@inetafrica/open-claudia 3.4.24 → 3.5.1

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 3.5.1
+
+Hardening after an adversarial review of 3.5.0, before any of it reaches the fleet. Canary first.
+
+- **A CLI believes only its own bot about who it acts for.** `whoami` and the staff `tool-gate` answer are asked only of a loopback that the CLI process itself or one of its ancestors is listening on, and never of one started inside a staff turn. An address in `OC_SEND_URL` is no longer enough: in 3.5.0 a staff turn could run its own server that answered "owner", and the keyring and the other owner-only verbs believed it. Linux reads `/proc`; macOS asks `/bin/ps` and `/usr/sbin/lsof`. Anything that cannot be checked is unattributed, which is never the owner.
+- **A staff member's watch check gets only the shell essentials.** It runs with an allowlist (PATH, HOME, user, locale, terminal, temp dirs, the config dir), its run stamp and `OC_GUARDED_RUN=1`. 3.5.0 dropped credentials by name pattern, so ones like `DATABASE_URL` or `MONGO_URI` still reached staff checks.
+- **The owner's watch checks get the bot's environment again,** so an owner watch that reads a credential from env works as it did before 3.5.0.
+- **A run with an incomplete chat origin is not the owner.** An origin that names a person or room but not the transport and room it came from counts as a non-owner. A run with no origin at all is still bot-internal work.
+- **The staff shell screen is wider, and it is not a boundary.** A staff turn's shell command may not name process environments or argument blocks, the keyring, the bot's config dir, per-process `/proc` paths, or credential stores. Correction to 3.5.0: the shell does not reliably refuse credential reads. A staff turn that has a shell can still read what the bot's OS user can read. Phase 2 takes the shell away from staff turns.
+- **The owner's routes outside a chat turn** (terminal, ssh, system cron), where 3.5.0 refuses owner-only work:
+  - the keyring: `/keyring set`, `/keyring get` and `/keyring remove` in the owner's chat;
+  - tool, pack, lessons, entity and ideas edits, and `open-claudia agent`: ask in the owner's chat;
+  - a write or destructive tool run: run it from a chat turn, or re-run it with the one-shot `--approval <id>` from a card the owner approved.
+- **Tests:** the provider parity test names the suite that timed out and allows 180 s per suite. A loaded CI runner overran 90 s on canary-v3.5.0's first build.
+
+## 3.5.0
+
+Security fixes for the permission system: phase 0 of the redesign in the owner's 25 Sep review. The owner's own chat turns work as before. Staff and external turns lose the ways around the checks. First shipped as a canary on two bots.
+
+- **Who a process acts for is now decided by the running bot.** The runner registers every run with the person it acts for, resolved from the inbound message, and stamps an attestation bound to that run. Tools, the keyring, notes and scheduling ask the bot through the loopback's new `whoami`. The following are all *unattributed*, and unattributed is never the owner:
+  - a shell that unsets or rewrites its environment;
+  - a process that outlives its turn;
+  - anything started outside a chat turn.
+  Before this release, the CLIs read the speaker from `OC_CHANNEL_*` variables that the agent's own shell could change, and an unset speaker counted as the owner.
+- **Staff turns never see the AI service credentials.** Non-owner runs set `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`.
+- **A staff write or destructive tool run is decided inside the bot.** The mandate check runs there. If the owner must approve, the bot posts the card itself. Requests raised from inside a tool used to die with "could not post to owner" or "no reachable owner" (18 dropped fleet-wide in 14 days).
+- **A verb that a tool's manifest does not declare is refused for everyone,** and the refusal lists the declared verbs. Before, a staff turn's undeclared verb was classed as a write and sent to the owner.
+- **An owner approval carries exactly the tier approved.** Redeeming any token used to export "destructive", so approving a write unlocked destructive for that run.
+- **Changing tools, notes, the keyring and sub-agents is owner-only:**
+  - tool add, set, edit, note, remove and lib;
+  - entity, pack, lessons and ideas writes;
+  - every keyring verb, including `list`;
+  - `open-claudia agent`.
+  From a plain terminal these are refused; 3.5.1 lists the owner's routes.
+- **Follow-ups set in a staff turn run at that person's level, in that room.** This covers wakeups, crons and watches. The job's creator is the attested run. Before, it came from fields the run's own shell could forge, with a fallback to the owner. Watch checks run without the bot's secrets, as their creator.
+- **People notes and tasks are owner-only through the bot's commands.**
+- **History stays in the caller's room.** For a non-owner, `recent`, `transcript-search` and `transcript-window` return only the caller's room. `recent-fetch`'s channel filter, which matched nothing, is fixed.
+- **File reads are screened on staff turns.**
+  - Read, Grep, Glob, NotebookRead and LS cannot reach:
+    - the bot's config (keyring, transcripts, approvals, people);
+    - Claude and Codex credentials;
+    - SSH, cloud and kube credentials;
+    - other processes' environments.
+  - Paths are resolved through symlinks.
+  - The shell screens a few common equivalents. This is not a boundary (corrected in 3.5.1).
+  - A permission hook that cannot run now refuses on a staff turn instead of letting the tool through.
+- **Destructive is never a standing permission.**
+  - "Always" on a destructive card is refused.
+  - A destructive grant already on disk counts as act.
+  - Grants for anonymous or unverifiable senders (Telegram anonymous admins, channel posts, the bot itself) are refused.
+  - When an exact-room grant and an all-rooms grant both match, the stronger one applies.
+- **Releases can be canaried.**
+  - A `canary-vX.Y.Z` tag publishes npm under `next` and pushes docker `:X.Y.Z` only.
+  - Pushing `vX.Y.Z` on the same commit later promotes that exact build (`latest`, no rebuild).
+
 ## 3.4.24
 
 - A repeating watch keeps polling while its triggered delivery waits for a busy room, waits to retry after a failed or `/stop`-killed run, or runs. A new hit folds into that one pending delivery instead of queueing another, and the delivered prompt says how many more times the check passed and whether its latest run had cleared. On 24 Sep the event-bus watch went unpolled for 7.5 h behind a busy room, and after a killed delivery attempt its polling never resumed. One-shot watches are unchanged, and the 15-minute "⏳ Watch … waiting" line still goes out once per occurrence.

package/bin/agent.js

@@ -58,6 +58,10 @@ async function run(args) {
   if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
     console.log(HELP); process.exit(args[0] === "--help" || args[0] === "help" ? 0 : 2);
   }
+  // A sub-agent is an unguarded agent with a shell: only the owner's own run
+  // may start one. Decided by the running bot from the run's attestation
+  // (bin/owner-gate), never from this process's env.
+  if (!(await require("./owner-gate").requireOwner("starting a sub-agent"))) return;
   let parsed;
   try { parsed = parseAgentArgs(args); }
   catch (error) { console.error(error.message); process.exit(2); return; }

package/bin/cli.js

@@ -146,7 +146,16 @@ switch (command) {
       const res = runHook(payload);
       if (res.stderr) console.error(res.stderr);
       code = res.exit;
-    } catch (e) { code = 0; }
+    } catch (e) {
+      // The guard itself failed (it would not load, or stdin was unreadable).
+      // On a non-owner's turn that must not wave the tool through: the runner
+      // marks such runs OC_GUARDED_RUN=1 in the agent's env, which the hook
+      // inherits from Claude Code and the agent's own shell cannot change.
+      if (process.env.OC_GUARDED_RUN === "1") {
+        console.error("⛔ The permission check could not run, so this is refused on a non-owner's turn.");
+        code = 2;
+      } else code = 0;
+    }
     process.exit(code);
     break;
   }

package/bin/entity.js

@@ -6,15 +6,26 @@
 //   open-claudia entity persona <name> [--relationship owner|trusted|external] [--role ..] [--style ..] [--knows ..] [--mandate ..]
 //   open-claudia entity remove <slug-or-name>
 //   open-claudia entity reindex
+//
+// note/persona/remove/reindex change the notes (and persona mandates) the bot
+// acts on: owner-only, decided by the running bot from the run's attestation
+// (bin/owner-gate), never from OC_CHANNEL_* env. list/show/match are reads.
 
 const fs = require("fs");
 const path = require("path");
 const entities = require("../core/entities");
 
-function run(args) {
+const OWNER_ONLY_VERBS = new Set(["note", "persona", "remove", "reindex"]);
+
+async function run(args) {
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 
+  if (OWNER_ONLY_VERBS.has(cmd)) {
+    const what = cmd === "persona" ? "setting a persona/mandate" : `"entity ${cmd}" changes the bot's notes`;
+    if (!(await require("./owner-gate").requireOwner(what))) return;
+  }
+
   switch (cmd) {
     case "list": {
       const all = entities.listEntities();
@@ -73,20 +84,11 @@ function run(args) {
       // is cleared to do/discuss with that person. Each flag replaces its section
       // wholesale; omit a flag to leave it unchanged.
       //
-      // OWNER-ONLY: setting a mandate/relationship is a privilege operation, so
-      // an external speaker must never reach it (self-escalation). No guarded
-      // speaker (owner turn, CLI, or cron) may proceed. Note: relationship
-      // "owner" set here is still coerced to "external" at runtime for a non-
-      // owner person (R1) — a note can never confer owner powers.
-      try {
-        const relationship = require("../core/relationship");
-        const sp = relationship.speakerFor(process.env.OC_CHANNEL_ADAPTER, process.env.OC_CHANNEL_ID, process.env.OC_CHANNEL_USER_ID);
-        if (relationship.guardActive(sp)) {
-          console.error("⛔ Only the owner can set a persona/mandate.");
-          process.exitCode = 3; return;
-        }
-      } catch (e) { /* no context → owner-equivalent, allowed */ }
-
+      // OWNER-ONLY (gated above): setting a mandate/relationship is a privilege
+      // operation, so nobody but the owner may reach it (self-escalation) — a
+      // guarded turn and an unattributed process alike are refused. Note:
+      // relationship "owner" set here is still coerced to "external" at runtime
+      // for a non-owner person (R1) — a note can never confer owner powers.
       const takeFlag = (flag) => {
         const i = rest.indexOf(flag);
         if (i === -1) return null;

package/bin/ideas.js

@@ -4,14 +4,23 @@
 //   open-claudia ideas remove <id|text>            — remove one
 //   open-claudia ideas show                         — raw file
 //   open-claudia ideas path                         — print the file path
+//
+// add/remove change the backlog the nightly dream works from: owner-only,
+// decided by the running bot from the run's attestation (bin/owner-gate).
 
 const fs = require("fs");
 const ideas = require("../core/ideas");
 
-function run(args) {
+const OWNER_ONLY_VERBS = new Set(["add", "remove", "rm"]);
+
+async function run(args) {
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 
+  if (OWNER_ONLY_VERBS.has(cmd)) {
+    if (!(await require("./owner-gate").requireOwner(`"ideas ${cmd}" changes the bot's ideas backlog`))) return;
+  }
+
   switch (cmd) {
     case "list": {
       const all = ideas.listIdeas();

package/bin/keyring.js

@@ -15,29 +15,30 @@
 //
 // For genuine personal secrets the bot should NOT use unattended, use the
 // vault (/vault) instead — it stays encrypted and locked.
+//
+// Owner only, every verb (exec and list included): the caller must be a live
+// run the bot attributes to the owner.
 
 const keyring = require("../core/keyring");
 
-function run(args) {
+async function run(args) {
   // The keyring is owner infrastructure wholesale: exec runs an arbitrary
   // command with every credential in env, get prints raw values, set/remove
-  // mutate them. No external request ever needs any of it — and the Bash
-  // control-plane gate exempts `keyring exec` as an authorised channel, so
-  // the speaker gate must live here, on the authorised side. Same fail
-  // directions as the file gate: dormant without channel env (owner-local),
-  // denied when resolution fails.
-  const speaker = require("../core/tool-guard").guardedSpeakerFromEnv();
-  if (speaker) {
-    try {
-      require("../core/tool-guard").logGuardEvent({
-        kind: "deny", rule: "external-keyring", command: `keyring ${args.join(" ")}`.slice(0, 300),
-      });
-    } catch (e) { /* logging is best-effort */ }
-    console.error(`⛔ External-speaker guard: the keyring is owner-only — this turn's speaker${speaker.name ? ` (${speaker.name})` : ""} is not the owner.`);
-    console.error("Describe what you need instead; write-tier tool runs escalate to the owner for approval.");
-    process.exitCode = 1;
-    return;
-  }
+  // mutate them, and even list/path map what exists. No other request ever
+  // needs any of it — and the Bash control-plane gate exempts `keyring exec`
+  // as an authorised channel, so the gate must live here, on the authorised
+  // side. EVERY verb needs an attributed owner: whether this process acts for
+  // the owner is answered by the running bot from the run's attestation
+  // (bin/owner-gate), never from OC_CHANNEL_* env — a stripped or rewritten
+  // env, and a process with no live run behind it, are refused.
+  const owner = await require("./owner-gate").requireOwner("the keyring", {
+    exitCode: 1,
+    onRefuse: (caller) => require("../core/tool-guard").logGuardEvent({
+      kind: "deny", rule: "external-keyring", caller: caller && caller.attributed ? "guarded" : "unattributed",
+      command: `keyring ${args.join(" ")}`.slice(0, 300),
+    }),
+  });
+  if (!owner) return;
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 

package/bin/lessons.js

@@ -4,14 +4,23 @@
 //   open-claudia lessons remove <id|text>           — remove one
 //   open-claudia lessons show                        — raw file + injected block
 //   open-claudia lessons path                        — print the file path
+//
+// add/remove change rules loaded into EVERY conversation: owner-only, decided
+// by the running bot from the run's attestation (bin/owner-gate).
 
 const fs = require("fs");
 const lessons = require("../core/lessons");
 
-function run(args) {
+const OWNER_ONLY_VERBS = new Set(["add", "remove", "rm"]);
+
+async function run(args) {
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 
+  if (OWNER_ONLY_VERBS.has(cmd)) {
+    if (!(await require("./owner-gate").requireOwner(`"lessons ${cmd}" changes the bot's always-loaded rules`))) return;
+  }
+
   switch (cmd) {
     case "list": {
       const all = lessons.listLessons();

package/bin/loopback-client.js

@@ -7,6 +7,7 @@ const fs = require("fs");
 const path = require("path");
 const http = require("http");
 const configDir = require(path.join(__dirname, "..", "config-dir"));
+const botEndpoint = require(path.join(__dirname, "..", "core", "bot-endpoint"));
 
 function readLoopbackInfo() {
   try {
@@ -46,6 +47,9 @@ function context() {
     // Runner-minted HMAC binding canonicalUserId to what the bot stamped for
     // this turn; the loopback's owner gates verify it (see core/speaker-attest).
     speakerAttest: process.env.OC_SPEAKER_ATTEST || null,
+    // Runner-minted attest for THIS run; the bot answers who the run acts
+    // for only while the run is live (see core/speaker-attest registerRun).
+    runAttest: process.env.OC_RUN_ATTEST || null,
     provider: process.env.OC_PROVIDER || null,
     providerSettings,
     project: process.env.OC_PROJECT || null,
@@ -68,9 +72,19 @@ function requireContext() {
   return ctx;
 }
 
-function postJson(kind, body) {
+// `verified: true` is for answers this process acts on (tool-gate): the
+// request only goes to an endpoint served by this process's own bot (see
+// core/bot-endpoint), never to whatever OC_SEND_URL names.
+function postJson(kind, body, { verified = false } = {}) {
   const ctx = requireContext();
-  const u = new URL(ctx.sendUrl);
+  let u;
+  if (verified) {
+    const check = botEndpoint.verifyEndpointCached(ctx.sendUrl);
+    if (!check.ok) return Promise.reject(new Error(`the bot's address could not be verified: ${check.reason}`));
+    u = new URL(check.url);
+  } else {
+    u = new URL(ctx.sendUrl);
+  }
   const requestedProject = body && body.project ? String(body.project) : ctx.project;
   const sameProject = !ctx.project || !requestedProject || requestedProject === ctx.project;
   const payload = JSON.stringify({
@@ -81,6 +95,7 @@ function postJson(kind, body) {
     userId: ctx.userId,
     canonicalUserId: ctx.canonicalUserId,
     speakerAttest: ctx.speakerAttest,
+    runAttest: ctx.runAttest,
     provider: ctx.provider,
     providerSettings: ctx.providerSettings,
     project: requestedProject,
@@ -127,4 +142,48 @@ function postJson(kind, body) {
   });
 }
 
-module.exports = { context, requireContext, postJson, readLoopbackInfo };
+// Who this process acts for, as the RUNNING BOT decides it. Needs no chat
+// context: a process with no live run behind it (stripped env, detached from
+// a finished turn, started outside the bot) comes back unattributed, and so
+// does every failure to ask. Unattributed is never the owner. The question
+// only goes to an endpoint served by this process's own bot — a server the
+// env points at is not believed (core/bot-endpoint).
+const UNATTRIBUTED = Object.freeze({ attributed: false, owner: false, guarded: true, kind: "unattributed" });
+
+function whoami({ timeoutMs = 5000 } = {}) {
+  const ctx = context();
+  if (!ctx.runId || !ctx.runAttest || !ctx.sendUrl || !ctx.sendToken) return Promise.resolve(UNATTRIBUTED);
+  const check = botEndpoint.verifyEndpointCached(ctx.sendUrl);
+  if (!check.ok) return Promise.resolve(Object.freeze({ ...UNATTRIBUTED, reason: check.reason }));
+  const u = new URL(check.url);
+  const payload = JSON.stringify({ runId: ctx.runId, originRunId: ctx.runId, runAttest: ctx.runAttest });
+  return new Promise((resolve) => {
+    const req = http.request({
+      method: "POST",
+      hostname: u.hostname,
+      port: u.port,
+      path: "/whoami",
+      timeout: timeoutMs,
+      headers: {
+        Authorization: `Bearer ${ctx.sendToken}`,
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+      },
+    }, (res) => {
+      let out = "";
+      res.on("data", (c) => { out += c; });
+      res.on("end", () => {
+        try {
+          const caller = res.statusCode === 200 ? JSON.parse(out).caller : null;
+          resolve(caller && caller.attributed === true ? caller : UNATTRIBUTED);
+        } catch (_) { resolve(UNATTRIBUTED); }
+      });
+    });
+    req.on("timeout", () => { req.destroy(); resolve(UNATTRIBUTED); });
+    req.on("error", () => resolve(UNATTRIBUTED));
+    req.write(payload);
+    req.end();
+  });
+}
+
+module.exports = { context, requireContext, postJson, readLoopbackInfo, whoami, UNATTRIBUTED };

package/bin/owner-gate.js

@@ -0,0 +1,39 @@
+// Owner-only CLI verbs (permission Phase 0). Whether a process acts for the
+// owner is decided by the RUNNING BOT (loopback whoami over OC_RUN_ID +
+// OC_RUN_ATTEST), never by this process's own env: OC_CHANNEL_* and
+// OC_CANONICAL_USER_ID are ignored, and a process with no live run behind it
+// (a stripped env, a detached leftover, a plain terminal) is unattributed —
+// which is never the owner.
+
+const { whoami } = require("./loopback-client");
+
+function hasRunAttest(env = process.env) {
+  return !!(env.OC_RUN_ID && env.OC_RUN_ATTEST);
+}
+
+function refusal(what, caller) {
+  const why = !(caller && caller.attributed)
+    ? `this process is not attributed to an owner chat turn${caller && caller.reason ? ` (${caller.reason})` : ""}`
+    : caller.name ? `this turn acts for ${caller.name}, not the owner`
+      : "this turn does not act for the owner";
+  return `⛔ Owner only: ${what} — ${why}.`;
+}
+
+// Resolves the caller when it is an attributed owner, else prints one refusal
+// line, sets process.exitCode and resolves null. With no run attestation at
+// all the refusal happens synchronously (before the first await), so callers
+// that do not await still see the exit code at once.
+async function requireOwner(what, { exitCode = 3, onRefuse = null } = {}) {
+  const refuse = (caller) => {
+    if (typeof onRefuse === "function") { try { onRefuse(caller); } catch (_) { /* best-effort */ } }
+    console.error(refusal(what, caller));
+    process.exitCode = exitCode;
+    return null;
+  };
+  if (!hasRunAttest()) return refuse({ attributed: false });
+  const caller = await whoami();
+  if (caller && caller.attributed === true && caller.owner === true) return caller;
+  return refuse(caller);
+}
+
+module.exports = { requireOwner, hasRunAttest, refusal };

package/bin/pack.js

@@ -6,15 +6,25 @@
 //   open-claudia pack migrate               — fold ~/.claude/skills into packs
 //   open-claudia pack remove <dir>
 //   open-claudia pack reindex
+//
+// skill/kind/archive/restore/remove/reindex/migrate change the packs the bot
+// works from: owner-only, decided by the running bot from the run's
+// attestation (bin/owner-gate). The listing/show/match/search verbs are reads.
 
 const fs = require("fs");
 const path = require("path");
 const packs = require("../core/packs");
 
-function run(args) {
+const OWNER_ONLY_VERBS = new Set(["skill", "kind", "archive", "restore", "remove", "reindex", "migrate"]);
+
+async function run(args) {
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 
+  if (OWNER_ONLY_VERBS.has(cmd)) {
+    if (!(await require("./owner-gate").requireOwner(`"pack ${cmd}" changes the bot's packs`))) return;
+  }
+
   switch (cmd) {
     case "list": {
       const all = packs.listPacks();

package/bin/tool.js

@@ -31,6 +31,14 @@
 // --yes-destructive — get the user's approval first; the flag records that
 // deliberate step. Read-only tools run freely.
 //
+// Who a run acts for is decided by the RUNNING BOT (loopback whoami over the
+// run's attestation), never by this process's env: the owner's turn keeps the
+// flag gate above; a staff turn's write/destructive run is decided in the bot
+// (tool-gate: mandate vet, else a held owner approval); a process with no live
+// run behind it may run write/destructive only with an owner's --approval
+// token. Changing tools (add/set/scaffold/edit/note/remove/migrate/lib set) is
+// owner-only.
+//
 // Fix before fork: when a tool is wrong, prefer `tool set` (metadata), `tool
 // note` (docs), or `tool edit` (body) over adding a near-duplicate. Hardcoded
 // secrets BLOCK a save; other lints (requires/keyring mismatch, syntax,
@@ -110,10 +118,22 @@ function reportSafety(t) {
   }
 }
 
+// Verbs that change the tool set, a tool's source/metadata, its TOOL.md, or the
+// shared _lib: owner-only. Reads (list/search/show/lib list|show/path) and
+// `run` (gated per tier below) are not in this set.
+const OWNER_ONLY_VERBS = new Set(["add", "save", "set", "fix", "scaffold", "new", "edit", "note", "migrate", "remove", "rm"]);
+const OWNER_ONLY_LIB_VERBS = new Set(["set", "add"]);
+
 async function run(args) {
   const cmd = (args[0] || "list").toLowerCase();
   const rest = args.slice(1);
 
+  const libVerb = cmd === "lib" ? String(rest[0] || "list").toLowerCase() : "";
+  if (OWNER_ONLY_VERBS.has(cmd) || OWNER_ONLY_LIB_VERBS.has(libVerb)) {
+    const what = `"tool ${libVerb ? `lib ${libVerb}` : cmd}" changes the bot's tools`;
+    if (!(await require("./owner-gate").requireOwner(what))) return;
+  }
+
   // Auto-migrate legacy flat-file tools to the directory layout on first use
   // (idempotent, one git commit per tool, telemetry carried over).
   if (cmd !== "path") {
@@ -376,9 +396,14 @@ async function run(args) {
       // calling this tool) gate on the tier the OUTERMOST invocation approved
       // instead — argv flags can't fabricate approval.
       const gate = tools.runGate(t, toolArgs, process.env);
+      // A tool's manifest is the contract: a verb it does not declare is
+      // refused for EVERY caller, before any vet, escalation or approval
+      // redemption — there is no tier to judge or to approve.
+      if (gate.undeclared) { console.error(gate.message); process.exitCode = 3; return; }
       const approvals = require("../core/approvals");
       const commandLine = approvals.formatApprovedCommand(["open-claudia", "tool", "run", t.name, ...toolArgs]);
       let approvedVia = "";
+      let approvedTier = "";
 
       // B10: creds preflight BEFORE any approval machinery. A missing keyring
       // key used to be discovered only after the one-shot --approval token was
@@ -395,56 +420,53 @@ async function run(args) {
         }
       }
 
-      // ── Phase 3.5: per-speaker external gate ──────────────────────────────
-      // When this run is FOR an external (non-owner) speaker, a write/destructive
-      // tool cannot rely on the agent's own --yes flag — the external could have
-      // talked it into passing it. Route mutating runs through the independent
-      // mandate vet: an action the owner-authored mandate clearly covers carries
-      // the owner's authority and runs; anything else is HELD and the owner is
-      // asked (Approve/Deny/Always-allow), then re-run via a one-shot --approval
-      // token. A token already present means the owner just approved → skip.
-      // Owner / no-context speakers are never gated here, so the legacy owner
-      // path is byte-for-byte unchanged (R9/R14).
-      if (!approvalId && (gate.tier === "write" || gate.tier === "destructive")) {
-        let speaker = null;
-        try {
-          const relationship = require("../core/relationship");
-          const sp = relationship.speakerFor(process.env.OC_CHANNEL_ADAPTER, process.env.OC_CHANNEL_ID, process.env.OC_CHANNEL_USER_ID);
-          if (relationship.guardActive(sp)) speaker = sp; // else owner/no-context → ungated
-        } catch (e) { speaker = null; }
-        if (speaker) {
-          const enforcer = require("../core/enforcer");
-          let vet;
-          try { vet = await enforcer.vetAction(speaker, { command: commandLine, tier: gate.tier }); }
-          catch (e) { vet = { decision: "escalate", reason: "vet error — failing closed" }; }
-          if (vet.decision === "allow") {
+      // ── Who this run acts for, decided by the RUNNING BOT ─────────────────
+      // Read-only runs are ungated for everyone. For write/destructive the
+      // bot answers from the run's attestation (whoami), never from this
+      // process's env (OC_CHANNEL_* can be unset or rewritten by the shell):
+      //   • the owner's run → the flag/approval gate below, unchanged;
+      //   • a guarded (non-owner) run → a --yes the speaker may have talked the
+      //     agent into proves nothing, so the bot decides (tool-gate): an action
+      //     the owner-authored mandate clearly covers carries the owner's
+      //     authority; anything else is HELD with an owner card (then re-run
+      //     via a one-shot --approval token) or blocked. A token already
+      //     present means the owner approved → redeem it below;
+      //   • no live run behind this process → refused unless it presents an
+      //     owner's --approval token.
+      if (gate.tier === "write" || gate.tier === "destructive") {
+        const client = require("./loopback-client");
+        const caller = await client.whoami();
+        if (!caller.attributed) {
+          if (!approvalId) {
+            console.error(`⛔ ${t.name} (${gate.tier}) refused — not attributed to a live chat turn; write actions need a chat turn or an owner approval token.${caller.reason ? ` (${caller.reason})` : ""}`);
+            process.exitCode = 3; return;
+          }
+        } else if (!caller.owner && !approvalId) {
+          let decision = null;
+          try {
+            const ctx = client.context();
+            if (!ctx.sendUrl || !ctx.sendToken || !ctx.channelId || !ctx.adapterId) throw new Error("no chat context to ask the bot from");
+            decision = await client.postJson("tool-gate", {
+              tool: t.name, verb: tools.invokedVerb(toolArgs), tier: gate.tier, command: commandLine,
+            }, { verified: true });
+          } catch (e) {
+            decision = { decision: "blocked", reason: `the bot could not vet this action (${e.message})` };
+          }
+          const who = (decision && decision.name) || caller.name || "the external contact";
+          if (decision && decision.decision === "allow") {
             // The owner's mandate pre-authorizes this class of action → it carries
             // the owner's approval, satisfying the risk gate without a redundant --yes.
             approvedVia = "mandate";
+          } else if (decision && decision.decision === "held" && decision.approvalId) {
+            console.error(`🛡️ Held for owner approval — ${who} is outside mandate for this ${gate.tier} action.`);
+            console.error(`Approval ${decision.approvalId} was raised to the owner. End the turn and tell them you're checking; a wakeup fires when they decide. Do NOT retry or re-request.`);
+            process.exitCode = 5; return;
           } else {
-            const esc = await enforcer.escalate({
-              speaker, kind: "action", command: commandLine, tier: gate.tier, reason: vet.reason,
-              canonicalUserId: process.env.OC_CANONICAL_USER_ID || "",
-              userId: process.env.OC_CHANNEL_USER_ID || "",
-              provider: process.env.OC_PROVIDER || "",
-              providerSettings: (() => {
-                try {
-                  const value = JSON.parse(process.env.OC_PROVIDER_SETTINGS || "{}");
-                  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-                } catch (_) { return {}; }
-              })(),
-              project: process.env.OC_PROJECT || "",
-              projectDir: process.env.OC_PROJECT_DIR || "",
-              sessionId: process.env.OC_SESSION_ID || process.env.OC_LAST_SESSION_ID || "",
-              previousSessionId: process.env.OC_PREVIOUS_SESSION_ID || "",
-              originRunId: process.env.OC_RUN_ID || process.env.OC_ORIGIN_RUN_ID || "",
-            });
-            if (esc.escalated) {
-              console.error(`🛡️ Held for owner approval — ${speaker.name || "the external contact"} is outside mandate for this ${gate.tier} action.`);
-              console.error(`Approval ${esc.id} was raised to the owner. End the turn and tell them you're checking; a wakeup fires when they decide. Do NOT retry or re-request.`);
-              process.exitCode = 5; return;
+            if (decision && decision.unreachable) {
+              console.error(`⛔ Blocked — ${who} is outside mandate and the owner could not be reached to approve.`);
+            } else {
+              console.error(`⛔ Blocked — ${(decision && decision.reason) || "the bot did not clear this action"}; failing closed.`);
             }
-            console.error(`⛔ Blocked — ${speaker.name || "the external contact"} is outside mandate and the owner could not be reached to approve.`);
             process.exitCode = 3; return;
           }
         }
@@ -455,12 +477,15 @@ async function run(args) {
           console.error("⛔ --approval tokens are only honored on top-level runs, not nested tool calls.");
           process.exitCode = 3; return;
         }
-        const redeemed = approvals.consume(approvalId, commandLine);
+        // Bound to the tier the owner approved: a run that now resolves above
+        // it is refused without burning the token.
+        const redeemed = approvals.consume(approvalId, commandLine, { tier: gate.tier });
         if (!redeemed.ok) {
           console.error(`⛔ Approval ${approvalId} rejected: ${redeemed.reason}. The run stays blocked.`);
           process.exitCode = 3; return;
         }
         approvedVia = "chat-approval";
+        approvedTier = approvals.approvedTier(redeemed.record, gate.tier);
         console.error(`✅ Approval ${approvalId} redeemed (single use) — running.`);
       } else if (!gate.ok && approvedVia !== "mandate") {
         // Chat-approval fallback: an unflagged destructive top-level run inside
@@ -497,12 +522,13 @@ async function run(args) {
             `Re-run with --yes-destructive only after the user explicitly approves.`);
           process.exitCode = 3; return;
         }
-        const redeemed = approvals.consume(reqId, commandLine);
+        const redeemed = approvals.consume(reqId, commandLine, { tier: gate.tier });
         if (!redeemed.ok) {
           console.error(`⛔ Approval ${reqId || "(missing)"} rejected: ${redeemed.reason}. The run stays blocked.`);
           process.exitCode = 3; return;
         }
         approvedVia = "chat-approval";
+        approvedTier = approvals.approvedTier(redeemed.record, gate.tier);
         console.error(`✅ Approval ${reqId} redeemed (single use) — running.`);
       }
 
@@ -516,12 +542,14 @@ async function run(args) {
       } catch (e) { /* advisory */ }
       // Composition inheritance: export the approved tier + call chain so any
       // tool this tool shells into is gated by what the human actually approved
-      // at the top — an already-inherited tier passes through UNCHANGED.
+      // at the top — an already-inherited tier passes through UNCHANGED. A
+      // redeemed approval exports exactly the tier on the owner's card (a write
+      // approval never unlocks a nested destructive tool).
       const env = tools.runEnv(t);
       const parentStack = String(process.env.OPEN_CLAUDIA_TOOL_STACK || "").trim();
       env.OPEN_CLAUDIA_APPROVED_TIER = parentStack
         ? (tools.normalizeRisk(process.env.OPEN_CLAUDIA_APPROVED_TIER) || "read-only")
-        : (approvedVia === "chat-approval" ? "destructive"
+        : (approvedVia === "chat-approval" ? (approvedTier || gate.tier)
           : approvedVia === "mandate" ? gate.tier
           : tools.approvedTierFromArgv(toolArgs));
       env.OPEN_CLAUDIA_TOOL_STACK = parentStack ? `${parentStack}>${t.name}` : t.name;