@open-everywhere/core 0.1.0

package/agent/routines/fire-auth.ts

@@ -0,0 +1,280 @@
+// fire-auth — THE one place an UNATTENDED ORIGIN's auth attributes are built. Three builders, three
+// origins: {@link routineFireAttributes} for a routine fire (clock + event fan-out),
+// {@link webhookFireAttributes} for a signed webhook fire, and {@link serviceTokenFireAttributes}
+// for a control-token door (see its own header — a door is not a fire, and it is here for the one
+// property every builder in this module stamps unconditionally, {@link FIRE_UNATTENDED_ATTR}).
+// The principal-gate lint's RULE 4 (access/principal-gate-manifest.ts) enforces the module's
+// monopoly: a session auth naming a SERVICE principal must take its bag from a builder here.
+// Extracted from schedules/dispatch.ts's `markedAuth` (OPE-143) because a
+// SECOND caller exists: the event fan-out (routines/github-fanout.ts). That caller used to build
+// its own bag by hand carrying ONLY the ROUTINE_MARKER attributes — no platform identity — so a
+// fired event routine's session bound to the fallback partition (slack/dev/default) instead of the
+// routine's real surface, and memory silo, skills, bundle, trust and spend attribution all landed
+// on the WRONG partition. There must not be two shapes; there is now one function and two callers.
+//
+// What goes in here is exactly what the clock dispatcher stamped, in the same order:
+//   1. the resolved DispatchTarget's platform identity attributes (team_id / channel_id /
+//      channel_type / chat_id / guild_id / … — whatever that platform's bindFrom mapper reads to
+//      re-derive workspace + surface + mode);
+//   2. the LIVE per-fire internal-trust verdict, positive-only (never a verdict cached at create
+//      time — a channel that goes externally-shared must stop being treated as internal);
+//   3. the root-DM grain stamp, so an autonomous fire into a 1:1 / group DM does NOT get the wide
+//      "native" hands a live human turn there would;
+//   4. the durable-JOB fire stamp (+ taint-forward) that narrows the wake's toolset;
+//   5. the ROUTINE_MARKER link the session-end outcome hook attributes ok/failed back through;
+//   6. the ATTESTED CREATOR (OPE-269) — the routine's stored `createdBy`, plus the LIVE per-fire
+//      verdict on that person's CURRENT standing;
+//   7. the UNATTENDED-ORIGIN marker (OPE-278) — UNCONDITIONAL, in every builder in this module,
+//      because attestation used to travel only as a side effect of point 6's creator id: a fire
+//      with nobody to name (a webhook hook, a creator-less row) bound its dispatcher's non-empty
+//      service principal un-attested, and satisfied every presence gate in the tree;
+//   8. the PER-FIRE ID (OPE-626) — the caller's host-minted `fireWakeId`, so the outcome fold has a
+//      per-fire latch key on the NATIVE path as well as the windowed one.
+//
+// NO FAKE USER PRINCIPAL, and no unconditional trust. Point 6 is neither: the id is the row's own
+// stored creator, and the trust half is re-derived from the platform on every single fire. What
+// this module never does is INVENT a human, or carry a verdict decided at creation time.
+//
+// ⚠️ THE OLD SHAPE, and why it was wrong (OPE-269). This header — and schedules/routine-dispatch.ts
+// — used to say a fire stamps no principal and no trust "because a routine fire has no acting human;
+// trust is a live per-fire recheck". The first clause is true; the second described a recheck that
+// was never performed. Skipping it is not neutral — binding then fell through to the fail-closed
+// default, so a DM fire bound `external` and silently lost the shared read layer the SAME person's
+// live DM gets, with no error and nothing to notice. Two further facts made the old wording
+// misleading rather than merely incomplete: a fire was never principal-LESS (it bound eve's own
+// `eve:app` schedule principal, so every "a fire has no principal" gate in the tree was inert), and
+// the recheck the comment promised is genuinely cheap. So the fire now performs it and stamps the
+// answer. Fail-closed intent is unchanged, and is now actually enforced: no positive verdict this
+// fire ⇒ no stamp ⇒ `external`.
+
+import { rootDmGrainAttrs } from "../channels/unified-window.js";
+import { jobFireAttrs } from "../access/job-posture.js";
+import type { SessionMode } from "../access/resolver.js";
+import { FIRE_PRINCIPAL_ATTR, FIRE_PRINCIPAL_TRUST_ATTR, FIRE_UNATTENDED_ATTR } from "../identity/binding.js";
+import { isJobRoutine, isRoutineModelRole, isSilentRoutine, routinePermissionKey, ROUTINE_MARKER, type Routine } from "./routine.js";
+
+/**
+ * Build the auth `attributes` bag for one routine fire.
+ *
+ * @param r               the routine being fired (supplies the marker + job stamps).
+ * @param destAttributes  the resolved DispatchTarget's platform identity attributes.
+ * @param mode            the fire surface's session mode (drives the root-DM grain stamp).
+ * @param internal        the LIVE internal-trust verdict for the fire's CHANNEL — fail-closed
+ *                        `false` wherever no live check is possible (only a confirmed Slack CHANNEL
+ *                        can be positive today).
+ * @param creatorInternal the LIVE per-fire verdict on the routine's CREATOR (routines/fire-creator.ts
+ *                        recheckFireCreator). POSITIVE-ONLY: pass `true` only on a verdict this fire
+ *                        actually obtained; `undefined` (the default, and the fail-closed answer for
+ *                        every platform that cannot check) stamps nothing.
+ * @param fireId          the caller's host-minted per-fire id (OPE-626) — the same uuid it hands the
+ *                        window divert as the wake id. Omitted ⇒ the bag is byte-identical to
+ *                        before, which is what every unit call site relies on.
+ */
+export function routineFireAttributes(
+  r: Routine,
+  destAttributes: Readonly<Record<string, string>>,
+  mode: SessionMode,
+  internal: boolean,
+  creatorInternal?: boolean,
+  fireId?: string,
+): Record<string, string> {
+  return {
+    ...destAttributes,
+    ...(internal ? { is_ext_shared: "false", trust_checked: "true" } : {}),
+    // THE UNATTENDED-ORIGIN MARKER (OPE-278) — UNCONDITIONAL, and the unconditionality is the whole
+    // point. The attested-creator stamp below is conditional on the row HAVING a creator, and
+    // `principalAttested` used to be set only as its side effect — so a creator-less row's fire
+    // bound eve's non-empty `eve:app` schedule principal (or the fan-out's `<source>:webhook`) with
+    // no attestation, and satisfied every presence gate in the tree. This marker says "this is a
+    // fire" independently of whether the fire can name anyone, so the two can never be fused again.
+    [FIRE_UNATTENDED_ATTR]: "true",
+    // THE ATTESTED CREATOR (OPE-269) — the ONE carrier of "whose routine is this?" into the fired
+    // session, host-set off the STORED row exactly like the grant/silent/manual stamps beside it.
+    // It is what lets an unattended fire be attributed honestly (audit, spend ledger, the "asked by"
+    // line on a cost-checkpoint card the fire raises) instead of to eve's `eve:app` runtime
+    // principal — and it is deliberately paired with `principalAttested` on the binding, so no
+    // reader can pick up the identity without also learning it is not a human acting.
+    ...(r.createdBy ? { [FIRE_PRINCIPAL_ATTR]: r.createdBy } : {}),
+    // …and the LIVE standing verdict, POSITIVE-ONLY. `=== true` rather than truthiness is
+    // load-bearing: the caller obtains this by awaiting a recheck, and a dropped `await` would hand
+    // us a Promise — truthy, and it would stamp `internal` on a verdict nobody ever received. An
+    // un-awaited promise fails this test and the fire falls back to fail-closed `external`, which is
+    // exactly what an unperformed check should produce.
+    ...(creatorInternal === true ? { [FIRE_PRINCIPAL_TRUST_ATTR]: "internal" } : {}),
+    // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a routine fire builds
+    // its auth BY HAND (bypassing the per-surface buildXxxAuth builders that stamp on live
+    // ingress), so it must stamp the standing grain itself — else the fire carries a native-shaped
+    // token ⇒ classifyTokenGrain "native" ⇒ FULL wide-hands kit on an autonomous fire.
+    ...rootDmGrainAttrs(
+      mode === "dm" || mode === "mpim",
+    ),
+    // DURABLE-JOB fire stamp (OPE-111) + the tainted-ledger forward (routines/routine.ts
+    // jobTainted). Empty (byte-identical) for every non-job routine.
+    ...jobFireAttrs(isJobRoutine(r), r.jobTainted === true),
+    [ROUTINE_MARKER.id]: r.id,
+    [ROUTINE_MARKER.surface]: r.surfaceKey,
+    [ROUTINE_MARKER.org]: r.org,
+    // STANDING-GRANT KEY (OPE-152) — the ONE carrier that makes this fire's approvals key on the
+    // ROUTINE rather than on its throwaway session. Derived from the STORED row, so it carries the
+    // row's live promptGeneration: an `edit_routine` between two fires hands the next fire a
+    // DIFFERENT key, which is how an edit invalidates every standing grant without a sweep.
+    // Host-set and model-unforgeable, like the silent/manual stamps beside it, and unconditional
+    // (see ROUTINE_MARKER.permissionKey for why a fire must never fall back to its window token).
+    [ROUTINE_MARKER.permissionKey]: routinePermissionKey(r),
+    // SILENT-FIRE stamp (OPE-149) — the ONE carrier of `report: {kind:"silent"}` into the fired
+    // session. Host-set off the STORED row and model-unforgeable, which is what makes the delivery
+    // gate (routines/report.ts ← hooks/routine-silence.ts) a structural control rather than an
+    // instruction the model could talk itself out of. Positive-only: absent for every ordinary
+    // routine, so their attribute bag is byte-identical to before. It rides the unified-window
+    // divert too — routines/fire-window.ts forwards this whole bag verbatim.
+    ...(isSilentRoutine(r) ? { [ROUTINE_MARKER.silent]: "true" } : {}),
+    // MANUAL-FIRE stamp (OPE-147) — the ONE carrier of "a human asked for this run off-schedule"
+    // (`run_routine_now` → routines/routine.ts manualRunAt) into the fired session, and from there
+    // onto the `routine.fire` join row via hooks/routine-outcome.ts. Host-set off the STORED row
+    // and model-unforgeable, exactly like the silent stamp above: the model cannot make an ordinary
+    // scheduled fire claim it was human-requested, nor hide that a run was. Positive-only, so a
+    // scheduled fire's attribute bag is byte-identical to before.
+    ...(r.manualRunAt !== undefined ? { [ROUTINE_MARKER.manual]: "true" } : {}),
+    // PER-FIRE ID (OPE-626, ROUTINE_MARKER.fire) — the latch key hooks/routine-outcome.ts folds one
+    // fire on. It rides HERE, in the bag both delivery legs carry, because the value it replaces
+    // (`oe_wake_id`) is stamped by the WINDOW DIVERT alone: a fire on the native path carried no
+    // per-fire key at all, so a native-path JOB seat — one session, many fires — folded its first
+    // fire and nothing after it. The dispatcher passes the SAME uuid it gives the divert as the wake
+    // id, so a windowed fire's latch key is unchanged and only the native path gains one.
+    //
+    // Positive-only, so a caller that supplies no id leaves the bag byte-identical.
+    ...(fireId !== undefined && fireId.length > 0 ? { [ROUTINE_MARKER.fire]: fireId } : {}),
+    // PER-ROUTINE MODEL ROLE (OPE-1627, ROUTINE_MARKER.modelRole) — the ONE carrier of the stored
+    // {@link Routine.modelRole} into the fired session, read back by model/routing.ts. Host-set off
+    // the STORED row and model-unforgeable, exactly like the silent and manual stamps above: a fire
+    // cannot talk itself onto a different model.
+    //
+    // Positive-only, and it is validated on the way OUT as well as in: a routine that names no role
+    // stamps nothing, so its bag is byte-identical to before this field existed and the router
+    // resolves the role it always did. That is what makes inheritance the default at the wire.
+    ...(isRoutineModelRole(r.modelRole) ? { [ROUTINE_MARKER.modelRole]: r.modelRole } : {}),
+  };
+}
+
+/** Auth-attribute key naming the webhook a fire came from — pre-existing, lifted here so the hook's
+ *  bag is built in the SAME module as every other triggered fire's (see {@link webhookFireAttributes}). */
+export const WEBHOOK_MARKER_ATTR = "open_everywhere_webhook_id";
+
+/**
+ * Build the auth `attributes` bag for one WEBHOOK fire (webhooks/dispatch.ts) — the THIRD caller of
+ * this module, and the reason it exists (OPE-144).
+ *
+ * IT USED TO BE BUILT INLINE AND STAMPED NO GRAIN AT ALL — no {@link rootDmGrainAttrs}, no job attrs,
+ * no fire marker — while `routineFireAttributes` right here shows that a fire must stamp DELIBERATELY
+ * or `classifySessionId` reads its plain provider token as grain `native`. So a publicly-triggered,
+ * unattended webhook fire got exactly the posture a live human channel turn gets. Two things fix that,
+ * and both are needed:
+ *   • the POSITIVE grain now comes from the thread-grain window divert (routines/fire-window.ts) —
+ *     that is where a fire stops being `native` at all, and it is the load-bearing half;
+ *   • the bag itself is built HERE, beside the routine bag, so the two can never drift apart again
+ *     and a future DM-capable webhook target inherits the standing stamp for free rather than
+ *     silently re-opening the same hole.
+ *
+ * `isDm` IS REACHABLE, contrary to what the old inline code assumed: `assertWebhooksValid` checks
+ * only that the target is a three-segment `slack/…/…` key — it never inspects the id — so a
+ * `slack/T1/D_ABC` DM hook is configurable today, and the caller derives `isDm` from the id prefix
+ * (webhooks/dispatch.ts). That case is exactly why this must not stay a hand-rolled literal.
+ *
+ * HONEST LIMIT, stated rather than papered over: for a CHANNEL target this function's grain
+ * contribution is `{}`. On a deployment where the divert does not apply (delegation disarmed, or
+ * the target surface has no window) a channel webhook fire therefore still lands `native`, exactly
+ * as a clock fire on that same surface does. That is deliberate — narrowing it there would leave
+ * the fire with no hands AND no delegator (see fire-window.ts's flag-off note), which is worse
+ * than what it replaces.
+ *
+ * NO PRINCIPAL AND NO UNCONDITIONAL TRUST — and unlike a routine fire (which since OPE-269 stamps
+ * the attested creator of its stored row), a webhook fire genuinely has nobody to name: it is
+ * triggered by a remote system against a declared hook, and the hook has no creator field whose
+ * standing could be re-derived. So this bag has no principal to attest, rather than one it declines
+ * to stamp. Trust remains a positive live recheck only.
+ *
+ * 🔴 …AND "NOBODY TO NAME" IS SAID OUT LOUD (OPE-278): the bag stamps {@link FIRE_UNATTENDED_ATTR},
+ * so `bindFrom` marks the binding attributed-not-acting WITHOUT any principal to stamp. Before that
+ * marker existed, attestation could only travel as a side effect of naming a creator — so this bag,
+ * having no {@link FIRE_PRINCIPAL_ATTR}, left `principalAttested` unset and identity/binding.ts
+ * `actingPrincipalId` (`attested ? undefined : principalId`) handed back the non-empty
+ * `webhook:<hookId>` service id `webhooks/dispatch.ts` supplies. Every `if
+ * (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree — the routine-authoring class, the
+ * OPE-273 credential/config plane, the OPE-279 skill pair, both memory_admin_* — therefore PASSED
+ * on a webhook fire, exactly as the pre-OPE-269 `principalIdOf` spelling passed on a routine fire:
+ * the same defect shape, one fire family over. Measured before it was fixed, and the measurement is
+ * kept, inverted, as §webhook-limit in scripts/fire-principal-test.ts. The service id itself still
+ * rides `principalId` untouched — the audit trail's answer to WHICH HOOK fired is not the presence
+ * gates' answer to IS ANYONE HERE, and separating those two questions is the fix.
+ *
+ * @param hookId    the hook that fired (the marker the audit/telemetry join reads).
+ * @param teamId    the target's Slack team id.
+ * @param channelId the target's Slack channel id.
+ * @param isDm      is the target a DM-family surface? (a `D…` Slack channel id — see above).
+ * @param internal  the LIVE internal-trust verdict — fail-closed `false` on any failed check.
+ */
+export function webhookFireAttributes(
+  hookId: string,
+  teamId: string,
+  channelId: string,
+  isDm: boolean,
+  internal: boolean,
+): Record<string, string> {
+  return {
+    team_id: teamId,
+    channel_id: channelId,
+    channel_type: isDm ? "im" : "channel",
+    ...(internal ? { is_ext_shared: "false", trust_checked: "true" } : {}),
+    // The unattended-origin marker (OPE-278) — see the header: a fire with nobody to name still
+    // says it is a fire, or its service principal answers presence gates as if a human were here.
+    [FIRE_UNATTENDED_ATTR]: "true",
+    ...rootDmGrainAttrs(isDm),
+    [WEBHOOK_MARKER_ATTR]: hookId,
+  };
+}
+
+/** Auth-attribute key naming WHICH control-token family verified a caller
+ *  (see {@link serviceTokenFireAttributes}). */
+export const TOKEN_FAMILY_ATTR = "oe_token_family";
+
+/** The two DISJOINT control-token families (OPE-136): the READ family that admits a control read,
+ *  and the WAKE-INJECTION family that admits a test wake. A token of one family verifies against no
+ *  entry of the other, and the stamped value is how an audit reader tells the two doors apart. */
+export type ControlTokenFamily = "read" | "inject";
+
+/**
+ * Build the auth `attributes` bag for one CONTROL-TOKEN DOOR (control/auth.ts `serviceTokenAuth`
+ * and `injectTokenAuth`) — the FOURTH caller of this module, and the one that is NOT a fire.
+ *
+ * A bearer presented at a control route is not dispatched: it has no routine row, no hook, no
+ * platform target, and therefore no identity, grain, job or marker attributes to stamp. It is here
+ * for the single property this module owns. The door binds its verified caller as the SERVICE
+ * principal `svc:<name>`, and a non-empty service id on `principalId` is EXACTLY what OPE-278
+ * measured answering every `if (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree as if a
+ * human were acting. A token door is machine-to-machine by construction, so that answer is wrong on
+ * every call rather than on an unlucky one. {@link FIRE_UNATTENDED_ATTR} is what makes
+ * `actingPrincipalId` answer `undefined` for such a caller while `principalId` keeps `svc:<name>`
+ * for the audit trail — the same separation of "WHICH service called" from "is a human here" that
+ * the webhook fire's header describes.
+ *
+ * HONEST LIMIT, stated rather than implied: neither door hands its snapshot to an agent session
+ * today. The read route (control/read-route.ts, mounted by channels/control-read.ts) answers plain
+ * JSON GET views and reads `principalId` for its audit row alone, and the test-wake route builds
+ * the injected wake's OWN delivery attributes. The control MCP mount is a THIRD door and not this
+ * one: it authenticates through `adminAuthenticatorFromEnv` into an `AdminIdentity`, which carries
+ * no attribute bag at all, so nothing there gets this marker. No presence gate reads this bag on a
+ * live path yet. The marker is a STANDING
+ * property of the door, so a later route that does carry the snapshot inherits it instead of
+ * re-opening OPE-278 by omission. scripts/unattended-derivation-test.ts §door drives the derivation
+ * end to end and pins the marker-less bag as the failing control.
+ *
+ * @param family which of the two disjoint token families verified this caller.
+ */
+export function serviceTokenFireAttributes(family: ControlTokenFamily): Record<string, string> {
+  return {
+    [TOKEN_FAMILY_ATTR]: family,
+    // UNCONDITIONAL, like every other builder here — a door has nobody to name at all, so this
+    // marker is the ONLY carrier of "not a human" it can ever have.
+    [FIRE_UNATTENDED_ATTR]: "true",
+  };
+}

package/agent/routines/fire-carriage.ts

@@ -0,0 +1,126 @@
+// FIRE-CARRIAGE PROBE (OPE-483) — the two rows that say which side of the session hop lost a
+// triggered fire's auth attributes.
+//
+// WHY IT EXISTS. On the deployed instance a routine fire arrives at its own tool contexts carrying
+// the dispatch target's identity attributes (`team_id` / `channel_id` / `channel_type`) and NONE of
+// the stamps routines/fire-auth.ts builds. Four controls fail together as a result: the fired
+// session binds eve's own `eve:app` schedule principal instead of the routine's attested creator,
+// `unattendedOf` reads `false`, the OPE-273 presence fence on a propose tool passes, and the seat
+// resolves grain `native` because its `oe_grain` stamp is gone too. The same tree, driven through
+// the SAME compiled schedule task on a local host, carries the bag intact — so the loss is on the
+// deployment's own session hop, not in the code that builds the bag.
+//
+// Nothing in the audit trail could tell those two sides apart, so the question "did the dispatcher
+// attach it, or did the session lose it?" had no answer short of a debugger on a serverless
+// function. These two rows answer it from one tick:
+//
+//   • {@link FIRE_ATTRS_SENT_ACTION} — written by the DISPATCHER, naming the keys it attached. ONE
+//     row per fire: the dispatcher writes it once, before the delivery.
+//   • {@link FIRE_ATTRS_SEEN_ACTION} — written by the FIRED SESSION at `turn.started`, naming the
+//     keys that arrived. ONE ROW PER SCHEDULE-AUTHED TURN of that session, which for a fire that
+//     DELEGATES is two: its own turn, and the settlement turn that runs under the same bag when the
+//     delegated work comes back (OPE-624). Delegated CHILD turns are skipped
+//     (hooks/fire-carriage.ts). So a SEEN row count is a turn count, never a fire count.
+//
+// Read them as a pair on one surface, seconds apart. SENT rich + SEEN poor ⇒ the hop drops them.
+// SENT poor ⇒ the dispatcher never attached them and the fault is upstream.
+//
+// 🔴 NAMES ONLY, NEVER VALUES. An auth attribute value can be a person's id, a workspace id or a
+// standing-grant key. {@link attributeKeyNames} returns keys and nothing else, and it is the ONLY
+// way either row is built — the same names/ids-only discipline `turn.tool_gated` and
+// `window.routing_degraded` already keep. A test asserts no value reaches a row.
+//
+// BOTH WRITERS ARE FAIL-SOFT. A probe that can fail a fire is worse than the blindness it replaces,
+// so every read sits inside the try and `appendAudit` is already best-effort by contract.
+//
+// THE SEEN SIDE KEYS ON eve's SCHEDULE AUTH, and that predicate lives in identity/binding.ts
+// (`isScheduleOriginatedAuth`) because the fail-closed attendedness floor reads it too (OPE-497).
+// Deliberately not the routine marker: the marker is exactly what can go missing, so keying on it
+// would make the probe silent in the one case worth observing.
+
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { routinePartition } from "./partition.js";
+import type { Routine } from "./routine.js";
+
+/** The dispatcher's side: the attribute keys it ATTACHED to this fire. */
+export const FIRE_ATTRS_SENT_ACTION = "routine.fire_attrs_sent";
+/** The fired session's side: the attribute keys that ARRIVED on its turn. */
+export const FIRE_ATTRS_SEEN_ACTION = "routine.fire_attrs_seen";
+
+/**
+ * The KEY NAMES of one auth-attribute bag — sorted, so two rows compare by eye and by test without
+ * caring about insertion order.
+ *
+ * 🔴 The whole point of this function is what it does NOT return. It never reads a value, so no
+ * caller can leak one into an audit row by accident, and there is one place to check that claim.
+ */
+function attributeKeyNames(attributes: Readonly<Record<string, unknown>> | undefined): readonly string[] {
+  return Object.keys(attributes ?? {}).sort();
+}
+
+/**
+ * DISPATCHER SIDE. Record the attribute keys this fire is being handed, BEFORE the delivery — so
+ * the row exists even when the delivery then throws and the fire is lost.
+ *
+ * `wakeId` is recorded for the window leg, where it joins the row to the wake. It is deliberately
+ * NOT the join key: a native fire carries no wake identity at all (measured — the degraded rows
+ * report `wakeId: null`), so the two rows are read as a pair on one surface within seconds.
+ */
+export async function auditFireAttrsSent(
+  routine: Routine,
+  attributes: Readonly<Record<string, unknown>> | undefined,
+  wakeId: string,
+): Promise<void> {
+  try {
+    const p = routinePartition(routine);
+    const attrKeys = attributeKeyNames(attributes);
+    await appendAudit({
+      org: p.org,
+      platform: p.platform,
+      workspace: p.workspace,
+      surface: p.surface,
+      action: FIRE_ATTRS_SENT_ACTION,
+      detail: { routineId: routine.id, wakeId, attrKeys: [...attrKeys], attrCount: attrKeys.length },
+    });
+  } catch {
+    // Observation only — a fire must never fail because we could not describe its own auth.
+  }
+}
+
+/**
+ * FIRED-SESSION SIDE. Record the attribute keys that actually arrived on this turn.
+ *
+ * ONE ROW PER TURN, and the caller decides which turns qualify — see the header for why a row count
+ * here is a turn count and not a fire count (OPE-624).
+ *
+ * 🔴 READ THE PAIR AS "WHICH SENT KEY IS MISSING HERE", NEVER AS AN EXACT SET COMPARISON. This side
+ * can legitimately carry keys the SENT row does not, because the fired session's own turn boundary
+ * writes onto the same bag: `hooks/spawn-taint.ts` writes `oe_dispatch_turn` (OPE-1467) on every
+ * turn, and `oe_parent_turn_tainted` on a tainted one. Both hooks answer `turn.started` and eve gives
+ * no ordering guarantee between hook files, so whether an extra key appears is a coin flip. A key the
+ * SENT row lists and this row does not is the carriage defect these rows exist to catch; an extra key
+ * here is not.
+ *
+ * The caller (hooks/fire-carriage.ts) supplies the partition, because resolving it needs a hook
+ * context and this module stays free of one.
+ */
+export async function auditFireAttrsSeen(
+  where: { readonly platform: string; readonly workspace: string; readonly surface: string },
+  attributes: Readonly<Record<string, unknown>> | undefined,
+  sessionId: string | undefined,
+): Promise<void> {
+  try {
+    const attrKeys = attributeKeyNames(attributes);
+    await appendAudit({
+      org: deploymentOrg(),
+      platform: where.platform,
+      workspace: where.workspace,
+      surface: where.surface,
+      action: FIRE_ATTRS_SEEN_ACTION,
+      detail: { attrKeys: [...attrKeys], attrCount: attrKeys.length, sessionId: sessionId ?? null },
+    });
+  } catch {
+    // Observation only — see the sent-side note.
+  }
+}

package/agent/routines/fire-creator.ts

@@ -0,0 +1,86 @@
+// fire-creator — THE live per-fire recheck of a routine CREATOR's current standing (OPE-269).
+//
+// WHY A RECHECK AND NOT A STORED VERDICT. A routine outlives the turn that armed it, often by
+// months. Freezing "this person was an internal member" at creation is the same
+// re-open-the-leak mistake identity/binding.ts warns about for channels: someone leaves the org, is
+// downgraded to a guest, or moves to another workspace, and a stamp written last March keeps
+// vouching for them. So nothing about standing is stored — the answer is re-derived from the
+// platform on EVERY fire, with the same staleness bound a live inbound turn accepts (the bundle's
+// own users.info TTL cache), and the fire's memory layer follows the answer immediately.
+//
+// WHY IT MATTERS AT ALL. Before this, the dispatcher skipped the check instead of performing it, so
+// binding fell through to the fail-closed default: a DM fire bound `external` and resolved the
+// `public` criteria domain rather than `dm` (memory/resolve.ts). On a deployment with a live `dm`
+// domain and no `public` one — the shipped shape — that is not "slightly less context", it is the
+// shared read layer silently resolving to nothing. Same personal silo, no org brain, no error.
+//
+// THE SHAPE OF "CANNOT CHECK". Only a Slack DM can be positively verified today, through the same
+// `users.info` answer a live DM's own partner check reads (channels/slack-bridge.ts — core composes
+// it from the bridge rather than reaching into the bundle, so an unregistered Slack provider fails
+// closed to `external` exactly like every other unbridged call). Discord / Teams have no
+// membership-verification gate even on their INBOUND paths, so their fires stamp nothing and bind
+// `external` — which is precisely what a live human turn on those surfaces gets. This module never
+// guesses: the absence of a positive answer IS the answer.
+//
+// A CHANNEL fire does not consult this. Its trust comes from the channel's own live
+// conversations.info recheck (schedules/dispatch.ts `confirmInternal`), which is already positive
+// and already wins; asking about the creator too would be a second network read that could not
+// change the verdict.
+
+import { bridgePartnerFactsFromInfo, bridgeSlackForm } from "../channels/slack-bridge.js";
+import type { SessionMode } from "../access/resolver.js";
+
+/** Is `principalId` a full internal member of `workspaceId` RIGHT NOW? Fail-closed on any doubt. */
+export type CreatorStandingCheck = (principalId: string, workspaceId?: string) => Promise<boolean>;
+
+/**
+ * The live default, Slack-only: `users.info` on the creator, read through the SAME fail-closed
+ * verdict function a live DM's partner check uses (`partnerFactsFromInfo` — guest, stranger,
+ * deleted, bot, or a different team all resolve `external`).
+ *
+ * Fail-soft AND fail-closed, which are different things and both required: a thrown lookup must not
+ * take the tick down (fail-soft), and its absence must not read as a pass (fail-closed) — so every
+ * error path returns `false`, never a rethrow and never a default of `true`.
+ */
+const liveCreatorStanding: CreatorStandingCheck = async (principalId, workspaceId) => {
+  try {
+    const info = await bridgeSlackForm("users.info", new URLSearchParams({ user: principalId }).toString());
+    if (!info) return false; // no Slack provider registered / no bot token ⇒ unverifiable
+    return bridgePartnerFactsFromInfo(info, workspaceId).dmPartnerTrust === "internal";
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Re-derive whether this fire's CREATOR is currently an internal member, for the one mode where the
+ * answer changes anything (a DM's shared read layer). Returns `undefined` — never `false` — when
+ * there is nothing to ask about, so a caller can tell "checked, and no" apart from "never asked"
+ * in a log; both stamp nothing, because {@link routineFireAttributes} is positive-only.
+ *
+ * @param createdBy  the routine's stored creator principal (absent on pre-OPE-152 rows and on
+ *                   anything armed without a verified sender — no id, no question to ask).
+ * @param platform   the fire's DESTINATION platform (routineReportSurfaceKey's first segment, not
+ *                   the routine's own — a redirected fire is verified where it LANDS).
+ * @param mode       the destination surface's session mode.
+ * @param workspaceId the destination workspace (Slack team id), so a Connect stranger from another
+ *                   workspace resolves external rather than passing on a bare id match.
+ */
+export async function recheckFireCreator(input: {
+  readonly createdBy: string | undefined;
+  readonly platform: string | undefined;
+  readonly mode: SessionMode;
+  readonly workspaceId?: string;
+  /** Test seam — the live default is the Slack `users.info` composition above. */
+  readonly check?: CreatorStandingCheck;
+}): Promise<boolean | undefined> {
+  if (!input.createdBy) return undefined;
+  // DM-ONLY, and that is a scope statement rather than a limitation: `trust` selects the shared read
+  // layer only for a DM (memory/resolve.ts), and a channel fire's verdict is already settled by its
+  // own live channel recheck. Anywhere else this call could only spend a network read to reach a
+  // conclusion nothing consults.
+  if (input.mode !== "dm") return undefined;
+  if (input.platform !== "slack") return undefined; // no membership-verification gate elsewhere
+  const check = input.check ?? liveCreatorStanding;
+  return check(input.createdBy, input.workspaceId);
+}