        }
+        catch {
+            return 'none';
+        }
+        const entry = this.ownerNotificationReplies.get(ownerNotificationWithdrawalKey(metadata['dsh.native-notice.withdrawalAuthority'], sourceId));
+        if (entry === undefined || !this.replyVouched(entry.authority, entry.registration))
+            return 'none';
+        const registration = entry.registration;
+        if (!outbox.intent.idempotencyKey.startsWith(registration.idempotencyKeyPrefix))
+            return 'none';
+        if (workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation)
+            || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(envelope.principal))
+            return 'none';
+        // The notice froze an exact owner row; a re-paired/replaced owner does not
+        // inherit permission to answer the old owner's question.
+        if (metadata['dsh.native-notice.ownerRecordId'] !== owner.id
+            || metadata['dsh.native-notice.ownerVersion'] !== String(owner.version))
+            return 'none';
+        const decision = this.policy.evaluate({
+            subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+            action: 'answer-attention-question', resource: { kind: 'message', id: binding.id }, context: { initiator: 'external' },
+        });
+        if (decision.effect !== 'allow')
+            return 'none';
+        let outcome;
+        try {
+            outcome = registration.consume(Object.freeze({
+                inboxId: inbox.id, envelopeHash: inbox.envelopeHash, outboxId: outbox.id, providerMessageId: replyTo,
+                idempotencyKey: outbox.intent.idempotencyKey, sourceId, principalId: externalPrincipalId(binding.principal),
+                text: envelope.text, receivedAt: inbox.receivedAt,
+            }));
+        }
+        catch {
+            return 'transient';
+        }
+        if (outcome === 'ignored')
+            return 'none';
+        if (outcome !== 'applied')
+            return 'transient';
+        try {
+            this.deliveryStore.markInboxProcessed(inbox.id, binding.id);
+        }
+        catch {
+            // The consumer's own durable effect already committed; if recording that
+            // here fails, never fall through and send the authorization to the Agent.
+            return this.deliveryStore.getInbox(inbox.id)?.status === 'processed' ? 'handled' : 'transient';
+        }
+        return 'handled';
+    }
     /**
      * Dedicated Automation result lane. Every learning field is derived from an
      * authoritative Automations receipt; callers cannot supply metadata,
@@ -7181,6 +7476,13 @@ export class AssistantDeliveryService extends Service {
             if (binding === undefined)
                 continue;
             if (!reset && !stop) {
+                // A pending owner-question reply is finished (or held for a retry)
+                // before it can be queued to the Agent.
+                const attentionReply = this.inspectOwnerQuestionReply(pending, binding);
+                if (attentionReply === 'handled')
+                    continue;
+                if (attentionReply === 'transient')
+                    return;
                 this.deliveryStore.queueInbox(pending.id, binding.id);
                 continue;
             }