@inetafrica/open-claudia 3.2.3 → 3.3.1

package/core/actions.js

@@ -753,6 +753,86 @@ async function handleAction(envelope) {
     await send(`Type the rule to apply to ${target}.\nFor example: “may share our office hours and address”, or “never discuss pricing”.\n\nOr send /cancel to skip.`);
     return;
   }
+  if (d.startsWith("vfy:")) {
+    // "Verify contact…" on an approval card for an unverified auto-added
+    // speaker. Owner-only (transport-gated on the callback envelope — the one
+    // surface the agent can't forge). Offers the same-name candidate notes as
+    // buttons; the actual state change happens in the vfl: pick handler via
+    // core/verify-contact, which re-validates everything.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const id = d.split(":")[1];
+    const approvals = require("./approvals");
+    const rec = approvals.read(id);
+    if (!rec || !rec.personId) return send("That request expired — nothing to verify from it.");
+    const people = require("./people");
+    const person = people.findById(rec.personId);
+    if (!person) return send("I no longer have a contact record for them.");
+    if (!person.autoCreated) return send(`${person.name} is already verified.`);
+    const candidates = require("./verify-contact").candidateEntitiesFor(person).slice(0, 6);
+    // Button payloads are INDEX-based: Telegram caps callback_data at 64
+    // bytes and slugs alone can be 60 — the picked index resolves against
+    // this snapshot, so a changed entity set can't shift what a tap means.
+    state.pendingVerify = {
+      aprId: rec.id,
+      personId: person.id,
+      personName: person.name,
+      candidates: candidates.map((c) => ({ slug: c.slug, name: c.name })),
+      armedAt: Date.now(),
+    };
+    saveState();
+    const rows = candidates.map((c, i) => ([{ text: `🔗 Link to ${c.slug}`.slice(0, 60), callback_data: `vfl:${rec.id}:${i}` }]));
+    rows.push([{ text: "✅ Just verify — this is a new contact", callback_data: `vfl:${rec.id}:self` }]);
+    rows.push([{ text: "✖️ Cancel", callback_data: `vfl:${rec.id}:x` }]);
+    await send(
+      `🪪 Verify ${person.name}?\n` +
+        (candidates.length
+          ? `They share a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`} — link them if this is the same person, or keep them separate.\n`
+          : `No existing note matches their name — verifying keeps their current note as canonical.\n`) +
+        `Verifying settles WHO they are. It grants no permissions — use “Make a rule” or /guardrails for that.`,
+      { keyboard: { inline_keyboard: rows } }
+    );
+    return;
+  }
+  if (d.startsWith("vfl:")) {
+    // Verification pick. Owner-only; one-shot against the armed snapshot with
+    // the same 5-minute TTL as rule authoring. verifyContact() re-validates
+    // the person and target at execution time, so a stale snapshot can only
+    // refuse — never mislink.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const parts = d.split(":");
+    const id = parts[1];
+    const pick = parts[2];
+    const pend = state.pendingVerify;
+    const VERIFY_TTL_MS = 5 * 60 * 1000;
+    if (!pend || pend.aprId !== id || (pend.armedAt && Date.now() - pend.armedAt > VERIFY_TTL_MS)) {
+      state.pendingVerify = null; saveState();
+      return send("That verify prompt is stale — tap “Verify contact…” on the card again.");
+    }
+    state.pendingVerify = null; saveState();
+    if (pick === "x") return send("Okay — left unverified.");
+    let linkSlug = null;
+    if (pick !== "self") {
+      const chosen = pend.candidates[parseInt(pick, 10)];
+      if (!chosen) return send("That button is stale — tap “Verify contact…” on the card again.");
+      linkSlug = chosen.slug;
+    }
+    const result = require("./verify-contact").verifyContact({
+      personId: pend.personId,
+      linkSlug,
+      by: String(envelope.channelId),
+      via: "approval-card",
+    });
+    if (!result.ok) {
+      return send(result.already
+        ? `${pend.personName} is already verified.`
+        : `Couldn't verify: ${result.reason}`);
+    }
+    return send(
+      `🪪 Verified ${pend.personName}` +
+        (linkSlug ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+        `\nVerification settles identity only; permissions still come from mandates and rules.`
+    );
+  }
   if (d.startsWith("grd:")) {
     // Guardrail capture buttons (Track C). Owner-only: standing rules layer
     // above lessons and are never editable by an external speaker.

package/core/enforcer.js

@@ -360,7 +360,27 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
       `<pre>${esc(String(rec.command || ""))}</pre>`,
     ];
   }
-  const lines = [head, ``, ...askBlock, ...body, reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
+  // Unverified auto-added speaker → the card carries a one-tap way for the
+  // owner to settle WHO this is (link to an existing note, or bless the stub).
+  // Computed live from the people record — after verification the row (and
+  // the warning line) disappear from subsequent cards on their own.
+  let unverifiedLine = "";
+  let verifyRow = null;
+  try {
+    if (rec.personId) {
+      const person = require("./people").findById(rec.personId);
+      if (person && person.autoCreated && !person.isOwner) {
+        const candidates = require("./verify-contact").candidateEntitiesFor(person);
+        unverifiedLine = candidates.length
+          ? `⚠️ Unverified auto-added contact. Possible existing note: <b>${esc(candidates[0].slug)}</b> — NOT linked until you verify.`
+          : `⚠️ Unverified auto-added contact — I only know them from this chat.`;
+        verifyRow = [{ text: "🪪 Verify contact…", callback_data: `vfy:${rec.id}` }];
+      }
+    }
+  } catch (e) { /* card still posts without the verify affordance */ }
+  const lines = [head, ``, ...askBlock, ...body,
+    unverifiedLine ? `\n${unverifiedLine}` : ``,
+    reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
   const yes = kind === "triage" ? "✅ Yes, handle it" : "✅ Approve once";
   const no = kind === "triage" ? "⛔ No, decline" : "⛔ Deny";
   const keyboard = { inline_keyboard: [
@@ -370,6 +390,7 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
     ],
     [
       { text: "📝 Make a rule…", callback_data: `apr:${rec.id}:rule` },
+      ...(verifyRow || []),
     ],
   ] };
   try {

package/core/handlers.js

@@ -2466,7 +2466,7 @@ function formatPersonShort(p) {
 }
 
 register({
-  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove ...]",
+  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove|verify ...]",
   handler: async (env, { tail }) => {
     if (!authorized(env)) return;
     if (!tail || tail === "list") {
@@ -2552,7 +2552,51 @@ register({
       for (const h of handles) { const r = accessStore.revokeChat(h.channelId); if (r.ok) revokedCount += 1; }
       return send(`Removed ${person.name}. Deauthed ${revokedCount} chat${revokedCount === 1 ? "" : "s"}.`);
     }
-    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove ... (owner)");
+    // Verify an auto-added contact: settle their identity, optionally binding
+    // them to an existing note. Owner-only and chat-surface-only by design —
+    // there is deliberately no CLI/loopback equivalent, so identity decisions
+    // can never ride agent-forgeable input. Grants no permissions.
+    const verifyMatch = tail.match(/^verify\s+(.+?)(?:\s+link\s+(\S+))?$/i);
+    if (verifyMatch) {
+      const person = peopleStore.findById(verifyMatch[1].trim()) || peopleStore.findByName(verifyMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyMatch[1].trim()}`);
+      const vc = require("./verify-contact");
+      if (person.autoCreated && !verifyMatch[2]) {
+        const candidates = vc.candidateEntitiesFor(person);
+        if (candidates.length) {
+          return send(
+            `${person.name} shares a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`}:\n` +
+              candidates.map((c) => `  ${c.slug}`).join("\n") +
+              `\n\nLink with /people verify ${person.name} link <slug>, or /people verify-new ${person.name} to keep them separate.`
+          );
+        }
+      }
+      const result = vc.verifyContact({
+        personId: person.id,
+        linkSlug: verifyMatch[2] || null,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(
+        `🪪 Verified ${person.name}` +
+          (verifyMatch[2] ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+          `\nVerification settles identity only; permissions still come from mandates and rules.`
+      );
+    }
+    const verifyNewMatch = tail.match(/^verify-new\s+(.+)$/i);
+    if (verifyNewMatch) {
+      const person = peopleStore.findById(verifyNewMatch[1].trim()) || peopleStore.findByName(verifyNewMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyNewMatch[1].trim()}`);
+      const result = require("./verify-contact").verifyContact({
+        personId: person.id,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(`🪪 Verified ${person.name} — their note is now canonical.\nVerification settles identity only; permissions still come from mandates and rules.`);
+    }
+    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove|verify ... (owner)");
   },
 });
 

package/core/loopback.js

@@ -25,6 +25,7 @@ const introFlow = require("./intro-flow");
 const relay = require("./relay");
 const audit = require("./audit");
 const access = require("./access");
+const speakerAttest = require("./speaker-attest");
 const fs2 = require("fs");
 const path2 = require("path");
 const { TRANSCRIPTS_DIR } = require("./config");
@@ -85,9 +86,17 @@ const JSON_KINDS = new Set([
   "say", "call", "tts", "transcribe",
 ]);
 
+// Owner gate for identity-sensitive kinds. The claimed canonicalUserId comes
+// from the CLI's env, which the agent's shell can rewrite — so the claim only
+// counts when it carries the runner-minted attestation (an HMAC over the id
+// with a per-boot, memory-only secret; see core/speaker-attest). No attest,
+// a wrong attest, or an attest for a different id all fail closed: forging
+// `OC_CANONICAL_USER_ID=<owner-id>` from a guarded external turn no longer
+// reaches the people/auth/intros mutations the relationship guard depends on.
 function callerIsOwner(payload) {
   const caller = payload?.canonicalUserId;
   if (!caller) return false;
+  if (!speakerAttest.verify(caller, payload?.speakerAttest)) return false;
   const person = peopleStore.findByCanonicalUserId(caller);
   return !!(person && person.isOwner);
 }
@@ -602,6 +611,24 @@ async function handleJson(req, res, url, kind) {
 
   if (kind === "relay-send") {
     if (!payload.text) return reply(res, 400, { error: "missing text" });
+    // A guarded (external) requester may pass a message TO THE OWNER — that is
+    // the "tell them for me" flow — but never use the bot as a relay to third
+    // parties: sending as the bot to anyone else is impersonation surface.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        const target =
+          (payload.targetPersonId && peopleStore.findById(payload.targetPersonId)) ||
+          (payload.targetPersonName && peopleStore.findByName(payload.targetPersonName)) ||
+          (payload.targetCanonicalUserId && peopleStore.findByCanonicalUserId(payload.targetCanonicalUserId)) ||
+          (payload.targetAdapter && payload.targetChannelId && peopleStore.findByHandle(payload.targetAdapter, payload.targetChannelId)) ||
+          null;
+        if (!target || !target.isOwner) {
+          return reply(res, 403, { error: "relay from an external contact can only go to the owner — messages to anyone else are owner-only" });
+        }
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     try {
       const result = await relay.send({
         text: payload.text,
@@ -620,6 +647,16 @@ async function handleJson(req, res, url, kind) {
   }
 
   if (kind === "recent-fetch") {
+    // Transcript reads are owner-side memory. A guarded (external, non-owner)
+    // requester must not pull other channels' conversations through the CLI —
+    // same default-deny as file/voice egress, same fail direction.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        return reply(res, 403, { error: "transcript access is owner-only — an external contact cannot read other conversations" });
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     const limit = Math.max(1, Math.min(parseInt(payload.limit || 20, 10) || 20, 200));
     try {
       let targetAdapter = payload.adapter;

package/core/media.js

@@ -99,34 +99,87 @@ async function elevenLabsToVoice(clean) {
   }
 }
 
+// Pack already-cleaned text into gateway-sized pieces. Long inputs used to go
+// to the gateway as ONE request and blow its synthesis window (the abort was
+// the binding limit, not any transport) — sentence-packed chunks keep every
+// request comfortably inside it. Oversized single sentences are hard-split at
+// word boundaries so one run-on sentence can't recreate the timeout.
+const TTS_CHUNK_MAX = 450;
+function chunkForTTS(clean, maxLen = TTS_CHUNK_MAX) {
+  if (clean.length <= maxLen) return [clean];
+  const sentences = clean.match(/[^.!?]+[.!?]+|\S[^.!?]*$/g) || [clean];
+  const chunks = [];
+  let buf = "";
+  const flush = () => { if (buf) { chunks.push(buf); buf = ""; } };
+  for (let piece of sentences) {
+    piece = piece.trim();
+    if (!piece) continue;
+    while (piece.length > maxLen) {
+      flush();
+      let cut = piece.lastIndexOf(" ", maxLen);
+      if (cut < maxLen / 2) cut = maxLen;
+      chunks.push(piece.slice(0, cut).trim());
+      piece = piece.slice(cut).trim();
+    }
+    if (buf && buf.length + piece.length + 1 > maxLen) flush();
+    buf = buf ? `${buf} ${piece}` : piece;
+  }
+  flush();
+  return chunks.filter(Boolean);
+}
+
+async function pocketFetchWav(input, voice, token) {
+  const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ input, voice, response_format: "wav" }),
+    signal: AbortSignal.timeout(120000),
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
 // Pocket TTS through the Agent Space speech gateway. The gateway returns WAV;
-// Telegram and voice transports receive a compact Ogg/Opus file.
+// Telegram and voice transports receive a compact Ogg/Opus file. Long text is
+// synthesized chunk-by-chunk and concatenated, so message length can no longer
+// abort the request mid-synthesis.
 async function pocketToVoice(clean, voiceOverride) {
   const token = speechBearerToken();
   if (TTS_PROVIDER === "elevenlabs" || !token || !SPEECH_SERVICE_URL || !FFMPEG) return null;
-  let wavPath = null;
+  const voice = voiceOverride || ttsVoice.getVoice();
+  const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
+  const wavPaths = [];
+  let listPath = null;
   try {
-    const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ input: clean, voice: voiceOverride || ttsVoice.getVoice(), response_format: "wav" }),
-      signal: AbortSignal.timeout(60000),
-    });
-    if (!res.ok) {
-      console.error(`Pocket TTS failed: HTTP ${res.status}`);
-      return null;
+    const chunks = chunkForTTS(clean);
+    for (let i = 0; i < chunks.length; i++) {
+      let buf;
+      try {
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      } catch (e) {
+        // one retry: a transient gateway blip shouldn't waste the chunks
+        // already synthesized before it
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      }
+      const wavPath = path.join(TEMP_DIR, `${stem}-${i}.wav`);
+      fs.writeFileSync(wavPath, buf);
+      wavPaths.push(wavPath);
+    }
+    if (wavPaths.length === 1) {
+      execSync(`"${FFMPEG}" -i "${wavPaths[0]}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
+    } else {
+      listPath = path.join(TEMP_DIR, `${stem}-list.txt`);
+      fs.writeFileSync(listPath, wavPaths.map((p) => `file '${p}'`).join("\n"));
+      execSync(`"${FFMPEG}" -f concat -safe 0 -i "${listPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 120000 });
     }
-    const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    wavPath = path.join(TEMP_DIR, `${stem}.wav`);
-    const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
-    fs.writeFileSync(wavPath, Buffer.from(await res.arrayBuffer()));
-    execSync(`"${FFMPEG}" -i "${wavPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
     return oggPath;
   } catch (e) {
     console.error("Pocket TTS error:", e.message);
     return null;
   } finally {
-    if (wavPath) { try { fs.unlinkSync(wavPath); } catch (e) {} }
+    for (const p of wavPaths) { try { fs.unlinkSync(p); } catch (e) {} }
+    if (listPath) { try { fs.unlinkSync(listPath); } catch (e) {} }
   }
 }
 
@@ -303,4 +356,4 @@ async function synthSentenceMp3(text) {
   }
 }
 
-module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };
+module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, chunkForTTS, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };

package/core/pack-review.js

@@ -388,7 +388,25 @@ function applyAction(a, activeSet = null) {
 
 function applyEntityAction(e) {
   if (!e || typeof e !== "object" || !String(e.name || "").trim()) return null;
+  // Slug-key through the people roster: name-keyed upserts land on the
+  // alphabetically-first same-named entity, but the relationship guard reads
+  // the file the person RECORD points at (auto-added contacts get a suffixed
+  // stub precisely so they can't shadow an existing note). A unique name
+  // match routes the write to the guard-read file; an ambiguous one (two
+  // tracked people sharing a name) is skipped outright — enriching the wrong
+  // identity's note is worse than writing nothing.
+  let slug = "";
+  try {
+    const people = require("./people");
+    const wanted = String(e.name || "").trim().toLowerCase();
+    const matches = people.list().filter((p) => (p.name || "").trim().toLowerCase() === wanted);
+    if (matches.length === 1) slug = people.resolveEntitySlug(matches[0]) || "";
+    else if (matches.length > 1) {
+      return { kind: "skip", slug: "", name: e.name, type: e.type || "", note: "ambiguous: multiple tracked people share this name — not writing to either note" };
+    }
+  } catch (err) { /* roster unavailable → name-keyed fallback below */ }
   const { entity, created } = entities.upsertEntity({
+    slug: slug || undefined,
     name: e.name,
     type: e.type,
     aliases: Array.isArray(e.aliases) ? e.aliases.slice(0, 5) : [],

package/core/relationship.js

@@ -253,10 +253,26 @@ function ensureContact(envelope) {
     const suffix = crypto.createHash("sha1").update(`${adapterType}:${userId}`).digest("hex").slice(0, 6);
     const slug = `${entities.slugify(displayName).slice(0, 48) || "contact"}-${suffix}`;
     people.setEntitySlug(person.id, slug);
+
+    // If a same-named person note already exists, surface it as a HINT only.
+    // Deliberately not linked (see invariants above): a name is spoofable, so
+    // absorbing the note here would hand the speaker that identity's history.
+    // Only the owner can link, via the approval card or /people verify.
+    let hint = "";
+    try {
+      const fresh = people.findById(person.id) || person;
+      const candidates = require("./verify-contact").candidateEntitiesFor(fresh);
+      if (candidates.length) hint = candidates.map((c) => c.slug).slice(0, 3).join(", ");
+    } catch (e) { /* hint is best-effort — the stub is safe without it */ }
+
     entities.upsertEntity({
       slug, name: displayName, type: "person", relationship: "external",
-      description: `Auto-added contact (unverified) — first seen in ${label}`,
-      log: `auto-added as a contact from ${label}`,
+      description: hint
+        ? `Auto-added contact (unverified) — first seen in ${label}. Possible existing note: ${hint} — NOT linked; only the owner can verify.`
+        : `Auto-added contact (unverified) — first seen in ${label}`,
+      log: hint
+        ? `auto-added as a contact from ${label}; same-named note detected (${hint}) — not linked pending owner verification`
+        : `auto-added as a contact from ${label}`,
     });
 
     try { require("./audit").log("auto-contact", { personId: person.id, name: displayName, adapter: adapterType, userId, channelId, entitySlug: slug }); } catch (e) {}

package/core/runner.js

@@ -1707,7 +1707,13 @@ function decorateForegroundInvocation(invocation, runContext, bundle) {
     if (runContext.origin?.adapterId) env.OC_CHANNEL_ADAPTER = runContext.origin.adapterId;
     if (runContext.channelId) env.OC_CHANNEL_ID = String(runContext.channelId);
     if (runContext.origin?.userId) env.OC_CHANNEL_USER_ID = String(runContext.origin.userId);
-    if (runContext.canonicalUserId) env.OC_CANONICAL_USER_ID = String(runContext.canonicalUserId);
+    if (runContext.canonicalUserId) {
+      env.OC_CANONICAL_USER_ID = String(runContext.canonicalUserId);
+      // Server-side attestation of the id above: the loopback's owner-gated
+      // kinds only honor a canonicalUserId whose attest verifies, so a shell
+      // that rewrites OC_CANONICAL_USER_ID cannot impersonate the owner.
+      try { env.OC_SPEAKER_ATTEST = require("./speaker-attest").mint(runContext.canonicalUserId); } catch (e) {}
+    }
     if (runContext.sessionId) env.OC_LAST_SESSION_ID = String(runContext.sessionId);
     if (lb?.url) env.OC_SEND_URL = lb.url;
   }

package/core/speaker-attest.js

@@ -0,0 +1,56 @@
+// Speaker attestation: lets the loopback server trust OC_CANONICAL_USER_ID.
+//
+// The problem: the loopback's owner-gated kinds (people mutations, auth,
+// intros) identified the caller by payload.canonicalUserId, which the CLI read
+// from env — and env is writable by the agent's shell, so a guarded external
+// turn could forge `OC_CANONICAL_USER_ID=<owner-id> open-claudia people link …`
+// and rewrite the identity map the relationship guard depends on.
+//
+// The fix: the RUNNER (which knows the turn's true speaker from the inbound
+// envelope, server-side) mints an HMAC over the canonical user id with a
+// per-boot secret that lives ONLY in bot-process memory — never on disk, never
+// in the loopback info file, stripped from provider env like all control-plane
+// keys would be (it is simply never exported). The provider spawn env carries
+// OC_SPEAKER_ATTEST next to OC_CANONICAL_USER_ID; the CLI forwards both; the
+// loopback verifies the pair before honoring an owner claim. An agent can
+// still LIE about OC_CANONICAL_USER_ID, but it cannot mint a matching
+// signature for any id other than the one the runner stamped for its turn.
+//
+// Scope and honesty: this authenticates "the runner said this turn speaks as
+// X". It is per-boot (a restart invalidates in-flight attests — same blast
+// radius as the loopback port/token rotating) and deliberately unforgeable
+// rather than merely obscure: no attest, wrong attest, or an attest for a
+// different id all fail closed. It does NOT bind adapter/channel — those stay
+// best-effort inputs to the guarded-speaker checks, whose spoof failure modes
+// are self-limiting (buttons/files land on the spoofed channel, i.e. the
+// owner's own chat, never silently on the attacker's).
+
+const crypto = require("crypto");
+
+// Lazily created so tests get a fresh secret per process, like production.
+let SECRET = null;
+
+function secret() {
+  if (!SECRET) SECRET = crypto.randomBytes(32);
+  return SECRET;
+}
+
+function mint(canonicalUserId) {
+  const id = String(canonicalUserId || "");
+  if (!id) return "";
+  return crypto.createHmac("sha256", secret()).update(id).digest("hex");
+}
+
+// Constant-time compare; every malformed shape is a plain false (fail closed).
+function verify(canonicalUserId, attest) {
+  const id = String(canonicalUserId || "");
+  const sig = String(attest || "");
+  if (!id || !sig) return false;
+  const expected = mint(id);
+  const a = Buffer.from(sig, "utf-8");
+  const b = Buffer.from(expected, "utf-8");
+  if (a.length !== b.length) return false;
+  try { return crypto.timingSafeEqual(a, b); } catch (e) { return false; }
+}
+
+module.exports = { mint, verify };

package/core/system-prompt.js

@@ -865,20 +865,29 @@ function buildSpeakerPersonaBlock(opts = {}) {
   if (!speaker.isOwner && (s.Mandate || "").trim()) {
     rows.push(`Mandate — what you may do/discuss with them: ${s.Mandate.trim()}`);
   }
-  if (rows.length === 0) return "";
+  // A bare note used to render nothing — which hid the guard's policy source
+  // exactly when it mattered most (auto-added stubs are born bare, so the
+  // agent couldn't see WHICH file governs the speaker, or that a same-named
+  // note elsewhere is a different identity). For non-owners the block always
+  // renders; an owner with an empty note still gets the quiet no-op.
+  if (rows.length === 0 && speaker.isOwner) return "";
   const runIdentity = promptDedupeIdentity(opts);
   const key = `${adapter.id || "?"}:${channelId}`;
   const stamp = `${runIdentity}:${slug}:${ent.updated}`;
   if (speakerPersonaInjectedFor.get(key) === stamp) return "";
   speakerPersonaInjectedFor.set(key, stamp);
   const rel = ent.relationship || (speaker.isOwner ? "owner" : "");
+  const unverified = !speaker.isOwner && !!speaker.autoCreated;
   const clip = (str) => (str.length > SPEAKER_PERSONA_MAX_CHARS ? str.slice(0, SPEAKER_PERSONA_MAX_CHARS) + "\n…[truncated — `open-claudia entity show " + slug + "`]" : str);
   return clip([
-    `\n\n## Who you're speaking with: ${speaker.name}${rel ? ` (${rel})` : ""}`,
+    `\n\n## Who you're speaking with: ${speaker.name}${rel ? ` (${rel})` : ""}${unverified ? " — UNVERIFIED auto-added contact" : ""}`,
     `Their persona pack (source: ${entitiesLib.ENTITIES_DIR}/${slug}.md) — adapt your voice and scope to it. Edit that file to refine how you treat them.`,
+    ...(speaker.isOwner ? [] : [
+      `That file is the ONLY note the relationship guard reads for them — a same-named note anywhere else belongs to a DIFFERENT identity and grants nothing here.${unverified ? " The owner has not yet confirmed who they are (verification happens on the owner's approval card or /people verify)." : ""}`,
+    ]),
     "",
     rows.join("\n"),
-  ].join("\n"));
+  ].join("\n")).trimEnd();
 }
 
 // External-mode posture block (Phase 3). For a non-owner (guarded) speaker,
@@ -896,9 +905,17 @@ function buildExternalModeBlock() {
   const who = speaker.name || "this person";
   const mandate = (speaker.mandate || "").trim();
   const unverified = !!(speaker.person && speaker.person.autoCreated);
+  let sourceLine = "";
+  if (speaker.slug) {
+    try {
+      const entitiesLib = require("./entities");
+      sourceLine = `Guard policy source: ${entitiesLib.ENTITIES_DIR}/${speaker.slug}.md — the ONLY note the guard reads for ${who}. A same-named note elsewhere is a different identity and grants nothing here.`;
+    } catch (e) {}
+  }
   const lines = [
     `\n\n## External speaker — restricted mode`,
-    `You are talking to ${who}, who is NOT the owner. You are operating under a strict, owner-defined scope.`,
+    `You are talking to ${who}, who is NOT the owner. You are operating under a strict, owner-defined scope.${unverified ? ` Their identity is UNVERIFIED (auto-added on first contact — only the owner can verify them, via the approval card or /people verify).` : ""}`,
+    ...(sourceLine ? [sourceLine] : []),
     "",
     mandate
       ? `Mandate — the ONLY things you are cleared to do or discuss with ${who}:\n${mandate}`