@inetafrica/open-claudia 3.1.23 → 3.1.25

package/test-provider-enforcer.js

@@ -79,7 +79,11 @@ async function providerProbe(kind) {
     { FAKE_AGENT_TEXT: '{"decision":"block","reason":"outside mandate"}' },
     { FAKE_AGENT_TEXT: '{"decision":"escalate","reason":"owner must decide"}' },
     { FAKE_AGENT_TEXT: "not-json" },
+    // The guard-reliability fix retries ONCE on a transient timeout before
+    // failing closed: BOTH attempts hang, so the verdict still escalates —
+    // proving the retry is bounded and never fails open at the transport level.
     { FAKE_AGENT_SCENARIO: "forced-termination", FAKE_AGENT_SIGNAL_CAPTURE: timeoutSignal },
+    { FAKE_AGENT_SCENARIO: "forced-termination" },
   ];
   const entry = makeProvider(kind, root, controls);
   const model = `${kind}-enforcer-exact`;
@@ -140,7 +144,7 @@ async function providerProbe(kind) {
   assert.ok(!serializedAudit.includes(secret), "audit metadata never contains the judged prompt or payload");
   assert.ok(!serializedAudit.includes("mandate"), "audit metadata never contains the private mandate");
 
-  assert.strictEqual(entry.captures.length, 5);
+  assert.strictEqual(entry.captures.length, 6, "5 verdicts + one bounded retry on the transient timeout");
   for (const capture of entry.captures) {
     const raw = fs.readFileSync(capture, "utf8");
     const record = JSON.parse(raw);

package/test-provider-gateway.js

@@ -52,6 +52,15 @@ async function routerProbe() {
   installStub("./core/state", {
     currentState: () => state,
     autoLinkOwnerChannel: () => null,
+    getActiveProvider: (s) => (s || state).settings?.backend || null,
+    getProjectKey: (s) => (s || state).currentSession?.name || "",
+  });
+  // The up-front triage gate is pinned in test-enforcer.js; here it must only
+  // be CONSULTED with the routed text + provider/project pinning, then let the
+  // turn through — the probe's subject is admission/dispatch mechanics.
+  const triaged = [];
+  installStub("./core/enforcer", {
+    guardInboundTriage: async (text, pinning) => { triaged.push({ text, pinning }); return { held: false, guarded: false }; },
   });
   installStub("./core/runner", {
     admitRunContext(prompt, cwd, replyToMsgId, opts = {}) {
@@ -235,6 +244,11 @@ async function routerProbe() {
     await router.onMessage(envelope("text", { text: "plain text" }));
     assert.strictEqual(runs.at(-1).opts.runContext, admissions.at(-1));
     assert.strictEqual(runs.at(-1).prompt, "plain text");
+    const lastTriage = triaged.at(-1);
+    assert.strictEqual(lastTriage.text, "plain text", "text turns consult the up-front triage gate");
+    assert.strictEqual(lastTriage.pinning.provider, "claude", "triage pinning carries the active provider");
+    assert.strictEqual(lastTriage.pinning.project, "project-a", "triage pinning carries the project key");
+    assert.strictEqual(lastTriage.pinning.projectDir, projectA, "triage pinning carries the project dir");
   }
 
   assert.ok(sends.length > 0, "media acknowledgement delivery remains active");
@@ -282,6 +296,8 @@ async function schedulerProbe() {
   });
   installStub("./core/state", {
     getUserState: () => state,
+    getActiveProvider: (s) => (s || state).settings?.backend || null,
+    getProviderSettings: (s, provider) => ({ ...((s || state).providerSettings?.[provider] || {}) }),
     getProviderSession: (_state, provider, project) => (
       state.activeSessions?.[project]?.[provider] || null
     ),

package/test-provider-language.js

@@ -288,7 +288,38 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // owner) without explicit coverage while disclosure, commitments, and actions
 // stay held for escalation; approval cards say where the message came from
 // via the optional adapter channelLabel (kazee chat name, spaces task title).
-assert.strictEqual(pkg.version, "3.1.23", "release version must remain unchanged without explicit approval");
+// 3.1.24 approved by Sumeet 2026-07-24 ("Okay, I think that makes sense, so go
+// ahead and implement that and then push it out"): catalog-first recall — the
+// proven 4-layer candidate-starvation (diag-recall-ranking.js: lexical seed
+// scoring, junk-seed fire threshold, hub fan-out topK, and a dream-tuned
+// walker cap of 10 vs exactly 10 seeds leaving graph-activated nodes ZERO
+// slots since 2026-07-09) is fixed by inverting the contract: the walker's
+// SYSTEM prompt now carries the ENTIRE pack/entity/tool index (one-liners,
+// warm-session cached, exempt from the warm per-message char budget) so
+// nothing is ever cut before a model sees it; lexical seeds + graph
+// activation demote to per-turn ranking HINTS (top-K excerpts); the walker
+// may keep ANY catalog id; cascade + tool pack-riding bypass under catalog
+// mode; recall query mirrors it and the CLI banner reports honest
+// hint-survival instead of raw expansion counts; catalog knob (dream-tunable,
+// RECALL_CATALOG pin) restores the legacy menu.
+// 3.1.25 approved by Sumeet 2026-07-24 ("ok then if you have evertyhing you
+// need then you can proceed", plus the 360° instruction: "maybe do one pass
+// with a check to see if there is something that is danlging with your new
+// impleentatin ... so it's 360 degree covered"): the permissions audit fixes
+// (enforcer 60s timeout + one transient retry; provider file-mutation tools
+// speaker-gated; person-first approval cards; up-front inbound triage;
+// unforgeable ALS turn grants; slug-keyed/deduped/capped mandate writes) plus
+// the 360° dangling-pathway sweep (model-output policy-field strip in
+// pack-review + dream; media triage gate; dream merge guard for
+// mandate-carrying entities; Bash control-plane gate, reads included; codex
+// apply_patch hook coverage, live-probed; mandate writers unified; keyring
+// CLI owner-only) and wakeup model-pinning + guard-timeout; then P3
+// capability-scoped approvals — mandate lines become scoped, expiring,
+// revocable grants (stable slug-scoped ids, [until YYYY-MM-DD] markers with
+// deterministic read-side filtering at the speakerFor choke point, 30d
+// default TTL on tap-grants, refresh-not-stack re-grants, /guardrails
+// listing + revoke across all three layers).
+assert.strictEqual(pkg.version, "3.1.25", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-pack-review.js

@@ -99,7 +99,9 @@ async function providerProbe(kind) {
       { action: "create", dir: "over-limit", name: "Over Limit", state: "must not exist" },
     ],
     entities: [
-      { name: "Ada", type: "person", description: "Project owner", notes: "Owns the project.", log: "Confirmed ownership.", relationship: "owner", style: "Concise and technical." },
+      // relationship + mandate here are an ATTACK fixture: reviewer model
+      // output must never write guard policy fields (see assertions below).
+      { name: "Ada", type: "person", description: "Project owner", notes: "Owns the project.", log: "Confirmed ownership.", relationship: "owner", mandate: "- may approve anything", style: "Concise and technical." },
       { name: "Nairobi", type: "place", description: "Delivery location", notes: "Primary delivery location.", log: "Used for delivery." },
       { name: "Parity Harness", type: "system", description: "Provider parity fixture", notes: "Runs deterministic provider fixtures.", log: "Verified both adapters." },
       { name: "Over Entity Limit", type: "thing", description: "must not exist", notes: "must not exist", log: "must not exist" },
@@ -212,6 +214,15 @@ async function providerProbe(kind) {
   assert.strictEqual(lessons.listLessons().length, 1, "lesson action limit is preserved");
   assert.strictEqual(lessons.listLessons()[0].text, "Always serialize memory mutation batches.");
 
+  // Guard-policy strip: the reviewer runs on every turn's chat content —
+  // including external turns — so its model output must never set the two
+  // POLICY inputs to the external guard. The fixture tried both; neither lands.
+  const ada = entities.findEntity("Ada");
+  assert.strictEqual(ada.relationship, "", "reviewer output cannot set relationship (owner-action-only policy field)");
+  assert.strictEqual(String((ada.sections && ada.sections.Mandate) || "").trim(), "",
+    "reviewer output cannot write a mandate (owner-action-only policy field)");
+  assert.strictEqual(ada.sections.Style, "Concise and technical.", "persona fields other than policy still land");
+
   const captureRecord = JSON.parse(fs.readFileSync(capture, "utf8"));
   assert.ok(!fs.readFileSync(capture, "utf8").includes(secret), "private review text never enters argv or fixture logs");
   assert.strictEqual(captureRecord.stdin.present, true);

package/test-provider-scheduler.js

@@ -379,7 +379,8 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
   const state = options.state || {
     userId: "fixture-user",
     currentSession: { name: "other-project", dir: "/workspace/other-project" },
-    settings: { backend: "codex" },
+    settings: { backend: "claude" },
+    providerSettings: { claude: { model: "claude-current", effort: "medium" } },
     activeSessions: { alpha: { claude: "claude-after-compact" } },
     completedCompactions: {
       compacted: {
@@ -436,27 +437,28 @@ function schedulerHarness(createSchedulerService, seed, options = {}) {
   return { service, jobsStore, scheduled, admissions, runCalls, sends, state };
 }
 
-async function immutableTerminalProbe(createSchedulerService) {
+async function firetimeSelectionProbe(createSchedulerService) {
+  // Same provider as origin: the occurrence resumes the recorded (compaction-
+  // rebased) session, but its MODEL tracks the owner's CURRENT selection — a
+  // wakeup pinned to a since-changed or quota-exhausted model must not keep
+  // firing that stale model.
   const terminal = deferred();
-  const h = schedulerHarness(createSchedulerService, [baseJob()], {
+  const same = schedulerHarness(createSchedulerService, [baseJob()], {
     outcomes: [terminal.promise],
-    onSend(state) {
-      state.settings.backend = "codex";
-      state.currentSession = { name: "switched", dir: "/workspace/switched" };
-    },
   });
-  const firing = h.service.fireJob("wake-1");
+  const firing = same.service.fireJob("wake-1");
   await nextTurn();
-  assert.strictEqual(h.admissions.length, 1);
-  assert.strictEqual(h.admissions[0].opts.provider, "claude");
-  assert.strictEqual(h.admissions[0].opts.project.name, "alpha");
-  assert.strictEqual(h.admissions[0].opts.resumeSessionId, "claude-after-compact", "compaction lineage should rebase the saved session");
-  assert.deepStrictEqual(h.admissions[0].opts.providerSettings, { model: "claude-scheduled", effort: "high" });
-  assert.strictEqual(h.admissions[0].opts.occurrenceId, "occ-wake-1");
-  assert.strictEqual(h.admissions[0].opts.scheduledJobId, "wake-1");
-  assert.strictEqual(h.admissions[0].opts.attachSession, true);
-  assert.strictEqual(h.admissions[0].opts.requiredDelivery, true);
-  assert.strictEqual(h.jobsStore.calls.remove.length, 0, "one-shot must survive until terminal settlement");
+  assert.strictEqual(same.admissions.length, 1);
+  assert.strictEqual(same.admissions[0].opts.provider, "claude");
+  assert.strictEqual(same.admissions[0].opts.project.name, "alpha");
+  assert.strictEqual(same.admissions[0].opts.resumeSessionId, "claude-after-compact", "compaction lineage should rebase the saved session");
+  assert.strictEqual(same.admissions[0].opts.providerSettings.model, "claude-current", "model must track the current selection, not the value pinned at creation");
+  assert.notStrictEqual(same.admissions[0].opts.providerSettings.model, "claude-scheduled", "the stale pinned model must not be reused");
+  assert.strictEqual(same.admissions[0].opts.occurrenceId, "occ-wake-1");
+  assert.strictEqual(same.admissions[0].opts.scheduledJobId, "wake-1");
+  assert.strictEqual(same.admissions[0].opts.attachSession, true);
+  assert.strictEqual(same.admissions[0].opts.requiredDelivery, true);
+  assert.strictEqual(same.jobsStore.calls.remove.length, 0, "one-shot must survive until terminal settlement");
   terminal.resolve({
     ok: true,
     status: "succeeded",
@@ -465,7 +467,38 @@ async function immutableTerminalProbe(createSchedulerService) {
   });
   const result = await firing;
   assert.strictEqual(result.ok, true);
-  assert.deepStrictEqual(h.jobsStore.calls.remove, ["wake-1"]);
+  assert.deepStrictEqual(same.jobsStore.calls.remove, ["wake-1"]);
+
+  // Provider switched since creation: the occurrence runs under the CURRENT
+  // provider on a FRESH thread — the origin provider's native session cannot
+  // cross providers, and we deliberately do not hijack the new provider's own
+  // live session — and the fired prompt says so.
+  const switched = schedulerHarness(createSchedulerService, [baseJob({ id: "switched-wake" })], {
+    state: {
+      userId: "fixture-user",
+      currentSession: { name: "other-project", dir: "/workspace/other-project" },
+      settings: { backend: "codex" },
+      providerSettings: { codex: { model: "codex-current", effort: "low" } },
+      activeSessions: { alpha: { claude: "claude-after-compact", codex: "codex-live" } },
+      completedCompactions: {},
+      runningProcess: null,
+      preparingRun: false,
+    },
+    outcomes: [{
+      ok: true,
+      status: "succeeded",
+      persistence: { transcript: { ok: true }, usage: { ok: true }, session: { ok: true } },
+      delivery: { ok: true },
+    }],
+  });
+  const switchedResult = await switched.service.fireJob("switched-wake");
+  assert.strictEqual(switchedResult.ok, true);
+  assert.strictEqual(switched.admissions[0].opts.provider, "codex", "a since-switched provider selection wins over the pinned origin provider");
+  assert.strictEqual(switched.admissions[0].opts.fresh, true);
+  assert.ok(!switched.admissions[0].opts.resumeSessionId, "a provider switch starts a fresh thread, resuming neither provider's session");
+  assert.strictEqual(switched.admissions[0].opts.providerSettings.model, "codex-current", "the switched-to provider's current model applies");
+  assert.match(switched.runCalls[0].prompt, /tracks your current selection/i);
+  assert.match(switched.runCalls[0].prompt, /claude/i);
 }
 
 async function duplicateFireProbe(createSchedulerService) {
@@ -550,7 +583,7 @@ async function detachedHistoricalBranchProbe(createSchedulerService) {
   const state = {
     userId: "fixture-user",
     currentSession: { name: "other", dir: "/workspace/other" },
-    settings: { backend: "codex" },
+    settings: { backend: "claude" },
     activeSessions: { alpha: { claude: "unrelated-live-session" } },
     completedCompactions: {},
     runningProcess: null,
@@ -822,7 +855,7 @@ function staticSchedulingProbe() {
     if (file === "core/jobs.js") continue;
     assert.ok(!/\bsessionKey\b/.test(source[file]), `${file} must not use the removed sessionKey scheduling field`);
   }
-  assert.match(source["bin/cli.js"], /selected provider session/i);
+  assert.match(source["bin/cli.js"], /current provider\/model at fire time/i);
 
   // Watch feature must be wired end to end: gate → loopback → CLI surfaces.
   assert.match(source["core/scheduler.js"], /job\.check/, "scheduler must gate firing on a watch check");
@@ -843,7 +876,7 @@ async function main() {
   migrationProbe(jobsApi);
   legacyDefaultsProbe(jobsApi);
   migrationIntegrationProbe(jobsApi, migrationApi);
-  await immutableTerminalProbe(schedulerApi.createSchedulerService);
+  await firetimeSelectionProbe(schedulerApi.createSchedulerService);
   await duplicateFireProbe(schedulerApi.createSchedulerService);
   await failureAndRetryProbe(schedulerApi.createSchedulerService);
   await detachedHistoricalBranchProbe(schedulerApi.createSchedulerService);

package/test-provider-tool-hooks.js

@@ -146,6 +146,10 @@ try {
   assert.match(overrides.projectTrust, /^projects=\{.+trust_level="untrusted".+\}$/);
   assert.match(overrides.preToolUse, /^hooks\.PreToolUse=/);
   assert.match(overrides.preToolUse, /deny-gate-hook/);
+  // Probed live 2026-07-24: Codex file edits arrive as tool_name "apply_patch"
+  // (shell as "Bash"). The matcher must cover both, or guarded external turns
+  // could write files unhooked — sandbox is bypassed on normal runs.
+  assert.match(overrides.preToolUse, /\^\(Bash\|apply_patch\)\$/, "matcher covers Codex's native file-edit tool");
 
   const prepared = prepareCodexHook({ cwd: projectDir });
   assert.strictEqual(verifyPreparedCodexHook(prepared), true);

package/test-tool-guard.js

@@ -14,6 +14,16 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tool-guard-"));
 process.env.TOOL_GUARD_LOG = path.join(tmp, "guard.jsonl");
 process.env.DENY_GATE_SETTINGS = path.join(tmp, "deny-gate.settings.json");
 process.env.KEYRING_FILE = path.join(tmp, "keyring.json");
+// Isolated identity stores for the external file-mutation gate cases: the gate
+// lazily resolves relationship→people→config, so these must precede requires.
+process.env.OPEN_CLAUDIA_CONFIG_DIR = tmp;
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+// This suite may itself run inside a bot-spawned shell that carries real
+// channel env — clear it so the dormant-gate baseline is deterministic.
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
 
 const guard = require("./core/tool-guard");
 
@@ -117,10 +127,114 @@ assert.strictEqual(guard.runHook("not json{{{").exit, 0, "unparseable payload fa
 assert.strictEqual(guard.runHook(null).exit, 0, "null payload fails OPEN");
 assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash" })).exit, 0, "missing tool_input fails OPEN");
 
+// ── external file-mutation gate: Write/Edit blocked on guarded turns only ──
+// Dormant without channel env — owner-local turns keep full file access (R9/R14).
+assert.strictEqual(guard.externalFileMutationDenial("Write"), null, "no OC_CHANNEL_* env → gate dormant");
+for (const tool of ["Write", "Edit", "MultiEdit", "NotebookEdit", "apply_patch"]) {
+  assert.strictEqual(
+    guard.runHook(JSON.stringify({ tool_name: tool, tool_input: { file_path: "/tmp/x" } })).exit, 0,
+    `${tool} without channel context stays ungated (owner-local)`,
+  );
+}
+
+// Guarded turn: an id unknown to the (isolated, empty) people store resolves
+// external → file mutations are denied with a redirect, reads/benign Bash stay free.
+process.env.OC_CHANNEL_ADAPTER = "telegram";
+process.env.OC_CHANNEL_ID = "999000111";
+process.env.OC_CHANNEL_USER_ID = "999000111";
+const extDeny = guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/evil.txt" } }));
+assert.strictEqual(extDeny.exit, 2, "external speaker → Write denied");
+assert.ok(/External-speaker guard/.test(extDeny.stderr), "denial names the guard");
+assert.ok(/write-tier tool/.test(extDeny.stderr), "denial redirects to the owner-approval channel");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Edit", tool_input: { file_path: "/tmp/x.js" } })).exit, 2,
+  "Edit equally gated on guarded turns");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "NotebookEdit", tool_input: { notebook_path: "/tmp/x.ipynb" } })).exit, 2,
+  "NotebookEdit equally gated on guarded turns");
+assert.strictEqual(
+  guard.runHook(JSON.stringify({ tool_name: "apply_patch", tool_input: { command: "*** Begin Patch\n*** Add File: /tmp/evil.txt\n+x\n*** End Patch\n" } })).exit, 2,
+  "Codex apply_patch equally gated on guarded turns (probed live: file edits arrive under this tool name)");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Read", tool_input: { file_path: "/etc/hosts" } })).exit, 0,
+  "reads stay free on guarded turns");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la" } })).exit, 0,
+  "benign Bash unaffected by the file gate (deny-gate rules unchanged)");
+
+// The owner on the same transport is never gated: guardActive is a strict no-op.
+{
+  const people = require("./core/people");
+  const owner = people.add({ name: "Owner", isOwner: true });
+  people.linkHandle(owner.id, { adapter: "telegram", channelId: "111222333", approvedBy: "test" });
+  process.env.OC_CHANNEL_ID = "111222333";
+  process.env.OC_CHANNEL_USER_ID = "111222333";
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/ok.txt" } })).exit, 0,
+    "owner turns keep full file access even with channel env present");
+}
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/tmp/x" } })).exit, 0,
+  "gate re-dormant once channel env is gone");
+
+// ── external control-plane gate: Bash touching config/package denied on guarded turns ──
+// F2's Write/Edit denial must not be routable-around with one Bash heredoc: on
+// guarded turns any shell command referencing the config dir, the installed
+// package source, or a .open-claudia path is denied (reads included — policy
+// text must not leak into the vetted surface). Dormant without channel env;
+// the authorised channels stay exempt (bin/tool.js speaker-gates them itself).
+const cpWrite = `printf '* * * * * evil\\n' >> ${tmp}/crons.json`;
+assert.strictEqual(guard.externalControlPlaneDenial(cpWrite), null, "no OC_CHANNEL_* env → control-plane gate dormant");
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
+  "owner-local shells keep full config access");
+process.exitCode = 0;
+require("./bin/keyring").run(["path"]);
+assert.strictEqual(process.exitCode || 0, 0, "keyring CLI stays open owner-local (no channel env)");
+process.env.OC_CHANNEL_ADAPTER = "telegram";
+process.env.OC_CHANNEL_ID = "999000111";
+process.env.OC_CHANNEL_USER_ID = "999000111";
+{
+  const denyWrite = guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } }));
+  assert.strictEqual(denyWrite.exit, 2, "external speaker → config-dir write denied");
+  assert.ok(/External-speaker guard/.test(denyWrite.stderr), "denial names the guard");
+  assert.ok(/control plane/.test(denyWrite.stderr), "denial says what was protected");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `cat ${tmp}/entities/sharon.md` } })).exit, 2,
+    "config reads equally denied on guarded turns (read-then-quote leaks policy)");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "cat ~/.open-claudia/lessons.md" } })).exit, 2,
+    ".open-claudia paths denied regardless of resolved config dir");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `sed -i '' 's/a/b/' ${__dirname}/core/enforcer.js` } })).exit, 2,
+    "installed package source is control plane too");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: "ls -la /tmp" } })).exit, 0,
+    "unrelated shell work stays free on guarded turns");
+  assert.strictEqual(guard.externalControlPlaneDenial(`open-claudia tool run oc-admin crons list --file ${tmp}/crons.json`), null,
+    "authorised channel (tool run) stays exempt — bin/tool.js gates externals itself");
+  assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: `open-claudia tool run oc-admin ping && cat ${tmp}/crons.json` } })).exit, 2,
+    "an authorised prefix cannot smuggle a raw control-plane suffix");
+  // keyring exec is exempt above as an authorised channel, so the speaker
+  // gate lives inside the keyring CLI itself — every verb is owner-only
+  // (exec carries the FULL keyring into an arbitrary command's env).
+  const keyringCli = require("./bin/keyring");
+  process.exitCode = 0;
+  keyringCli.run(["path"]);
+  assert.strictEqual(process.exitCode, 1, "keyring CLI refuses guarded external speakers outright");
+  process.exitCode = 0;
+}
+// The owner on a linked channel is never gated.
+process.env.OC_CHANNEL_ID = "111222333";
+process.env.OC_CHANNEL_USER_ID = "111222333";
+assert.strictEqual(guard.runHook(JSON.stringify({ tool_name: "Bash", tool_input: { command: cpWrite } })).exit, 0,
+  "owner turns keep full control-plane access with channel env present");
+delete process.env.OC_CHANNEL_ADAPTER;
+delete process.env.OC_CHANNEL_ID;
+delete process.env.OC_CHANNEL_USER_ID;
+
 // ── audit trail: denies + bypasses land in the guard log (5c KPI source) ──
 guard.logGuardEvent({ kind: "bypass", reason: "no tool yet", command: "curl x" });
 const lines = fs.readFileSync(process.env.TOOL_GUARD_LOG, "utf-8").trim().split("\n").map((l) => JSON.parse(l));
 assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "inet-central-api"), "runHook deny is logged");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-file-write" && l.tool === "Write"),
+  "external file-mutation deny is audited with tool + rule");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-control-plane" && /crons\.json/.test(l.command || "")),
+  "external control-plane deny is audited with the command");
+assert.ok(lines.some((l) => l.kind === "deny" && l.rule === "external-keyring"),
+  "external keyring refusal is audited");
 assert.ok(lines.some((l) => l.kind === "bypass" && l.reason === "no tool yet"), "keyring exec bypass is logged");
 assert.ok(lines.every((l) => l.ts), "every guard event is timestamped");
 
@@ -170,6 +284,10 @@ assert.strictEqual(pre[0].matcher, "Bash", "hook is scoped to the Bash tool");
 assert.ok(/deny-gate-hook/.test(pre[0].hooks[0].command), "hook invokes the CLI hook entry");
 assert.ok(pre[0].hooks[0].command.includes(process.execPath), "hook uses an absolute node path (subprocess PATH independent)");
 assert.ok(pre[0].hooks[0].timeout > 0, "hook carries a timeout so a hung gate fails open");
+assert.strictEqual(pre[1].matcher, "^(Write|Edit|MultiEdit|NotebookEdit)$",
+  "file-mutation tools are hooked for the external-speaker gate");
+assert.strictEqual(pre[1].hooks[0].command, pre[0].hooks[0].command,
+  "file gate rides the same deny-gate-hook entry (one CLI, one audit path)");
 // second call with the file read-only: content-compare must skip the write
 fs.chmodSync(sPath, 0o444);
 assert.strictEqual(guard.ensureHookSettings(), sPath, "unchanged settings are not rewritten");