@nelsonlongxiang/dsh-open-a2a-net 0.6.43 → 0.7.0

package/lib/canvas-member.js

@@ -0,0 +1,43 @@
+/** Session-member provenance (#334). fp8 selects an owner; only a full key anchors it. */
+import { createPublicKey } from 'node:crypto';
+import { canvasOwnerFingerprint } from "./canvas-id.js";
+import { CLI_HANDLE_RE } from "./cli-deposit.js";
+/** CLI handles keep their existing home/deposit rules and are never parsed as session members. */
+export function splitQualifiedMember(ref) {
+    if (CLI_HANDLE_RE.test(ref))
+        return undefined;
+    const match = /^([^/\s@]+\/[0-9a-f]{8})@([0-9a-f]{8})$/.exec(ref);
+    return match ? { handle: match[1], fingerprint: match[2] } : undefined;
+}
+export function validMemberOwner(ref, key) {
+    const member = splitQualifiedMember(ref);
+    if (!member || !key || canvasOwnerFingerprint(key) !== member.fingerprint)
+        return false;
+    try {
+        const bytes = Buffer.from(key, 'base64'), publicKey = createPublicKey({ key: bytes, format: 'der', type: 'spki' });
+        return publicKey.asymmetricKeyType === 'ed25519' && publicKey.export({ format: 'der', type: 'spki' }).equals(bytes) && bytes.toString('base64') === key;
+    }
+    catch {
+        return false;
+    }
+}
+export function qualifiedSessionMember(handle, key) {
+    const ref = handle + '@' + canvasOwnerFingerprint(key);
+    return validMemberOwner(ref, key) ? ref : undefined;
+}
+export function memberProvenance(ref, ownerKey, ownKey) {
+    if (CLI_HANDLE_RE.test(ref))
+        return 'cli';
+    if (!ref.includes('/'))
+        return 'local-id';
+    const qualified = splitQualifiedMember(ref);
+    if (!qualified)
+        return ref.includes('@') ? 'conflict' : 'unknown';
+    if (ownerKey === undefined)
+        return qualified.fingerprint === canvasOwnerFingerprint(ownKey) ? 'confirmed-local' : 'unknown';
+    if (!validMemberOwner(ref, ownerKey))
+        return 'conflict';
+    if (qualified.fingerprint === canvasOwnerFingerprint(ownKey) && ownerKey !== ownKey)
+        return 'conflict';
+    return ownerKey === ownKey ? 'confirmed-local' : 'confirmed-remote';
+}

package/lib/canvas-store.js

@@ -21,6 +21,7 @@ import { randomUUID } from 'node:crypto';
 import { hostname } from 'node:os';
 import { dirname } from 'node:path';
 import { CLI_HANDLE_RE } from "./cli-deposit.js";
+import { splitQualifiedMember, validMemberOwner, memberProvenance } from "./canvas-member.js";
 /** A bare session handle is not a CLI identity or a qualified owner selector. */
 export function legacyBareMember(id) {
     return isRemoteMemberRef(id) && !CLI_HANDLE_RE.test(id) && !/@[0-9a-f]{8}$/.test(id);
@@ -135,8 +136,15 @@ export class CanvasStore {
                         members.add(member);
                     }
                 }
-                if (snapshot.memberOwners !== undefined && (snapshot.memberOwners === null || typeof snapshot.memberOwners !== 'object' || Array.isArray(snapshot.memberOwners) || Object.values(snapshot.memberOwners).some(key => typeof key !== 'string')))
+                if (snapshot.memberOwners !== undefined && (snapshot.memberOwners === null || typeof snapshot.memberOwners !== 'object' || Array.isArray(snapshot.memberOwners) || Object.entries(snapshot.memberOwners).some(([ref, key]) => typeof key !== 'string' || !validMemberOwner(ref, key))))
                     throw Error('invalid canvas v2 owners');
+                const fpKeys = new Map();
+                for (const [ref, key] of Object.entries(snapshot.memberOwners ?? {})) {
+                    const fp = splitQualifiedMember(ref).fingerprint;
+                    if (fpKeys.has(fp) && fpKeys.get(fp) !== key)
+                        throw Error('conflicting canvas member fingerprints');
+                    fpKeys.set(fp, key);
+                }
                 if (snapshot.cliHome !== undefined && (snapshot.cliHome === null || typeof snapshot.cliHome !== 'object' || Array.isArray(snapshot.cliHome) || Object.entries(snapshot.cliHome).some(([handle, home]) => !CLI_HANDLE_RE.test(handle) || typeof home !== 'string' || !validHomeOrigin(home) || !snapshot.teams.some(t => t.members.includes(handle)))))
                     throw Error('invalid canvas v2 CLI homes');
                 if (snapshot.cliHomeCleared !== undefined && (!Array.isArray(snapshot.cliHomeCleared) || new Set(snapshot.cliHomeCleared).size !== snapshot.cliHomeCleared.length || snapshot.cliHomeCleared.some(handle => typeof handle !== 'string' || !CLI_HANDLE_RE.test(handle) || !snapshot.teams.some(t => t.members.includes(handle)))))
@@ -207,6 +215,7 @@ export class CanvasStore {
             const previous = JSON.parse(this.committed);
             this.teams = previous.teams.map(t => ({ name: t.name, members: [...t.members] }));
             this.suspended = [...previous.suspendedMembers ?? []];
+            this.memberOwners = { ...previous.memberOwners };
             this.cliHome = { ...previous.cliHome };
             this.cliHomeCleared = new Set(previous.cliHomeCleared);
             this.revision = previous.revision ?? 0;
@@ -220,7 +229,7 @@ export class CanvasStore {
         }
     }
     serialize() {
-        return JSON.stringify({ teams: this.teams, suspendedMembers: this.suspended, cliHome: this.cliHome, cliHomeCleared: [...this.cliHomeCleared], revision: this.revision });
+        return JSON.stringify({ teams: this.teams, memberOwners: this.memberOwners, suspendedMembers: this.suspended, cliHome: this.cliHome, cliHomeCleared: [...this.cliHomeCleared], revision: this.revision });
     }
     write() {
         if (this.readOnlyReason)
@@ -328,7 +337,15 @@ export class CanvasStore {
         const entry = this.teams.find(t => t.name === name);
         if (this.readOnlyReason || this.failedSuspension)
             return [];
-        return entry === undefined ? [] : entry.members.filter(id => !this.isSuspended(name, id) && (this.options.legacyBareMembers !== false || !legacyBareMember(id)));
+        return entry === undefined ? [] : entry.members.filter(id => {
+            if (this.isSuspended(name, id) || (this.options.legacyBareMembers === false && legacyBareMember(id)))
+                return false;
+            if (this.options.ownPublicKey && id.includes('@') && !CLI_HANDLE_RE.test(id)) {
+                const provenance = memberProvenance(id, this.memberOwners[id], this.options.ownPublicKey);
+                return provenance === 'confirmed-local' || provenance === 'confirmed-remote';
+            }
+            return true;
+        });
     }
     /** Inspection only: never use raw rows for routing, authorization or counts. */
     rawMembersOf(name) { return [...(this.teams.find(t => t.name === name)?.members ?? [])]; }
@@ -341,6 +358,48 @@ export class CanvasStore {
             ...(this.readOnlyReason || this.failedSuspension || this.lastWriteError ? { error: this.readOnlyReason || (this.failedSuspension ? 'canvas suspension persistence failed; restart after repair' : this.lastWriteError) } : {}) };
     }
     ownerKeyOf(member) { return this.memberOwners[member]; }
+    ownerConflict(member, key) {
+        const fp = splitQualifiedMember(member)?.fingerprint;
+        return Object.entries(this.memberOwners).some(([ref, pinned]) => (ref === member || splitQualifiedMember(ref)?.fingerprint === fp) && pinned !== key);
+    }
+    /** Owner control only: CAS the complete slot and preserve suspension plus routing priority. */
+    confirmMember(team, member, replacement, ownerKey, revision, expectedOwner) {
+        if (this.readOnlyReason || this.failedSuspension)
+            return { ok: false, error: this.state().error };
+        const entry = this.teams.find(t => t.name === team), index = entry?.members.indexOf(member) ?? -1;
+        if (!entry || index < 0 || revision !== this.revision || expectedOwner !== (this.memberOwners[member] ?? null))
+            return { ok: false, error: 'canvas version, member slot or owner changed; refresh first' };
+        const sameId8 = (value) => value.replace(/^session-/, '').slice(0, 8);
+        const originalHandle = splitQualifiedMember(member)?.handle ?? member;
+        const replacementHandle = splitQualifiedMember(replacement)?.handle ?? replacement;
+        if (member.includes('/') && (replacement.includes('/') ? originalHandle !== replacementHandle : !originalHandle.endsWith('/' + sameId8(replacement))))
+            return { ok: false, error: 'confirmation must identify the same original session handle' };
+        if (!member.includes('/') || !replacement || CLI_HANDLE_RE.test(member) || CLI_HANDLE_RE.test(replacement))
+            return { ok: false, error: 'session provenance confirmation only; CLI homes use their own controls' };
+        const qualified = splitQualifiedMember(replacement);
+        if ((replacement.includes('/') && !qualified) || (qualified && (!ownerKey || !validMemberOwner(replacement, ownerKey) || this.ownerConflict(replacement, ownerKey))))
+            return { ok: false, error: 'owner key/fingerprint conflict or unproved member' };
+        if (this.memberOwners[member] !== undefined && (replacement !== member || ownerKey !== this.memberOwners[member]))
+            return { ok: false, error: 'confirmed owner cannot be silently replaced' };
+        const equivalent = entry.members.indexOf(replacement);
+        if (equivalent >= 0 && equivalent !== index && this.suspensionOf(team, member).some(row => this.suspensionOf(team, replacement).some(other => other.reason === row.reason && other.localSessionId === row.localSessionId)))
+            return { ok: false, error: 'both slots have independent matching suspension reasons; handle them explicitly before merging' };
+        if (equivalent >= 0 && equivalent !== index)
+            entry.members.splice(index, 1);
+        else
+            entry.members[index] = replacement;
+        this.suspended = this.suspended.map(row => row.team === team && row.member === member ? { ...row, member: replacement } : row)
+            .filter((row, i, all) => all.findIndex(other => other.team === row.team && other.member === row.member && other.reason === row.reason && other.localSessionId === row.localSessionId) === i);
+        if (qualified)
+            this.memberOwners[replacement] = ownerKey;
+        try {
+            this.persist();
+            return { ok: true };
+        }
+        catch (error) {
+            return { ok: false, error: String(error) };
+        }
+    }
     /** Durably revoke canvas consent BEFORE join/agent/roster state is removed. */
     revokeLocal(id, ownQualified, inferredBare, reason, team) {
         if (this.readOnlyReason || this.failedSuspension)
@@ -353,7 +412,7 @@ export class CanvasStore {
                 this.suspended.push({ team: entry.name, member: inferredBare, localSessionId: id, reason, at: new Date().toISOString(), token: randomUUID() });
                 changed = true;
             }
-            const kept = entry.members.filter(m => m !== id && m !== ownQualified);
+            const kept = entry.members.filter(m => (m !== id && m !== ownQualified) || this.isSuspended(entry.name, m));
             if (kept.length !== entry.members.length) {
                 entry.members = kept;
                 changed = true;
@@ -462,10 +521,15 @@ export class CanvasStore {
             return false;
         if (home !== undefined && this.cliHome[id] !== undefined && this.cliHome[id] !== home && options.replaceHome !== true)
             return false;
+        const qualified = splitQualifiedMember(id);
+        if (qualified && (!options.ownerKey || !validMemberOwner(id, options.ownerKey) || this.ownerConflict(id, options.ownerKey)))
+            return false;
         const entry = this.teams.find(t => t.name === name);
         if (entry === undefined)
             return false;
         if (entry.members.includes(id)) {
+            if (qualified && this.memberOwners[id] === undefined)
+                return false; // Existing unknown slots require explicit confirmation, not re-add.
             if (home !== undefined && this.cliHome[id] !== home) {
                 this.cliHome[id] = home;
                 this.cliHomeCleared.delete(id);
@@ -476,6 +540,8 @@ export class CanvasStore {
         if (entry.members.length >= CANVAS_MEMBER_CAP)
             return false;
         entry.members.push(id);
+        if (qualified)
+            this.memberOwners[id] = options.ownerKey;
         if (home !== undefined) {
             this.cliHome[id] = home;
             this.cliHomeCleared.delete(id);

package/lib/direct-forward.js

@@ -3,6 +3,7 @@ import { DEFAULT_HOP_BUDGET, guardHeader, mintGuard } from "./recursion-guard.js
 import { briefOf } from "./task-ledger.js";
 import { parseReceipt } from "./receipt.js";
 import { splitCanvasOwner } from "./canvas-id.js";
+import { splitQualifiedMember } from "./canvas-member.js";
 import { claimCovers } from "./task-auth.js";
 /** An early receipt waits at most this long for its forward row to be born (#298). */
 export const BIRTH_WAIT_CAP_MS = 60_000;
@@ -46,8 +47,9 @@ export function createDirectForward(d) {
         if (!request.localCliProof || !d.deposited(request.caller))
             return refuse('caller is not a proven online local CLI deposit', publish);
         // #282 S2: candidates honour an owner-qualified id; scope, the peer, the receivers and the ledger see the plain team.
-        const plainTeam = splitCanvasOwner(request.team).team;
-        const scope = await d.scope(request.caller, plainTeam);
+        const qualifiedMember = splitQualifiedMember(request.team);
+        const plainTeam = qualifiedMember?.handle ?? splitCanvasOwner(request.team).team;
+        const scope = await d.scope(request.caller, qualifiedMember ? request.team : plainTeam);
         if (!scope.ok)
             return refuse('target is outside sender scope: ' + scope.error, `ask this host's operator to link ${request.team} here: drag it (or one of its members) into a canvas team on this host`);
         const failures = [];
@@ -83,9 +85,9 @@ export function createDirectForward(d) {
                     if (result.ok && result.bridge !== undefined)
                         return { ...result, receipt: 'none' };
                     const deliveredTo = result.ok ? result.deliveredTo : undefined;
-                    const birth = { forwarded: true, ...(request.auth !== undefined ? { auth: request.auth } : {}), ...(peerCard?.publicKey ? { peerKey: peerCard.publicKey } : {}), ...(peerCard?.session ? { peerHost: peerCard.session } : {}), ...(deliveredTo !== undefined ? { deliveredTo } : {}), ...(receivers !== undefined ? { receiverMembers: receivers } : {}) };
+                    const birth = { ...(result.ok && typeof result.consumed === 'boolean' ? { consumed: result.consumed } : {}), forwarded: true, ...(request.auth !== undefined ? { auth: request.auth } : {}), ...(peerCard?.publicKey ? { peerKey: peerCard.publicKey } : {}), ...(peerCard?.session ? { peerHost: peerCard.session } : {}), ...(deliveredTo !== undefined ? { deliveredTo } : {}), ...(receivers !== undefined ? { receiverMembers: receivers } : {}) };
                     // Exactly one outbound row. A completed sync response is receiptless bookkeeping.
-                    if (result.ok && (result.task_status === 'TASK_STATE_COMPLETED' || result.receipt === 'none'))
+                    if (result.ok && result.receiverBookkeeping !== 'failed' && (result.task_status === 'TASK_STATE_COMPLETED' || result.receipt === 'none'))
                         d.ledger.trackReceiptless(request.taskId, plainTeam, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
                     else
                         d.ledger.track(request.taskId, plainTeam, url, request.contextId, briefOf(request.message), { kind: 'cli', id: request.caller }, birth);
@@ -117,13 +119,13 @@ export function forwardReceiptBasis(row, caller, cliHandle, claim) {
     // The signer's zone must cover the caller label: B never signs for another zone's member (review of #287 M4).
     if (!claimCovers(caller, claim.caller))
         return undefined;
-    if (row === undefined || row.status !== 'pending' || row.forwarded !== true || row.sender?.kind !== 'cli' || row.sender.id !== cliHandle)
+    if (row === undefined || row.status !== 'pending' || row.forwarded !== true || row.sender?.kind !== 'cli' || row.sender.id !== cliHandle || (row.auth !== undefined && row.auth.receipt_target !== cliHandle) || row.receiptExpected === false)
         return undefined;
     // Body-bound (Sig3) only: a stripped Sig3 would let a captured envelope carry another body (review of #287 P3-1).
     if (!claim.bound || claim.bodyBound !== true || row.peerKey === undefined || claim.card.publicKey !== row.peerKey)
         return undefined;
-    // A legacy row's deliveredTo may be the canvas handle itself (#272/#275): never a receiver.
-    if (row.deliveredTo !== undefined && (row.deliveredTo === row.team || row.deliveredTo.includes('/canvas/')))
+    // A legacy canvas deliveredTo is never a receiver; a direct session target equal to row.team is valid.
+    if (row.deliveredTo !== undefined && row.deliveredTo.includes('/canvas/'))
         return undefined;
     return (row.deliveredTo !== undefined ? [row.deliveredTo] : row.receiverMembers ?? []).includes(caller) ? `peer-org:${row.team}` : undefined;
 }

package/lib/faces/admin.js

@@ -18,6 +18,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { reminderView } from "../reconciliation-state.js";
 import { canvasNameReserved as reservedCanvasName, isRemoteMemberRef, validRemoteMemberRef, legacyBareMember } from "../canvas-store.js";
 import { qualifiedCanvasId } from "../canvas-id.js";
 import { refreshPeerCard, registerCanvasNotify } from "./canvas-notify.js";
@@ -76,6 +77,7 @@ export function registerAdminFaces(webServer, d) {
                         id: String(agent.id),
                         label: sessionLabelOf(agent),
                         team: sessionTeamOf(agent),
+                        memberRef: `${sessionTeamOf(agent)}@${d.ownCanvasFingerprint}`,
                         ...nodeMetadataOf(agent),
                         joined: sessionNodes.has(String(agent.id)),
                         live: true,
@@ -115,6 +117,7 @@ export function registerAdminFaces(webServer, d) {
                         label: `${session}-${id8(id)}`,
                         ...(d.ownerSeatNames[id] !== undefined ? { name: d.ownerSeatNames[id], seatName: d.ownerSeatNames[id] } : {}),
                         team: `${config.team}/${id8(id)}`,
+                        memberRef: `${config.team}/${id8(id)}@${d.ownCanvasFingerprint}`,
                         joined: true,
                         live: false,
                         teams: [...teamMemberships.teamsOf(id)],
@@ -194,7 +197,7 @@ export function registerAdminFaces(webServer, d) {
                         };
                     }),
                     remote: (refreshRemoteRows(), (d.remoteRowsCache?.rows ?? []).map(row => {
-                        const canvasTeams = canvasStore.teamsOf(row.team);
+                        const canvasTeams = [...new Set([...canvasStore.teamsOf(row.team), ...(row.memberRef ? canvasStore.teamsOf(row.memberRef) : [])])];
                         return canvasTeams.length > 0 ? { ...row, canvasTeams: [...canvasTeams] } : row;
                     })),
                     activity: recentActivity.slice(),
@@ -207,12 +210,19 @@ export function registerAdminFaces(webServer, d) {
                     // in-flight ring cannot show. Dead-lettered rows ride their own
                     // list and settled ones just a count, all additive so the panel
                     // keeps rendering plain owed rows until it learns the tiers.
+                    ledgerPersistence: taskLedger.persistenceState(),
+                    deliveryBookkeeping: taskLedger.deliveryBookkeepingState(),
+                    nudgeEscalations: d.nudgeEscalations?.() ?? { queued: 0, unavailable: 0, failed: 0 },
+                    reconciliationReminders: d.reminderDiagnostics?.(),
                     tasks: taskLedger.list()
                         .filter(task => task.status === 'pending')
                         .map(task => ({
+                        ...reminderView(taskLedger.reminderState(task.taskId)),
                         taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, status: task.status,
                         direction: task.direction ?? 'outbound', receiptExpected: task.receiptExpected !== false,
                         ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}),
+                        ...(task.receiptDelivery ? { receiptDelivery: task.receiptDelivery } : {}),
+                        ...(task.consumed !== undefined ? { consumed: task.consumed, deliveryObservation: task.consumed ? 'consumed' : 'delivered-unconsumed' } : {}),
                         ...(task.forwarded === true ? { forwarded: true } : {}),
                         ...(task.deliveredTo !== undefined ? { deliveredTo: task.deliveredTo } : {}),
                         ...(task.receiverMembers !== undefined ? { receiverMembers: task.receiverMembers } : {}),
@@ -234,7 +244,8 @@ export function registerAdminFaces(webServer, d) {
                     tasksStaleCount: taskLedger.list().filter(task => task.status === 'pending' && (task.receiptExpected === false || Date.now() - task.startedAt >= 60 * 60_000)).length,
                     tasksDead: taskLedger.list()
                         .filter(task => task.status === 'dead')
-                        .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}), ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}), ...(task.sender !== undefined ? { sender: task.sender } : {}), ...(task.auth !== undefined ? { auth: task.auth } : task.direction === 'inbound' ? { authLegacy: true } : {}) })),
+                        .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}),
+                        ...(task.receiptDelivery ? { receiptDelivery: task.receiptDelivery } : {}), ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}), ...(task.sender !== undefined ? { sender: task.sender } : {}), ...(task.auth !== undefined ? { auth: task.auth } : task.direction === 'inbound' ? { authLegacy: true } : {}) })),
                     // gh#31: per-task outcomes for rows that LEFT the ledger — the
                     // chat drawer used to guess (settled, abandoned or cancelled).
                     // Bounded to the archive (≤64), newest first, with the
@@ -253,6 +264,7 @@ export function registerAdminFaces(webServer, d) {
                     // its direction when known.
                     archived: taskLedger.archive().slice(0, ARCHIVE_CAP).map(row => ({
                         taskId: row.taskId,
+                        ...(row.withdrawalResult ? { withdrawalResult: row.withdrawalResult } : {}),
                         team: row.team,
                         peer: row.peer,
                         startedAt: row.startedAt,
@@ -345,6 +357,9 @@ export function registerAdminFaces(webServer, d) {
                     boundMissInbound: d.boundMissInboundCount,
                     // Who missed, by verified caller and the origin it dialled (newest first, ≤16).
                     boundMissRecent: d.boundMissRecent,
+                    // Present-but-unverifiable envelopes by claimed caller and reason (bad-ts = sender clock skew > ±5 min).
+                    claimRejectsInbound: d.claimRejectsInboundCount,
+                    claimRejectsRecent: d.claimRejectsRecent,
                     // gh#113: CLI mailbox loss, all handles — mail the 64-row cap
                     // pushed out, and mail cut at 4000 chars. The team verifier
                     // holds `dropped` to zero.
@@ -528,7 +543,7 @@ export function registerAdminFaces(webServer, d) {
         path: '/__dsh_a2a/fleet-canvas-op',
         handler: controlRoute((req, res) => {
             readJsonBody(req, res, async (body) => {
-                const { peer, op, name, id } = body;
+                const { peer, op, name, id, memberPeer } = body;
                 const peerUrl = typeof peer === 'string' ? peer : '';
                 const opV = typeof op === 'string' ? op : '';
                 const nameV = typeof name === 'string' ? name : '';
@@ -547,7 +562,13 @@ export function registerAdminFaces(webServer, d) {
                 }
                 try {
                     const target = peerUrl.replace(/\/$/, '') + '/a2a/canvas-op';
-                    const body = JSON.stringify({ op: opV, name: nameV, ...(opV === 'add-member' || opV === 'remove-member' ? { id: idV !== '' && !isRemoteMemberRef(idV) && (sessionNodes.has(idV) || joinedSessions.has(idV)) ? `${config.team}/${id8(idV)}` : idV } : {}) });
+                    const proof = opV === 'add-member' ? await d.canvasMemberForWrite(idV, memberPeer) : undefined;
+                    if (proof && !proof.ok) {
+                        send(JSON.stringify(proof));
+                        return;
+                    }
+                    const selectedId = proof?.ok ? (proof.member.includes('/') ? proof.member : `${config.team}/${id8(proof.member)}@${d.ownCanvasFingerprint}`) : idV !== '' && !isRemoteMemberRef(idV) && (sessionNodes.has(idV) || joinedSessions.has(idV)) ? `${config.team}/${id8(idV)}@${d.ownCanvasFingerprint}` : idV;
+                    const body = JSON.stringify({ op: opV, name: nameV, ...(opV === 'add-member' || opV === 'remove-member' ? { id: selectedId } : {}) });
                     const reply = await d.peerFetch(target, {
                         method: 'POST',
                         headers: { 'Content-Type': 'application/json', ...originClaimHeaders({ url: target, method: 'POST', body }) },
@@ -756,7 +777,18 @@ export function registerAdminFaces(webServer, d) {
                 const action = body.action;
                 let payload;
                 try {
-                    if (action === 'restore-suspended' || action === 'delete-suspended') {
+                    if (action === 'confirm-member') {
+                        const name = typeof body.name === 'string' ? body.name : '', id = typeof body.id === 'string' ? body.id : '';
+                        const request = body;
+                        const replacement = typeof request.replacement === 'string' ? request.replacement : '';
+                        const originalHandle = id.replace(/@[0-9a-f]{8}$/, '');
+                        const localChoice = replacement !== '' && !replacement.includes('/');
+                        const proof = localChoice && originalHandle !== `${config.team}/${id8(replacement)}` ? { ok: false, error: 'local confirmation must match this host zone and the original handle' } : await d.canvasMemberForWrite(replacement, request.peer);
+                        const out = proof.ok ? canvasStore.confirmMember(name, id, proof.member, proof.ownerKey, request.revision, request.expectedOwner) : proof;
+                        logger.info('canvas provenance owner confirmation actor=owner-control at=%s team=%s old=%s new=%s ownerKey=%s ok=%s', new Date().toISOString(), name, id, proof.ok ? proof.member : replacement, proof.ok ? proof.ownerKey ?? 'local-id' : 'unconfirmed', out.ok);
+                        payload = JSON.stringify({ ...out, ...canvasStore.state() });
+                    }
+                    else if (action === 'restore-suspended' || action === 'delete-suspended') {
                         const request = body;
                         const name = typeof request.name === 'string' ? request.name : '', id = typeof request.id === 'string' ? request.id : '';
                         const out = canvasStore.regulateSuspended(action === 'restore-suspended' ? 'restore' : 'delete', name, id, request.revision, request.expected);
@@ -802,15 +834,26 @@ export function registerAdminFaces(webServer, d) {
                         else if (name === '' || !memberValid) {
                             payload = JSON.stringify({ ok: false, error: 'name and a member (joined session id, or a zone-qualified remote team handle like zone/a1b2c3d4) are required' });
                         }
+                        else if (legacyBareMember(id) && canvasStore.rawMembersOf(name).includes(id)) {
+                            // Re-adding a retained legacy slot is a no-op, never provenance confirmation or restore.
+                            payload = JSON.stringify({ ok: true, members: canvasStore.membersOf(name), provenance: 'unknown' });
+                        }
                         else {
-                            const pin = await d.cliHomeForAdd(id, body.home).catch(() => ({ ok: false, error: 'linked home card lookup failed' }));
+                            const proof = await d.canvasMemberForWrite(id, body.peer);
+                            if (!proof.ok) {
+                                payload = JSON.stringify(proof);
+                                res.writeHead(200, { 'Content-Type': 'application/json' });
+                                res.end(payload);
+                                return;
+                            }
+                            const pin = await d.cliHomeForAdd(proof.member, body.home).catch(() => ({ ok: false, error: 'linked home card lookup failed' }));
                             if (!pin.ok)
                                 payload = JSON.stringify({ ok: false, error: pin.error });
                             else {
                                 canvasStore.create(name);
                                 const explicitHome = body.home !== undefined;
                                 const home = explicitHome ? pin.home : canvasStore.cliHomeOf(id) ?? pin.home;
-                                payload = JSON.stringify({ ok: canvasStore.addMember(name, id, home, { replaceHome: explicitHome }), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
+                                payload = JSON.stringify({ ok: canvasStore.addMember(name, proof.member, home, { replaceHome: explicitHome, ownerKey: proof.ownerKey }), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
                             }
                         }
                     }

package/lib/faces/files.js

@@ -1,6 +1,7 @@
 import { BLOB_FILE_MAX } from "../blob-store.js";
 import { isRootOriginUrl } from "../origin-claim.js";
 import { claimCovers } from "../task-auth.js";
+import { splitQualifiedMember } from "../canvas-member.js";
 /** Pulls per proven signer (host zone or CLI handle) in a sliding minute (design §8; the FloodGuard figure). */
 export const BLOB_PULLS_PER_MINUTE = 16;
 /** Distinct signers the pull limiter remembers; a full table refuses new signers rather than forgetting live ones. */
@@ -91,7 +92,7 @@ export function registerFileFaces(webServer, d) {
                 refuse(403, 'untrusted-origin', 'the envelope does not prove this caller (it must be the audience-bound form, signed from a root card URL whose zone covers caller_session)');
                 return;
             }
-            const grant = blobStore.list().find(g => g.sha256 === sha256 && grantAdmits(g.to, caller, claim.caller, config.team, name => canvasStore.membersOf(name), claim.cli === true));
+            const grant = blobStore.list().find(g => g.sha256 === sha256 && grantAdmits(g.to, caller, claim.caller, config.team, name => canvasStore.membersOf(name).flatMap(ref => { const member = splitQualifiedMember(ref); return member ? (canvasStore.ownerKeyOf?.(ref) === claim.card.publicKey ? [member.handle] : []) : [ref]; }), claim.cli === true));
             // One answer for "no such blob", "expired" and "not yours": a refusal is no existence oracle.
             if (grant === undefined) {
                 refuse(403, 'not-granted', 'no live grant lets this caller pull that file');