@dsh-enhanced/assistant-delivery 0.1.66 → 0.1.68

package/lib/service.js

@@ -33,7 +33,7 @@ import { bindingMatchesOwnerRoute, canonicalBackgroundSourceId as canonicalHostB
 import { isExactDeliveryCommand, parseDeliveryCommand } from './session-commands.js';
 import { deliveryT1PreferenceKeys, deliveryT1PreferenceValues } from './learning-command.js';
 import { assertReplyReplayAllowed, blockAgentRepliesForReplay as createReplyReplayBlock, } from './reply-replay.js';
-import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, objectiveStateMessage, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
+import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, parseNaturalOwnerReply, objectiveStateMessage, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
 import { DELIVERY_PREFERENCE_PROJECTION_PROTOCOL, TRUSTED_DELIVERY_PRESENTATION_PRODUCER_PROTOCOL, } from './types.js';
 const trustedDeliveryPreferenceProducers = new WeakSet();
 const deliveryPreferenceProducerProbe = Symbol('assistant-delivery.preference-producer-probe');
@@ -265,6 +265,7 @@ function containsReservedLearningMetadata(metadata) {
     return metadata !== undefined && Object.keys(metadata).some(key => key.startsWith(learningMetadataPrefix));
 }
 export const ownerNotificationWithdrawalProtocol = 'assistant-delivery/owner-notification-withdrawal/v1';
+export const ownerNotificationReplyProtocol = 'assistant-delivery/owner-notification-reply/v1';
 export class AssistantDeliveryError extends Error {
     code;
     constructor(code, message) {
@@ -338,6 +339,16 @@ const configSchema = Schema.object({
     attentionAttachOverCap: Schema.boolean().default(false),
     attentionEnforce: Schema.boolean().default(false),
     ownerReportRouting: Schema.object({ orderAcrossLanes: Schema.boolean().default(false) }),
+    naturalFeedback: Schema.object({
+        coverage: Schema.boolean().default(false),
+        mixedIntent: Schema.boolean().default(false),
+    }),
+    peerAgents: Schema.array(Schema.object({
+        channel: Schema.string().min(1).required(),
+        account: Schema.string().min(1).required(),
+        tenant: Schema.string().min(1).required(),
+        user: Schema.string().min(1).required(),
+    })).default([]),
     ownerRoutes: Schema.array(Schema.object({
         id: Schema.string().min(1).required(),
         conversation: Schema.object({
@@ -435,6 +446,23 @@ const ownerRequestedChangeArgumentBytes = 64 * 1024;
 const toolApprovalIdentityBytes = 512;
 /** Bounded owner-ordered linked fallback list for one report route. */
 const maxLinkedReportFallback = 8;
+/**
+ * Host-native tool arguments normalized exactly as Delivery attests them:
+ * JSON.parse then JSON.stringify, preserving key order and rejecting any
+ * non-object payload. Other components must hash this exact text instead of
+ * re-canonicalizing it, otherwise a foreground witness cannot be matched.
+ */
+export function normalizeForegroundToolArguments(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return JSON.stringify(parsed);
+    }
+    catch {
+        return undefined;
+    }
+}
 function inspectUnsettledNativeCall(events, turn, callId, toolName, argumentsJson, argumentBytes = toolApprovalArgumentBytes) {
     if (!callId || !toolName || Buffer.byteLength(callId) > toolApprovalIdentityBytes
         || Buffer.byteLength(toolName) > toolApprovalIdentityBytes
@@ -463,16 +491,9 @@ function inspectUnsettledNativeCall(events, turn, callId, toolName, argumentsJso
         || events.filter(event => event.type === 'step/start' && event.data.turn === turn
             && event.data.step === call.data.step).length !== 1)
         return undefined;
-    let normalizedArguments;
-    try {
-        const parsed = JSON.parse(call.data.arguments);
-        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-            return undefined;
-        normalizedArguments = JSON.stringify(parsed);
-    }
-    catch {
+    const normalizedArguments = normalizeForegroundToolArguments(call.data.arguments);
+    if (normalizedArguments === undefined)
         return undefined;
-    }
     const argumentsDigest = createHash('sha256').update(normalizedArguments).digest('hex');
     if (argumentsDigest !== createHash('sha256').update(argumentsJson).digest('hex'))
         return undefined;
@@ -696,6 +717,8 @@ export class AssistantDeliveryService extends Service {
     ownerNotificationWithdrawals = new Map();
     /** Live handles issued by `registerOwnerNotificationWithdrawal`, mapped to their (authority, source) key. */
     ownerNotificationWithdrawalHandles = new Map();
+    /** Slice-5 reply consumers, one per (authority, canonical owner-notice source id). */
+    ownerNotificationReplies = new Map();
     foregroundObserver;
     /** Once a live verifier required acceptance, loss of that verifier must not silently bypass it. */
     acceptanceRequired = false;
@@ -2091,10 +2114,53 @@ export class AssistantDeliveryService extends Service {
             completeExecution: (inboxId, input) => this.completeForegroundTaskExecution(inboxId, input),
             recordExecutionModelSelection: (inboxId, input) => this.deliveryStore.recordForegroundExecutionModelSelection({ inboxId, ...input }),
             claimed: (agent, envelope, turn) => this.capturePreferenceTurn(agent, { kind: 'delivery', channel: envelope.channel, account: envelope.account, eventId: envelope.eventId }, turn),
-            notifications: binding => this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 50 }).filter(record => record.status === 'accepted'
-                // Already-accepted notices stay listed: withdrawal only gates the send attempt.
+            notifications: binding => this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 50 }).filter(record => (record.status === 'accepted' || record.status === 'delivered')
+                // Acknowledged notices stay listed until read; withdrawal only gates the send attempt.
                 && record.intent.metadata?.['dsh.native-notice'] === 'v1' && this.#notificationGuard(record, { withdrawal: false }) === undefined)
-                .map(record => ({ id: record.id, text: record.intent.text, createdAt: record.createdAt })),
+                .map(record => ({ id: record.id, text: record.intent.text, createdAt: record.createdAt,
+                status: record.status === 'delivered' ? 'delivered' : 'accepted' })),
+            acknowledgeNotices: (binding, ids, status) => {
+                // Validate the whole batch against this binding and the exact send-path
+                // guard before writing anything: one foreign/forged/expired id, drifted
+                // owner/binding/route/policy or withdrawn notice rejects the batch with
+                // zero receipts.
+                const byId = new Map(this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 100 }).map(record => [record.id, record]));
+                const targets = ids.map(id => {
+                    const record = byId.get(id);
+                    if (record === undefined || record.intent.metadata?.['dsh.native-notice'] !== 'v1'
+                        || (record.status !== 'accepted' && record.status !== 'delivered' && record.status !== 'read')
+                        || record.providerMessageId === undefined) {
+                        throw new Error('assistant-delivery: native notice acknowledgement is invalid');
+                    }
+                    // Re-run the exact send-path guard: expiry, owner/binding version or
+                    // generation drift, route/policy change and withdrawal all fail closed
+                    // before any receipt is written. withdrawal:true is required so a
+                    // withdrawn notice cannot be acknowledged after it was sent.
+                    const refused = this.#nativeNoticeGuard(record.intent, { withdrawal: true });
+                    if (refused !== undefined)
+                        throw new Error(`assistant-delivery: native notice acknowledgement is ${refused.failureCode}`);
+                    return record;
+                });
+                const rank = { accepted: 1, delivered: 2, read: 3 };
+                for (const record of targets) {
+                    // A late lower-rank ack is a no-op: it must not append a stale receipt
+                    // after read/delivered nor downgrade the outbox state.
+                    if (rank[status] <= rank[record.status])
+                        continue;
+                    try {
+                        this.deliveryStore.recordReceipt({ channel: binding.conversation.channel, account: binding.conversation.account,
+                            providerMessageId: record.providerMessageId, status, occurredAt: Date.now() });
+                    }
+                    catch (error) {
+                        // The web client re-acks every rendered notice. A repeat with a new
+                        // timestamp is an idempotent no-op, not a client error; other
+                        // storage failures still propagate.
+                        if (!(error instanceof DeliveryStoreError) || error.code !== 'idempotency-conflict')
+                            throw error;
+                    }
+                }
+                return Object.freeze({ acknowledged: targets.length });
+            },
         }, config);
         this.nativeWebOwner = access;
         this.nativeWebBound = true;
@@ -2185,6 +2251,55 @@ export class AssistantDeliveryService extends Service {
         return Object.freeze({ protocol: 'assistant-delivery/foreground-tool-input/v1',
             attestation, ...page });
     }
+    /**
+     * The live caller's unique configured owner route. A caller never names a
+     * route here: zero matching routes (anonymous, unconfigured, or failed
+     * revalidation) and more than one matching route (ambiguous owner authority)
+     * both fail closed.
+     */
+    ownerRouteForAgent(agent) {
+        if (!this.active || typeof agent !== 'object' || agent === null || agent.session === undefined)
+            return undefined;
+        let resolved;
+        try {
+            for (const authorityId of this.ownerRoutes.keys()) {
+                if (this.validateOwnerAgentForRoute(agent, authorityId) === undefined)
+                    continue;
+                if (resolved !== undefined)
+                    return undefined;
+                resolved = authorityId;
+            }
+        }
+        catch {
+            return undefined;
+        }
+        return resolved;
+    }
+    /** Host-only proof resolved from the caller Agent's unique live owner route. */
+    inspectOwnerForegroundToolCallForAgent(agent, input) {
+        if (!input || typeof input !== 'object' || Reflect.ownKeys(input).some(key => typeof key !== 'string'
+            || !['callId', 'toolName', 'argumentsJson'].includes(key)))
+            return undefined;
+        const authorityId = this.ownerRouteForAgent(agent);
+        if (authorityId === undefined)
+            return undefined;
+        return this.inspectOwnerForegroundToolCall({ agent, authorityId, callId: input.callId,
+            toolName: input.toolName, argumentsJson: input.argumentsJson });
+    }
+    /** Read-only human-input pages resolved from the caller Agent's unique live
+     * owner route; the caller cannot select an Inbox, route, owner or replacement text. */
+    readOwnerForegroundToolInputForAgent(agent, input) {
+        if (!input || typeof input !== 'object' || Reflect.ownKeys(input).some(key => typeof key !== 'string'
+            || !['callId', 'toolName', 'argumentsJson', 'offset', 'maxBytes'].includes(key)))
+            return undefined;
+        const authorityId = this.ownerRouteForAgent(agent);
+        if (authorityId === undefined)
+            return undefined;
+        return this.readOwnerForegroundToolInput({ agent, authorityId, callId: input.callId,
+            toolName: input.toolName, argumentsJson: input.argumentsJson,
+            ...(input.offset === undefined ? {} : { offset: input.offset }),
+            ...(input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }) });
+    }
     /** Host-only, read-only source proof for an owner's live memory or wiki tool call. */
     inspectOwnerRequestedChange(execution, input) {
         if (!this.active || !execution || typeof execution !== 'object'
@@ -2817,6 +2932,16 @@ export class AssistantDeliveryService extends Service {
         return inbox !== undefined && binding !== undefined && inbox.bindingId === binding.id
             && this.isInboundAuthorized(binding, inbox.envelope);
     }
+    /**
+     * Exact owner-configured peer bot, or `undefined`. `senderIsBot` is only the
+     * provider's declaration; the allowlisted tuple is the actual authority.
+     */
+    peerAgentAuthority(envelope) {
+        if (envelope.metadata?.senderIsBot !== 'true')
+            return undefined;
+        return this.config.peerAgents?.find(peer => peer.channel === envelope.channel && peer.account === envelope.account
+            && peer.tenant === envelope.principal.tenant && peer.user === envelope.principal.user);
+    }
     isInboundAuthorized(binding, envelope) {
         if (!this.active)
             return false;
@@ -3251,6 +3376,25 @@ export class AssistantDeliveryService extends Service {
         void this.drainWorkflowTraces();
         return 'recorded';
     }
+    /** Opt-in widened deterministic grammar; off keeps the legacy exact phrases. */
+    widenedNaturalFeedbackCoverage() {
+        return this.config.naturalFeedback?.coverage === true;
+    }
+    /** Splitting one reply into result + continuation requires both opt-ins. */
+    mixedNaturalFeedbackIntent() {
+        return this.config.naturalFeedback?.coverage === true
+            && this.config.naturalFeedback?.mixedIntent === true;
+    }
+    /**
+     * One canonical selection for admission and its later re-derivation fences.
+     * The widened parser is a pure function, so a frozen intent keeps verifying
+     * even after a restart that toggles the opt-in.
+     */
+    naturalObjectiveSelection(text) {
+        return this.widenedNaturalFeedbackCoverage()
+            ? parseNaturalOwnerReply(text)?.status
+            : parseNaturalObjectiveFeedback(text);
+    }
     /**
      * Convert only an authenticated reply to one exact Automation delivery into
      * a trusted objective label. The original run timestamp is retained because
@@ -3259,7 +3403,7 @@ export class AssistantDeliveryService extends Service {
      */
     async dispatchNaturalObjectiveFeedback(binding, envelope) {
         const selection = envelope.kind === 'text' && (envelope.attachments?.length ?? 0) === 0
-            ? parseNaturalObjectiveFeedback(envelope.text) : undefined;
+            ? this.naturalObjectiveSelection(envelope.text) : undefined;
         if (selection === undefined || !this.isOwnerFeedbackController(binding, envelope))
             return;
         const replyTarget = envelope.metadata?.replyToProviderMessageId;
@@ -3375,7 +3519,7 @@ export class AssistantDeliveryService extends Service {
         const naturalMatches = naturalIntent !== undefined && inbox.envelope.kind === 'text'
             && naturalIntent.envelopeHash === inbox.envelopeHash
             && naturalIntent.sourceOutboxId === target.id
-            && parseNaturalObjectiveFeedback(inbox.envelope.text) === naturalIntent.selection
+            && this.naturalObjectiveSelection(inbox.envelope.text) === naturalIntent.selection
             && (parsed.kind === 'objective-status' || (naturalIntent.status === 'frozen'
                 && JSON.stringify(naturalIntent.command) === JSON.stringify(parsed)));
         if ((inbox.envelope.attachments?.length ?? 0) !== 0 || (!typedMatches && !naturalMatches))
@@ -3803,7 +3947,7 @@ export class AssistantDeliveryService extends Service {
         const sessions = ctx.get('sessions');
         const agent = request.agent;
         const events = agent.session.snapshotEvents();
-        const reviewer = approvalReviewerOf(events);
+        const reviewer = approvalReviewerOf(events, agent.session.header.version);
         const reviewRoute = reviewer === 'user'
             ? 'user'
             : reviewer === 'auto-review' && ctx.assistantPolicy.isAutoReviewEscalation(request)
@@ -3942,7 +4086,8 @@ export class AssistantDeliveryService extends Service {
             return next();
         let reviewer;
         try {
-            reviewer = approvalReviewerOf(request.agent.session.snapshotEvents());
+            const session = request.agent.session;
+            reviewer = approvalReviewerOf(session.snapshotEvents(), session.header.version);
         }
         catch {
             return 'unavailable';
@@ -4121,6 +4266,32 @@ export class AssistantDeliveryService extends Service {
         if (!['received', 'authorized'].includes(record.status)) {
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         }
+        // An explicitly allowlisted peer bot enters its own linked-principal lane.
+        // It is still subject to the ordinary Policy ingest decision below and never
+        // receives owner feedback/continuation behavior. The allowlist is re-read
+        // for every provider-declared bot message: removing an entry revokes the
+        // lane even while the old linked principal row is still active.
+        const senderIsBot = envelope.metadata?.senderIsBot === 'true';
+        const peerAuthority = senderIsBot ? this.peerAgentAuthority(envelope) : undefined;
+        if (senderIsBot && peerAuthority === undefined) {
+            record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
+            return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+        }
+        if (peerAuthority !== undefined && !this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
+            const owner = this.deliveryStore.activeOwnerPrincipal();
+            if (owner === undefined) {
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-owner-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+            try {
+                this.deliveryStore.ensurePeerPrincipal(envelope.principal, owner.id, { reauthorize: true });
+            }
+            catch (error) {
+                this.context.logger.warn(`assistant-delivery: peer principal admission failed: ${String(error)}`);
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-principal-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+        }
         if (!this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
             record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
@@ -4225,50 +4396,114 @@ export class AssistantDeliveryService extends Service {
                 const failed = this.deliveryStore.getInbox(record.id);
                 return { duplicate: accepted.duplicate, inboxId: failed.id, status: failed.status };
             }
-            const feedback = this.admitOwnerWorkItemFeedback(record, binding);
-            if (feedback === 'handled') {
+            // Slice 5: a reply to the exact delivered owner-question notice is
+            // consumed here, before any Agent admission. Applied replies are
+            // processed; a transient consumer failure leaves the Inbox pending.
+            const attentionReply = this.inspectOwnerQuestionReply(record, binding);
+            if (attentionReply !== 'none') {
+                const current = this.deliveryStore.getInbox(record.id);
+                return { duplicate: accepted.duplicate, inboxId: current.id, status: current.status };
+            }
+            const feedback = this.inspectOwnerWorkItemFeedback(record, binding);
+            const splitContinuation = feedback.kind !== 'none' && feedback.continuation;
+            if (feedback.kind === 'ready') {
+                // One reply may carry a result and an explicit continuation. They are two
+                // independently fenced decisions: admit both atomically when both lanes
+                // are permitted, otherwise record the result alone and record the reason.
+                let admittedContinuation = false;
+                if (splitContinuation) {
+                    const report = this.prepareWorkItemReply(record, binding);
+                    if (report !== undefined) {
+                        try {
+                            this.deliveryStore.admitOwnerWorkItemFeedbackWithReply({ feedback: feedback.source, binding, report, fence: feedback.fence });
+                            admittedContinuation = true;
+                        }
+                        catch (error) {
+                            // The combined transaction rolled back; fall back to the result lane
+                            // only. A failed result fence re-throws on that fallback, as before.
+                            this.context.logger.warn(`assistant-delivery: mixed owner feedback continuation admission failed: ${String(error)}`);
+                        }
+                    }
+                }
+                if (!admittedContinuation) {
+                    this.deliveryStore.workItemFeedback.admit(feedback.source, feedback.fence);
+                    if (splitContinuation)
+                        this.recordPartialMixedFeedbackAdmission(record, 'continuation-not-admitted');
+                }
+                if (admittedContinuation)
+                    this.notifyWorkItemReplyPending();
                 void this.drainWorkItemFeedback().catch(() => { });
                 return { duplicate: accepted.duplicate, inboxId: record.id, status: 'processed' };
             }
-            if (feedback !== 'ordinary' && this.admitWorkItemReply(record, binding)) {
+            // A pure recognized result never becomes execution when feedback permission
+            // is absent; only an explicit continuation in the same reply may proceed.
+            const continuationAllowed = feedback.kind === 'none'
+                || (feedback.kind === 'ordinary' && splitContinuation);
+            if (continuationAllowed && this.admitWorkItemReply(record, binding)) {
                 const handedOff = this.deliveryStore.getInbox(record.id);
                 this.notifyWorkItemReplyPending();
+                if (feedback.kind === 'ordinary')
+                    this.recordPartialMixedFeedbackAdmission(record, 'feedback-not-admitted');
                 return { duplicate: accepted.duplicate, inboxId: handedOff.id, status: handedOff.status };
             }
+            if (feedback.kind === 'ordinary' && splitContinuation)
+                this.recordPartialMixedFeedbackAdmission(record, 'neither-lane-admitted');
             record = this.deliveryStore.queueInbox(record.id, binding.id);
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         });
     }
+    /**
+     * Deterministic backend classification of one authenticated owner reply to an
+     * exact report. The legacy closed whole-sentence grammar stays in force unless
+     * the widened coverage opt-in is on; no caller text is reinterpreted as an
+     * instruction, and no model is called.
+     */
     parseWorkItemFeedback(envelope) {
         if ((envelope.attachments?.length ?? 0) !== 0)
             return undefined;
         if (envelope.kind === 'text') {
             const text = envelope.text.trim();
-            if (!/^(?:问题解决了|已经解决了|现在解决了|还是不行|还没解决|问题还没解决|撤回刚才的任务反馈|撤回我刚才的任务反馈)[。.!！]?$/u.test(text))
-                return undefined;
-            const value = parseNaturalObjectiveFeedback(text);
-            return value === undefined ? undefined : { kind: 'natural', value };
+            if (!this.widenedNaturalFeedbackCoverage()) {
+                if (!/^(?:问题解决了|已经解决了|现在解决了|还是不行|还没解决|问题还没解决|撤回刚才的任务反馈|撤回我刚才的任务反馈)[。.!！]?$/u.test(text))
+                    return undefined;
+                const value = parseNaturalObjectiveFeedback(text);
+                return value === undefined ? undefined : { selection: { kind: 'natural', value }, continuation: false };
+            }
+            const parsed = parseNaturalOwnerReply(text);
+            return parsed === undefined ? undefined : {
+                selection: { kind: 'natural', value: parsed.status },
+                continuation: parsed.continuation && this.mixedNaturalFeedbackIntent(),
+            };
         }
         const command = parseDeliveryCommand(envelope);
         if (command?.name !== 'feedback')
             return undefined;
         const parsed = parseFeedbackCommand(command.rawInput);
         return ['objective', 'objective-status', 'objective-revision'].includes(parsed.kind)
-            ? { kind: 'explicit', command: parsed } : undefined;
+            ? { selection: { kind: 'explicit', command: parsed }, continuation: false }
+            : undefined;
     }
     workItemFeedbackPermission(binding, registration) {
         return this.policy.evaluate({ subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
             action: 'feedback-work-items', resource: { kind: 'automation', id: registration.continuationAutomationId }, context: { initiator: 'external' } }).effect === 'allow';
     }
-    admitOwnerWorkItemFeedback(inbox, binding) {
-        const registration = this.currentWorkItemReplyConsumer(), selection = this.parseWorkItemFeedback(inbox.envelope);
-        if (!registration || registration.feedbackEnabled !== true || !selection || !inbox.envelope.metadata?.replyToProviderMessageId)
-            return 'none';
+    /**
+     * Inspect one Inbox as an authenticated owner result reply to an exact report.
+     * `ready` carries the frozen source plus its live admission fence; `ordinary`
+     * keeps the historical "recognized result but separate feedback permission
+     * absent" outcome and never admits the result lane by itself. The
+     * `continuation` flag is a deterministic classification only.
+     */
+    inspectOwnerWorkItemFeedback(inbox, binding) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const parsed = this.parseWorkItemFeedback(inbox.envelope);
+        if (!registration || registration.feedbackEnabled !== true || parsed === undefined || !inbox.envelope.metadata?.replyToProviderMessageId)
+            return { kind: 'none' };
         const report = this.deliveryStore.workItemReplies.replyReport(inbox.channel, inbox.account, inbox.envelope.metadata.replyToProviderMessageId);
         if (!report || !['accepted', 'delivered', 'read'].includes(report.outbox.status) || !report.outbox.providerMessageId
             || workItemReplyCanonical(report.outbox.intent.target.conversation) !== workItemReplyCanonical(inbox.envelope.conversation)
             || workItemReplyCanonical(report.outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal))
-            return 'none';
+            return { kind: 'none' };
         let target;
         try {
             target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId, reportRevision: report.target.reportRevision,
@@ -4276,25 +4511,30 @@ export class AssistantDeliveryService extends Service {
                 format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
         }
         catch {
-            return 'none';
+            return { kind: 'none' };
         }
         if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
-            return 'none';
+            return { kind: 'none' };
+        const continuation = parsed.continuation;
         // A recognized result must not be converted into execution when its separate feedback permission is absent.
         if (!this.workItemFeedbackPermission(binding, registration))
-            return 'ordinary';
+            return { kind: 'ordinary', continuation };
         const source = { protocol: 'assistant-delivery/work-item-feedback/v1', inboxId: inbox.id, envelopeHash: inbox.envelopeHash,
             inputText: inbox.envelope.text, inputSha256: createHash('sha256').update(inbox.envelope.text).digest('hex'), admissionCursor: inbox.admissionCursor, occurredAt: inbox.receivedAt,
             owner: target.owner, principalId: externalPrincipalId(binding.principal), binding: { id: binding.id, version: binding.version, generation: binding.generation }, scope: target.scope,
-            target: { outboxId: report.outbox.id, providerMessageId: report.outbox.providerMessageId, itemId: target.itemId, reportRevision: target.reportRevision, reportDigest: target.reportDigest, streamId: target.streamId }, selection,
+            target: { outboxId: report.outbox.id, providerMessageId: report.outbox.providerMessageId, itemId: target.itemId, reportRevision: target.reportRevision, reportDigest: target.reportDigest, streamId: target.streamId }, selection: parsed.selection,
             operationId: `owner-work-item-feedback:${createHash('sha256').update(JSON.stringify([inbox.id, inbox.envelopeHash])).digest('hex')}` };
-        this.deliveryStore.workItemFeedback.admit(source, () => {
+        const fence = () => {
             const current = this.currentWorkItemReplyConsumer(), owner = this.ownerLineageForBinding(binding), active = this.deliveryStore.getBinding(binding.id);
             if (current !== registration || current?.feedbackEnabled !== true || workItemReplyCanonical(owner) !== workItemReplyCanonical(source.owner)
                 || workItemReplyCanonical(active) !== workItemReplyCanonical(binding) || !this.workItemFeedbackPermission(binding, registration))
                 throw new Error('feedback admission authority changed');
-        });
-        return 'handled';
+        };
+        return { kind: 'ready', source, fence, continuation };
+    }
+    /** One deterministic, non-durable record when a mixed reply could only admit one lane. */
+    recordPartialMixedFeedbackAdmission(inbox, reason) {
+        this.context.logger.warn(`assistant-delivery: mixed owner feedback ${inbox.id} admitted partially (${reason})`);
     }
     /** Passing an explicit registration makes this the callback-free final local authority check. */
     workItemFeedbackFence(intent, recorded = false, expectedRegistration) {
@@ -4596,7 +4836,11 @@ export class AssistantDeliveryService extends Service {
             || !/^[a-z][a-z0-9-]{0,54}$/u.test(principal.channel))
             return undefined;
         const key = { channel: principal.channel, account: principal.account, tenant: principal.tenant, user: principal.user };
-        const senderAllowlisted = this.deliveryStore.isAuthorizedPrincipal(key);
+        // Only the owner role is a trusted intake sender. A linked peer bot is
+        // authorized to converse, but its messages must stay `inferred`/filtered
+        // rather than entering the owner work-item allowlist.
+        const principalRecord = this.deliveryStore.getPrincipal(key);
+        const senderAllowlisted = principalRecord?.status === 'active' && principalRecord.role === 'owner';
         // A follow-up counts only from an allowlisted sender replying, in the same
         // conversation, to a delivered WorkItems report.
         let threadFollowUp = false;
@@ -4879,32 +5123,43 @@ export class AssistantDeliveryService extends Service {
             action: 'continue-work-items-from-reply', resource: { kind: 'automation', id: registration.continuationAutomationId },
             context: { initiator: 'external' } }).effect === 'allow';
     }
-    admitWorkItemReply(inbox, binding) {
+    /**
+     * Validate the continuation lane of one reply to an exact report without
+     * writing it. Mixed-intent admission reuses this report inside its combined
+     * transaction; the ordinary path admits it through `admitWorkItemReply`.
+     */
+    prepareWorkItemReply(inbox, binding) {
         const registration = this.currentWorkItemReplyConsumer();
         const envelope = inbox.envelope;
         if (!registration || registration.continuationEnabled === false || envelope.kind !== 'text' || envelope.text.trim().startsWith('/') || !envelope.text
             || (envelope.attachments?.length ?? 0) > 0 || !envelope.metadata?.replyToProviderMessageId)
-            return false;
+            return undefined;
         const report = this.deliveryStore.workItemReplies.replyReport(envelope.channel, envelope.account, envelope.metadata.replyToProviderMessageId);
         const outbox = report?.outbox;
         if (!report || !outbox || !['accepted', 'delivered', 'read'].includes(outbox.status) || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal)
             || workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation))
-            return false;
+            return undefined;
         try {
             const target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId,
                 reportRevision: report.target.reportRevision, bindingId: outbox.intent.bindingId, idempotencyKey: outbox.intent.idempotencyKey,
                 text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
             if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
-                return false;
+                return undefined;
             if (registration.canContinueReport?.({ itemId: target.itemId, reportRevision: target.reportRevision, bindingId: outbox.intent.bindingId,
                 idempotencyKey: outbox.intent.idempotencyKey, text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }) === false)
-                return false;
+                return undefined;
             if (this.currentWorkItemReplyConsumer() !== registration || !this.workItemReplyPermission(binding, registration))
-                return false;
+                return undefined;
         }
         catch {
-            return false;
+            return undefined;
         }
+        return report;
+    }
+    admitWorkItemReply(inbox, binding) {
+        const report = this.prepareWorkItemReply(inbox, binding);
+        if (report === undefined)
+            return false;
         // From here a failed durable handoff is an error, never ordinary fallback.
         this.deliveryStore.workItemReplies.admit(inbox.id, binding, report);
         return true;
@@ -5115,7 +5370,7 @@ export class AssistantDeliveryService extends Service {
                 throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome lookup');
             }
             return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL,
-                facts: this.deliveryStore.attentionAudit.outcomeFactsFor([...new Set(input.outboxIds)]), hasMore: false, nextAfterSequence: null });
+                facts: this.notificationOutcomeFacts([...new Set(input.outboxIds)]), hasMore: false, nextAfterSequence: null });
         }
         const afterSequence = input.afterSequence ?? 0;
         const limit = input.limit ?? 100;
@@ -5123,10 +5378,24 @@ export class AssistantDeliveryService extends Service {
             throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome scan');
         }
         const page = this.deliveryStore.attentionAudit.list(afterSequence, limit);
-        const facts = this.deliveryStore.attentionAudit.outcomeFactsFor(page.entries.map(entry => entry.outboxId));
+        const facts = this.notificationOutcomeFacts(page.entries.map(entry => entry.outboxId));
         return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL, facts, hasMore: page.hasMore,
             nextAfterSequence: page.entries.length === 0 ? null : page.entries.at(-1).sequence });
     }
+    /**
+     * Attach the registered adapter's read-receipt completeness to each fact.
+     * The Delivery store owns transport facts but not adapter capabilities; only
+     * this read boundary can combine them. An undeclared capability stays absent
+     * so older Evaluation classifiers keep their pinned v1 digests.
+     */
+    notificationOutcomeFacts(outboxIds) {
+        return this.deliveryStore.attentionAudit.outcomeFactsFor(outboxIds).map(fact => {
+            const binding = this.deliveryStore.getBinding(fact.bindingId);
+            const readReceipts = binding === undefined ? undefined
+                : this.registry.get(binding.conversation.channel, binding.conversation.account)?.capabilities.readReceipts;
+            return readReceipts === undefined ? fact : Object.freeze({ ...fact, readReceipts });
+        });
+    }
     /**
      * Read-only WP19 stage-2c progress audit page in append order; never exposes
      * progress text. Entries are process-local (`durable: false`), bounded, and
@@ -5496,6 +5765,148 @@ export class AssistantDeliveryService extends Service {
             return undefined;
         return Object.freeze({ outboxId: record.id, status: record.status });
     }
+    /**
+     * Register the slice-5 reply consumer for one owner-notice source (see
+     * `OwnerNotificationReply`). The service in the `authority` slot must vouch
+     * for the exact object; one live consumer per (authority, source). A
+     * registration its authority no longer vouches for is superseded by the
+     * next vouched one, so a restarted owner regains its replies without a new
+     * notice. Registering never sends anything and grants no send authority.
+     */
+    registerOwnerNotificationReply(registration) {
+        this.assertActive();
+        if (!registration || registration.protocol !== ownerNotificationReplyProtocol
+            || typeof registration.authority !== 'string' || !ownerNotificationAuthorityPattern.test(registration.authority)
+            || typeof registration.sourceId !== 'string' || typeof registration.idempotencyKeyPrefix !== 'string'
+            || registration.idempotencyKeyPrefix.length < 1 || registration.idempotencyKeyPrefix.length > 128
+            || typeof registration.consume !== 'function') {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid owner notification reply consumer');
+        }
+        const authority = registration.authority;
+        const sourceId = canonicalBackgroundSourceId(registration.sourceId);
+        if (!this.replyVouched(authority, registration))
+            throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply is not owned by its authority');
+        const key = ownerNotificationWithdrawalKey(authority, sourceId);
+        const existing = this.ownerNotificationReplies.get(key);
+        if (existing !== undefined) {
+            if (this.replyVouched(existing.authority, existing.registration))
+                throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply already registered');
+            this.ownerNotificationReplies.delete(key);
+        }
+        const entry = Object.freeze({ authority, sourceId, registration });
+        this.ownerNotificationReplies.set(key, entry);
+        let live = true;
+        return Object.freeze({ unregister: () => {
+                if (!live)
+                    return;
+                live = false;
+                if (this.ownerNotificationReplies.get(key) === entry)
+                    this.ownerNotificationReplies.delete(key);
+            } });
+    }
+    /** The service now in `authority`'s slot vouches for this exact reply registration. */
+    replyVouched(authority, registration) {
+        try {
+            const owner = this.context.get(authority, false);
+            return typeof owner?.ownsOwnerNotificationReply === 'function' && owner.ownsOwnerNotificationReply(registration) === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Slice 5 matcher: bind one authenticated inbound text reply to exactly one
+     * accepted/delivered/read owner notice through `replyToProviderMessageId`,
+     * require the live registered consumer's source and idempotency-key prefix,
+     * an active owner binding/principal with the notice's frozen owner lineage,
+     * and an `allow` external `answer-attention-question` Policy decision. On
+     * `applied` the Inbox is marked processed; `transient` leaves it pending for
+     * a retry. Everything else falls through to ordinary inbound handling.
+     */
+    inspectOwnerQuestionReply(inbox, binding) {
+        this.assertActive();
+        const envelope = inbox.envelope;
+        const replyTo = envelope.metadata?.replyToProviderMessageId;
+        if (typeof replyTo !== 'string' || replyTo.length === 0 || envelope.kind !== 'text' || (envelope.attachments?.length ?? 0) > 0)
+            return 'none';
+        if (typeof envelope.text !== 'string' || envelope.text.length === 0 || Buffer.byteLength(envelope.text, 'utf8') > 256)
+            return 'none';
+        // The reply must come from the active owner binding itself, not another
+        // conversation that happens to quote the provider message id.
+        if (binding.status !== 'active' || externalPrincipalId(binding.principal) !== externalPrincipalId(envelope.principal)
+            || workItemReplyCanonical(envelope.conversation) !== workItemReplyCanonical(binding.conversation))
+            return 'none';
+        const active = this.deliveryStore.getActiveBinding(binding.conversation);
+        if (active?.id !== binding.id)
+            return 'none';
+        const owner = this.deliveryStore.getPrincipal(binding.principal);
+        if (owner?.status !== 'active' || owner.role !== 'owner')
+            return 'none';
+        let outbox;
+        try {
+            outbox = this.deliveryStore.getUniqueOutboxByProviderMessage(inbox.channel, inbox.account, replyTo);
+        }
+        catch {
+            return 'none';
+        }
+        if (outbox === undefined || !['accepted', 'delivered', 'read'].includes(outbox.status))
+            return 'none';
+        const metadata = outbox.intent.metadata;
+        if (metadata?.['dsh.native-notice'] !== 'v1' || typeof metadata['dsh.native-notice.sourceId'] !== 'string'
+            || typeof metadata['dsh.native-notice.withdrawalAuthority'] !== 'string')
+            return 'none';
+        let sourceId;
+        try {
+            sourceId = canonicalBackgroundSourceId(metadata['dsh.native-notice.sourceId']);
+        }
+        catch {
+            return 'none';
+        }
+        const entry = this.ownerNotificationReplies.get(ownerNotificationWithdrawalKey(metadata['dsh.native-notice.withdrawalAuthority'], sourceId));
+        if (entry === undefined || !this.replyVouched(entry.authority, entry.registration))
+            return 'none';
+        const registration = entry.registration;
+        if (!outbox.intent.idempotencyKey.startsWith(registration.idempotencyKeyPrefix))
+            return 'none';
+        if (workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation)
+            || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(envelope.principal))
+            return 'none';
+        // The notice froze an exact owner row; a re-paired/replaced owner does not
+        // inherit permission to answer the old owner's question.
+        if (metadata['dsh.native-notice.ownerRecordId'] !== owner.id
+            || metadata['dsh.native-notice.ownerVersion'] !== String(owner.version))
+            return 'none';
+        const decision = this.policy.evaluate({
+            subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+            action: 'answer-attention-question', resource: { kind: 'message', id: binding.id }, context: { initiator: 'external' },
+        });
+        if (decision.effect !== 'allow')
+            return 'none';
+        let outcome;
+        try {
+            outcome = registration.consume(Object.freeze({
+                inboxId: inbox.id, envelopeHash: inbox.envelopeHash, outboxId: outbox.id, providerMessageId: replyTo,
+                idempotencyKey: outbox.intent.idempotencyKey, sourceId, principalId: externalPrincipalId(binding.principal),
+                text: envelope.text, receivedAt: inbox.receivedAt,
+            }));
+        }
+        catch {
+            return 'transient';
+        }
+        if (outcome === 'ignored')
+            return 'none';
+        if (outcome !== 'applied')
+            return 'transient';
+        try {
+            this.deliveryStore.markInboxProcessed(inbox.id, binding.id);
+        }
+        catch {
+            // The consumer's own durable effect already committed; if recording that
+            // here fails, never fall through and send the authorization to the Agent.
+            return this.deliveryStore.getInbox(inbox.id)?.status === 'processed' ? 'handled' : 'transient';
+        }
+        return 'handled';
+    }
     /**
      * Dedicated Automation result lane. Every learning field is derived from an
      * authoritative Automations receipt; callers cannot supply metadata,
@@ -7181,6 +7592,13 @@ export class AssistantDeliveryService extends Service {
             if (binding === undefined)
                 continue;
             if (!reset && !stop) {
+                // A pending owner-question reply is finished (or held for a retry)
+                // before it can be queued to the Agent.
+                const attentionReply = this.inspectOwnerQuestionReply(pending, binding);
+                if (attentionReply === 'handled')
+                    continue;
+                if (attentionReply === 'transient')
+                    return;
                 this.deliveryStore.queueInbox(pending.id, binding.id);
                 continue;
             }