@open-everywhere/core 0.1.0

package/agent/identity/binding.ts

@@ -0,0 +1,1308 @@
+// SurfaceBinding is the platform-agnostic identity a session runs under: each platform contributes a mapper that translates its native identity into this one shape, and the rest of the system never sees a platform-specific field.
+// Identity lives in session.auth.current.attributes, not in channel.metadata, so a mapper reads those attributes plus channel.kind and this module interprets them into mode, visibility and trust.
+
+import type { SessionMode } from "../access/resolver.js";
+import { readBindingBridge, stampBindingBridge, bridgedContext, type BridgedIdentity } from "./binding-bridge.js";
+import { normalizePlatform, platformFromKind } from "./platform.js";
+import { seg, deploymentOrg, ambientWorkspace, ambientSurface } from "./deployment-identity.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { declaredSurfaceTrust, type SurfaceTrust } from "./trust.js";
+
+import { UNNAMED_TENANT } from "./principal-key.js";
+import { bareTokenFromEveContext, classifySessionId, parseWindowToken, sessionGrantKeyFromToken } from "../channels/window-key.js";
+import { sourcesForWindow, decodeSources } from "../channels/window-sources.js";
+import { ROUTINE_MARKER, routinePermissionKeyStamped } from "../routines/routine.js";
+import type { Domain } from "../memory/domain.js";
+import { processRegistryMap } from "../lib/process-registry.js";
+// A LEAF import (OPE-585): access/task-wake-signal.ts reaches only `eve/context`, so it closes no
+// cycle in this module's cone — the same property access/taint-signal.ts's own leaf imports rely on.
+import { taskWakeThisTurn, uningressedTurn } from "../access/task-wake-signal.js";
+import { delegatedBindingAdopted, delegatedBindingThisTurn, delegatedSlotState } from "./delegated-binding.js";
+import { frozenSurfaceBindingFrom } from "./frozen-surface-binding.internal.js";
+
+/** Whether a surface's learnings may flow up to shared (workspace/domain) memory. */
+export type Visibility = "public" | "private";
+
+/**
+ * Whether a surface is INSIDE the trust boundary (members are all in-org) or reaches
+ * OUTSIDE it (externally shared / Slack Connect / guest members). This is a SEPARATE
+ * dimension from visibility: a private channel is still internal; an externally-shared
+ * channel is external even if "public" within the workspace.
+ *
+ * It selects the shared-memory layer (memory/resolve.ts): an `external` channel routes to
+ * the read-only `public` pseudo-domain instead of an internal domain, because surfacing
+ * internal memory to an outsider is a serious leak. For a DM, `trust` means "is the DM
+ * PARTNER internal?" — it picks the DM's shared read layer (internal → `dm`, external →
+ * `public`); the per-user DB silo is granted regardless. The gate is fail-closed: when
+ * trust can't be positively determined on a real platform (including any DM partner, which
+ * we can't yet verify), treat as `external`. See docs/capabilities/memory.md "external/guest gate".
+ */
+export type Trust = "internal" | "external";
+
+export interface SurfaceBinding {
+  /**
+   * The TENANT — the outermost partition key (Claude Tag's "org"). One deployment
+   * serves one org today (declared in agent/identity/surfaces.ts, default "default"); a hosted, multi-tenant
+   * deployment resolves it per-request (Slack workspace → org lookup, an auth claim, …),
+   * which is a dedicated resolver, not this env read — so org is resolved here in
+   * bindFrom, not in a per-platform mapper (those translate per-message identity).
+   * Every durable store partitions by this: SQLite/Postgres as the `org_id` column
+   * (+ RLS), git as the top-level directory.
+   */
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface: string;
+  /**
+   * The surface segment to use for DOMAIN + SPEND grain when it differs from `surface`
+   * — today only a Discord THREAD, whose `surface` is the thread's own channel id while
+   * domains and spend caps are declared against the PARENT channel (backlog item 22:
+   * Slack threads share the channel's surface key, so on Slack the two grains coincide
+   * and this is absent). Consumers that resolve a channel→domain hop (memory, RBAC,
+   * access bundles, model routes) or account/gate spend use `domainSurface ?? surface`;
+   * everything CONVERSATIONAL (sessions, engagement, reply targets, the partition
+   * surfaceKey that names memory working-copy dirs) deliberately stays on `surface` —
+   * a thread keeps its own conversational identity, it just belongs to its parent's
+   * domain and budget. Sanitized like `surface` (it becomes a storage/scope key segment).
+   */
+  readonly domainSurface?: string;
+  readonly mode: SessionMode;
+  /**
+   * TRUE when {@link mode} was RESOLVED — a platform mapper answered with one, or the operator
+   * declared it on `OE_MODE`. ABSENT means the mode is a GAP-FILL: nothing answered, and `channel`
+   * is the default that keeps every reader working (OPE-1867).
+   *
+   * 🔴 IT IS ONLY AS TRUTHFUL AS THE MAPPER, AND TODAY ONLY TEAMS ANSWERS HONESTLY. The flag says
+   * a mapper RETURNED a mode, not that the mapper was sure of it. `teamsResolvedMode` returns
+   * undefined for a conversation scope it cannot read, so Teams reports its own ignorance;
+   * `slackMode` still ends `return "channel"` for an activity with neither a `channel_type` nor a
+   * `D`-prefixed id, so Slack reports a default as a resolution. The residual exposure there is
+   * small — a Slack DM id starts with `D`, which that mapper's earlier arm catches — but do not
+   * read this flag as "every mapper reports provenance". Giving a mapper the Teams treatment is one
+   * function per bundle, and the next one to be written should follow `teamsResolvedMode`, never
+   * `slackMode`'s tail.
+   *
+   * 🔴 `mode` IS ALWAYS A USABLE VALUE, AND THIS IS THE ONLY WAY TO TELL THE TWO APART. Most
+   * readers want the gap-filled value and should keep reading `mode` alone — a room is the right
+   * assumption for visibility, trust and routing, all of which fail closed on their own terms.
+   * The reader that must NOT accept a default is the one that PUBLISHES the surface: a turn the
+   * mapper could not classify may be a one-to-one conversation, and naming it in a report posted
+   * into a room is the disclosure this flag exists to prevent. `hooks/spend.ts` `turnSurfaceMode`
+   * is that reader — it returns undefined here, and the row masks as `(unclassified)`.
+   *
+   * Absent therefore FAILS CLOSED for disclosure, which is why it is a positive flag rather than a
+   * `modeGapFilled` negative: a construction site that forgets it masks, it does not publish.
+   */
+  readonly modeResolved?: true;
+  readonly visibility: Visibility;
+  /**
+   * Trust boundary of the surface (internal vs external/guest). Gates ALL shared
+   * memory in the memory resolver (memory/resolve.ts) — fail-closed to `external`.
+   */
+  readonly trust: Trust;
+  /** The operator's own declaration for this room, in the declaration's vocabulary (internal or public), or undefined when they declared nothing. It is NOT trust: trust is a join in which the mapper's verdict outranks the declaration, so a gate that must ask whether the operator vouched that everyone here is a member reads this field instead. */
+  readonly declaredTrust?: SurfaceTrust;
+  readonly principalId?: string;
+  /** TRUE when principalId is attribution rather than an actor: the attested creator of a routine fire, or an unattended origin with nobody to name. Every read that turns an identity into a PERMISSION goes through actingPrincipalId, which answers undefined here; reads that only say WHO keep using principalId. */
+  readonly principalAttested?: true;
+  /** Channel-adapter target for proactive post-back (e.g. `{ channelId }`). */
+  readonly target?: Readonly<Record<string, unknown>>;
+  /**
+   * The thread this turn is anchored on, when the platform has one (Slack: the auth
+   * attributes' `thread_ts`, which Eve's adapter falls back to the triggering message's
+   * own ts — so a channel mention always carries it). Lets a tool post its side-effects
+   * (approval cards etc.) into the SAME thread as the agent's reply instead of as a
+   * fresh top-level channel message. NOT part of `target` deliberately: routine
+   * post-backs target the channel (a fresh message), never an old thread.
+   */
+  readonly threadTs?: string;
+  /** The engagement-registry key of this conversation. A mapper sets it only where the platform's key is not the Slack-shaped threadTs, never by reusing threadTs (about twenty consumers read that field as a Slack thread_ts API parameter), and it is not sanitized, because it must match the key the platform's ingress wrote byte for byte. */
+  readonly engagementKey?: string;
+  /** The room-grain engagement key, for a platform whose wake gate also watches the whole room. It is the stop anchor of last resort, reached only when the engagementKey mark found no row, so a mapper publishes it only where the platform stores a room-grain wake row; it is not sanitized, like engagementKey. */
+  readonly roomEngagementKey?: string;
+  /**
+   * The id of the message this turn is anchored on, for a platform whose reply anchor is NOT a
+   * Slack-shaped `threadTs` (OPE-671). `hooks/turn-anchor.ts` reads `threadTs` first and falls back
+   * to this field, so the ✋ stop-hand reaction (and the anchor row a reaction event resolves by)
+   * gets a real per-message id on Discord instead of always being empty.
+   *
+   * 🔴 A SEPARATE FIELD, for the SAME reason `engagementKey` is (OPE-661): reusing `threadTs` for a
+   * Discord message id would corrupt the ~twenty consumers that read it as a Slack thread_ts API
+   * parameter. A mapper sets this only where `threadTs` is absent and a real triggering-message id
+   * is known — Discord's gateway relay path; absent on a slash-command interaction (no message) and
+   * on Slack (its anchor is already `threadTs`).
+   */
+  readonly anchorMessageId?: string;
+  /** The container id the stop registry keys this turn's conversation by, when the platform's container is not the post-back target's channelId (Linear an issue, GitHub an issue or PR thread, Teams a reply chain). It is a separate field because about fifteen consumers read target.channelId as a chat channel to post into, and it is PREFERRED over target.channelId when a mapper sets both. */
+  readonly anchorChannelId?: string;
+}
+
+// Structural context — no eve imports, so it's satisfied by HookContext,
+// ToolContext, and DynamicResolveContext alike.
+interface AuthPrincipal {
+  readonly attributes?: Readonly<Record<string, string | readonly string[]>>;
+  readonly principalId?: string;
+  readonly principalType?: string;
+  /** eve's own name for the credential family that produced this slot ("app" on a schedule fire).
+   *  Read ONLY by {@link isScheduleOriginatedAuth}; every other derivation keys on attributes. */
+  readonly authenticator?: string;
+}
+export interface BindableContext {
+  readonly session?: {
+    readonly auth?: {
+      readonly current?: AuthPrincipal | null;
+      readonly initiator?: AuthPrincipal | null;
+    } | null;
+    /**
+     * eve's TYPED parent linkage, present on a DELEGATED CHILD run and on nothing else
+     * (`SessionParent`, seeded into the child's context by execution/runtime-context.js from the run
+     * input execution/subagent-tool.js built). Declared here — not only on hooks/spend.ts's
+     * `DelegatableContext` — because since OPE-393 it is a security discriminator read by the grain
+     * override, the delegation leaf rule, the wake/addressing neutralisation, the memory
+     * single-writer rule and the egress identical-binding invariant, all of which take a plain
+     * `BindableContext`. Host-set and model-unreachable: `buildSubagentRunInput` destructures only
+     * `message`/`outputSchema` off the model's action, so nothing a model writes can produce it.
+     */
+    readonly parent?: { readonly sessionId?: string; readonly callId?: string; readonly rootSessionId?: string };
+    /** This session's own durable id, distinct from parent.sessionId above. It is named id because every eve context that carries it names it id, and turn.id is session-scoped (turn_0, turn_1, and so on), so a caller that needs a unique per-turn key pairs the two. */
+    readonly id?: string;
+  };
+  readonly channel?: { readonly kind?: string; readonly continuationToken?: string };
+}
+
+/**
+ * The GROUP-rung key a mapper's {@link RawIdentity.trustGroup} contributes, or `undefined` when the
+ * mapper set nothing or set something malformed (fail-closed: no rung).
+ *
+ * SHAPE ONLY — core validates `<marker>:<id>` over the same safe charset every key segment uses and
+ * learns no vendor word. A value that would need sanitising is REFUSED rather than repaired: `seg()`
+ * would strip the colon and silently turn a group key into a surface key that could collide with a
+ * real room.
+ */
+function trustGroupKey(
+  platform: string,
+  workspace: string,
+  group: string | undefined,
+): { readonly groupKey: string } | undefined {
+  const key = trustGroupKeyFor(`${platform}/${workspace}`, group);
+  return key === undefined ? undefined : { groupKey: key };
+}
+
+/**
+ * The same GROUP-rung key from a workspace key a caller ALREADY holds — the shape a gate reading a
+ * resolved partition has (OPE-1538: the Teams single-window privacy floor). Exported so the rung has
+ * ONE spelling: a gate that composed `${workspaceKey}/${group}` by hand would drift from the binding
+ * the moment either side's validation changed, and the two must agree or a `public` group carve-out
+ * demotes on one plane and not the other. Returns `undefined` on a malformed group, fail-closed.
+ */
+export function trustGroupKeyFor(workspaceKey: string, group: string | undefined): string | undefined {
+  if (group === undefined || !/^[a-zA-Z0-9._-]+:[a-zA-Z0-9._-]+$/.test(group)) return undefined;
+  return `${workspaceKey}/${group}`;
+}
+
+/**
+ * The ENTERPRISE-rung key a mapper's {@link RawIdentity.trustEnterprise} contributes, or `undefined`
+ * when the mapper set nothing (fail-closed: no rung, so the walk reaches nothing it would not have
+ * reached before).
+ *
+ * SPELLED, NOT REFUSED — the opposite of {@link trustGroupKey}, and for a structural reason. A group
+ * key needs a colon that `seg()` would strip, so repairing it could silently turn it into a surface
+ * key; an enterprise id occupies the TENANT slot, where `seg()` is already the one spelling every
+ * other tenant id goes through. An id that cleans to nothing has no key.
+ */
+function trustEnterpriseKey(
+  platform: string,
+  enterprise: string | undefined,
+): { readonly enterpriseKey: string } | undefined {
+  const spelled = seg(enterprise, "");
+  if (spelled.length === 0) return undefined;
+  return { enterpriseKey: `${platform}/${spelled}` };
+}
+
+/** The one sanitiser for a platform id used as a key segment: the surface key, the memory partition, the domain roster, every audit row and a resource grant all use this spelling, and a second copy of the charset is how two of them drift apart. It is idempotent, and the 100-character clamp is its only lossy step. */
+export function surfaceKeySegment(value: string | undefined): string {
+  return seg(value, "");
+}
+
+// Re-exported so this module stays the one name callers say for the deployment's org; the
+// definition lives in the leaf `deployment-identity.ts` so a boot-time caller that cannot import
+// the identity layer's graph still reads the SAME spelling (OPE-1438).
+export { deploymentOrg } from "./deployment-identity.js";
+
+function authOf(ctx: BindableContext): AuthPrincipal | null {
+  return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+
+// Auth principalId, treating empty string as absent so it falls through to a
+// platform attribute (e.g. Slack's user_id) rather than binding a blank id. Exported (OPE-645) so
+// a chat channel's `turn.started` handler — the one point in a terminal reply's lifecycle where
+// `ctx.session.auth` is still THIS turn's live delivery, not a later queued one — can snapshot the
+// same principal `bindFrom` itself falls back to, without pulling in the whole platform-mapper +
+// binding-bridge machinery `bindFrom` runs (which needs a `channel.kind` a channel event's own ctx
+// never carries).
+export function authPrincipalId(ctx: BindableContext): string | undefined {
+  const pid = authOf(ctx)?.principalId;
+  return pid && pid.length > 0 ? pid : undefined;
+}
+
+function attr(a: AuthPrincipal["attributes"], keys: readonly string[]): string | undefined {
+  if (!a) return undefined;
+  for (const k of keys) {
+    const v = a[k];
+    if (typeof v === "string" && v.length > 0) return v;
+    if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0) return v[0];
+  }
+  return undefined;
+}
+
+// These two host-set attributes carry a triggered fire's stored creator into the binding, and routines/fire-auth.ts is their only writer, off the stored row and a live per-fire recheck of that person's standing. They are attributes rather than eve's auth.principalId on purpose: the creator's id then travels together with principalAttested, so no reader picks up the identity with the flag stripped off.
+
+/** Host-set: the STORED creator principal an autonomous fire is bound as ({@link SurfaceBinding.principalAttested}). */
+export const FIRE_PRINCIPAL_ATTR = "oe_fire_principal";
+/** Host-set: the LIVE per-fire verdict on that creator's CURRENT standing. POSITIVE-ONLY — the only
+ *  value that means anything is the literal `"internal"`; absent/anything else is fail-closed. */
+export const FIRE_PRINCIPAL_TRUST_ATTR = "oe_fire_principal_trust";
+/** Host-set marker that a trigger produced this session and nobody is acting on it; only the literal true counts, and every fire-auth bag builder stamps it. It exists beside the creator stamp because a webhook fire or a creator-less routine row has nobody to name, and it affects the attestation flag only, never trust. */
+export const FIRE_UNATTENDED_ATTR = "oe_fire_unattended";
+
+/** The attested creator this delivery carries, or undefined on an ordinary (human-acting) turn. */
+function attestedFirePrincipal(ctx: BindableContext): { readonly id: string; readonly internal: boolean } | undefined {
+  const a = authOf(ctx)?.attributes;
+  const id = attr(a, [FIRE_PRINCIPAL_ATTR, "oeFirePrincipal"]);
+  if (id === undefined) return undefined;
+  return { id, internal: attr(a, [FIRE_PRINCIPAL_TRUST_ATTR, "oeFirePrincipalTrust"]) === "internal" };
+}
+
+/** The attested creator id this delivery carries, when it carries one. Use it for AUDIT DETAIL only and never as the reply's author, because the schedule or service principal stays the actor a fired turn speaks as; it is undefined on an ordinary human turn, on a webhook fire and on a creator-less routine row, where there is genuinely nobody to name. */
+export function attestedFireCreatorId(ctx: BindableContext): string | undefined {
+  return attestedFirePrincipal(ctx)?.id;
+}
+
+/** Does this delivery declare an UNATTENDED origin ({@link FIRE_UNATTENDED_ATTR})? Positive-only,
+ *  like the trust stamp: only the literal `"true"` counts, anything else reads as a live turn. */
+function unattendedOrigin(ctx: BindableContext): boolean {
+  return attr(authOf(ctx)?.attributes, [FIRE_UNATTENDED_ATTR, "oeFireUnattended"]) === "true";
+}
+
+// eve hands every schedule handler this exact auth slot but exports it from no public entry point, so the three fields are restated here and pinned against eve's dist by the integration tier: a rename must fail loudly.
+// Attendedness fails CLOSED over three independent host-set facts, the unattended stamp, the routine marker and eve's schedule auth, and a hit on any one means nobody is acting; no live human turn can produce any of them.
+export const SCHEDULE_APP_AUTHENTICATOR = "app";
+export const SCHEDULE_APP_PRINCIPAL_ID = "eve:app";
+export const SCHEDULE_APP_PRINCIPAL_TYPE = "runtime";
+
+/** The auth slot {@link isScheduleOriginatedAuth} reads — structural, so a caller holding a raw eve
+ *  slot (hooks/fire-carriage.ts) needs no eve type import to pass it. */
+interface ScheduleAuthSlot {
+  readonly authenticator?: unknown;
+  readonly principalId?: unknown;
+  readonly principalType?: unknown;
+}
+
+/**
+ * Was this session started by a SCHEDULE handler? Mirrors eve's own `isScheduleAppAuth` predicate —
+ * all three fields, never the attributes — so a session that merely looks app-shaped cannot answer
+ * yes, and so the answer survives a fire that arrives with an empty attribute bag.
+ */
+export function isScheduleOriginatedAuth(auth: ScheduleAuthSlot | null | undefined): boolean {
+  return (
+    auth?.authenticator === SCHEDULE_APP_AUTHENTICATOR &&
+    auth?.principalId === SCHEDULE_APP_PRINCIPAL_ID &&
+    auth?.principalType === SCHEDULE_APP_PRINCIPAL_TYPE
+  );
+}
+
+/** Is a ROUTINE FIRE's own marker on this delivery? routines/fire-auth.ts is the only writer of it,
+ *  and it writes it onto nothing but a fire — so its presence alone means nobody is acting. */
+function routineMarkerDelivery(ctx: BindableContext): boolean {
+  return attr(authOf(ctx)?.attributes, [ROUTINE_MARKER.id]) !== undefined;
+}
+
+/** THE FAIL-CLOSED ATTENDEDNESS FLOOR (OPE-497) — see the block above for why it has three arms. */
+function unattendedDelivery(ctx: BindableContext): boolean {
+  return unattendedOrigin(ctx) || routineMarkerDelivery(ctx) || isScheduleOriginatedAuth(authOf(ctx));
+}
+
+/**
+ * The principal ACTING on this turn — `binding.principalId` unless it is merely ATTESTED, in which
+ * case there is no acting human and the answer is `undefined`.
+ *
+ * 🔴 THIS IS THE AUTHORITY FENCE (OPE-269). Call it — never `binding.principalId` — anywhere an
+ * identity is about to become a PERMISSION: admin standing (access/roles.ts), the personal
+ * connector universe (`dm:<principal>`, access/request.ts), and the "a human is in the room asking
+ * for this" gates on routine-mutating tools. `principalId` itself stays the honest answer to WHO,
+ * which is what audit rows, the spend ledger and an approval card's "asked by" line need.
+ *
+ * Deliberately a function over the binding rather than a second field: a field would be one more
+ * thing every SurfaceBinding literal has to remember to set correctly, and forgetting it would
+ * fail OPEN. This derives the answer from the flag the ONE constructor (bindFrom) sets.
+ */
+export function actingPrincipalId(binding: SurfaceBinding): string | undefined {
+  return binding.principalAttested ? undefined : binding.principalId;
+}
+
+/**
+ * IS NOBODY WATCHING THIS TURN? `true` on a routine/webhook/cron fire, `false` on a live human turn.
+ * The binding-taking form; `access/request.ts` `unattendedOf(ctx)` is the ctx-taking twin, and the
+ * pair mirrors {@link actingPrincipalId} / `actingPrincipalIdOf` deliberately.
+ *
+ * 🔴 THIS IS A SECURITY CONTROL (OPE-440). The approver chain turns `ask` into `deny` when it reads
+ * `true`, so "ask when nobody can answer" IS "deny". Every approval site derives the value through
+ * this function or its twin, and `lint:principal-gate` rule 5 refuses any other spelling — reading
+ * `binding.principalId` here would answer "a human is present" for every fire, because a fire binds
+ * as its routine's attested creator.
+ */
+export function unattendedFrom(binding: SurfaceBinding): boolean {
+  return actingPrincipalId(binding) === undefined;
+}
+
+// What a mapper returns — every field optional; bindFrom fills gaps from env/defaults.
+// Exported so a future provider bundle can author its mapper against the same contract and
+// register it via {@link registerIdentityMapper}.
+export interface RawIdentity {
+  readonly workspace?: string;
+  readonly surface?: string;
+  /** Domain/spend-grain surface segment when it differs (see SurfaceBinding.domainSurface). */
+  readonly domainSurface?: string;
+  readonly mode?: SessionMode;
+  readonly visibility?: Visibility;
+  /** Trust boundary; a mapper that can't determine it leaves it undefined → bindFrom
+   *  fails closed to `external` for real platforms (internal only for local/dev). */
+  readonly trust?: Trust;
+  /**
+   * For a DM: set true iff the mapper POSITIVELY verified the partner's trust (a real
+   * users.info-style lookup). When false/absent, bindFrom fails the DM closed to external.
+   * Lets a verified DM partner light up the `dm` shared layer while unverifiable platforms
+   * stay safe. Ignored for channels (their trust is already authoritative or fail-closed).
+   */
+  readonly trustVerified?: boolean;
+  /** The group rung between the tenant and the surface, as a marked segment of the form marker:id, set by a mapper only where such a container exists (Teams contributes its team id). The marker is the mapper's and never core's, core validates the shape alone, and a malformed value contributes no group key, so the rung is simply absent. */
+  readonly trustGroup?: string;
+  /** The enterprise rung above the tenant, for a platform that groups several workspaces under one organisation (Slack Enterprise Grid). A mapper sets the raw id and core spells it, an unspellable value contributes no key, and this is the LOWEST rung, so it never overrides the workspace line beneath it. */
+  readonly trustEnterprise?: string;
+  readonly principalId?: string;
+  readonly target?: Readonly<Record<string, unknown>>;
+  readonly threadTs?: string;
+  /** The engagement-registry key of this conversation, when the platform does not key it by
+   *  `threadTs` (see {@link SurfaceBinding.engagementKey}). Absent on Slack — its registry key IS
+   *  the thread ts. */
+  readonly engagementKey?: string;
+  /** The ROOM-GRAIN engagement key, for a platform whose wake gate also watches the whole room
+   *  (see {@link SurfaceBinding.roomEngagementKey}). Teams only. */
+  readonly roomEngagementKey?: string;
+  /** The stop-hand anchor message id, when the platform does not anchor by `threadTs` (see
+   *  {@link SurfaceBinding.anchorMessageId}). Absent on Slack — its anchor IS the thread ts. */
+  readonly anchorMessageId?: string;
+  /** The stop registry's CONTAINER id, when the platform's container is not the post-back target's
+   *  `channelId` (see {@link SurfaceBinding.anchorChannelId}). Absent on Slack and Discord. */
+  readonly anchorChannelId?: string;
+}
+
+/** A platform's identity mapper. IdentityMapper is the outward-facing name a provider bundle registers against; Mapper is the terse in-file alias. */
+export type IdentityMapper = (ctx: BindableContext) => RawIdentity;
+type Mapper = IdentityMapper;
+
+// The Slack identity mapper lives in the provider-slack bundle and registers at app boot. Unregistered, a slack bind falls back to bindLocal, the fail-closed default every unregistered platform gets.
+
+// The Linear identity mapper lives in the provider-linear bundle and registers at app boot; its contract is surface = the TEAM (the silo grain), issue = the post-back anchor, fail-closed private visibility, demotion-only guest trust.
+// currentTurnIssue below stays in core, because the neutral entity-actions spine reads it.
+
+// The Teams identity mapper lives in the provider-teams bundle and registers at app boot.
+
+// The GitHub chat-surface identity mapper lives in the provider-github bundle and registers at app boot: workspace = owner, surface = repo, mode = channel.
+
+// The Discord identity mapper lives in the provider-discord bundle and registers at app boot.
+
+// The Notion identity mapper lives in the provider-notion bundle and registers at app boot.
+
+// This mapper names no workspace and no surface on purpose: carriesPlatformIdentity runs it, and a value the deployment declares about itself must never make an identity-less delivery look like it carried a surface.
+// The ambient workspace and surface are gap-fillers applied in bindFrom; the mode, visibility and trust stand-ins stay on env, because they are clamped enums rather than identifiers.
+const ENV_MODES: ReadonlySet<string> = new Set(["channel", "dm", "mpim"]);
+
+const bindLocal: Mapper = (ctx) => {
+  const envMode = process.env.OE_MODE;
+  const envVis = process.env.OE_VISIBILITY;
+  const envTrust = process.env.OE_TRUST; // dev/test override for the memory gate
+  return {
+    workspace: undefined,
+    surface: undefined,
+    // OPE-1867: UNDEFINED when the operator declared nothing, rather than the old blind "channel".
+    // The effective mode is unchanged — bindFrom's own `?? "channel"` tail supplies it — but the
+    // binding can now say the value was GAP-FILLED. Declaring `OE_MODE` is a resolution: the
+    // operator answered for the surface, which is exactly what a mapper does.
+    mode: envMode && ENV_MODES.has(envMode) ? (envMode as SessionMode) : undefined,
+    visibility: envVis === "private" ? "private" : "public",
+    // Only honour OE_TRUST when explicitly set; otherwise leave undefined so bindFrom's
+    // platform-aware default applies (internal for local, external for unknown platforms).
+    trust: envTrust === "external" ? "external" : envTrust === "internal" ? "internal" : undefined,
+    principalId: authPrincipalId(ctx) ?? process.env.OE_PRINCIPAL,
+    target: undefined,
+  };
+};
+
+// The mapper registry is process-global, not module-private: a provider may register from one module identity while bindFrom reads from another. A missing mapper falls back to bindLocal, fail closed and silent, so a split registry looks exactly like an uninstalled platform; local is the hardcoded fallback and never a registry key.
+const MAPPERS = processRegistryMap<Mapper>("identity-mappers.v1");
+
+/** Register or replace one platform's identity mapper. A provider bundle calls this once at boot, so adding a platform needs no downstream change. */
+export function registerIdentityMapper(platform: string, mapper: IdentityMapper): void {
+  if (!admitProviderRegistration(platform, "identity-mapper")) return;
+  MAPPERS.set(platform, mapper);
+}
+
+/**
+ * Every platform that has REGISTERED a mapper, sorted. Read by `lint:surface-parity` to hold the
+ * §7.1 identity-mapper row to what the bundles actually registered. Distinct from asking `bindFrom`
+ * about a platform, which answers for every string by falling back to `bindLocal`.
+ */
+export function registeredIdentityMapperPlatforms(): readonly string[] {
+  return [...MAPPERS.keys()].sort();
+}
+
+/**
+ * Resolve the full surface binding from runtime context. Platform is `channel.kind`
+ * (the channel's `kindHint`, e.g. "slack") or OE_PLATFORM, defaulting to
+ * "local". The platform's mapper supplies identity; anything it leaves undefined
+ * falls back to env stand-ins, then to stable defaults (so the key stays constant
+ * across `eve dev` runs and cross-session recall is testable today).
+ */
+/** eve exposes a channel kind in two forms: the bare platform inside tool and step contexts, and a namespaced channel:slack inside lifecycle and hook contexts. Every kind comparison goes through platformFromKind, because a raw equality check silently fails in hook contexts; that bug shipped once, as the identity line falling back to generic. */
+/** eve derives a session's kind from the channel file's slug, not from its kindHint, so a platform served by a file not named after it binds as the slug and misses the mapper registry (measured 2026-07-06: gateway sessions bound as discord-gateway). Alias every such channel file in identity/platform.ts. */
+// An eve subagent child runs this bundle, but eve replaces its adapter, so its channel kind is subagent and it inherits the PARENT's whole auth attribute bag: every inherited host stamp describes the parent, not the child.
+// Three host-set discriminators identify a child, the typed session.parent, the channel kind and the subagent continuation token, and the predicate ORs them because each surface exposes a different subset; a false negative leaves a child on the parent's grain, wake identity and delegation route.
+
+/** eve's framework channel kind for a built-in/declared subagent child (`FRAMEWORK_CHANNEL_KINDS`). */
+export const SUBAGENT_CHANNEL_KIND = "subagent";
+
+/** The PARENT session id eve's typed linkage names, or undefined on a root run. Read through a local
+ *  cast (the {@link currentTurnId} precedent) so no eve type reaches this module. */
+export function subagentParentSessionId(ctx: BindableContext): string | undefined {
+  const id = ctx.session?.parent?.sessionId;
+  return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+
+/** The seat a delegated worker was spawned from: eve's rootSessionId, or the immediate parent.sessionId when the linkage names no root. A verb whose effect belongs to the CONVERSATION keys on this and not on currentSessionId, which names the one-shot run that ends before a person answers; it reads eve's typed session.parent only, never the continuation token, whose greedy subagent parse yields a scope key that names no session. */
+export function delegationRootSessionId(ctx: BindableContext): string | undefined {
+  try {
+    const parent = ctx.session?.parent;
+    const root = parent?.rootSessionId;
+    if (typeof root === "string" && root.length > 0) return root;
+    return subagentParentSessionId(ctx);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Is THIS context an eve-minted SUBAGENT CHILD run (built-in `agent` or a declared subagent)?
+ * See the block above for the three discriminators and why the OR is the safe shape. PURE and
+ * fail-soft — never throws, so it is callable from every gate that must narrow on it.
+ */
+export function isSubagentChildContext(ctx: BindableContext): boolean {
+  try {
+    if (subagentParentSessionId(ctx) !== undefined) return true;
+    // RAW kind, deliberately not channelPlatform — that function RESOLVES a subagent context to its
+    // parent's origin platform (that is its job below), so asking it here would always answer "slack".
+    // Same reasoning as isUnifiedWindowContext's raw read.
+    if (platformFromKind(ctx.channel?.kind) === SUBAGENT_CHANNEL_KIND) return true;
+    return classifySessionId(ctx.channel?.continuationToken).kind === "subagent";
+  } catch {
+    return false;
+  }
+}
+
+export function channelPlatform(ctx: BindableContext): string | undefined {
+  // A subagent child takes an origin hop: eve copies the parent's whole auth bag, so reading the inherited platform stamp resolves the PARENT's mapper against the PARENT's attributes and the two bindings come out identical, which is the invariant hooks/egress.ts enforces because the child shares the parent's sandbox.
+  // Fail-closed with no stamp (no mapper, then bindLocal), and this arm runs BEFORE the unified arm, so a child of a non-unified session that carries the stamp is healed too.
+  if (platformFromKind(ctx.channel?.kind) === SUBAGENT_CHANNEL_KIND) {
+    const delegated = delegatedBindingThisTurn(currentTurnId(ctx));
+    if (delegated !== undefined) return normalizePlatform(delegated.platform);
+    const inherited = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+    return inherited ? normalizePlatform(inherited) : SUBAGENT_CHANNEL_KIND;
+  }
+  const kind = platformFromKind(ctx.channel?.kind ?? process.env.OE_PLATFORM);
+  // SINGLE-WINDOW unified sessions (channels/unified.ts): the channel is synthetic — the REAL
+  // platform is per-DELIVERY, stamped into the auth attributes by the surface's diversion
+  // (channels/unified-window.ts stampUnifiedWindowAuth). Resolving it here means every
+  // downstream consumer (the MAPPERS registry, partitions, capabilities) sees the ORIGINATING
+  // surface exactly as it would on that surface's own channel — the auth attributes ARE that
+  // surface's own capture. Fail-closed: no stamp → "unified" (no mapper → bindLocal → the
+  // env-stand-in partition, same as any unknown kind — never a guessed platform). Unreachable
+  // when the feature is off (no unified channel session exists), so flag-off is byte-identical.
+  if (kind === "unified") {
+    const stamped = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+    return stamped ? normalizePlatform(stamped) : kind;
+  }
+  return kind;
+}
+
+/** Is this context a session on the synthetic single-window `unified` channel (channels/
+ *  unified.ts)? Checks the RAW kind — deliberately NOT {@link channelPlatform}, which resolves a
+ *  unified session to its per-delivery ORIGIN platform (that is its job). Used by the reply
+ *  tool to select its map-addressed unified variant. */
+export function isUnifiedWindowContext(ctx: BindableContext): boolean {
+  return platformFromKind(ctx.channel?.kind) === "unified";
+}
+
+/**
+ * The origin surface of the delivery driving this turn, resolvable from a tool-execute context, which carries no channel object at all, so every gate written against ctx.channel answers undefined inside an execute.
+ * The three arms weaken in order: channelPlatform, the per-delivery platform stamp, then bindFrom. local is not an origin and reports undefined, which a caller treats as a REFUSAL, never as a pass.
+ */
+export function turnOriginPlatform(ctx: BindableContext): string | undefined {
+  const live = channelPlatform(ctx);
+  if (live !== undefined) return live;
+  const stamped = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+  if (stamped) return normalizePlatform(stamped);
+  const bound = bindFrom(ctx).platform;
+  return bound === "local" ? undefined : bound;
+}
+
+/**
+ * The wake id of the delivery driving THIS turn (the `oe_wake_id` auth stamp
+ * channels/unified-window.ts writes). eve rewrites `session.auth.current` from each delivery's
+ * auth and coalesces a multi-delivery turn to the LAST delivery's auth, so this is the current
+ * turn's wake — the authority fence the single-window reply tool validates against so a model
+ * can't target a wakeId from a prior turn or another conversation.
+ *
+ * THIS IS THE TURN'S ADDRESS, and three classes of turn are refused one here rather than at each of
+ * the many consumers: a subagent child (OPE-393), a background-task settlement that has read a
+ * terminal view (OPE-585 — it answers under the TASK's own id), and a settlement that has read none
+ * (OPE-597 — it answers `undefined`). Undefined off the single-window path too (no stamp). */
+export function currentWakeId(ctx: BindableContext): string | undefined {
+  // 🔴 A SUBAGENT CHILD HAS NO WAKE IDENTITY (OPE-393). MEASURED 2026-08-11: the child's auth bag
+  // carries the PARENT's `oe_wake_id` byte-identically (its `turn.tool_gated` audit rows were stamped
+  // with the parent's wakeId), so a child holding `reply` held a VALID address into the human's live
+  // thread — it could speak into a conversation that never asked it anything, bypassing the seat's
+  // fold-in entirely. A child's output has exactly one legitimate route: the subagent-result leg back
+  // to its parent.
+  //
+  // NEUTRALISED AT THE SOURCE rather than at each consumer, because the consumers are many and the
+  // fail directions are already right: `reply` refuses (resolveAnswerableReplyTarget cannot resolve a
+  // target from `undefined`), `no_reply`/`react`/`complete_thread`/`spawn_*` degrade
+  // to "no wake", and every audit row writes `wakeId: null`. One neutralisation, no consumer left to
+  // forget. {@link currentTurnAddressing} / {@link currentTurnAddressed} are neutralised the same way
+  // just below — the addressing stamp is the other half of the same inherited claim.
+  if (isSubagentChildContext(ctx)) return undefined;
+  // 🔴 A BACKGROUND-TASK SETTLEMENT WAKE HAS NO STAMP OF ITS OWN (OPE-585). MEASURED 2026-08-15:
+  // eve wakes the delegating parent through the session's own command hook with NO auth
+  // (`wakeTaskParentStep`), and eve writes the turn's auth only when a delivery brings one — so the
+  // task-woken turn inherits the PREVIOUS wake's `oe_wake_id` and holds a live address into
+  // whichever conversation happened to run last. The settlement edge installs the task's OWN
+  // host-minted wake id (channels/task-wake.ts), and it wins here, at the source, for the same
+  // reason the subagent-child neutralisation above is at the source: the consumers are many.
+  //
+  // TURN-SCOPED, so the override cannot outlive the turn that adopted it — the slot refuses to
+  // answer for any turn but the one stamped into it, and an unreadable turn id answers `undefined`,
+  // which falls straight through to the inherited stamp (the pre-OPE-585 behaviour).
+  const turnId = currentTurnId(ctx);
+  const adopted = taskWakeThisTurn(turnId);
+  if (adopted !== undefined) return adopted;
+  // A turn that meets no settlement edge holds no address of its own: it kept the previous delivery's wake id and could reply into a conversation that asked nothing, so the honest answer is none. Every consumer then refuses or throws an instructive error, except the question bridge, which drops a worker's question with an audit row and no model-visible error.
+  if (uningressedTurn(turnId)) return undefined;
+  return inheritedWakeStampOf(ctx);
+}
+
+/**
+ * The RAW `oe_wake_id` auth stamp, with every override in {@link currentWakeId} bypassed.
+ *
+ * Two callers, both of which want the stamp as a FACT rather than as an address:
+ *   • the `unified.task_wake` audit row's `inheritedWakeId` field — the stale id the turn would
+ *     otherwise have replied under, which is what makes the defect countable after the fix;
+ *   • {@link deliveryStampOf}, as its fallback.
+ *
+ * 🔴 NEVER USE THIS TO ADDRESS A REPLY. It is exactly the value OPE-393, OPE-585 and OPE-597 each
+ * decided a turn may not speak under; {@link currentWakeId} is the only reader that answers that
+ * question.
+ *
+ * 🔴 ONE READER USES IT TO NAME, NEVER TO POST (OPE-1869), and the distinction is the whole licence.
+ * `hooks/spawn-taint.ts` offers this stamp as a delegated read's SECOND provenance address, because
+ * the seat REPLIES under it while the settling turn answers under the task's own minted wake. It is
+ * not a post target there and it is not trusted on sight: `channels/delegated-provenance.ts`
+ * `delegatedSecondAddress` reads both wake rows back and admits the stamp only where they resolve to
+ * the same conversation — which is what keeps OPE-585's "whichever conversation ran last" out.
+ */
+export function inheritedWakeStampOf(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["oe_wake_id", "oeWakeId"]);
+}
+
+/** The per-delivery discriminator the turn boundary compares: a value byte-identical to the previous turn's proves this turn brought no delivery of its own. It falls back to the raw wake stamp for a bag written before the nonce existed, and it stays pure and override-free, because the boundary must read what eve delivered rather than what a later edge installed. */
+export function deliveryStampOf(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["oe_delivery_id", "oeDeliveryId"]) ?? inheritedWakeStampOf(ctx);
+}
+
+/** The eve turn id, read off the session handle rather than the auth bag. It is turn-constant, and undefined outside an active turn compares unequal to any stored id, so the same-turn re-accept fence fails closed; it is present on tool and hook callback contexts but ABSENT on the step.started resolver context, where a caller falls back to the resolver event's own turnId field. */
+export function currentTurnId(ctx: BindableContext): string | undefined {
+  const turn = (ctx as { session?: { turn?: { id?: string } } }).session?.turn;
+  return typeof turn?.id === "string" && turn.id.length > 0 ? turn.id : undefined;
+}
+
+/** This session's own durable id; sessionId is a defensive fallback that no measured eve context uses. Pair it with currentTurnId for a unique key, because eve mints turn ids as turn_0, turn_1 and so on, so two warm sessions collide on turn number alone. */
+export function currentSessionId(ctx: BindableContext): string | undefined {
+  const session = (ctx as { session?: { id?: unknown; sessionId?: unknown } }).session;
+  const id = session?.id;
+  if (typeof id === "string" && id.length > 0) return id;
+  const legacy = session?.sessionId;
+  return typeof legacy === "string" && legacy.length > 0 ? legacy : undefined;
+}
+
+/**
+ * The BARE window token of the session THIS delivery woke (the host-set `oe_window_token` stamp,
+ * channels/unified-window.ts OE_WINDOW_TOKEN_ATTR — stamped by divertToUnifiedWindow on every
+ * delivery). The FALLBACK identity channel for `ctx.channel.continuationToken`, which is
+ * session-static and can be ABSENT at tool-execute time on a resumed seat (the live-found
+ * 2026-07-16 refusal on a legitimate standing window) — per-wake auth attributes are fresh on
+ * every delivery, exactly like the oe_grain stamp that survived the same turn. Host-set only,
+ * unforgeable (§AUTH-ATTRIBUTE PROVENANCE, channels/unified-window.ts); the stamp names the
+ * DISPATCHED-TO session (a task worker's stamp is its task
+ * token), so grain/recursion classification over it stays truthful. Undefined off the
+ * single-window path (no stamp).
+ */
+export function currentWindowToken(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["oe_window_token", "oeWindowToken"]);
+}
+
+/**
+ * The bare session/window token THIS turn runs under — the key a per-session "Approve for session"
+ * memo is stored/consulted under (OPE-53 pr.open, OPE-11 connector writes). Prefers the live
+ * continuation token (namespace-stripped), falling back to the host-set window-token stamp
+ * ({@link currentWindowToken}) — `ctx.channel` can be blank at tool-execute on a resumed seat.
+ * Undefined ⇒ the turn's session can't be identified, so session-approval is simply never
+ * offered/consulted for it (safe: a card is always minted). Shared by open_pull_request.ts's
+ * propose path so the key is derived identically wherever it is consulted.
+ *
+ * TASK-grain wakes collapse to their PARENT window ({@link sessionGrantKeyFromToken}): on the
+ * unified topology every wake runs in a spawned task session whose token embeds the wakeId, so
+ * keying the memo on the raw token made every wake a different "session" and a grant could never
+ * be seen again (live-caught 2026-07-25: S-PR-SESSION leg 2 drew a fresh card on a granted window).
+ * The conversation the human granted is the WINDOW; the task is plumbing.
+ */
+export function proposingSessionId(ctx: BindableContext): string | undefined {
+  // A ROUTINE FIRE keys on the ROUTINE, not on the throwaway session it happens to run in
+  // (OPE-152). This ONE swap is the whole run-time half: every consult site and the click path's
+  // memo write already read this function (or the frozen `sessionId` it produced), so a grant a
+  // human gives an unattended flow outlives the fire, and the next fire finds it. The key is
+  // host-set on the fire's auth bag off the STORED row (routines/fire-auth.ts), so it carries the
+  // routine's live generation — and an `edit_routine` therefore hands the next fire a different
+  // key, invalidating the whole standing set with no sweep.
+  const routineKey = routinePermissionKeyStamped(authOf(ctx)?.attributes);
+  if (routineKey !== undefined) return routineKey;
+  // A native subagent child keys its PARENT's session-approval memo deliberately: delegating a piece of the work must not escape a card the human declined, nor ask them again for one they approved, and one memo means a revoke takes both sides back at once.
+  // The arm is explicit because a hook context would otherwise key a different memo than a tool context; a dispatched task worker is a separate session and still asks its own cards.
+  if (isSubagentChildContext(ctx)) {
+    const inherited = currentWindowToken(ctx);
+    if (inherited !== undefined) return sessionGrantKeyFromToken(inherited);
+  }
+  const raw = (ctx as { channel?: { continuationToken?: unknown } }).channel?.continuationToken;
+  const token = bareTokenFromEveContext(raw) ?? currentWindowToken(ctx);
+  return token === undefined ? undefined : sessionGrantKeyFromToken(token);
+}
+
+/**
+ * The ADDRESSING of the delivery driving THIS turn (`oe_addressing`, written by
+ * channels/unified-window.ts stampUnifiedWindowAuth ONLY for an addressed `direct-mention` wake).
+ * It marks the wake as OWED a reply, which is what the envelope tells the seat. It is NOT a delivery
+ * path: since OPE-1982 the unified channel's completion handler drops a turn's closing prose on EVERY
+ * addressing and re-drives it once towards the `reply` tool, so it no longer selects a route.
+ * 🔴 IT IS STILL LOAD-BEARING IN THREE PLACES, and reading it as audit-only is how a later change
+ * moves a tool gate without noticing: it classifies the drop row's `addressing` field (an owed
+ * answer nobody received stays countable apart from ambient chatter); `hooks/job-posture.ts` reads
+ * `direct-mention` as a HUMAN PRINCIPAL in the turn, which feeds the job-session tool restriction;
+ * and `access/analytics-scope.ts`'s `isAmbientNonAddressedTurn` degrades analytics rows mode to
+ * aggregates without it. Undefined off the single-window path or for a non-addressed (watch) wake.
+ */
+export function currentTurnAddressing(ctx: BindableContext): string | undefined {
+  // A SUBAGENT CHILD inherits this stamp verbatim too (OPE-393) — see {@link currentWakeId}. Nobody
+  // addressed the child; a brief was handed to it. Neutralised for the same reason and in the same
+  // direction: every consumer treats absence as "ambient / no requestor", which is the narrower
+  // answer (connector disclosure's leg 2 stops running, the job hook stops reading a human into the
+  // room, the analytics ambient test is unreachable at `task` grain).
+  if (isSubagentChildContext(ctx)) return undefined;
+  return attr(authOf(ctx)?.attributes, ["oe_addressing", "oeAddressing"]);
+}
+
+/**
+ * Was the delivery driving THIS turn ADDRESSED to the agent (a `direct`/addressed wake — @mention,
+ * DM, or a surface's name-drop), as opposed to a judged/ambient/channel-watch wake? Reads the
+ * host-set `oe_addressed` auth stamp a surface dispatch writes on its direct wakes (identity/
+ * bot-name.ts OE_ADDRESSED_ATTR), OR the single-window `oe_addressing="direct-mention"`/`"direct"`
+ * stamp (stampUnifiedWindowAuth) which already means addressed.
+ *
+ * 🔴 AUTHORITATIVE AND FAIL-CLOSED. This is the signal the link-claim hook gates its relaxed
+ * `link <code>` recognition on (hooks/link-claim.ts): an addressed single-author body may carry a
+ * leading address token, a judged multi-author ENVELOPE may not (that is the F1 attack surface). The
+ * stamp is HOST-SET (§AUTH-ATTRIBUTE PROVENANCE, channels/unified-window.ts) — a model or untrusted
+ * body cannot forge it — and a MISSING stamp reads as NOT addressed ⇒ the strict whole-message anchor
+ * applies ⇒ nothing regresses on a surface that has not (yet) stamped it.
+ */
+export function currentTurnAddressed(ctx: BindableContext): boolean {
+  // The third inherited addressing claim (OPE-393) — `oe_addressed` rides the same verbatim copy.
+  // A child was never addressed by anyone, and this stamp's one consumer (hooks/link-claim.ts) uses
+  // it to RELAX a recogniser, so answering false is the fail-closed direction.
+  if (isSubagentChildContext(ctx)) return false;
+  const a = authOf(ctx)?.attributes;
+  const flag = attr(a, ["oe_addressed", "oeAddressed"]);
+  if (flag !== undefined) return flag === "1" || flag.toLowerCase() === "true";
+  const addressing = attr(a, ["oe_addressing", "oeAddressing"]);
+  return addressing === "direct-mention" || addressing === "direct";
+}
+
+/** The platform-resolved integration name stamped on THIS delivery's auth (identity/bot-name.ts
+ *  OE_BOT_NAME_ATTR), when a surface with a live integration name set it (Notion). Feeds the
+ *  addressed link-claim recogniser's name-token set so a name-drop that matches the deployment's
+ *  ACTUAL integration name is stripped even without OE_AGENT_* configured. Undefined ⇒ the recogniser
+ *  falls back to the env/brand tokens only. */
+export function currentTurnBotName(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["oe_bot_name", "oeBotName"]);
+}
+
+/**
+ * The Linear ISSUE the delivery driving THIS turn is anchored to (`issue_id`, falling back to
+ * `issue_identifier`) — the authoritative per-wake issue the surface's identity capture stowed
+ * (channels/linear-identity.ts buildLinearAuth), the SAME source the Linear supervisor's turn.started
+ * reply-target snapshot reads. This is the DEFAULT issue for read_linear_issue: unlike Notion (whose
+ * binding.surface IS the page being read), a Linear session's `surface` is the TEAM (the silo grain,
+ * see bindLinear) — the CONTAINER, not the entity — so `bindFrom(ctx).surface` is the wrong default
+ * (it would fetch a team id as an issue). The issue lives in the auth attributes, not `surface`;
+ * reading it here is the authoritative anchor, NOT a guess derived from the team. Undefined when no
+ * issue was stamped (e.g. a unified turn whose stamp omits it) ⇒ the tool requires an explicit arg.
+ */
+export function currentTurnIssue(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["issue_id", "issueId", "issue_identifier", "issueIdentifier"]);
+}
+
+/**
+ * The Notion PAGE the delivery driving THIS turn is anchored to — `page_id`, the raw per-wake stamp
+ * the surface's identity capture stows (channels/notion-identity.ts, whose `pageId` is "the page the
+ * comment lives on").
+ *
+ * 🔴 THE RAW ATTRIBUTE, NOT `bindFrom(ctx).surface`, AND THE DIFFERENCE IS THE POINT. A Notion
+ * session's `surface` IS the page, but it is the SANITIZED partition segment — `seg()`-passed, and
+ * defaulted to a placeholder on an under-identified event — so it is a partition key, not an id you
+ * can compare against one a Notion API call returned. `channels/read-reach.ts` compares exactly that
+ * way, to decide whether a record's id already appeared in the room, so it needs the id the host
+ * stamped. Undefined on every turn woken somewhere other than a Notion page.
+ */
+export function currentTurnPage(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["page_id", "pageId"]);
+}
+
+/** The raw Linear organization id off this turn's auth attributes: the credential SELECTOR a Linear tool call needs, because a Linear token is workspace-scoped and the exact organization id is the registry key. It is deliberately not the binding's sanitized workspace segment, and it is undefined when this turn stamped no organization, where the caller falls back to the org-free credential chain. */
+export function currentTurnOrganization(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["organization_id", "organizationId"]);
+}
+
+/**
+ * The GitHub issue/PR the delivery driving THIS turn is anchored to — owner + repo + exactly one of
+ * issue/PR number, read off THIS turn's RAW auth attributes rather than a stored session-open
+ * snapshot, so a unified session's per-delivery GitHub turn resolves its OWN anchor (mirrors
+ * {@link currentTurnIssue}'s Linear counterpart). Reads the same attributes bindGitHub interprets,
+ * but DIRECTLY (not via the resolved binding.target) so it stays CORE-SELF-CONTAINED after the
+ * github chat-surface mapper moved into @open-everywhere/provider-github (OPE-114 stage 4): the
+ * githubEntityAdapter / SCM plane stay in core and must not depend on a bundle registration. The
+ * platform gate is kind-derived (bindFrom's platform comes from the channel kind, not the mapper).
+ * Undefined when this turn isn't a GitHub delivery, or the webhook carried no owner/repo/number —
+ * the caller (entity-ref default resolution) then requires an explicit ref rather than guessing.
+ */
+export function currentTurnGithubTarget(ctx: BindableContext): { owner: string; repo: string; number: number; isPr: boolean } | undefined {
+  // Kind-derived platform gate (channelPlatform resolves the originating surface from the channel
+  // kind — or the unified-window oe_platform stamp — WITHOUT the mapper registry), so this stays
+  // core-self-contained regardless of whether the github bundle's mapper is registered.
+  if (channelPlatform(ctx) !== "github") return undefined;
+  const a = authOf(ctx)?.attributes;
+  const owner = attr(a, ["owner"]);
+  const repo = attr(a, ["repo"]);
+  if (!owner || !repo) return undefined;
+  // Anchor selection mirrors the GitHub mapper, and exactly one anchor is emitted.
+  const conversationKind = attr(a, ["conversation_kind", "conversationKind"]);
+  const issueNumber = attr(a, ["issue_number", "issueNumber"]);
+  const pullRequestNumber = attr(a, ["pull_request_number", "pullRequestNumber"]);
+  const isPrKind = conversationKind === "pull_request" || conversationKind === "review_thread";
+  if (isPrKind && pullRequestNumber) return { owner, repo, number: Number(pullRequestNumber), isPr: true };
+  if (issueNumber) return { owner, repo, number: Number(issueNumber), isPr: false };
+  if (pullRequestNumber) return { owner, repo, number: Number(pullRequestNumber), isPr: true };
+  return undefined;
+}
+
+/**
+ * Per-turn surface fence for a per-surface read tool, called inside execute: a cross-surface session carries turns from several surfaces while the session.started mount gate saw only the opener's origin, so this requires THIS turn's origin to equal the tool's surface and throws on anything else.
+ * It fails closed hard: a turn whose origin cannot be named at all is refused, never waved through.
+ */
+/** OPE-732 — thrown by {@link assertTurnSurface}. Lets the five async call sites distinguish this
+ *  fence's refusal from any other thrown Error (without parsing message text) and audit it before
+ *  rethrowing. `assertTurnSurface` itself stays PURE and synchronous — no store access, no signature
+ *  change — the audit write happens at each async caller. Deliberately no `.name` override: `String(err)`
+ *  stays "Error: …", so every existing message-regex `assert.throws` assertion is unaffected. */
+export class TurnOriginFenceError extends Error {
+  constructor(message: string, readonly surface: string) {
+    super(message);
+  }
+}
+
+export function assertTurnSurface(ctx: BindableContext, surface: string): void {
+  const origin = turnOriginPlatform(ctx);
+  if (origin === surface) return;
+  throw new TurnOriginFenceError(
+    origin === undefined
+      ? `this tool reads ${surface}, but this turn's origin surface could not be resolved — a per-surface read only runs on a turn this deployment can place on ${surface}.`
+      : `this tool reads ${surface}, but the message that woke this turn came from ${origin} — ` +
+        `on a cross-surface session a per-surface read tool only runs on a turn from its OWN surface (what you can recall across surfaces is the shared context, not another surface's live reads).`,
+    surface,
+  );
+}
+
+/**
+ * The GRAIN of a session — what sets its HANDS (window-tool-gating-design §D/§S3). A STANDING ambient
+ * watcher (the unified window / a per-channel or ticketing supervisor / the root DM seat) narrows to
+ * conversational hands and delegates heavy work; a THREAD seat (a persistent conversational presence
+ * spawned by spawn_thread_session, Stage T2) is likewise narrow; only a TASK (thread-scoped worker,
+ * the one-shot spawn) keeps the FULL wide-hands kit. Grain — not source count —
+ * determines the toolset (the invariant that supersedes `sources.length===1 ⇒ full`).
+ *
+ * NATIVE (a raw `@mention` seat) WAS a full-kit grain (Stage C); under the narrowing (flag
+ * delegation.oneshotAgent) it is a CONVERSATIONAL-ROOT grain that delegates through `agent`, so it
+ * LOSES the wide hands (see access/window-gate-manifest.ts `fullKit()`). The grain enum is unchanged; what
+ * moved is wide-hands membership. Conversational-root grains = standing/native/thread; the ONLY grain
+ * with wide hands is `task` (the one-shot worker — a credential-correct new session, both agent modes).
+ */
+export type WindowGrain = "standing" | "task" | "native" | "thread";
+
+/** Classify a raw continuation token's grain from its shape alone (the BACKSTOP signal). Delegates to
+ *  the ONE typed codec {@link classifySessionId} (channels/window-key.ts) — which strips eve's
+ *  `unified:<raw>` send-prefix, tests task (`t/`) + thread-seat (`s/`) window tokens BEFORE the
+ *  standing `:oe-sup:g` suffix, and fail-softs a non-string / unrecognised token to "native" (full
+ *  hands, the pre-gate default). Byte-identical to the former inline classifier (task→task,
+ *  thread-seat→thread, window/container-supervisor→standing, else→native), pinned by
+ *  scripts/session-id-codec-test.ts. A thread-seat token still fails CLOSED to `thread` (narrow),
+ *  never `task`, so a lost `oe_grain` stamp cannot re-widen a thread seat. */
+function classifyTokenGrain(token: unknown): WindowGrain {
+  return classifySessionId(token).grain;
+}
+
+/**
+ * The grain the HOST STAMPED on this delivery, unreconciled, or `undefined` when no stamp reads as a grain.
+ *
+ * 🔴 IT IS NOT {@link windowGrainOf}, AND THE DIFFERENCE IS THE POINT. On a DELEGATED CHILD, `windowGrainOf`
+ * answers `task` by the subagent-child override, while eve copies the PARENT's whole auth bag into the child —
+ * so the stamp there describes the SEAT the worker was spawned from, and this is the one reader of that fact.
+ * A caller asking what THIS session's own hands are takes `windowGrainOf` and never this: the reconciliation
+ * below (the spoof/bug guard) is exactly what this function skips.
+ *
+ * Host-set and model-unreachable (channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE). An unrecognised value
+ * answers `undefined` rather than a guess, so a caller must state what it does with an unreadable stamp.
+ */
+export function stampedWindowGrainOf(ctx: BindableContext): WindowGrain | undefined {
+  const stamped = attr(authOf(ctx)?.attributes, ["oe_grain", "oeGrain"]);
+  return stamped === "standing" || stamped === "task" || stamped === "native" || stamped === "thread" ? stamped : undefined;
+}
+
+/**
+ * The grain of THIS session. PRIMARY = the host-stamped `oe_grain` auth attribute
+ * (channels/unified-window.ts stampUnifiedWindowAuth / channels/unified.ts dispatchTaskWindow) — set
+ * by OE host code at dispatch, never model-authored, so it is unforgeable and stable for the session's
+ * life (verified + source-cited ONCE in channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE). BACKSTOP = {@link classifyTokenGrain} (the token shape). PURE — a function of the stamp and the
+ * token only (no eve, no store) — so each grain is mint-and-assert testable, exactly as §S3 requires.
+ *
+ * SPOOF/BUG guard, fail-CLOSED to NARROW: if the stamp claims a FULL grain (task/native) while the
+ * token independently classifies a NARROWER grain, the wider claim LOSES. A stamped task grain on a
+ * non-task token is a bug, not a capability grant.
+ *
+ * The one deliberate exception is the DEGRADATION case: a blank/unreadable token (the known
+ * session.started degradation, §S3 fragile point) is NOT a positive narrow signal — it is the ABSENCE
+ * of the token, so the stamp stays primary (a legit async worker whose `t/` token degraded keeps its
+ * `task` grain). This is why the guard distinguishes an ABSENT/blank token (stamp wins) from a token
+ * that is PRESENT and positively classifies `native` (a real `cse_…` @mention seat — a `task` stamp
+ * there is a bug/forge, since a legit worker always rides a `t/` token — so it is narrowed). Closes the
+ * T2 asymmetry the adversarial review flagged (F2): `task` on a present native token no longer keeps
+ * wide hands, WITHOUT regressing the degraded-worker path (blank token).
+ */
+export function windowGrainOf(ctx: BindableContext): WindowGrain {
+  // A subagent child is task grain, overriding any inherited grain stamp: measured, a child of a standing seat resolved standing and was stripped to the conversational roster.
+  // It sits FIRST, above the stamp-versus-token reconciliation, because neither the stamp nor the token describes this session; task hands are not a widening, because the child is credentialed identically to its parent and holds no delegation route and no wake identity.
+  if (isSubagentChildContext(ctx)) return "task";
+  const rawToken = ctx.channel?.continuationToken;
+  const stamped = stampedWindowGrainOf(ctx);
+  const tokenGrain = classifyTokenGrain(rawToken);
+  // A token is a POSITIVE signal only when it is actually present; a non-string/empty token is the
+  // degradation sentinel (classifyTokenGrain also returns "native" for it), where the stamp stays primary.
+  const tokenPresent = typeof rawToken === "string" && rawToken.length > 0;
+  if (stamped !== undefined) {
+    // SPOOF/BUG guard, fail-CLOSED to NARROW: a stamp claiming a grain WIDER than the token positively
+    // shows LOSES. ORIGINAL (Stage-C, preserved byte-identical): a task/native stamp on a positively-
+    // STANDING token → standing. EXTENDED (Stage T2): a `task` stamp (the sole wide-hands grain) on a
+    // positively-narrow THREAD-seat token → thread; and (F2) on a PRESENT native token → native — a
+    // forged/buggy wide stamp never re-widens a narrow seat. A blank token (tokenPresent === false)
+    // takes none of these branches, so the stamp stays primary for the degraded legit worker.
+    if ((stamped === "task" || stamped === "native") && tokenGrain === "standing") return "standing";
+    if (stamped === "task" && tokenGrain === "thread") return "thread";
+    if (stamped === "task" && tokenGrain === "native" && tokenPresent) return "native";
+    return stamped;
+  }
+  return tokenGrain;
+}
+
+/**
+ * The short WORKER TASK LABEL stamped on a task-window worker's OPENING delivery (OPE-508, the reply
+ * display-name/prefix TIER signal) — a PURE read of the `oe_task_label` auth attribute, mirroring
+ * {@link windowGrainOf}'s attribute-read style but with no token-shape backstop (there is no text to
+ * recover from a token — only the host stamp carries it). Undefined on every non-worker turn, and on
+ * a worker turn woken by a LATER message in its own thread (the stamp is not re-derived on a resumed
+ * wake, unlike `oe_grain` — see channels/unified-window.ts's OE_TASK_LABEL_ATTR header). Callers that
+ * need a bracket on every worker turn regardless fall back to a generic label when this is undefined
+ * — see channels/turn-delivery.ts's {@link ReplierLabel}-producing `replierLabelFor`.
+ */
+export function windowTaskLabelOf(ctx: BindableContext): string | undefined {
+  return attr(authOf(ctx)?.attributes, ["oe_task_label"]);
+}
+
+/** The sources vector stamped on THIS delivery: a pure read of the host-set stamp, with no config and no store. Undefined when the stamp is absent, on a normal non-unified session or a resumed pre-stamp session, and the caller then picks the fallback. */
+export function windowSourcesOf(ctx: BindableContext): readonly string[] | undefined {
+  const a = authOf(ctx)?.attributes;
+  if (!a) return undefined;
+  const decoded = decodeSources(a["oe_sources"] ?? a["oeSources"]);
+  return decoded.length > 0 ? decoded : undefined;
+}
+
+/** The sources vector for this session, fail-closed: the host stamp first, then a recompute from the continuation token's window and domain plus the domain config, then the single origin platform, never empty and never a wider set. domains is injected so the resolver stays pure and testable. */
+export function resolveWindowSources(ctx: BindableContext, domains: readonly Domain[]): readonly string[] {
+  const stamped = windowSourcesOf(ctx);
+  if (stamped) return stamped;
+  // Both fallbacks have to work inside an execute, where ctx.channel is absent: the window-token stamp stands in for the continuation token, and turnOriginPlatform for the origin. A resolver context carries both, so resolve-time behaviour is unchanged; eve namespaces a window-channel send with a unified prefix, so strip it before parsing the token.
+  const tok = ctx.channel?.continuationToken ?? currentWindowToken(ctx);
+  const raw = typeof tok === "string" && tok.startsWith("unified:") ? tok.slice("unified:".length) : tok;
+  const key = parseWindowToken(raw);
+  if (key) {
+    const recomputed = sourcesForWindow(key.windowId, key.domain, domains);
+    if (recomputed.length > 0) return recomputed;
+  }
+  const origin = turnOriginPlatform(ctx);
+  return origin ? [origin] : [];
+}
+
+/** Resolve a bridged, identity-less context through the same platform hop the live path uses. That heals a stamped raw channel slug and adds the unified-to-origin hop, so the bridged fallback binds the REAL origin surface instead of unified, which resolved no mapper and desynced memory writes from reads on the very channel the bridge exists to keep in sync. */
+export function bindBridged(bridged: BridgedIdentity): { platform: string; raw: RawIdentity } {
+  const bctx = bridgedContext(bridged);
+  const platform = seg(channelPlatform(bctx), "local");
+  const raw = (MAPPERS.get(platform) ?? bindLocal)(bctx);
+  return { platform, raw };
+}
+
+/**
+ * The platform + {@link RawIdentity} a LIVE context resolves through the mapper registry — the first
+ * hop of {@link bindFrom}, factored out so {@link carriesPlatformIdentity} answers "does this
+ * context carry a platform identity?" with the SAME two lines that ask it. Normalizing the kind (see
+ * {@link channelPlatform}) is what makes the mapper registry match in BOTH forms: without it the
+ * hook path resolves no mapper and fails closed to `external`, desyncing memory READS (hook) from
+ * WRITES (tool) on the very same internal channel. (`seg` would turn the ":" into "-", so the strip
+ * happens BEFORE the sanitize.)
+ */
+function rawIdentityFrom(ctx: BindableContext): { platform: string; raw: RawIdentity } {
+  const platform = seg(channelPlatform(ctx), "local");
+  return { platform, raw: (MAPPERS.get(platform) ?? bindLocal)(ctx) };
+}
+
+/**
+ * Does this context carry a PLATFORM IDENTITY of its own — a workspace or a surface its platform
+ * mapper can read off the delivered auth attributes?
+ *
+ * This is the exact question {@link bindFrom}'s bridged fallback asks, exported because it is also
+ * the question {@link refreshBindingStamp} asks on both sides of its downgrade test.
+ * A bag can be non-empty and still answer FALSE: the OE window stamps (`oe_platform`, `oe_wake_id`,
+ * `oe_grain`, `oe_window_token`, `oe_sources`) are host metadata about the delivery, not the
+ * platform's own identity attributes (Slack's `team_id`/`channel_id`, Discord's `guild_id`, …).
+ */
+export function carriesPlatformIdentity(ctx: BindableContext): boolean {
+  return namesASurface(rawIdentityFrom(ctx).raw);
+}
+
+/** Did a mapper resolve either half of a surface address off this identity? The ONE spelling of the
+ *  test — {@link bindFrom}'s bridged-fallback trigger, {@link carriesPlatformIdentity} and
+ *  {@link refreshBindingStamp}'s downgrade test all read it, so the three cannot drift apart. */
+function namesASurface(raw: RawIdentity): boolean {
+  return raw.workspace !== undefined || raw.surface !== undefined;
+}
+
+/** The one production entry point for the binding bridge. A stamp that names a surface may not be replaced by a context that names none, but the rule is a DOWNGRADE test only: the same bag carries a fire's attested creator and unattended marker, and refusing an identity-less fire's write would hand its tool contexts an ATTENDED reading. */
+export function refreshBindingStamp(ctx: BindableContext): "stamped" | "kept" {
+  if (!carriesPlatformIdentity(ctx)) {
+    const established = readBindingBridge();
+    if (established !== null && namesASurface(bindBridged(established).raw)) return "kept";
+  }
+  stampBindingBridge(ctx);
+  return "stamped";
+}
+
+// The bridge is a session-scoped slot and eve gives a native subagent child a NEW durable session, so a child inherits the delivery's auth bag and nothing else; the heal writes the platform's own attributes back onto that bag, and it rides the four eve dist facts that scripts/native-subagent-test.ts section D9 pins.
+// It may never copy a host stamp of either prefix: a stale wake id is the cross-conversation address that was refused three times, and a stale routine marker would widen a live seat to the fire posture.
+
+/** The two prefixes every HOST-set auth stamp uses. The heal copies neither — see the block above. */
+const HOST_STAMP_PREFIXES: readonly string[] = ["oe_", "open_everywhere_"];
+
+/** What one {@link healDeliveryIdentity} pass did. `unwritable` is the LOUD arm and the only one a
+ *  caller should report: the write WAS attempted and the read-back says it did not land (a frozen or
+ *  cloned bag). `no-delivery` is its quiet twin — there was no auth slot to write to at all, which is
+ *  every context that never carried a delivery. */
+export type DeliveryHealOutcome = "not-needed" | "healed" | "no-stamp" | "cross-platform" | "no-delivery" | "unwritable";
+
+/**
+ * Write the session's established platform identity back onto THIS delivery's auth attributes, so a subagent child's verbatim inherited copy sees the identity the seat already binds.
+ * It can only restore, never escalate: it runs only when the delivery names no surface, writes only keys the bag lacks, repeats bindFrom's cross-platform fence, and derives its answer from a read-back, so a frozen or cloned bag reports unwritable rather than a false healed.
+ */
+export function healDeliveryIdentity(ctx: BindableContext): DeliveryHealOutcome {
+  try {
+    if (carriesPlatformIdentity(ctx)) return "not-needed";
+    const bridged = readBindingBridge();
+    if (bridged === null) return "no-stamp";
+    const hop = bindBridged(bridged);
+    if (!namesASurface(hop.raw)) return "no-stamp";
+    const platform = seg(channelPlatform(ctx), "local");
+    if (MAPPERS.get(platform) !== undefined && hop.platform !== platform) return "cross-platform";
+    const auth = authOf(ctx) as { attributes?: Record<string, string | readonly string[]> } | null;
+    if (auth === null) return "no-delivery";
+    if (auth.attributes === undefined) auth.attributes = {};
+    const bag = auth.attributes;
+    for (const [key, value] of Object.entries(bridged.attributes)) {
+      if (HOST_STAMP_PREFIXES.some((p) => key.startsWith(p))) continue;
+      if (bag[key] !== undefined) continue;
+      bag[key] = value;
+    }
+    // THE READ-BACK, not a count of assignments: it asks the question the caller actually has.
+    return carriesPlatformIdentity(ctx) ? "healed" : "unwritable";
+  } catch {
+    return "unwritable";
+  }
+}
+
+/**
+ * The fail-closed backstop for a child that lost its parent's binding: the heal depends on a mutation of an eve-owned object surviving into the child, and a release that freezes or clones the bag takes it away silently, leaving the child on the org-default partition with no grants and the wrong memory partition.
+ * Narrow on purpose: true only when the inherited platform stamp resolves a REGISTERED mapper and the child still names no surface, so eve dev, evals and unit contexts can never trip it.
+ */
+export function subagentBindingLost(ctx: BindableContext): boolean {
+  try {
+    if (!isSubagentChildContext(ctx)) return false;
+    if (delegatedBindingThisTurn(currentTurnId(ctx)) !== undefined) return false;
+    if (MAPPERS.get(seg(channelPlatform(ctx), "local")) === undefined) return false;
+    if (carriesPlatformIdentity(ctx)) return false;
+    const bridged = readBindingBridge();
+    return bridged === null || !namesASurface(bindBridged(bridged).raw);
+  } catch {
+    return false; // fail-soft: an unreadable context must not kill a session on a guess
+  }
+}
+
+/**
+ * Does {@link bindFrom} answer this context with the `subagent/…/unresolved` sentinel, and why?
+ * `undefined` for every context that is not a delegated child, or that holds its dispatch binding.
+ * `no-context` is the eve-context-scope class (OPE-2106): the slot holds the binding, but the caller
+ * runs outside eve's context and cannot read it. `empty` is a child whose slot holds nothing.
+ */
+export function delegatedBindingUnresolved(ctx: BindableContext): "empty" | "no-context" | undefined {
+  try {
+    if (!isSubagentChildContext(ctx)) return undefined;
+    if (delegatedBindingThisTurn(currentTurnId(ctx)) !== undefined) return undefined;
+    const state = delegatedSlotState();
+    return state === "adopted" ? undefined : state;
+  } catch {
+    return undefined;
+  }
+}
+
+export function bindFrom(ctx: BindableContext): SurfaceBinding {
+  // An internal continuation (today, an approval decision wake) carries the exact binding frozen
+  // from the wake that proposed the action. Its rendered trigger is system-authored and its live
+  // auth intentionally carries no clicker's platform identity, so the ordinary mapper road would
+  // otherwise fall through to the ambient/env stand-in. Admit only the strict host stamp, on the
+  // synthetic unified channel, for this deployment and the same stamped origin platform.
+  if (isUnifiedWindowContext(ctx)) {
+    const frozen = frozenSurfaceBindingFrom(ctx);
+    if (frozen !== undefined && frozen.org === deploymentOrg() && normalizePlatform(frozen.platform) === channelPlatform(ctx)) return frozen;
+  }
+  // A delayed native child can start after a sibling surface has replaced the standing seat's
+  // current auth. Its dispatch wake is the authority: hooks/binding-bridge.ts restores that
+  // host-captured binding before any worker tool or access resolver runs. The child session is
+  // dedicated to that dispatch; approval/input resumes remain under the same authority.
+  if (isSubagentChildContext(ctx)) {
+    const delegated = delegatedBindingThisTurn(currentTurnId(ctx));
+    if (delegated !== undefined) return delegated;
+    // Until the async lifecycle hook resolves the durable dispatch snapshot, a native child has no
+    // surface authority. Never let an earlier hook consume Eve's launch-time auth: on a shared seat
+    // it may belong to a later sibling wake. The sentinel also answers a caller that runs outside
+    // eve's context scope, where the slot cannot be read (see delegatedBindingUnresolved).
+    if (!delegatedBindingAdopted()) {
+      return {
+        org: deploymentOrg(),
+        platform: "subagent",
+        workspace: UNNAMED_TENANT,
+        surface: "unresolved",
+        // No `modeResolved` (OPE-1867), deliberately: this sentinel names no real conversation, so
+        // `channel` is the fail-closed default and never a classification. A report must not
+        // publish `subagent//unresolved` as a room on the strength of it.
+        mode: "channel",
+        visibility: "private",
+        trust: "external",
+      };
+    }
+  }
+  let { platform, raw } = rawIdentityFrom(ctx);
+  // The attested creator of a triggered fire (OPE-269), read BEFORE the bridged fallback and
+  // re-read from the bridge below — a fire whose tool contexts arrive identity-less must not lose
+  // its creator (it would silently fall back to eve's `eve:app` schedule principal, which is the
+  // pre-OPE-269 behaviour this exists to replace).
+  let fire = attestedFirePrincipal(ctx);
+  // The unattended-origin marker (OPE-278) — read alongside the creator stamp, from the same bag,
+  // for the same reason: a fire whose tool contexts arrive identity-less must not lose it (the
+  // fallback would silently hand its non-empty service id back to every presence gate). Since
+  // OPE-497 the read is the three-armed FAIL-CLOSED floor, so the loss of one attribute — or of the
+  // whole bag — can no longer answer "a human is present".
+  let unattended = unattendedDelivery(ctx);
+  // Identity-less context (no platform ids at all — tool contexts of send()-created
+  // sessions arrive like this in prod): fall back to the identity a hook of THIS
+  // session stamped, instead of silently binding the env-default "dev" partition.
+  // See identity/binding-bridge.ts. Real contexts (mention path, hooks) never trigger
+  // this — their mapper resolves at least a workspace or surface.
+  if (!namesASurface(raw)) {
+    const bridged = readBindingBridge();
+    if (bridged) {
+      const hop = bindBridged(bridged);
+      // 🔴 THE CROSS-PLATFORM FENCE (OPE-603). A standing window seat can serve SEVERAL platforms at
+      // once (a cross-surface domain), so "the identity this session last established" is only the
+      // right answer when this delivery names the SAME platform. The delivery names it in its own
+      // `oe_platform` stamp, which is host-set and unforgeable, so the test is cheap and honest.
+      // It applies ONLY when the live context resolved a REGISTERED platform: the classic bridged
+      // case — a `send()`-created session whose tool context carries no stamp at all — resolves the
+      // synthetic "unified"/"subagent" kind, which has no mapper, and it must still bridge (that is
+      // the whole reason the bridge exists). A genuine mismatch refuses the hop and falls to the env
+      // stand-in, i.e. fail-closed to `external` — never a neighbouring surface's grants.
+      if (MAPPERS.get(platform) === undefined || hop.platform === platform) {
+        ({ platform, raw } = hop);
+        // The bridge stamps the whole attribute bag verbatim, so the fire stamps ride it — and they
+        // ride TOGETHER, which is what keeps a bridged fire attested rather than fail-open. The
+        // unattended marker takes the identical ride: same bag, same verbatim carriage — and the
+        // bridge carries `authenticator` too (OPE-497), so the schedule-auth arm of the floor below
+        // survives the reconstitution rather than being the one arm a bridged fire loses.
+        fire ??= attestedFirePrincipal(bridgedContext(bridged));
+        unattended ||= unattendedDelivery(bridgedContext(bridged));
+        console.warn(
+          `[open-everywhere:binding-bridge] context carried no platform identity — bound via the session's stamped ${platform} identity`,
+        );
+      }
+    }
+  }
+  const local = bindLocal(ctx); // gap-filler for missing fields
+  // OPE-1867 — THE MODE, AND WHETHER ANYTHING ACTUALLY RESOLVED IT. `resolvedMode` is undefined
+  // exactly when neither the platform mapper nor an `OE_MODE` declaration could classify this
+  // conversation; `mode` then gap-fills `channel` so every reader keeps a usable value, and
+  // `modeResolved` is what lets the one reader that PUBLISHES a surface refuse the default.
+  const resolvedMode = raw.mode ?? local.mode;
+  const mode = resolvedMode ?? "channel";
+  // Resolve the storage keys up-front (same derivation as memory/partition.ts) so the
+  // per-surface trust allowlist can be consulted against the EXACT key it'll be filed
+  // under. A workspace-level vouch (`<platform>/<workspace>`) covers every surface under
+  // it; a surface-level vouch narrows to one. See identity/trust.ts.
+  // The fallback literal is identity/principal-key.ts's UNNAMED_TENANT, imported rather than
+  // re-typed: the principal composer REFUSES that exact string as a tenant rung (OPE-309), so the
+  // two spellings must not be able to drift apart.
+  // The deployment's declared AMBIENT room is the last rung before the built-in defaults, and it
+  // is read HERE rather than in `bindLocal` on purpose (OPE-1545): a value the deployment declares
+  // about itself fills a gap, and must never make an identity-less delivery look like it carried a
+  // surface — see the bindLocal header, and `carriesPlatformIdentity` below it.
+  const workspace = seg(raw.workspace ?? ambientWorkspace(), UNNAMED_TENANT);
+  const surface = seg(raw.surface ?? ambientSurface(), "default");
+  // The DOMAIN grain, resolved here (not only at the return below) because a declaration written on
+  // the CONTAINER — the Discord channel a thread lives in, the Teams channel a conversation belongs
+  // to — must reach the room inside it. Raw surface first: an exact declaration on the room itself
+  // always beats one on its container.
+  const domainSurfaceSeg = raw.domainSurface ? seg(raw.domainSurface, surface) : undefined;
+  const declared = declaredSurfaceTrust({
+    tenantKey: `${platform}/${workspace}`,
+    surfaceKeys:
+      domainSurfaceSeg !== undefined && domainSurfaceSeg !== surface
+        ? [`${platform}/${workspace}/${surface}`, `${platform}/${workspace}/${domainSurfaceSeg}`]
+        : [`${platform}/${workspace}/${surface}`],
+    ...(trustGroupKey(platform, workspace, raw.trustGroup) ?? {}),
+    ...(trustEnterpriseKey(platform, raw.trustEnterprise) ?? {}),
+  });
+  const vouched = declared === "internal" ? ("internal" as const) : undefined;
+  // The operator's public declaration sits ABOVE the mapper because it maps to external, the floor: it can only lower, so it is safe by construction, and the matching internal promotion stays BELOW the mapper, so uncertainty never resolves up.
+  // DMs and group DMs are out of scope, because there trust asks whether the PARTNER is internal; a public declaration leaves vouched undefined and the DM gate fails the partner closed.
+  const declaredExternal = mode === "channel" && declared === "public" ? ("external" as const) : undefined;
+  // The LIVE per-fire verdict on a triggered fire's attested creator (OPE-269) — POSITIVE-ONLY, so
+  // it can only ever raise a surface that would otherwise fail closed, never demote one the mapper
+  // positively verified. That ordering is why a CHANNEL fire is untouched by this: its mapper
+  // verdict (`trust_checked`/`is_ext_shared`, stamped by the dispatcher's own live
+  // conversations.info recheck) is already positive, so it wins on the left.
+  const fireTrust: Trust | undefined = fire?.internal === true ? "internal" : undefined;
+  // Trust precedence, and the DEMOTE-ABOVE / PROMOTE-BELOW asymmetry is the whole of it:
+  //   1. the operator's `public` DECLARATION (a demotion to the floor — can only ever lower);
+  //   2. the platform mapper's own verdict (a real membership check, or a positively-external
+  //      Slack channel that must STAY external);
+  //   3. the fire's live creator recheck;
+  //   4. this deploy's per-surface `internal` declaration (a PROMOTION — "deny by default,
+  //      allow-list exceptions", and it must stay below the mapper);
+  //   5. the blanket OE_TRUST env;
+  //   6. a platform-aware default — `internal` for local/dev (so memory works under `eve dev` and
+  //      tests), `external` for any real platform (FAIL CLOSED on the gate).
+  let trust = declaredExternal ?? raw.trust ?? fireTrust ?? vouched ?? local.trust ?? (platform === "local" ? "internal" : "external");
+  // For a DM, trust means is the DM PARTNER an internal member, because it selects the DM's shared read layer.
+  // A mapper's positive verification, an explicit vouch of this DM's key, a blanket OE_TRUST of internal, or a fire whose creator was re-verified internal THIS FIRE are honoured; anything else fails closed to external, and the per-user DB silo is granted regardless.
+  if (
+    mode === "dm" &&
+    platform !== "local" &&
+    process.env.OE_TRUST !== "internal" &&
+    !raw.trustVerified &&
+    vouched !== "internal" &&
+    fire?.internal !== true
+  ) {
+    trust = "external";
+  }
+  return {
+    // Tenant: deployment-level today (env), a per-request lookup when hosted. See the
+    // SurfaceBinding.org doc for why this isn't a per-platform mapper concern.
+    org: deploymentOrg(),
+    platform,
+    workspace,
+    surface,
+    // Domain/spend grain (see the field doc): sanitized like `surface` (it builds scope
+    // keys). Only surfaced when the mapper actually resolved one AND it differs from the
+    // surface itself — a degenerate equal value would just be noise for consumers.
+    domainSurface: domainSurfaceSeg !== undefined && domainSurfaceSeg !== surface ? domainSurfaceSeg : undefined,
+    mode,
+    // Spread conditionally, like every other optional field on this object: an unresolved mode
+    // omits the key rather than carrying an explicit `undefined`, so a deep-equal over a binding
+    // does not start seeing a new key on a surface nothing classified.
+    ...(resolvedMode === undefined ? {} : { modeResolved: true as const }),
+    visibility: raw.visibility ?? local.visibility ?? "public",
+    trust,
+    // The operator's declaration, BEFORE the join above folded it in behind the mapper. Spread
+    // conditionally so an undeclared room omits the key entirely rather than carrying an explicit
+    // `undefined` — every other optional field on this object does the same, and a deep-equal over a
+    // binding must not start seeing a new key on a deployment that declared nothing.
+    ...(declared === undefined ? {} : { declaredTrust: declared }),
+    // The attested creator WINS over the mapper (OPE-269). It has to: on a fire the mapper reads
+    // eve's schedule principal off the auth slot (`eve:app`, channel/schedule-auth.js) and that is a
+    // non-empty string, so a lower-precedence stamp would never be reached. The pairing with
+    // `principalAttested` below is what makes this safe — see that field's doc.
+    principalId: fire?.id ?? raw.principalId ?? local.principalId,
+    // ATTESTED on an attested-creator fire — and on ANY unattended origin (OPE-278), even one with
+    // nobody to name. The webhook fire's `webhook:<hookId>` (and a creator-less row's `eve:app`)
+    // stays on `principalId` for audit/provenance; what the marker removes is only its ability to
+    // answer "is a human here, acting" — actingPrincipalId returns undefined for both.
+    ...(fire || unattended ? { principalAttested: true as const } : {}),
+    target: raw.target,
+    // Not seg()-sanitized: a thread ts ("1234.5678") is a Slack API parameter, never a
+    // storage path segment, and it comes from the platform's own verified event payload.
+    threadTs: raw.threadTs,
+    // Not seg()-sanitized either, and for a stricter reason than threadTs: this key must equal, byte
+    // for byte, the key the platform's own ingress passed to markThreadEngaged. A repaired value
+    // would address a row that no wake gate ever reads.
+    engagementKey: raw.engagementKey,
+    // The ROOM-grain opt-in (OPE-1511). It carries the platform's own raw room id for the audit
+    // trail; the room row's ADDRESS is never taken from here but derived from the partition
+    // (`channels/engagement.ts` roomEngagementAddress), so the wake that writes the row and the
+    // stop that marks it cannot drift apart on two spellings of one id.
+    roomEngagementKey: raw.roomEngagementKey,
+    // Not seg()-sanitized, for the same reason: must equal, byte for byte, the real message id a
+    // reaction event carries (turnAnchorKey matches on it exactly).
+    anchorMessageId: raw.anchorMessageId,
+    // Not seg()-sanitized, for the same reason again: the stop trigger names the platform's own raw
+    // container id, and `turnChannelKey` matches on it exactly.
+    anchorChannelId: raw.anchorChannelId,
+  };
+}