@gotcos/glasses-server 6.99.25 → 6.99.33

package/server/lib/turn-file-store.ts

@@ -0,0 +1,202 @@
+// Any file, for a session turn only (Miles, 2026-11-07: "We still don't have the ability to take picture, or add photo
+// or files from the web").
+//
+// The media store takes what a MODEL can read (photos, PDF, TXT, MD, CSV, JSON, XLSX, MP4, MOV): it extracts text and
+// frames, and an Ask, a Drop or Prep hands those to a model. A Claude or Codex session on this Mac is different: it gets
+// the file's path (lib/session-turn-attachments.ts) and opens it with its own tools, so a .zip, a .docx, a log or a
+// HEIC is useful there. This keeps those, and only those, beside the media store:
+//
+//   - Same upload: POST /api/media/file. Only when the upload says `X-COS-Purpose: session-turn` AND the media store
+//     refuses the file as a format it cannot read does the file land here instead (routes/media.ts).
+//   - Same ids (m_ + 24 hex), but never in the media index: an Ask, a Drop, Prep or GET /api/media/:id cannot find one
+//     (media_not_found), so a file no model can read never reaches a model. Only the turn and fork routes resolve them.
+//   - Same cap as the media store's own for a file that is not a video: 64 MB (MAX_OTHER_MEDIA_BYTES).
+//   - Kept 4 hours until a turn takes it, then 30 days. Swept on each new file, at boot and every 5 minutes after
+//     (startSweep, beside the media store's own GC; QA 6.99.27).
+//   - Each file is `<root>/<id>/file/<its own name, made safe>`, so the agent sees a real name and extension, and the
+//     record is `<root>/<id>/meta.json`, one folder up. No name a person gives a file can reach the record: on the
+//     default case-insensitive macOS disk a file named META.JSON beside the record WAS the record, and the record write
+//     replaced its bytes (QA, 6.99.27). Nothing here ever serves the bytes back over HTTP.
+
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, copyFileSync, statSync } from 'node:fs'
+import { join, resolve, sep } from 'node:path'
+import { randomBytes } from 'node:crypto'
+import { DATA_DIR } from './data-dir.js'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import { MAX_OTHER_MEDIA_BYTES, RichMediaSafetyError } from './rich-media-safety.js'
+import { isValidMediaId, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { MediaStoreError, MEDIA_GC_INTERVAL_MS } from './media-store.js'
+
+export const TURN_FILE_MAX_BYTES = MAX_OTHER_MEDIA_BYTES
+export const TURN_FILE_STAGED_TTL_MS = 4 * 60 * 60_000
+export const TURN_FILE_KEPT_TTL_MS = 30 * 24 * 60 * 60_000
+const PAYLOAD_DIR = 'file'
+
+interface TurnFileMeta {
+  id: string
+  name: string
+  label: string
+  mime: string
+  bytes: number
+  createdAtMs: number
+  associatedAtMs?: number
+  runId?: string
+}
+
+/** What the upload answers: an id and what it is. Never a path. */
+export interface TurnFileRef {
+  id: string
+  kind: 'session_file'
+  mime: string
+  bytes: number
+  label: string
+  createdAt: string
+}
+
+/** A filename the agent can read, that cannot climb out of its folder or carry control characters. */
+export function safeTurnFileName(label: string | undefined): string {
+  // eslint-disable-next-line no-control-regex
+  // QA 6.99.27: bidi controls go too, so the name on disk (and in the path the agent reads) shows as what it is.
+  let name = String(label ?? '').replace(/[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, '')
+    .replace(/[\u0000-\u001f\u007f\u2028\u2029/\\:]+/g, ' ').replace(/\s+/g, ' ').trim()
+  name = name.replace(/^[.\s]+/, '').trimEnd()
+  if (!name) name = 'file'
+  if (name.length > 120) {
+    const dot = name.lastIndexOf('.')
+    const ext = dot > 0 && name.length - dot <= 12 ? name.slice(dot) : ''
+    name = name.slice(0, 120 - ext.length).trimEnd() + ext
+  }
+  return name
+}
+
+function safeMime(declared: string | undefined): string {
+  const m = String(declared ?? '').toLowerCase().split(';', 1)[0]!.trim()
+  return /^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$/.test(m) ? m : 'application/octet-stream'
+}
+
+export class TurnFileStore {
+  readonly root: string
+  private readonly now: () => number
+  constructor(root: string = join(DATA_DIR, 'turn-files'), now: () => number = Date.now) {
+    this.root = resolve(root)
+    this.now = now
+  }
+
+  private dirOf(id: string): string { return join(this.root, id) }
+  /** The file's own folder, apart from the record (see the header). */
+  private payloadDirOf(id: string): string { return join(this.root, id, PAYLOAD_DIR) }
+
+  private readMeta(id: string): TurnFileMeta | null {
+    if (!isValidMediaId(id)) return null
+    const path = join(this.dirOf(id), 'meta.json')
+    if (!existsSync(path)) return null
+    try {
+      const m = JSON.parse(readFileSync(path, 'utf8')) as TurnFileMeta
+      if (m.id !== id || typeof m.name !== 'string' || m.name !== safeTurnFileName(m.name) || typeof m.createdAtMs !== 'number') return null
+      return m
+    } catch { return null }
+  }
+
+  private expired(m: TurnFileMeta, now: number): boolean {
+    return typeof m.associatedAtMs === 'number' ? now - m.associatedAtMs > TURN_FILE_KEPT_TTL_MS : now - m.createdAtMs > TURN_FILE_STAGED_TTL_MS
+  }
+
+  /** Takes a staged upload (moved, else copied). Throws RichMediaSafetyError('attachment_too_large') past the cap. */
+  ingestFromFile(input: { sourcePath: string; byteLength: number; label?: string; declaredMime?: string }): TurnFileRef {
+    if (!Number.isSafeInteger(input.byteLength) || input.byteLength <= 0) throw new RichMediaSafetyError('corrupt_attachment', 'attachment is empty')
+    if (input.byteLength > TURN_FILE_MAX_BYTES) throw new RichMediaSafetyError('attachment_too_large', `attachment exceeds ${TURN_FILE_MAX_BYTES} byte limit`)
+    this.sweep()
+    const id = 'm_' + randomBytes(12).toString('hex')
+    const dir = this.dirOf(id)
+    const payloadDir = this.payloadDirOf(id)
+    mkdirSync(payloadDir, { recursive: true, mode: 0o700 })
+    const name = safeTurnFileName(input.label)
+    const target = join(payloadDir, name)
+    try {
+      renameSync(input.sourcePath, target)
+    } catch {
+      copyFileSync(input.sourcePath, target)
+    }
+    const now = this.now()
+    const meta: TurnFileMeta = { id, name, label: String(input.label ?? '').slice(0, 120) || name, mime: safeMime(input.declaredMime), bytes: input.byteLength, createdAtMs: now }
+    atomicWriteFileSync(join(dir, 'meta.json'), JSON.stringify(meta))
+    return { id, kind: 'session_file', mime: meta.mime, bytes: meta.bytes, label: meta.label, createdAt: new Date(now).toISOString() }
+  }
+
+  /** The file's ref (in the media ref's shape, for the turn's line) and path, or a media-store error. */
+  resolveUsable(id: string): { record: { ref: MediaAttachmentRef }; path: string } {
+    const m = this.readMeta(id)
+    if (!m) throw new MediaStoreError('media_not_found', `attachment ${id} not found`)
+    if (this.expired(m, this.now())) throw new MediaStoreError('media_expired', `attachment ${id} expired`)
+    const path = join(this.payloadDirOf(id), m.name)
+    if (!resolve(path).startsWith(this.payloadDirOf(id) + sep) || !existsSync(path)) throw new MediaStoreError('media_unavailable', `attachment ${id} content unavailable`)
+    // Shaped as a ref only for the line the agent reads (kind and mime are not in the media contract and never leave
+    // this server as one).
+    const ref = { id, kind: 'session_file', category: 'file', mime: m.mime, width: 0, height: 0, createdAt: new Date(m.createdAtMs).toISOString(), bytes: m.bytes, label: m.label } as unknown as MediaAttachmentRef
+    return { record: { ref }, path }
+  }
+
+  has(id: string): boolean { return this.readMeta(id) !== null }
+
+  /** Kept for 30 days from now: a turn took it. */
+  async associate(ids: string[], target: { runId?: string }): Promise<void> {
+    const now = this.now()
+    for (const id of ids) {
+      const m = this.readMeta(id)
+      if (!m) throw new MediaStoreError('media_not_found', `attachment ${id} not found`)
+      if (this.expired(m, now)) throw new MediaStoreError('media_expired', `attachment ${id} expired`)
+      m.associatedAtMs = now
+      if (target.runId) m.runId = target.runId.slice(0, 160)
+      atomicWriteFileSync(join(this.dirOf(id), 'meta.json'), JSON.stringify(m))
+    }
+  }
+
+  private sweepTimer: ReturnType<typeof setInterval> | null = null
+  /**
+   * QA 6.99.27 (Skeptic W2): a sweep at once and then every `intervalMs` (the media store's GC interval), so a file
+   * past its time goes even when no new file arrives. Before, only an upload swept. Idempotent; the timer never holds
+   * the process open.
+   */
+  startSweep(intervalMs: number = MEDIA_GC_INTERVAL_MS): void {
+    if (this.sweepTimer) return
+    this.sweep()
+    this.sweepTimer = setInterval(() => { this.sweep() }, intervalMs)
+    this.sweepTimer.unref?.()
+  }
+  stopSweep(): void {
+    if (this.sweepTimer) clearInterval(this.sweepTimer)
+    this.sweepTimer = null
+  }
+
+  /** Removes expired files and folders that are not ours. Never throws. */
+  sweep(): number {
+    let removed = 0
+    if (!existsSync(this.root)) return 0
+    const now = this.now()
+    let names: string[] = []
+    try { names = readdirSync(this.root) } catch { return 0 }
+    for (const name of names) {
+      const dir = join(this.root, name)
+      try {
+        if (!statSync(dir).isDirectory()) continue
+        const m = this.readMeta(name)
+        // A folder with no readable meta is a crashed upload once it is past the staged TTL.
+        const stale = m ? this.expired(m, now) : now - statSync(dir).mtimeMs > TURN_FILE_STAGED_TTL_MS
+        if (stale) { rmSync(dir, { recursive: true, force: true }); removed++ }
+      } catch { /* one bad folder never stops the sweep */ }
+    }
+    return removed
+  }
+}
+
+let defaultStore: TurnFileStore | null = null
+export function getTurnFileStore(): TurnFileStore {
+  if (!defaultStore) defaultStore = new TurnFileStore()
+  return defaultStore
+}
+/** Test hook. */
+export function _setTurnFileStoreForTests(store: TurnFileStore | null): TurnFileStore | null {
+  const prev = defaultStore
+  defaultStore = store
+  return prev
+}

package/server/lib/turn-footer.ts

@@ -0,0 +1,81 @@
+// The one trailing verify line a vouched glasses or phone turn carries into an agent session (G2
+// authority Tier 1, 6.99.29). PURE: no I/O, no imports, so the stream grammar
+// (session-stream-events.ts), the transcript readers and the queue evidence can take the line off
+// without importing the ledger. lib/g2-turn-provenance.ts re-exports all of it.
+//
+//   [COS-G2 turn <id> · verify: operations/scripts/cos_python operations/scripts/verify_g2_turn.py <id> --session <your session id> --provider claude]
+//
+// The provider is filled in (claude, codex or cursor): the server footing the turn knows which
+// harness it delivers into (Codex re-audit of 910eb90). The session stays a placeholder ON PURPOSE:
+// the receiving agent states its OWN session id and the verifier compares it with the record, so a
+// message that landed in the wrong session does not verify there. An unknown provider keeps the
+// `<claude|codex|cursor>` placeholder rather than naming a wrong one.
+//
+// The COS-WEB tag is reserved for a future web origin backed by a device key the API token cannot
+// produce. In 6.99.29 no turn is footed COS-WEB: a web turn is recorded, never vouched. The readers
+// still take either tag off.
+//
+// The verifier (MU-Chief-Staff operations/scripts/verify_g2_turn.py) mirrors G2_TURN_FOOTER_RE.
+//
+// FOOTER-SHAPED LINES IN TYPED TEXT ARE REFUSED (QA 6.99.29). Only the server writes a footer, so
+// words that carry anything that looks like one are refused at every route that hands words to a
+// session (turns, queue park and edit, steer, fork, Send again, native Codex queue edit).
+
+/** The footer tag per origin: the glasses and the phone keep COS-G2, a web turn says COS-WEB. */
+export function turnFooterTag(client: string): 'COS-G2' | 'COS-WEB' {
+  return client === 'web' ? 'COS-WEB' : 'COS-G2'
+}
+
+/** The harnesses the verifier accepts for --provider. */
+export const FOOTER_PROVIDERS: ReadonlySet<string> = new Set(['claude', 'codex', 'cursor'])
+
+/** The footer's --provider value: the receiving harness when it is one the verifier knows, else the placeholder. */
+export function footerProvider(provider: string | null | undefined): string {
+  return typeof provider === 'string' && FOOTER_PROVIDERS.has(provider) ? provider : '<claude|codex|cursor>'
+}
+
+export function turnFooter(turnId: string, client: string = 'glasses', provider?: string | null): string {
+  return `[${turnFooterTag(client)} turn ${turnId} · verify: operations/scripts/cos_python operations/scripts/verify_g2_turn.py ${turnId} --session <your session id> --provider ${footerProvider(provider)}]`
+}
+
+/**
+ * Anything that looks like a footer, anywhere in the text: `[COS-G2 turn` or `[COS-WEB turn`, any
+ * case, with spaces or any dash between the parts. Lenient on purpose: refusing a lookalike costs a
+ * retyped line; accepting one could put a second footer in front of a reader.
+ */
+export const TURN_FOOTER_SHAPED_RE = /\[\s*COS[-\u2010-\u2015\u2212\s]*(?:G2|WEB)\s+turn\b/i
+
+/** Whether typed words carry a footer-shaped line (refused: only the server writes a footer). */
+export function hasFooterShapedLine(text: string): boolean {
+  return typeof text === 'string' && TURN_FOOTER_SHAPED_RE.test(text)
+}
+
+/** The refusal copy for a footer-shaped line, shown where the words were typed. */
+export const FOOTER_LINE_REFUSED_COPY = 'This message has a line that looks like a COS verify footer ("[COS-G2 turn" or "[COS-WEB turn"). Only COS writes those lines. Take that line out and send it again.'
+
+/** The refusal copy for a turn id this server already used for a different turn. */
+export const TURN_ID_IN_USE_COPY = 'That message id was already used for a different message. Send it again as a new message.'
+
+/** The 6.66 name, kept: a glasses or phone footer. */
+export function g2TurnFooter(turnId: string, provider?: string | null): string {
+  return turnFooter(turnId, 'glasses', provider)
+}
+
+/** The footer line as it ends a delivered prompt (either tag). Used by tests and mirrored by the verifier. */
+export const G2_TURN_FOOTER_RE = /\n\[COS-(G2|WEB) turn ([A-Za-z0-9][A-Za-z0-9_-]{7,127}) · verify: [^\n\]]*\][\t\n\v\f\r ]*$/
+
+/** The prompt with its footer stripped, and the turn id the footer named (null: no footer). */
+export function stripG2TurnFooter(text: string): { text: string; turnId: string | null; tag: 'COS-G2' | 'COS-WEB' | null } {
+  const m = G2_TURN_FOOTER_RE.exec(text)
+  if (!m) return { text, turnId: null, tag: null }
+  return { text: text.slice(0, m.index), turnId: m[2], tag: m[1] === 'WEB' ? 'COS-WEB' : 'COS-G2' }
+}
+
+/**
+ * The words a transcript row shows with a trailing verify footer taken off, for the code that
+ * matches a transcript against the words it sent (queue-turn-evidence.ts). Only a footer at the
+ * very end, of either tag, is removed.
+ */
+export function withoutTurnFooter(text: string): string {
+  return stripG2TurnFooter(text).text
+}

package/server/routes/agent-session-bindings.ts

@@ -98,7 +98,7 @@
 import type { FenceRecord } from '../lib/thread-fence-store.js'
 import { defaultPidStartProbe, fenceLiveness, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
 import { Router, type Request, type Response } from 'express'
-import { createHash, randomUUID } from 'node:crypto'
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
 import {
   threadOccupancy,
   type Occupancy,
@@ -131,7 +131,9 @@ import { isValidNativeThreadId } from '../lib/native-thread-id.js'
 import { FORK_PROVIDER_FAILURES, type ForkProviderFailure } from '../lib/fork-thread.js'
 import { CLIENT_FORK_ID_RE, ForkJobLedger, type ForkJobRow } from '../lib/fork-job-ledger.js'
 import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
+import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, QUEUED_TURN_TAMPERED_COPY, sealMatches, TURN_CARRY_HEADER, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict, type QueueSeal } from '../lib/g2-turn-provenance.js'
 import { KEYED_SESSION_REFUSAL } from '../lib/keyed-sessions.js'
+import { associateTurnAttachments, composeTurnPrompt, parseTurnAttachmentIds, TURN_ATTACHMENT_COPY, turnAttachmentManifest, type TurnAttachmentStore } from '../lib/session-turn-attachments.js'
 import {
   CANCEL_QUEUE_HOLD_MS,
   CLIENT_CANCEL_ID_RE,
@@ -318,6 +320,13 @@ export type AttachedTurnResult =
   | { ok: boolean; delivery: 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered' | 'cancelled' }
 
 export interface AgentSessionBindingsDeps {
+  /**
+   * G2 authority Tier 1, with web origin (6.99.29): where each turn came from. With it, every turn
+   * and fork this router hands to a session is ledgered, and a VERIFIED glasses or phone turn
+   * carries the one verify footer line (a Control Web turn is recorded, never vouched or footed).
+   * Footer-shaped words and reused turn ids are refused. Absent: the 6.99.28 behaviour, byte for byte.
+   */
+  provenance?: G2TurnProvenance
   /** Shared fence state. Omit and the router owns a private one, which is correct
    *  for tests and wrong for the server -- see the wiring note at its use site. */
   guard?: TargetGuard
@@ -437,6 +446,11 @@ export interface AgentSessionBindingsDeps {
    * and before the claim; a hit is replayed, never sent again. Absent: 6.77 behaviour.
    */
   turnReceipt?: (provider: string, nativeThreadId: string, clientTurnId: string, prompt: string) => TurnReceipt | null
+  /**
+   * 11/07 (Control Web attach): the media store a turn's `attachmentIds` resolve against. Absent: the real store
+   * (lib/session-turn-attachments.ts). Tests pass a fake. Never read for a turn without files.
+   */
+  turnAttachmentStore?: TurnAttachmentStore
 
   /**
    * 6.78.0 (COS_SESSION_STEER): could a turn go INTO this thread's running turn? Added to an
@@ -2601,10 +2615,13 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (typeof cosSessionId !== 'string' || !COS_SESSION_ID_RE.test(cosSessionId)) {
         return refuseFork('invalid_request')
       }
-      const prompt = body.prompt
-      if (typeof prompt !== 'string' || prompt.trim().length === 0 || prompt.length > maxPromptChars) {
+      const words = body.prompt
+      if (typeof words !== 'string' || words.trim().length === 0 || words.length > maxPromptChars) {
         return refuseFork('invalid_request')
       }
+      // 6.99.27: a fork's first turn takes files as a turn does (the message written with them, sent to the copy).
+      const forkFiles = parseTurnAttachmentIds(body.attachmentIds)
+      if (!forkFiles.ok) return refuseFork('invalid_request')
       // 6.63.0: optional. With it, the fork answers 202 once every gate has passed and runs
       // in the background; without it, the route behaves exactly as before.
       const clientForkId = body.clientForkId
@@ -2628,6 +2645,28 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         if (known) return known.source === forkSource ? replayForkJob(known) : refuseFork('invalid_request')
       }
 
+      // After the replay (a known fork sends nothing), before the workspace, the claim and the spawn: where each file is
+      // on this Mac goes under the words. Without files the prompt is the words, untouched. Nothing is kept yet: the
+      // files are associated only once this fork holds its claim (below, QA 6.99.27).
+      const forkComposed = await composeTurnPrompt(words, forkFiles.ids, {
+        maxChars: maxPromptChars,
+        ...(deps.turnAttachmentStore ? { store: deps.turnAttachmentStore } : {}),
+      })
+      if (!forkComposed.ok) {
+        return refuseFork('invalid_request', { reasonCopy: TURN_ATTACHMENT_COPY[forkComposed.code], attachmentError: forkComposed.code })
+      }
+      const prompt = forkComposed.prompt
+      // G2 authority Tier 1 (QA 6.99.29): only the server writes a verify footer. Words (or a file
+      // name) carrying anything footer-shaped are refused before anything is spawned.
+      if (deps.provenance && hasFooterShapedLine(prompt)) {
+        return refuseFork('invalid_request', { retryable: false, error: 'footer_line_refused', reasonCopy: FOOTER_LINE_REFUSED_COPY })
+      }
+      // A client fork id this server already holds a turn record for is never reused (a new id
+      // would overwrite that record). A repeat of this same fork was replayed above.
+      if (deps.provenance && typeof clientForkId === 'string' && deps.provenance.holds(clientForkId)) {
+        return refuseFork('invalid_request', { retryable: false, error: 'turn_id_in_use', reasonCopy: TURN_ID_IN_USE_COPY })
+      }
+
       const now = readNow()
       if (now === null) return refuseFork('fork_failed')
 
@@ -2636,7 +2675,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       let cwd: string | null = null
       try {
         // 6.62.0: may answer later (a Cursor IDE composer's folder is read from Cursor's own
-        // store). Still before the claim below, which stays the last synchronous step.
+        // store). Before the claim below, whose check and set stay one synchronous call.
         cwd = await resolveWorkspace(providerParam, threadIdParam)
       } catch (error) {
         console.error(`[agent-session-bindings] fork workspace resolve threw: ${error instanceof Error ? error.message : error}`)
@@ -2649,9 +2688,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return refuseFork('fork_workspace_unresolvable')
       }
 
-      // LAST SYNCHRONOUS STATEMENT BEFORE THE FIRST AWAIT. One fork per source
-      // thread at a time: this route spawns a provider CLI, and without a claim a
-      // client retry loop spawns one child per request with nothing bounding it.
+      // Check and set in ONE synchronous call (awaits above, the workspace read and the
+      // files, come before it; nothing may sit between the check and the set). One fork
+      // per source thread at a time: this route spawns a provider CLI, and without a claim
+      // a client retry loop spawns one child per request with nothing bounding it.
       // A DISTINCT key namespace from the turn claim, so a fork can never block a
       // continuation or be blocked by one — `targetKey` is length-prefixed and
       // therefore unambiguous, and this prefix cannot collide with one.
@@ -2665,6 +2705,13 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       }
       claimedForkKey = forkKey
 
+      // QA 6.99.27 (Skeptic W2): the files are kept with this fork only now that it holds the claim and every gate
+      // has passed, before the job is recorded or anything is spawned. A file that went in the meantime refuses here.
+      if (forkFiles.ids.length > 0) {
+        const kept = await associateTurnAttachments(forkFiles.ids, `session-fork:${typeof clientForkId === 'string' ? clientForkId : mintId()}`, deps.turnAttachmentStore)
+        if (!kept.ok) return refuseFork('invalid_request', { reasonCopy: TURN_ATTACHMENT_COPY[kept.code], attachmentError: kept.code })
+      }
+
       if (typeof clientForkId === 'string') {
         // Recorded BEFORE the spawn and before the 202: a job the ledger cannot hold would
         // have an outcome nobody can read, so it does not start.
@@ -2686,12 +2733,26 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         console.log(`[agent-session-bindings] fork accepted provider=${providerParam} background=true`)
       }
 
+      // G2 authority Tier 1: a fork is a turn too, ledgered. Its id is the client's fork id, or one
+      // minted here; the target is the SOURCE thread (the copy's id is not known until it ran). The
+      // hash covers the prompt as composed (words plus any files block). Never vouched (below).
+      let forkPrompt = prompt
+      if (deps.provenance) {
+        // 6.99.29 (Codex audit of e4758a6): the record names the SOURCE session, never the fork child
+        // that actually receives the words, and the child has no binding yet. Until a destination
+        // binding exists, a forked turn is recorded UNVERIFIED for the child: no footer, ever.
+        const forkVerdict = unvouched(deps.provenance.originOf(req), 'fork_destination_unbound')
+        const forkTurnId = typeof clientForkId === 'string' ? clientForkId : `fork-${randomBytes(12).toString('hex')}`
+        forkPrompt = deps.provenance.footed(prompt, forkTurnId, forkVerdict, providerParam)
+        deps.provenance.record({ turnId: forkTurnId, prompt, verdict: forkVerdict, provider: providerParam, sessionId: threadIdParam, via: 'fork', fork: true })
+      }
+
       let raw: unknown
       try {
         raw = await fork({
           provider: providerParam,
           nativeThreadId: threadIdParam,
-          prompt,
+          prompt: forkPrompt,
           cwd,
           // Text-only, same as the attached path. A fork runs a real model turn
           // against a workspace the user did not hand us explicitly.
@@ -2973,10 +3034,13 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // an empty one, and must not fall through as a turn with no claims to check.
       if (body === null) return refuseTurn('invalid_request')
 
-      const prompt = body.prompt
-      if (typeof prompt !== 'string' || prompt.trim().length === 0 || prompt.length > maxPromptChars) {
+      const words = body.prompt
+      if (typeof words !== 'string' || words.trim().length === 0 || words.length > maxPromptChars) {
         return refuseTurn('invalid_request')
       }
+      // 11/07: files with the turn, as media-store ids. Absent is the old turn; a bad list refuses it whole.
+      const attachIds = parseTurnAttachmentIds(body.attachmentIds)
+      if (!attachIds.ok) return refuseTurn('invalid_request')
       const epoch = body.epoch
       if (!Number.isInteger(epoch) || (epoch as number) < 1) return refuseTurn('invalid_request')
       const claimedTargetKey = body.targetKey
@@ -3014,6 +3078,59 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return
       }
 
+      // 11/07: the files' paths on this Mac go under the words HERE, after the ledger replay (a replayed turn sends
+      // nothing) and before the receipt (which matches the transcript against what was actually sent). Without files
+      // the prompt is the words, untouched. A file that cannot be read refuses the turn before anything is sent. The
+      // files are kept with the turn only after the claim and the gates (before the pin, below; QA 6.99.27).
+      const composed = await composeTurnPrompt(words, attachIds.ids, {
+        maxChars: maxPromptChars,
+        ...(deps.turnAttachmentStore ? { store: deps.turnAttachmentStore } : {}),
+      })
+      if (!composed.ok) {
+        return refuseTurn('invalid_request', { reasonCopy: TURN_ATTACHMENT_COPY[composed.code], attachmentError: composed.code })
+      }
+      const prompt = composed.prompt
+      // G2 authority Tier 1 (QA 6.99.29): only the server writes a verify footer. Words (or a file
+      // name) carrying anything footer-shaped are refused here, before any gate, claim or hop.
+      if (deps.provenance && hasFooterShapedLine(prompt)) {
+        return refuseTurn('invalid_request', { retryable: false, error: 'footer_line_refused', reasonCopy: FOOTER_LINE_REFUSED_COPY })
+      }
+
+      // G2 authority Tier 1 (6.99.29 port, with web origin): who said this, and the exact text the
+      // session will see. A turn the queue drains re-enters over loopback with a single-use carry
+      // token naming the origin captured when it was parked (bound to the WORDS it parked, before
+      // any files block); anything else is judged by its own socket, its token and its cookie.
+      // `prompt` stays the unfooted text: the receipts, the turn ledger and the queue evidence
+      // compare against it, and the transcript readers take the footer off before they compare.
+      const provenance = deps.provenance
+      let turnVerdict: OriginVerdict | null = null
+      let turnCarried = false
+      /** The seal a vouched queued turn carries; checked against the files here and the binding below. */
+      let turnSeal: QueueSeal | null = null
+      if (provenance) {
+        // A carry marks the queue's own drain of a parked turn: it carries the parked origin while
+        // one is held (else none, and the hop is judged as the local call it is) and is the one
+        // caller allowed to add to that turn's record.
+        const carried = provenance.takeCarry(req.headers[TURN_CARRY_HEADER], clientTurnId, words)
+        turnCarried = carried !== null
+        turnVerdict = carried?.verdict ?? provenance.originOf(req)
+        turnSeal = carried?.seal ?? null
+      }
+      // 6.99.29 (Codex audit of e4758a6): the queue file holds MUTABLE attachment ids, and the drain
+      // composes them into the text this turn vouches for. A carried seal names the manifest (each id
+      // with its content hash) the origin was given for; files that differ now refuse the turn.
+      if (turnSeal !== null) {
+        const files = attachIds.ids.length === 0 ? { ok: true as const, manifest: [] } : await turnAttachmentManifest(attachIds.ids, deps.turnAttachmentStore)
+        if (!files.ok || attachmentsDigest(files.manifest) !== turnSeal.attachments) {
+          console.warn(`[agent-session-bindings] queued turn seal mismatch (files) turnId=${turnId} clientTurnId=${clientTurnId}`)
+          return refuseTurn('invalid_request', { retryable: false, error: 'queued_turn_tampered', reasonCopy: QUEUED_TURN_TAMPERED_COPY })
+        }
+      }
+      /** Ledgered once the text did, or may have, reached a session. Hash of the text WITHOUT the footer. */
+      const ledgerTurn = (via: string, provider: string, sessionId: string): void => {
+        if (provenance && turnVerdict && clientTurnId !== null) provenance.record({ turnId: clientTurnId, prompt, verdict: turnVerdict, provider, sessionId, via: turnCarried ? `drain-${via}` : via, continues: turnCarried })
+      }
+
       // 6.78.0: RECEIPTS, before any gate, claim, pin or hop. The ledger above is dropped
       // with its binding and records nothing for a pre-202 `live_unverified`; a crash after
       // the pin leaves no record at all. The receipt covers those (target-scoped attempt
@@ -3074,6 +3191,22 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (!isBindableProvider(binding.provider) || !isValidNativeThreadId(binding.nativeThreadId)) {
         return refuseTurn('binding_unusable')
       }
+      // G2 authority Tier 1 (QA 6.99.29): a turn id this server already holds a record for is never
+      // reused for a different turn (it would overwrite that record: a denial of service on a
+      // vouched turn). An identical retry is not reuse, and the queue's own drain (a carry) continues
+      // its turn while that turn is still parked; never over a delivered record.
+      // ...and the seal names the provider and thread it was parked for: a drain into any other
+      // binding is refused, never delivered under the parked origin.
+      if (turnSeal !== null && !sealMatches(turnSeal, { provider: binding.provider, threadId: binding.nativeThreadId, attachments: turnSeal.attachments })) {
+        console.warn(`[agent-session-bindings] queued turn seal mismatch (target) turnId=${turnId} clientTurnId=${clientTurnId}`)
+        return refuseTurn('invalid_request', { retryable: false, error: 'queued_turn_tampered', reasonCopy: QUEUED_TURN_TAMPERED_COPY })
+      }
+      if (provenance && turnVerdict && provenance.reusesTurnId(clientTurnId, { prompt, verdict: turnVerdict, provider: binding.provider, sessionId: binding.nativeThreadId }, { continues: turnCarried })) {
+        return refuseTurn('invalid_request', { retryable: false, error: 'turn_id_in_use', reasonCopy: TURN_ID_IN_USE_COPY })
+      }
+      // Footed HERE, once the binding names the harness the text goes into: the footer's verify
+      // command carries that provider (Codex re-audit of 910eb90). Every delivery below uses this text.
+      const deliveredPrompt = provenance && turnVerdict ? provenance.footed(prompt, clientTurnId, turnVerdict, binding.provider) : prompt
 
       const key = binding.targetKey
       const fenced = guard.fencedReason(key)
@@ -3082,9 +3215,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return refuseTurn(fenced, { retryable: false, deliveryState: 'unknown' })
       }
 
-      // LAST SYNCHRONOUS STATEMENT BEFORE THE FIRST AWAIT. Check-and-set in one
-      // call: with an await between them, two turns admitted in the same tick both
-      // see a free target and both deliver.
+      // Check-and-set in ONE synchronous call. Awaits come before it (the files above,
+      // QA 6.99.27) and after it, never between the check and the set: with an await
+      // between them, two turns admitted in the same tick both see a free target and
+      // both deliver.
       if (!guard.tryClaim(key, turnId)) return refuseTurn('native_turn_in_progress')
       claimedKey = key
       // 6.53.0: cancellable from here, with the claim. Same key, same lifetime.
@@ -3137,6 +3271,14 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         guard.acknowledgeHead(bindingId, head.digest)
       }
 
+      // QA 6.99.27 (Skeptic W2): the files are kept with this turn only now, with the claim held and every gate
+      // passed, and before the pin and any hop. A turn refused above keeps nothing past the 4 hour staged TTL.
+      if (attachIds.ids.length > 0) {
+        const kept = await associateTurnAttachments(attachIds.ids, `session-turn:${clientTurnId}`, deps.turnAttachmentStore)
+        stage('files')
+        if (!kept.ok) return refuseTurn('invalid_request', { reasonCopy: TURN_ATTACHMENT_COPY[kept.code], attachmentError: kept.code })
+      }
+
       // A failed pin is FATAL, per the registry's own caller contract: an unpinned
       // binding can expire or be detached mid-turn, which defeats the lease.
       // 6.78.0: the pin names its client turn (COS_PIN_BOOT_REAP) and opens the attempt
@@ -3184,7 +3326,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = await deps.deliverLiveTurn({
             provider: binding.provider,
             sessionId: binding.nativeThreadId,
-            prompt,
+            prompt: deliveredPrompt,
             verifyTimeoutMs: LIVE_VERIFY_BUDGET_MS,
             clientTurnId,
           })
@@ -3204,6 +3346,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           const latched = latchedHere()
           if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt })
           console.log(`[agent-session-bindings] turn delivered live provider=${binding.provider} turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} pid=${live.pid ?? 'null'}`)
+          ledgerTurn('live', binding.provider, binding.nativeThreadId)
           respond(200, {
             turnId,
             outcome: 'completed',
@@ -3222,6 +3365,8 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           // 6.53.3: something MAY be in the session and the person asked for it to stop: arm
           // the marker as for a landed turn, and settle this turn as cancelled, never as a
           // retryable hold that the queue would send again after the cancel's two minutes.
+          // The text MAY be in the session, footer and all: a record, so a verify finds it.
+          ledgerTurn('live-unverified', binding.provider, binding.nativeThreadId)
           const latched = latchedHere()
           if (latched) {
             settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'maybe', { prompt, sentAt: handOffAt })
@@ -3263,7 +3408,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = await deps.deliverCodexLiveTurn({
             provider: binding.provider,
             sessionId: binding.nativeThreadId,
-            prompt,
+            prompt: deliveredPrompt,
             foreignHolder: true,
           })
         } catch (error) {
@@ -3278,6 +3423,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           // 6.53.3: queued in the Codex app, which only the app can stop ("Stop it there").
           const latched = latchedHere()
           if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt, busy: busyCodexHop })
+          ledgerTurn('codex-live', binding.provider, binding.nativeThreadId)
           console.log(`[agent-session-bindings] turn delivered live provider=codex turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} queuedId=${live.queuedId ?? 'null'}`)
           respond(200, {
             turnId,
@@ -3320,6 +3466,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           // delivery is: ambiguous, ledgered (a replay answers the same), and fenced until
           // a person looks at the Codex app's queue and releases it.
           if (live === null || live.reason === 'unverified') {
+            ledgerTurn('codex-live-unverified', binding.provider, binding.nativeThreadId)
             guard.fence(key, 'native_target_fenced', {
               provider: binding.provider,
               headBefore: head.digest,
@@ -3373,6 +3520,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       let delivery: Delivery
       deliveryAttempted = true
       spawnMay = true
+      ledgerTurn('spawn', binding.provider, binding.nativeThreadId)
       try {
         const result = await deliver({
           turnId,
@@ -3383,7 +3531,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           workspaceFingerprint: binding.workspaceFingerprint,
           sourceFingerprint: binding.sourceFingerprint,
           expectedNativeHead: head.raw,
-          prompt,
+          prompt: deliveredPrompt,
           abortSignal: cancelController.signal,
           // 6.62.0 /qa (Q3): only a client that shows `continue_note` gets Cursor Run Everything.
           continueNoteAck: continueNoteAcknowledged(req.headers[CONTINUE_NOTE_HEADER]),