@nelsonlongxiang/dsh-open-a2a-net 0.6.37 → 0.6.39

package/lib/config.js

@@ -0,0 +1,125 @@
+/** The plugin row's configuration: the `Config` interface and its Schemastery schema (moved out of index.ts, #77). */
+import s from '@deepseek-ai/schemastery';
+import { TASK_STALE_TTL_MS } from "./task-ledger.js";
+import { DEFAULT_TARGET_QUEUE_CAP } from "./queue-guard.js";
+/** Schemastery configuration for the A2A client plugin row. */
+export const Config = s.object({
+    apiKey: s.string().default(''),
+    session: s.string().default(''),
+    team: s.string().default('dsh'),
+    /** S4 fix ③: host-side (agent-less) routing calls — audit them (default) or refuse outright. */
+    gateAgentLessCalls: s.union(['audit', 'refuse']).default('audit'),
+    settlementAuth: s.union(['off', 'observe', 'enforce']).default('observe'),
+    announce: s.boolean().default(false),
+    isolated: s.boolean().default(false),
+    forwardDirect: s.boolean().default(true),
+    agentName: s.string().default('DeepSeek Harness A2A node'),
+    peers: s.array(s.string()).default([]),
+    delegates: s.array(s.object({ name: s.string(), url: s.string(), publicKey: s.string().default('') })).default([]),
+    dshHome: s.string().default(''),
+    sessionNodes: s.boolean().default(true),
+    wakeJoinedOnBoot: s.boolean().default(false),
+    wakePrewarmDelayMs: s.number().default(10_000),
+    wakePrewarmQuietMs: s.number().default(5_000),
+    wakeBootStaggerMs: s.number().default(3_000),
+    wakeReconcile: s.boolean().default(true),
+    wakeReconcileIntervalMs: s.number().default(60_000),
+    wakeReconcileBackoffBaseMs: s.number().default(5_000),
+    wakeReconcileMaxBackoffMs: s.number().default(600_000),
+    /**
+     * S4 (gh#11 N7): the joinable-team curation list. A model calling
+     * a2a_team_join may only declare membership in a team with an EXACT
+     * entry here — trailing-`*` patterns are readable but authorize nothing
+     * (no mint rights: a pattern pre-authorizing every future name under it
+     * would let a model mint teams nobody created). Default empty: the
+     * owner's no-self-join ruling, institutionalized as default-deny; a
+     * refused join carries guidance instead of failing silently.
+     */
+    teamJoinAllowlist: s.array(s.string()).default([]),
+    seatNames: s.dict(s.any()).default({}),
+    /**
+     * S3 (phase-2 default, owner ruling 2026-09-01): route dispatch checks
+     * caller↔target shared team membership before addressing — a session
+     * with no declared team has no network (the unteamed-peer defect the
+     * owner reproduced on 4080 and locally). Fleet compatibility rides the
+     * roster capability flag (0.5.44 cards advertise roster:true; older
+     * peers read as legacy). Set false to restore the open outbound seam.
+     */
+    teamScopeRouting: s.boolean().default(true),
+    /**
+     * S5 (default-on, owner directive 2026-10-20): the information-plane
+     * tools answer from the joined-team scope only — a2a_teams lists
+     * [this host] rows plus peer rows serving a joined team (note field
+     * explains the scope); a2a_status narrows peers / in-flight / activity
+     * to that scope (local traffic and idempotency aggregates stay);
+     * a2a_probe sweeps serving peers and refuses a single URL whose
+     * verified card cannot prove service. A host whose nodes declare no
+     * teams keeps host-internal facts only. Set false to restore
+     * fleet-wide disclosure.
+     */
+    teamScopeInfo: s.boolean().default(true),
+    /**
+     * Peer boundary model — connection layer: an empty list keeps the
+     * historical open-referral posture; a non-empty list admits a referral
+     * only when its host matches an entry (exact host[:port], bare domain
+     * suffix, or full URL). Seeds from `peers` are owner-configured and
+     * unaffected.
+     */
+    peerAllowlist: s.array(s.string()).default([]),
+    /**
+     * Peer boundary model — connection layer: when false, referral URLs are
+     * neither learned nor offered; the tracked set stays the configured seed
+     * set for the lifetime of the config that named them.
+     */
+    referralLearning: s.boolean().default(true),
+    /**
+     * gh#8 (N9): team-name resolution rides the operator-established peer
+     * basis (config seeds + delegates) only; the referral-learned tail's
+     * self-published card claims do not bind team names. Set true to restore
+     * the legacy whole-store basis (fleet migration window).
+     */
+    referralTeamResolution: s.boolean().default(false),
+    /**
+     * #19 D2 (ruling final, owner-level knob): how much of a session team's
+     * activity EXCERPT the card face publishes in sessionTeams descriptions.
+     * 'full' (default) keeps the verbatim tail excerpt; 'masked' truncates
+     * to a shape-only prefix; 'off' omits the description field entirely.
+     * Titles and team handles stay in every tier — the knob is the excerpt,
+     * not the listing.
+     */
+    exposureExcerpt: s.union(['full', 'masked', 'off']).default('full'),
+    /**
+     * gh#9+gh#10 OriginClaim window: absent envelopes still walk N3 during
+     * the window (counted as legacyInbound); closing it rejects them like
+     * failed signatures. See docs/protocol/delivery-origin-auth.md §4.
+     */
+    originClaimWindow: s.boolean().default(true),
+    /**
+     * OriginClaim unbound window: also sign/accept the legacy envelope that
+     * names no audience (counted as unboundInbound); closing it leaves the
+     * audience-bound form only. See docs/protocol/delivery-origin-auth.md §2.1.
+     */
+    originClaimUnboundWindow: s.boolean().default(true),
+    /** Extra OriginClaim audience origins (port-mapped/proxied hosts). */
+    originClaimAudiences: s.array(s.string()).default([]),
+    /** OriginClaim callerUrl override for pocket-tunneled hosts; '' = auto. */
+    originClaimUrl: s.string().default(''),
+    /**
+     * v0.5.23 (async-stall): delay before a delivered-but-unconsumed async
+     * route re-wakes its target with a one-line nudge (defect
+     * t-mt6nd0sq-hxuhj6). 0 disables the nudge entirely.
+     */
+    asyncNudgeDelayMs: s.number().default(120_000),
+    /** gh#224: at most this many receipt-owing tasks queue for one target; the next is refused (-32009). 0 disables. */
+    targetQueueCap: s.number().default(DEFAULT_TARGET_QUEUE_CAP),
+    stateColdRowsTtlMs: s.number().default(5_000),
+    cardCacheTtlMs: s.number().default(60_000),
+    cardCacheNegativeTtlMs: s.number().default(30_000),
+    remoteRowsTtlMs: s.number().default(15_000),
+    cardTtlMs: s.number().default(172_800_000),
+    flushTimeoutMs: s.number().default(300_000),
+    routeTimeoutMs: s.number().default(1_800_000),
+    taskStaleTtlMs: s.number().default(TASK_STALE_TTL_MS),
+    nativeTeamsInbound: s.boolean().default(false),
+    nativeRoundWaitMs: s.number().default(180_000),
+});

package/lib/direct-forward.js

@@ -2,60 +2,128 @@
 import { DEFAULT_HOP_BUDGET, guardHeader, mintGuard } from "./recursion-guard.js";
 import { briefOf } from "./task-ledger.js";
 import { parseReceipt } from "./receipt.js";
+import { splitCanvasOwner } from "./canvas-id.js";
+import { claimCovers } from "./task-auth.js";
+/** An early receipt waits at most this long for its forward row to be born (#298). */
+export const BIRTH_WAIT_CAP_MS = 60_000;
+/** Birth barrier exists only for eligible, actively dispatched tasks; receipts never reserve a slot. */
+export class ForwardBirths {
+    waitCapMs;
+    pending = new Map();
+    constructor(waitCapMs = BIRTH_WAIT_CAP_MS) {
+        this.waitCapMs = waitCapMs;
+    }
+    /**
+     * Resolves when the birth is released or after the cap, whichever is first. After the cap the receipt
+     * is judged by the normal rules against whatever row exists then — never accepted in advance (#298).
+     */
+    wait(taskId) {
+        const birth = this.pending.get(taskId);
+        if (birth === undefined)
+            return undefined;
+        let timer;
+        const cap = new Promise(resolve => { timer = setTimeout(resolve, this.waitCapMs); timer.unref?.(); });
+        return Promise.race([birth, cap]).finally(() => clearTimeout(timer));
+    }
+    begin(taskId) {
+        if (this.pending.size >= 64 || this.pending.has(taskId))
+            return undefined;
+        let release;
+        this.pending.set(taskId, new Promise(resolve => { release = resolve; }));
+        return () => { this.pending.delete(taskId); release(); };
+    }
+}
 export function createDirectForward(d) {
     return async (request) => {
-        const refuse = (why) => ({ ok: false, code: -32000, task_id: request.taskId, error: 'not forwarded: ' + why });
+        const refuse = (why, next) => ({ ok: false, code: -32000, task_id: request.taskId, error: 'not forwarded: ' + why, ...(next !== undefined ? { next } : {}) });
+        const publish = 'run `a2a-net publish` to renew this CLI deposit on its home host, then send again with a new task id';
         if (!d.enabled())
-            return refuse('forwardDirect is off');
+            return refuse('forwardDirect is off', 'ask this host\'s operator to set forwardDirect: true (the default since 0.6.38)');
         if (d.isolated())
-            return refuse('host is isolated');
+            return refuse('host is isolated', 'this host forwards nothing while isolated; deposit the CLI on another home host');
         if (request.guarded)
             return refuse('an inbound X-A2A-Guard is present; already forwarded');
         if (!request.localCliProof || !d.deposited(request.caller))
-            return refuse('caller is not a proven online local CLI deposit');
-        const scope = await d.scope(request.caller, request.team);
+            return refuse('caller is not a proven online local CLI deposit', publish);
+        // #282 S2: candidates honour an owner-qualified id; scope, the peer, the receivers and the ledger see the plain team.
+        const plainTeam = splitCanvasOwner(request.team).team;
+        const scope = await d.scope(request.caller, plainTeam);
         if (!scope.ok)
-            return refuse('target is outside sender scope: ' + scope.error);
+            return refuse('target is outside sender scope: ' + scope.error, `ask this host's operator to link ${request.team} here: drag it (or one of its members) into a canvas team on this host`);
         const failures = [];
         const directory = await d.candidates(request.team, failures, request.caller);
         const guard = guardHeader({ ...mintGuard(), hopBudget: DEFAULT_HOP_BUDGET - 1 });
         for (const url of directory.urls) {
             if (!d.deposited(request.caller))
-                return refuse('local CLI deposit expired before dispatch');
-            if (request.team.includes('/canvas/')) {
-                const card = await directory.card(url);
-                const org = card?.canvasOrg?.find(row => row.team === request.team);
-                const receivers = org?.members.filter(member => member !== request.caller) ?? [];
-                if (receivers.length === 0 || receivers.some(member => !d.memberLinked(member))) {
-                    failures.push(url + ': forwarding a canvas requires a direct operator link to every receiving member for its receipt return path');
+                return refuse('local CLI deposit expired before dispatch', publish);
+            const peerCard = await directory.card(url);
+            const receivers = plainTeam.includes('/canvas/') ? peerCard?.canvasOrg?.find(row => row.team === plainTeam)?.members.filter(member => member !== request.caller) : undefined;
+            if (plainTeam.includes('/canvas/')) {
+                // #282 S3 (same team authorizes): the owner's signed canvas is the return path; receipts settle only from these frozen receivers on this peer key (#274).
+                if (receivers === undefined || receivers.length === 0) {
+                    failures.push(url + ': the owner card lists no receiving member of this canvas');
                     continue;
                 }
             }
-            const answer = await d.dispatch(url, request, guard);
-            const result = !answer.ok && answer.ownBudgetExhausted === true ? { ...answer, code: -32005 } : answer;
-            d.activity(request.team, url, result.ok);
-            if (result.ok || result.code === -32005) {
-                // A receipt owes no receipt; native bridge rounds have no A2A receipt contract.
-                // Match routeTrunk/trackOwedTask rather than manufacturing an unpayable debt.
-                if (parseReceipt(request.message) !== null)
-                    return { ...result, receipt: 'none' };
-                if (result.ok && result.bridge !== undefined)
-                    return { ...result, receipt: 'none' };
-                const card = await directory.card(url);
-                const birth = { forwarded: true, ...(card?.publicKey ? { peerKey: card.publicKey } : {}), ...(card?.session ? { peerHost: card.session } : {}), deliveredTo: result.ok ? result.deliveredTo ?? request.team : request.team };
-                // Exactly one outbound row. A completed sync response is receiptless bookkeeping.
-                if (result.ok && (result.task_status === 'TASK_STATE_COMPLETED' || result.receipt === 'none'))
-                    d.ledger.trackReceiptless(request.taskId, request.team, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
-                else
-                    d.ledger.track(request.taskId, request.team, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
-                return result;
+            // Reserve only after all eligibility/receiver-link gates. A receipt owes no receipt.
+            const receipt = parseReceipt(request.message) !== null;
+            const release = receipt ? () => { } : d.births.begin(request.taskId);
+            if (release === undefined)
+                return refuse('forward receipt correlation capacity is full', 'wait for in-flight forwards to settle, then send again with a new task id');
+            try {
+                // The same selected-peer snapshot supplies both return-link gate and settlement birth.
+                const answer = await d.dispatch(url, plainTeam === request.team ? request : { ...request, team: plainTeam }, guard);
+                const result = !answer.ok && answer.ownBudgetExhausted === true ? { ...answer, code: -32005 } : answer;
+                d.activity(plainTeam, url, result.ok);
+                if (result.ok || result.code === -32005) {
+                    // A receipt owes no receipt; native bridge rounds have no A2A receipt contract.
+                    // Match routeTrunk/trackOwedTask rather than manufacturing an unpayable debt.
+                    if (parseReceipt(request.message) !== null)
+                        return { ...result, receipt: 'none' };
+                    if (result.ok && result.bridge !== undefined)
+                        return { ...result, receipt: 'none' };
+                    const deliveredTo = result.ok ? result.deliveredTo : undefined;
+                    const birth = { forwarded: true, ...(request.auth !== undefined ? { auth: request.auth } : {}), ...(peerCard?.publicKey ? { peerKey: peerCard.publicKey } : {}), ...(peerCard?.session ? { peerHost: peerCard.session } : {}), ...(deliveredTo !== undefined ? { deliveredTo } : {}), ...(receivers !== undefined ? { receiverMembers: receivers } : {}) };
+                    // Exactly one outbound row. A completed sync response is receiptless bookkeeping.
+                    if (result.ok && (result.task_status === 'TASK_STATE_COMPLETED' || result.receipt === 'none'))
+                        d.ledger.trackReceiptless(request.taskId, plainTeam, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
+                    else
+                        d.ledger.track(request.taskId, plainTeam, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
+                    return result;
+                }
+                // The shared dispatcher's sync recovery query may prove a definitive failed
+                // outcome; like routeTrunk, that is an eligible miss, not an uncertain -32005.
+                failures.push(url + ': ' + result.error);
+                if (result.code === -32002 || result.code === -32003)
+                    return { ...result, task_id: request.taskId };
+            }
+            finally {
+                release();
             }
-            // The shared dispatcher's sync recovery query may prove a definitive failed
-            // outcome; like routeTrunk, that is an eligible miss, not an uncertain -32005.
-            failures.push(url + ': ' + result.error);
-            if (result.code === -32002 || result.code === -32003)
-                return { ...result, task_id: request.taskId };
         }
-        return { ok: false, code: -32004, task_id: request.taskId, error: 'forwarding to "' + request.team + '" failed: ' + (failures.join('; ') || 'no eligible peer candidate') };
+        const noReceiver = failures.some(f => f.includes('lists no receiving member'));
+        const next = noReceiver ? `the owner's canvas ${plainTeam} lists no member besides you; ask its owner to add one, or route to a member's own handle` : failures.length === 0 ? `no linked peer lists ${request.team}; check the name with \`a2a-net teams\`` : undefined;
+        return { ok: false, code: -32004, task_id: request.taskId, error: 'forwarding to "' + request.team + '" failed: ' + (failures.join('; ') || 'no eligible peer candidate'), ...(next !== undefined ? { next } : {}) };
     };
 }
+/**
+ * #282 S3 (same team authorizes): the admission basis for a receipt delivered to a local CLI mailbox
+ * from a member the home never linked — only for that CLI's own pending forward, only from a receiver
+ * frozen at birth, only when the body-bound (Sig3) claim's card key is the frozen peer key. Anything else:
+ * undefined. Trust assumption (design D2): the selected owner host is honest about its own canvas — it may
+ * list any label as a receiver, including one of this host's session labels in the same zone.
+ */
+export function forwardReceiptBasis(row, caller, cliHandle, claim) {
+    // The signer's zone must cover the caller label: B never signs for another zone's member (review of #287 M4).
+    if (!claimCovers(caller, claim.caller))
+        return undefined;
+    if (row === undefined || row.status !== 'pending' || row.forwarded !== true || row.sender?.kind !== 'cli' || row.sender.id !== cliHandle)
+        return undefined;
+    // Body-bound (Sig3) only: a stripped Sig3 would let a captured envelope carry another body (review of #287 P3-1).
+    if (!claim.bound || claim.bodyBound !== true || row.peerKey === undefined || claim.card.publicKey !== row.peerKey)
+        return undefined;
+    // A legacy row's deliveredTo may be the canvas handle itself (#272/#275): never a receiver.
+    if (row.deliveredTo !== undefined && (row.deliveredTo === row.team || row.deliveredTo.includes('/canvas/')))
+        return undefined;
+    return (row.deliveredTo !== undefined ? [row.deliveredTo] : row.receiverMembers ?? []).includes(caller) ? `peer-org:${row.team}` : undefined;
+}

package/lib/faces/admin.js

@@ -19,6 +19,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { canvasNameReserved as reservedCanvasName, isRemoteMemberRef, validRemoteMemberRef } from "../canvas-store.js";
+import { qualifiedCanvasId } from "../canvas-id.js";
 import { refreshPeerCard, registerCanvasNotify } from "./canvas-notify.js";
 import { CLI_HANDLE_RE } from "../cli-deposit.js";
 import { applyOwnerSettings, parseSeatNames } from "../owner-settings.js";
@@ -125,6 +126,7 @@ export function registerAdminFaces(webServer, d) {
                 const body = JSON.stringify({
                     nodes: true,
                     zone: config.team,
+                    ownerHost: d.ownCardUrl,
                     version: PLUGIN_VERSION,
                     // gh#193: a dark host says so — an empty remote list is not an outage.
                     ...(config.isolated ? { isolated: true } : {}),
@@ -134,6 +136,8 @@ export function registerAdminFaces(webServer, d) {
                         teams: canvasStore.list().map(name => ({
                             name,
                             team: canvasTeamOf(name),
+                            // #282 S2: the owner-qualified routing id.
+                            id: `${canvasTeamOf(name)}@${d.ownCanvasFingerprint}`,
                             // gh#152: members as the local tiers read them (gh#131). One
                             // of this host's own handles renders as the local session it
                             // names — join/live facts instead of an opaque remote chip — and
@@ -204,6 +208,9 @@ export function registerAdminFaces(webServer, d) {
                         taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, status: task.status,
                         direction: task.direction ?? 'outbound', receiptExpected: task.receiptExpected !== false,
                         ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}),
+                        ...(task.forwarded === true ? { forwarded: true } : {}),
+                        ...(task.deliveredTo !== undefined ? { deliveredTo: task.deliveredTo } : {}),
+                        ...(task.receiverMembers !== undefined ? { receiverMembers: task.receiverMembers } : {}),
                         // The dispatch brief rides every row: a task id and a team
                         // say nothing about WHAT is owed — supervision cannot tell
                         // a nudge from an abandon without it.
@@ -256,6 +263,8 @@ export function registerAdminFaces(webServer, d) {
                         ...(row.summary !== undefined && row.summary !== '' ? { summary: row.summary.slice(0, 160) } : {}),
                         ...(row.sender !== undefined ? { sender: row.sender } : {}),
                         ...(row.forwarded === true ? { forwarded: true } : {}),
+                        ...(row.deliveredTo !== undefined ? { deliveredTo: row.deliveredTo } : {}),
+                        ...(row.receiverMembers !== undefined ? { receiverMembers: row.receiverMembers } : {}),
                         ...(row.auth !== undefined ? { auth: row.auth } : {}),
                         // #114 S4: who settled it and how they stood on the chain.
                         ...(row.settledBy !== undefined ? { settledBy: row.settledBy } : {}),
@@ -270,6 +279,8 @@ export function registerAdminFaces(webServer, d) {
                         const roles = archive.flatMap(row => (row.settledBy !== undefined ? [row.settledBy.chain_role] : []));
                         return {
                             mode: config.settlementAuth,
+                            ...(d.enforceRefused !== undefined ? { enforceRefused: d.enforceRefused } : {}),
+                            enforceBlockers: taskLedger.settlementEnforceBlockers(),
                             offChain: roles.filter(r => r === 'off-chain').length,
                             legacy: roles.filter(r => r === 'legacy').length,
                             compat: roles.filter(r => r === 'compat').length,
@@ -313,7 +324,7 @@ export function registerAdminFaces(webServer, d) {
                         const unreachable = card !== undefined && entry?.missAt !== undefined ? { unreachable: true } : {};
                         return Array.isArray(org)
                             ? { url, ...unreachable, org: org.filter((e) => e !== null && typeof e === 'object')
-                                    .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: typeof e.team === 'string' ? e.team : '', members: Array.isArray(e.members) ? e.members.filter((m) => typeof m === 'string') : [] }))
+                                    .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: typeof e.team === 'string' ? e.team : '', id: typeof e.team === 'string' ? qualifiedCanvasId(e.team, card?.publicKey) : '', members: Array.isArray(e.members) ? e.members.filter((m) => typeof m === 'string') : [] }))
                                     .filter(e => e.team !== '') }
                             : { url, ...unreachable, org: [] };
                     }),
@@ -327,6 +338,8 @@ export function registerAdminFaces(webServer, d) {
                     // Of those, envelopes whose bound form missed here: the sender
                     // dials an origin missing from originClaimAudiences.
                     boundMissInbound: d.boundMissInboundCount,
+                    // Who missed, by verified caller and the origin it dialled (newest first, ≤16).
+                    boundMissRecent: d.boundMissRecent,
                     // gh#113: CLI mailbox loss, all handles — mail the 64-row cap
                     // pushed out, and mail cut at 4000 chars. The team verifier
                     // holds `dropped` to zero.

package/lib/faces/wire.js

@@ -1,11 +1,12 @@
 import { isRemoteMemberRef, validRemoteMemberRef } from "../canvas-store.js";
+import { splitCanvasOwner } from "../canvas-id.js";
 import { CLI_HANDLE_RE } from "../cli-deposit.js";
 import { TRANSCRIPT_DEFAULT_LIMIT, TRANSCRIPT_MAX_LIMIT } from "../session-transcript.js";
 import { refuseIfBudgetExhausted } from "../recursion-guard.js";
 import { peerPayloadFingerprint, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REPLAY_REJECTED } from "../idempotency-store.js";
 import { briefOf } from "../task-ledger.js";
 import { parseReceipt, taskIdRefusal } from "../receipt.js";
-import { buildAuthorization, claimCovers, refusalOf } from "../task-auth.js";
+import { buildAuthorization, claimCovers, nextOf, refusalOf } from "../task-auth.js";
 import { isRootOriginUrl } from "../origin-claim.js";
 import { withResponseFields } from "../response-fields.js";
 import { WIRE_ERROR_PAYLOAD_TOO_LARGE, withinRouteBodyCap } from "../transport-caps.js";
@@ -53,7 +54,7 @@ export function settlerClaimFields(claim, originOf) {
  * @param d - the captures listed on {@link WireDeps}.
  */
 export function registerWireFaces(webServer, d) {
-    const { ctx, logger, config, cliDeposits, canvasStore, canvasNameReserved, sessionNodes, joinedSessions, idempotencyStore, verifyOriginClaim, remoteCliProof, callerLinkedToThisHost, recordActivity, secretEqual, a2aCallerRefusal, a2aCallerAdmission, allowlistVersionNow, observeAuthorization, scanSessionLogList, readSessionLogTail, taskLedger, refuseIfFlooded, refuseIfQueueFull, settleAndAnnounce, session, resolveAgentForTeam, parseCanvasTeamName, canvasLiveAgent, wakeColdTeam, probeConsumption, sessionTeamOf, localSessionOfHandle, steerRelay, fromClause, sanitizeFromClause, armReceiptAutosend, eventCountOf, receiptExpectationOf, armAsyncNudge, liveAgent, callerIsAgent, selfRouteText, noWakeFaceText, archivedColdMatchText, noColdMatchText, nativeTeamsPrepare, nativeTeamsRound, routeIntoAgent, } = d;
+    const { ctx, logger, config, cliDeposits, canvasStore, canvasNameReserved, sessionNodes, joinedSessions, idempotencyStore, verifyOriginClaim, remoteCliProof, callerLinkedToThisHost, recordActivity, secretEqual, a2aCallerRefusal, a2aCallerAdmission, allowlistVersionNow, observeAuthorization, scanSessionLogList, readSessionLogTail, taskLedger, refuseIfFlooded, refuseIfQueueFull, settleAndAnnounce, waitForForwardBirth, session, resolveAgentForTeam, parseCanvasTeamName, canvasLiveAgent, wakeColdTeam, probeConsumption, sessionTeamOf, localSessionOfHandle, steerRelay, fromClause, sanitizeFromClause, armReceiptAutosend, eventCountOf, receiptExpectationOf, armAsyncNudge, liveAgent, callerIsAgent, selfRouteText, noWakeFaceText, archivedColdMatchText, noColdMatchText, nativeTeamsPrepare, nativeTeamsRound, routeIntoAgent, } = d;
     // gh#45 CLI 户口卡面 (peer face, unsigned card serve): the deposited
     // CLI's SIGNED card is served verbatim under its own base URL — an
     // OriginClaim verification of a CLI envelope fetches exactly here
@@ -434,7 +435,9 @@ export function registerWireFaces(webServer, d) {
                         return;
                     }
                 }
-                const team = typeof body.team === 'string' ? body.team : '';
+                // #282 S2: our own `<canvas>@<fp8>` is our canvas; a foreign suffix stays for the forward walk.
+                const ownerQualified = splitCanvasOwner(typeof body.team === 'string' ? body.team : '');
+                const team = ownerQualified.owner !== undefined && ownerQualified.owner === d.ownCanvasFingerprint ? ownerQualified.team : typeof body.team === 'string' ? body.team : '';
                 const message = typeof body.message === 'string' ? body.message : '';
                 const caller = typeof body.caller_session === 'string' ? body.caller_session : '';
                 // P2 receipt-callback: where THIS node's receipt should route on
@@ -482,11 +485,25 @@ export function registerWireFaces(webServer, d) {
                 const foreignCli = config.teamScopeRouting && CLI_HANDLE_RE.test(caller) && cliDeposits.get(caller) === undefined;
                 const earlyClaim = foreignCli ? await verifyOriginClaim(req, { cli: true, rawBody }) : undefined;
                 const cliProof = foreignCli && earlyClaim?.ok ? await remoteCliProof(caller, earlyClaim).catch(() => undefined) : undefined;
-                const admission = a2aCallerAdmission(caller, team, cliProof);
+                let admission = a2aCallerAdmission(caller, team, cliProof);
+                // #282 S3 (same team authorizes): a receipt for this host's own forward, to the CLI that sent it, from a
+                // receiver frozen at birth on the selected peer's key — the owner's signed canvas is the return path.
+                const echoed = !admission.ok && cliDeposits.get(team) !== undefined ? parseReceipt(message) : null;
+                if (echoed !== null) {
+                    // Verify first, so an unsigned or Sig2-only caller cannot hold the connection on an in-flight forward (#287 review P3);
+                    // then a body-bound receipt may beat the dispatch's HTTP answer: wait for this forward's row to be born (#287 P2).
+                    const receiptClaim = earlyClaim ?? await verifyOriginClaim(req, { cli: true, rawBody });
+                    if (receiptClaim.ok && receiptClaim.bodyBound === true)
+                        await waitForForwardBirth(message);
+                    const basis = receiptClaim.ok ? d.forwardReceiptBasis(echoed.taskId, caller, team, receiptClaim) : undefined;
+                    if (basis !== undefined)
+                        admission = { ok: true, via: 'peer-org', rule: 'peer-org', basis: [basis] };
+                }
                 const callerRefusal = refusalOf(admission);
                 if (callerRefusal !== undefined || !admission.ok) {
                     recordActivity('in', team, caller === '' ? 'anonymous' : caller, false);
-                    const payload = JSON.stringify({ error: callerRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
+                    const next = nextOf(admission);
+                    const payload = JSON.stringify({ error: callerRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED', ...(next !== undefined ? { next } : {}) });
                     res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                     res.end(payload);
                     return;
@@ -559,6 +576,8 @@ export function registerWireFaces(webServer, d) {
                 // #114 S4: the settler is this delivery's caller, as proven here. A CLI identity's claim URL
                 // is not a host's origin (its origin is unconstrained), so it never vouches for one (review of PR #140 P1-2).
                 // #139: the claim's card key names the host whatever address spelling it signed with.
+                // The response can race a fast peer receipt. Wait for this exact forwarding birth before judging or acknowledging it.
+                await waitForForwardBirth(message);
                 const refusedSettlement = settleAndAnnounce(message, { caller, proof: callerProof, ...settlerClaimFields(claim, originOf), ingress: 'wire' });
                 // #139 (design §4.4): every answer this delivery gets carries the refusal.
                 if (refusedSettlement !== undefined)
@@ -587,13 +606,16 @@ export function registerWireFaces(webServer, d) {
                 // quiet window around it.
                 d.touchWakeDemand();
                 const forwardMiss = async (original) => {
-                    const result = await d.forwardDirect({ team, message, caller, taskId, contextId, noWait,
+                    // #282 S2 review P1: forward with the id the caller sent — our own `@fp8` must find no other owner.
+                    const result = await d.forwardDirect({ team: typeof body.team === 'string' && ownerQualified.owner !== undefined ? body.team : team, message, caller, taskId, contextId, noWait,
+                        auth: buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget: caller, receivedAt: admittedAt.at }),
                         localCliProof: claim.ok && claim.cli === true && claim.bound && claim.caller === caller, guarded: req.headers['x-a2a-guard'] !== undefined }).catch((error) => ({ ok: false, error: `forwarding unavailable: ${String(error)}`, code: -32000, task_id: taskId }));
+                    const failure = result.ok ? '' : await d.diagnoseCanvas(team, original + ' — ' + result.error, claim.ok && claim.cli === true && claim.bound && claim.caller === caller ? caller : undefined);
                     if (!result.ok && result.code !== -32005)
-                        idempotencyStore.recordOutcome(taskId, { status: 'failed', error: original + ' — ' + result.error });
+                        idempotencyStore.recordOutcome(taskId, { status: 'failed', error: failure });
                     else if (result.ok && result.task_status === 'TASK_STATE_COMPLETED')
                         idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: result.reply });
-                    const payload = JSON.stringify(result.ok ? { routed: true, ...(result.task_status === 'TASK_STATE_DELIVERED' ? { delivered: true } : { result: { text: result.reply } }), team, task_id: taskId, context_id: contextId, task_status: result.task_status, consumed: result.consumed, bridge: result.bridge, receipt: result.receipt, forwarded: true } : { error: original + ' — ' + result.error, code: result.code ?? -32000, receipt: result.receipt, task_id: taskId, team, task_status: result.code === -32005 ? 'TASK_STATE_DELIVERED' : 'TASK_STATE_FAILED' });
+                    const payload = JSON.stringify(result.ok ? { routed: true, ...(result.task_status === 'TASK_STATE_DELIVERED' ? { delivered: true } : { result: { text: result.reply } }), team, task_id: taskId, context_id: contextId, task_status: result.task_status, consumed: result.consumed, bridge: result.bridge, receipt: result.receipt, forwarded: true } : { error: failure, code: result.code ?? -32000, receipt: result.receipt, task_id: taskId, team, task_status: result.code === -32005 ? 'TASK_STATE_DELIVERED' : 'TASK_STATE_FAILED', ...(result.next !== undefined ? { next: result.next } : {}) });
                     res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                     res.end(payload);
                 };
@@ -809,7 +831,16 @@ export function registerWireFaces(webServer, d) {
                     })();
                     return;
                 }
-                void routeIntoAgent(team, message, caller, taskId, proofClause, directHeader).then(async (outcome) => {
+                let syncTarget;
+                // A forwarded synchronous delivery still owes its automatic receipt after the HTTP waiter expires.
+                const syncSteered = req.headers['x-a2a-guard'] === undefined || parseReceipt(message) !== null ? undefined : (target, floor) => {
+                    syncTarget = sessionTeamOf(target);
+                    const receiptTarget = callback !== '' ? callback : caller;
+                    const auth = buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ...(admission.rule === 'remote-ref-cli' && claim.ok ? { carrierUrl: originOf(claim.callerUrl) } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget, receivedAt: admittedAt.at });
+                    taskLedger.trackInbound(taskId, team, receiptTarget, contextId, receiptExpectationOf(receiptTarget) !== 'process-label', briefOf(message), auth, syncTarget === team ? undefined : syncTarget);
+                    armReceiptAutosend(target, taskId, receiptTarget, message, floor);
+                };
+                void routeIntoAgent(team, message, caller, taskId, proofClause, directHeader, undefined, syncSteered).then(async (outcome) => {
                     if (!outcome.ok && outcome.localMiss) {
                         await forwardMiss(outcome.error);
                         return;
@@ -840,7 +871,7 @@ export function registerWireFaces(webServer, d) {
                             team,
                             session,
                             result: { text: outcome.reply },
-                            ...(req.headers['x-a2a-guard'] !== undefined ? ((target) => target === undefined ? {} : { delivered_to: sessionTeamOf(target) })(resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team))) : {}),
+                            ...(syncTarget !== undefined ? { delivered_to: syncTarget } : {}),
                             task_id: taskId,
                             context_id: contextId,
                             task_status: outcome.status ?? 'TASK_STATE_COMPLETED',

package/lib/flood-guard.js

@@ -104,7 +104,9 @@ export function createFloodGuard(outcomes, recordActivity) {
         const error = 'flood-guard: ' + reason + ' (gh#91): file data must use an independent channel; no delivery occurred' + (advice === undefined ? '' : '; use-file-channel: ' + advice.message);
         outcomes.recordOutcome(taskId, { status: 'failed', error });
         recordActivity('in', team, caller, false);
-        const payload = JSON.stringify({ error, reason, code: WIRE_ERROR_RATE_LIMITED, task_id: taskId, team, delivered: false, task_status: 'TASK_STATE_FAILED' });
+        // #282 S1: one next step — file bytes go through the file channel, never chat messages.
+        const next = 'send file data with a2a_file_send / `a2a-net file send <path> <team>` instead of message chunks; resend other text as one message with a new task id';
+        const payload = JSON.stringify({ error, reason, code: WIRE_ERROR_RATE_LIMITED, task_id: taskId, team, delivered: false, task_status: 'TASK_STATE_FAILED', next });
         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
         res.end(payload);
         return true;