@open-everywhere/core 0.1.0

package/agent/routines/fire-disclosure.ts

@@ -0,0 +1,233 @@
+// TRIGGERED-FIRE AUDIENCE DISCLOSURE (OPE-166, extended OPE-183) — consumer #3 of the
+// audience-floor seam, and the ONE disclosure policy every unattended fire rides.
+//
+// TWO LEGS USE IT, ONE POLICY:
+//   • the GitHub EVENT fan-out (routines/github-fanout.ts, OPE-166) — the original consumer;
+//   • the config-declared WEBHOOK hook (webhooks/dispatch.ts, OPE-183) — added because a config
+//     hook is a standing, unattended, human-authored instruction that fires ARBITRARY EXTERNAL
+//     PAYLOAD content into one room, and nothing on that path asked whether the room was a fit
+//     audience for it either. That leg cannot be normalized onto the event plane's admitTrigger
+//     (OPE-179 refused the collapse: a config hook is authorized by an operator's MERGED CODE
+//     DECLARATION — id → target → instruction — not by a subscription filter over a normalized
+//     event, so there is nothing on that plane for it to be routed by) — but it does not need to
+//     be, because this check operates on the
+//     TARGET, not the payload. That is the whole reason it transplants cleanly.
+// Everything below is written in terms of "a fire"; where it says EVENT specifically, that is the
+// OPE-166 leg's own worked example, not a narrowing of the policy.
+//
+// ⚠️ THE TWO LEGS DIFFER IN ONE PLACE ONLY, and it is downstream of this module: the event leg
+// posts a content-free withheld notice into the refused room ({@link announceFireWithheld}),
+// throttled by fire-audit.ts's per-(routine, reason) hour window. The webhook leg posts NOTHING —
+// it has no such throttle, so a notice there would let one secret-holder drive channel spam at
+// request rate. It records the refusal in its own existing `webhook.declined` audit row instead.
+//
+// THE HOLE THIS CLOSES. OPE-163 settled "can": the read grant over the scope path the delivery
+// proved — non-empty per core, with the source's own adapter choosing which step is authoritative
+// (routines/event-authz.ts, checked per fire in github-fanout.ts). That answers
+// whether the DOMAIN may read the content. It says nothing about whether the ROOM the routine
+// reports into is an appropriate audience for it. Those are different questions, and OE already
+// treats them as different questions elsewhere — a domain granted `repos:[acme/payments]` so
+// someone could ask about PRs in #general does not thereby make #general a fit venue for a security
+// issue whose TITLE carries a live customer id. Events are where the gap bites, because a fire is
+// UNATTENDED and RECURRING: nobody chose this particular content for this particular room.
+//
+// ── THE FOUR DECISIONS THE TICKET ASKED FOR, AND WHY ──────────────────────────────────────────
+//
+// (1) THE CHECK IS ROOM-GRAIN, NOT CONTENT-GRAIN — neither "the summary" nor "the hydrated body".
+//     Both candidate answers are wrong for the same reason: NEITHER is what reaches the room. The
+//     summary and the hydrated body both go into the fire's PROMPT (github-fanout.ts eventPrompt →
+//     `ingestUntrusted`); what lands in the channel is MODEL OUTPUT. A classifier over either is a
+//     proxy for something it does not control, and a content classifier ("does this title carry a
+//     customer id?") is a DLP model this project does not have and must not invent here.
+//     assertConnectorDisclosure has the same shape and gives the same answer: it never inspects the
+//     connector's data — it refuses the CONNECTION for the room. So does this. The question is
+//     "may this room hear org-internal trigger-sourced content AT ALL", and the answer does not
+//     depend on which event arrived.
+//
+// (2) FIRE TIME, NOT ARM TIME. Membership changes after arming — a channel becoming Slack-Connect
+//     shared a month after a routine was armed IS the threat, so an arm-time verdict is stale by
+//     construction. The per-fire cost is ~zero: resolveRoomRoster's memo is ~15 min and is SHARED
+//     with the governance tripwire and the connector gate, so N routines on one channel in one
+//     delivery cost one platform call between them, and usually zero. A SECOND arm-time check was
+//     deliberately NOT added: it could not be authoritative, so it would be either a duplicate (a
+//     dead branch by the time it mattered) or a divergent second policy. What arm time actually
+//     needed — "the human finds out" — is delivered by (3) instead, at the moment it is true.
+//
+// (3) THE REFUSAL IS VISIBLE, TWICE. A silent skip is precisely the "why didn't it tell me" failure
+//     the audit wedge exists to prevent (and the failure disable-notice.ts was written to fix for
+//     the sibling case). So a withheld fire writes a `routine.skip` row with reason
+//     `audience_floor` — the SHARED forensics vocabulary (fire-audit.ts), never a new action, per
+//     OPE-145 — AND posts one host-composed line into the room through the routine's own
+//     `DispatchTarget.origin`, the same arm announceSelfDisable uses. The notice is CONTENT-FREE by
+//     construction: it names the OE-minted routine id and nothing else. Not the event summary, not
+//     the scope path, not the routine's prompt (which disable-notice.ts DOES echo, and which here
+//     would leak the very intent — "watch security issues in acme/payments" — into the room we just
+//     refused). It is throttled by being posted only when the skip row was actually EMITTED, so an
+//     inbound delivery stream cannot turn a standing misconfiguration into channel spam; the
+//     throttle is fire-audit.ts's existing per-(routine, reason) hour window, not a second one.
+//
+// (4) IT DOES NOT COMPOSE WITH THE TAINT MODEL — IT IS ORTHOGONAL, AND THAT IS THE POINT. A webhook
+//     fire is structurally UNTAINTED (OPE-163 C3): no human turn preceded it, so there is no taint
+//     to carry. Anything keyed on taint is therefore INERT on exactly this path. This check reads
+//     the ROOM's live roster and nothing about the content's provenance, which is why it fires here
+//     at all. scripts/event-disclosure-test.ts demonstrates that directly: every case it drives is a
+//     plain webhook delivery, and the refusal still happens.
+//
+// ── FAIL-OPEN ON AN UNOBSERVABLE ROOM, REFUSE ONLY ON AN OBSERVED GUEST ───────────────────────
+// The authentication/authorization boundary on this path is checkEventReadGrant, and it fails
+// CLOSED. This is the layer above it: a disclosure judgement over a fact the platform may simply
+// not be able to report. Exactly one production member supplier exists in the tree (the Slack
+// bundle's — connector-disclosure.ts narrowing n1 states it and scripts/connector-disclosure-test.ts
+// §5 pins it), so on Discord/Teams/GitHub/Linear/Notion resolveRoomRoster yields UNRESOLVED_ROSTER,
+// whose floor is `guest`. Refusing on THAT would stop every event routine on every non-Slack surface
+// from firing — a silent, total product outage dressed as a security fix. So this reads the roster's
+// `resolved` bit alongside the floor, identically to connector-disclosure.ts leg 1: OBSERVED guest ⇒
+// refuse; unobservable ⇒ inert, byte-identical to the pre-OPE-166 fire.
+//
+// ── WHY THIS IS NOT A DEAD GUARD (the standing house rule) ────────────────────────────────────
+// It fires in a SHIPPED configuration: a Slack workspace (supplier registered at boot), an event
+// routine armed in an externally-shared / Slack-Connect / org-shared channel (which is what sets
+// `hasGuest` — see narrowing n2), and a delivery whose read grant passes. Note it is strictly MORE
+// live than connector leg 1, whose third narrowing (n3) is that the DM-only wall defaults ON and so
+// leaves it seeing DM turns only: a routine's surface is a CHANNEL by construction, so there is no
+// equivalent wall in front of this one. It is live on the default posture.
+//
+// The OPE-183 leg is live for the same reason and a narrower one: a config hook's target is
+// SLACK-ONLY by construction (webhooks/config.ts assertWebhooksValid requires a `slack/TEAM/
+// CHANNEL` triple), and Slack is the one surface with a member supplier — so unlike most guards,
+// its triggering condition is reachable on 100% of the surfaces it can fire into.
+//
+// ⚠️ THE UNRESOLVED ARM IS LOAD-BEARING, NOT A DEFAULT INHERITED FROM THE EVENT LEG. On the
+// webhook leg it is reachable for entirely ordinary internal channels (the live supplier reports
+// `resolved: false` for a channel with more than ONE PAGE of members, among other cases) and a
+// refused delivery is LOST — the route acks 200 and fires in the background, so there is no
+// redelivery and no next tick. The full argument, and why fail-open there is not a hole, is in
+// webhooks/dispatch.ts at the call site.
+
+import { resolveAudienceFloor, type AudienceFloor, type RoomRoster } from "../access/audience-floor.js";
+import { postUnifiedReply } from "../channels/unified-reply.js";
+import type { UnifiedWakeOrigin } from "../channels/unified-window.js";
+
+function log(msg: string): void {
+  console.log(`[open-everywhere:routines] ${msg}`);
+}
+
+/** The verdict on whether a room may hear a trigger-sourced fire. `floor` is carried on BOTH arms so
+ *  an allow can be telemetered later without reshaping the type. */
+export type FireDisclosureVerdict =
+  | { readonly ok: true; readonly floor: AudienceFloor }
+  /** The room's audience floor was POSITIVELY resolved to `guest` — today, an externally-shared
+   *  Slack channel (connector-disclosure.ts narrowing n2: `hasGuest` is the CHANNEL's external bit,
+   *  not a per-member classification). */
+  | { readonly ok: false; readonly reason: "audience-floor"; readonly floor: AudienceFloor };
+
+/** The facts {@link classifyFireDisclosure} judges — resolved by the caller so the classifier is
+ *  pure and matrix-testable (the classifyConnectorDisclosure / classifyPaneVenue precedent). */
+export interface FireDisclosureInput {
+  /** The room's floor, from the ONE primitive (access/audience-floor.ts). */
+  readonly floor: AudienceFloor;
+  /** The live roster the floor came from — read for its `resolved` bit (the inert rule above). */
+  readonly roster: RoomRoster;
+}
+
+/**
+ * The pure decision. One leg, deliberately: an OBSERVED `guest` floor refuses; everything else —
+ * including an unobservable roster whose floor is `guest` by fail-closed default — allows.
+ */
+export function classifyFireDisclosure(input: FireDisclosureInput): FireDisclosureVerdict {
+  if (input.roster.resolved && input.floor === "guest") {
+    return { ok: false, reason: "audience-floor", floor: input.floor };
+  }
+  return { ok: true, floor: input.floor };
+}
+
+/**
+ * The admin set this leg judges against: EMPTY, on purpose.
+ *
+ * {@link classifyFireDisclosure} only ever acts on the `guest` verdict, and `guest` is the one floor
+ * computeAudienceFloor decides BEFORE it consults the admin set at all (`!resolved || hasGuest`
+ * returns first). Passing an admin set here would be decoration implying a dependency this leg does
+ * not have — and it would drag `getConfig().loadDomains()` into the fan-out loop for a value that
+ * cannot change the answer. The independence is a real claim about a function in another module, so
+ * it is PINNED by a differential assertion in scripts/event-disclosure-test.ts, not asserted here.
+ */
+const NO_ADMINS: ReadonlySet<string> = new Set<string>();
+
+/** Injectable edges — the live default is the shared, memoized audience-floor seam. */
+export interface FireDisclosureDeps {
+  readonly floor?: typeof resolveAudienceFloor;
+}
+
+/**
+ * Resolve one room's disclosure verdict for a trigger-sourced fire. `surfaceKey` is the routine's
+ * own `platform/workspace/surface` key — the same string the member supplier is keyed on.
+ *
+ * FAIL-OPEN on a throw: the floor seam is best-effort by contract (its live supplier already
+ * swallows platform errors into UNRESOLVED_ROSTER), but an INJECTED one might not, and a disclosure
+ * layer above a fail-closed authorization gate must never convert a transient platform blip into a
+ * dead routine fleet.
+ */
+export async function checkFireDisclosure(surfaceKey: string, deps: FireDisclosureDeps = {}): Promise<FireDisclosureVerdict> {
+  try {
+    const resolution = await (deps.floor ?? resolveAudienceFloor)(surfaceKey, NO_ADMINS);
+    return classifyFireDisclosure(resolution);
+  } catch (err) {
+    log(`audience floor unresolvable for ${surfaceKey} (${String(err)}) — fire disclosure inert`);
+    return { ok: true, floor: "guest" };
+  }
+}
+
+/**
+ * The withheld-fire notice. CONTENT-FREE: the routine's OE-minted id (`r-xxxxxxxx`, store.ts
+ * newRoutineId) is the only variable in it. Everything a reader might want — which event, which
+ * repo, what the routine watches — is exactly what must not be said in a room that just failed the
+ * disclosure check, so it is said in the `routine.skip` audit row instead, which has an entitled
+ * audience by construction. Partial disclosure is still disclosure.
+ */
+export function fireWithheldNoticeText(routineId: string): string {
+  return (
+    `🔒 Routine \`${routineId}\` had something to report and I withheld it. This channel's audience ` +
+    `floor resolved to "guest" — it is externally shared, or carries an observed guest/external ` +
+    `member — so org-internal content from a trigger source can't be delivered here. Nothing about ` +
+    `the event is in this message, deliberately. Move the routine to an internal channel (or remove ` +
+    `the external members) and it will resume by itself; the full reason is in the audit log.`
+  );
+}
+
+/** Injectable edges for the notice — the live default posts through the routine's own wake origin. */
+export interface FireWithheldNoticeDeps {
+  readonly post?: (origin: UnifiedWakeOrigin, text: string) => Promise<string>;
+}
+
+/**
+ * Post the withheld-fire notice into the routine's own surface. Returns whether a message landed.
+ *
+ * Routed through the routine's `DispatchTarget.origin` — the SAME host-derived wake origin the fire
+ * itself would have replied through — so there is no second delivery mechanism to keep in step, and
+ * so the notice is HOST-composed rather than a model turn. That last part is load-bearing twice
+ * over: a model turn would need the event in its context (the thing we are withholding), and it
+ * would make an inbound delivery stream into an inference-spend amplifier.
+ *
+ * FAIL-SOFT, always: the skip row is the durable record and has already been written. A surface with
+ * no declared origin, or a dead token, must never turn "I withheld a fire" into a thrown error that
+ * takes out the rest of the fan-out loop.
+ */
+export async function announceFireWithheld(
+  routineId: string,
+  surfaceKey: string,
+  origin: UnifiedWakeOrigin | undefined,
+  deps: FireWithheldNoticeDeps = {},
+): Promise<boolean> {
+  if (!origin) {
+    log(`withheld-fire notice SKIPPED for ${routineId} [${surfaceKey}] — no post-back origin for this surface (audit row still written)`);
+    return false;
+  }
+  try {
+    await (deps.post ?? postUnifiedReply)(origin, fireWithheldNoticeText(routineId));
+    log(`withheld-fire notice posted for ${routineId} [${surfaceKey}]`);
+    return true;
+  } catch (err) {
+    log(`withheld-fire notice FAILED for ${routineId} [${surfaceKey}]: ${String(err)}`);
+    return false;
+  }
+}

package/agent/routines/fire-eligibility.ts

@@ -0,0 +1,280 @@
+// fire-eligibility — THE creator-membership + account-status predicate re-checked AT FIRE TIME
+// (OPE-506, adopting Claude Tag's policy verbatim — a design note
+// §S2: "a creator-membership predicate re-checked at fire time — stop firing if the creator is
+// removed from the channel").
+//
+// A routine's creator can LEAVE THE ORG without stopping the routine — routines are surface-owned,
+// not principal-owned (routine.ts), so a fire runs on the ROOM's own authority, not the creator's
+// continued presence. That asymmetry is deliberate and is unaffected by this module (fire-creator.ts
+// already covers the DM-trust half of "left the org"). Two DIFFERENT facts DO stop a fire:
+//
+//   1. the creator is explicitly REMOVED from the room the routine posts into — "the org" and "the
+//      room" are different questions, and this asks the narrower one;
+//   2. the creator's ACCOUNT is deactivated/deleted outright — a stronger signal than merely losing
+//      internal-member standing, and one that survives even a workspace the creator otherwise still
+//      belongs to.
+//
+// Either one SKIPS this fire (never a failure — the ceiling and the three-strike counter never see
+// it, exactly like an over-budget decline), cached, with a `routine.skip` reason row
+// (routines/fire-audit.ts) so the gap is legible rather than a silent no-op.
+//
+// SCOPE: Slack + Teams (OPE-522 added the Teams leg) — the two platforms this tree has a
+// room-membership primitive and a per-account status field for. Every other platform has no such
+// check reachable from core today (fire-creator.ts's recheckFireCreator draws the identical line for
+// the same reason), so the predicate is a NO-OP there: PASS, never a manufactured skip. "Cannot
+// check" is a real answer, not a default of "removed" — the same fail-OPEN-on-uncertainty posture
+// channels/slack-events.ts's author probe and fire-creator.ts's recheck both take. Only a POSITIVE
+// "no" skips a fire; an unresolved probe never does.
+//
+// THE TEAMS ROOM CHECK ENFORCES, AND ONLY SINCE OPE-1810 COULD IT (Tommy, 2026-09-13). Its Graph
+// read addressed the team with the Bot Connector's id, which Graph does not answer, so the call
+// threw on every fire and the leg was fail-open on all of them — a check that had never once
+// skipped anything. The provider arm now resolves the Microsoft 365 group id first, and a creator
+// CONFIRMED out of the channel now skips the fire with the same `creator_removed_from_room` row the
+// Slack leg writes. Fail-open survives only where the probe could not GET an answer, and that arm
+// names its own cause (`TeamsMembershipUnresolved`) so schedules/dispatch.ts audits it — otherwise
+// a fail-open and a pass leave the same trace, which is exactly how this defect stayed invisible.
+//
+// TEAMS IDENTITY NOTE (OPE-522). `Routine.createdBy` (the `createdBy`/`roomId` pair below) is the
+// Bot Framework `from.id` for a Teams routine — the channel-account id captured on the creating
+// turn, NOT a Microsoft Graph identifier. Graph's `/users/{id}` and a channel roster's `userId` are
+// both keyed on the Azure AD OBJECT id, a DIFFERENT value (teams-identity.ts's `aadObjectId`
+// capture). So the Teams leg takes its OWN identity + room fields (`teamsTeamId`,
+// `teamsCreatorAadObjectId`) rather than overloading `createdBy`/`roomId` — an absent one is "cannot
+// check" (eligible), exactly like an absent `roomId` is for Slack.
+
+import { bridgeSlackForm, type SlackFormFn } from "../channels/slack-bridge.js";
+import {
+  bridgeTeamsRoomMembership,
+  bridgeTeamsAccountActive,
+  type TeamsAccountActiveCheck,
+  type TeamsMembershipUnresolved,
+  type TeamsRoomMembership,
+  type TeamsRoomMembershipCheck,
+} from "../channels/teams-bridge.js";
+import { dmTrustTtlMs } from "../identity/trust.js";
+import type { RoutineSkipReason } from "./fire-audit.js";
+
+/** Room-membership probe: is `userId` CURRENTLY a member of `channelId`? `undefined` = the probe
+ *  could not answer (no token, an API error, an unresolvable channel) — never a "no". */
+export type RoomMembershipCheck = (channelId: string, userId: string) => Promise<boolean | undefined>;
+
+/** Account-status probe: is `userId`'s account CURRENTLY active (not deleted)? `undefined` = the
+ *  probe could not answer. */
+export type AccountActiveCheck = (userId: string) => Promise<boolean | undefined>;
+
+/** Bounds the worst-case pagination cost of a single membership probe (~10k members scanned at
+ *  Slack's max page size) — a huge channel that still doesn't contain the creator degrades to
+ *  "unresolved" (pass) rather than an unbounded loop. */
+const ROOM_MEMBER_MAX_PAGES = 10;
+
+const roomMemberCache = new Map<string, { readonly member: boolean; readonly at: number }>();
+
+/**
+ * Slack room-membership probe (pure but for the injected `form`): paginate `conversations.members`
+ * looking for `userId`, bounded at {@link ROOM_MEMBER_MAX_PAGES}. Exported (not the cache-wrapped
+ * live wrapper below) so the pagination + fail-open logic is unit-testable with a canned form
+ * function, no bridge registration or network call — the same split
+ * teams-fire-eligibility.ts's `teamsRoomMembershipViaGraph` draws for the Teams leg.
+ */
+export async function slackRoomMembershipViaConversationsMembers(channelId: string, userId: string, form: SlackFormFn): Promise<boolean | undefined> {
+  if (channelId.length === 0 || userId.length === 0) return undefined;
+  try {
+    let cursor: string | undefined;
+    for (let page = 0; page < ROOM_MEMBER_MAX_PAGES; page++) {
+      const qs = new URLSearchParams({ channel: channelId, limit: "1000" });
+      if (cursor) qs.set("cursor", cursor);
+      const info = await form("conversations.members", qs.toString());
+      if (!info || info["ok"] !== true) return undefined; // no provider / no token / a real API error ⇒ unresolvable
+      // A genuine Slack success ALWAYS carries `members` as an array, even an empty one — a
+      // response missing the key entirely is not a members list at all (a malformed/unexpected
+      // shape), so it is read as UNRESOLVABLE rather than as "confirmed nobody's in this channel".
+      // Fabricating a negative from a shape this module doesn't recognise is exactly the "cannot
+      // check" case the whole module exists to distinguish from "confirmed no".
+      if (!Array.isArray(info["members"])) return undefined;
+      const members = info["members"] as unknown[];
+      if (members.includes(userId)) return true;
+      const meta = info["response_metadata"] as { next_cursor?: unknown } | undefined;
+      cursor = typeof meta?.next_cursor === "string" && meta.next_cursor.length > 0 ? meta.next_cursor : undefined;
+      if (!cursor) break;
+    }
+    // `cursor` still set here means the page bound was hit with roster left unseen — that is NOT
+    // the same fact as "scanned every member and they weren't in it", so it stays unresolved
+    // rather than becoming a confirmed (and possibly wrong) "removed". Only a loop that ended
+    // because pagination itself ran out (`cursor` fell to `undefined`) has actually seen the WHOLE
+    // roster. Mirrors teams-fire-eligibility.ts's identical `url`-still-set check.
+    return cursor ? undefined : false;
+  } catch {
+    return undefined; // never block a fire on a failed probe
+  }
+}
+
+/**
+ * Live Slack room-membership probe: {@link slackRoomMembershipViaConversationsMembers} through the
+ * real bridge, TTL-cached per (channel, user) on the same clock the rest of this tree's trust
+ * probes use (`dmTrustTtlMs` — identity/trust.ts). A cache hit costs nothing; a miss costs at most
+ * {@link ROOM_MEMBER_MAX_PAGES} Web API calls, once per (channel, user) per TTL window regardless
+ * of how many routines share that creator+room. Only a CONFIRMED result (the whole roster seen, or
+ * the creator found early) is cached — an unresolved probe, including a page-bound hit with more
+ * roster left unseen, is never cached, so the very next check gets a fresh chance to resolve it.
+ */
+export const liveRoomMembership: RoomMembershipCheck = async (channelId, userId) => {
+  if (channelId.length === 0 || userId.length === 0) return undefined;
+  const key = `${channelId}/${userId}`;
+  const hit = roomMemberCache.get(key);
+  if (hit && Date.now() - hit.at < dmTrustTtlMs()) return hit.member;
+  const member = await slackRoomMembershipViaConversationsMembers(channelId, userId, bridgeSlackForm);
+  if (member !== undefined) roomMemberCache.set(key, { member, at: Date.now() });
+  return member;
+};
+
+const accountActiveCache = new Map<string, { readonly active: boolean; readonly at: number }>();
+
+/** Live Slack account-status probe: `users.info.deleted`, TTL-cached the same way. Deliberately
+ *  NARROWER than `slackAuthorIsMember`/`partnerFactsFromInfo` (which also fold in guest/stranger
+ *  status): those answer "is this person internal", which is the ORG question this module does not
+ *  ask; this answers only whether the account itself still exists and is enabled. */
+const liveAccountActive: AccountActiveCheck = async (userId) => {
+  if (userId.length === 0) return undefined;
+  const hit = accountActiveCache.get(userId);
+  if (hit && Date.now() - hit.at < dmTrustTtlMs()) return hit.active;
+  try {
+    const info = await bridgeSlackForm("users.info", new URLSearchParams({ user: userId }).toString());
+    if (!info || info["ok"] !== true) return undefined; // no provider / no token / a real API error ⇒ unresolvable
+    const u = info["user"] as Record<string, unknown> | undefined;
+    if (!u || typeof u !== "object") return undefined; // an unexpected shape ⇒ unresolvable, never a fabricated "active"
+    const active = !u["deleted"];
+    accountActiveCache.set(userId, { active, at: Date.now() });
+    return active;
+  } catch {
+    return undefined;
+  }
+};
+
+/** Test seam — drop both in-process caches so one test can't inherit another's verdicts. */
+export function _resetFireEligibilityCachesForTest(): void {
+  roomMemberCache.clear();
+  accountActiveCache.clear();
+}
+
+/** The Teams probe contracts live on the bridge (channels/teams-bridge.ts) and are re-exported here
+ *  for this module's own callers. ONE declaration, not two: this module carried its own identical
+ *  copy of both signatures, and nothing would have made the two disagree LOUDLY — each side
+ *  typechecks against its own copy, so a change to one alone compiles. */
+export type { TeamsRoomMembershipCheck, TeamsAccountActiveCheck, TeamsMembershipUnresolved };
+
+/** Live Teams room-membership probe: the registered bridge, which answers `no_provider` when no
+ *  Teams provider is booted. Args are already non-empty-checked by the caller. */
+const liveTeamsRoomMembership: TeamsRoomMembershipCheck = (teamId, channelId, aadObjectId, serviceUrl) =>
+  bridgeTeamsRoomMembership(teamId, channelId, aadObjectId, serviceUrl);
+
+/** Live Teams account-status probe: the registered bridge, or `undefined` when unregistered. */
+const liveTeamsAccountActive: TeamsAccountActiveCheck = (aadObjectId) => bridgeTeamsAccountActive(aadObjectId);
+
+export interface FireEligibilityInput {
+  readonly createdBy: string | undefined;
+  /** The fire's DESTINATION platform (routineReportSurfaceKey's first segment) — a redirected fire
+   *  is checked where it LANDS, matching fire-creator.ts's recheckFireCreator. */
+  readonly platform: string | undefined;
+  /** The room the fire posts into — the resolved DispatchTarget's channel id. Slack-only field;
+   *  Teams' room fields are {@link FireEligibilityInput.teamsTeamId} + this same `roomId` read as
+   *  the Teams CHANNEL id (Graph needs both — see teams-read.ts's two-level-id note). */
+  readonly roomId: string | undefined;
+  /** Test seam — the live default is {@link liveRoomMembership}. */
+  readonly membershipCheck?: RoomMembershipCheck;
+  /** Test seam — the live default is {@link liveAccountActive}. */
+  readonly activeCheck?: AccountActiveCheck;
+  /** Teams only (OPE-522): the routine's TEAM id — a Graph channel-membership read needs team +
+   *  channel, not the channel alone. Absent ⇒ the Teams leg is a no-op (eligible), same posture as
+   *  an absent `roomId` on Slack. */
+  readonly teamsTeamId?: string;
+  /** Teams only (OPE-522): the creator's Azure AD OBJECT id — see the file header for why this is a
+   *  different value from `createdBy` on this platform. Absent ⇒ the Teams leg is a no-op. */
+  readonly teamsCreatorAadObjectId?: string;
+  /** Teams only (OPE-1810): the routine's regional Bot Connector endpoint. The membership read needs
+   *  it to turn `teamsTeamId` (the Connector's `19:…` spelling) into the Microsoft 365 group id every
+   *  Graph `/teams/{team-id}/…` URL takes. Absent ⇒ the read is unresolvable on a team whose group id
+   *  is not already cached, which is a fail-OPEN arm and is audited as `team_id_unresolved`. */
+  readonly teamsServiceUrl?: string;
+  /** Test seam — the live default is {@link liveTeamsRoomMembership}. */
+  readonly teamsMembershipCheck?: TeamsRoomMembershipCheck;
+  /** Test seam — the live default is {@link liveTeamsAccountActive}. */
+  readonly teamsActiveCheck?: TeamsAccountActiveCheck;
+}
+
+export type FireEligibility =
+  | {
+      readonly eligible: true;
+      /**
+       * OPE-1810, Teams only: the fire proceeds, but the room-membership read could NOT answer, and
+       * this names why. Present ONLY on that arm — a Teams fire whose creator was confirmed present
+       * carries nothing, so the field's presence is itself the signal the dispatcher audits. A
+       * fail-open that leaves no row is indistinguishable from a pass, which is what the Teams leg
+       * looked like on every fire before this ticket.
+       */
+      readonly teamsMembershipUnresolved?: TeamsMembershipUnresolved;
+    }
+  | { readonly eligible: false; readonly reason: RoutineSkipReason };
+
+/** Positive-only refusal from a (member, active) pair, shared by every platform leg below: a
+ *  CONFIRMED "no" on either axis skips; anything else (both true, or either unresolved) is eligible.
+ *  Membership is read first only for READ ORDER (it is the one Tag's own wording names — "removed
+ *  from the channel"); a confirmed-inactive account skips just the same either way. */
+function verdictFromChecks(member: boolean | undefined, active: boolean | undefined): FireEligibility {
+  if (member === false) return { eligible: false, reason: "creator_removed_from_room" };
+  if (active === false) return { eligible: false, reason: "creator_account_inactive" };
+  return { eligible: true };
+}
+
+/**
+ * Is this fire's creator still eligible to have it run? Positive-only refusal: a CONFIRMED "no"
+ * (removed from the room, or an inactive account) skips the fire; anything else — no creator to
+ * check, an unsupported platform, an unresolvable room, or a probe that could not answer — is
+ * eligible. Never throws: both probes are already internally fail-soft, but a caller that races a
+ * network read still gets a definite answer either way.
+ */
+export async function checkFireEligibility(input: FireEligibilityInput): Promise<FireEligibility> {
+  if (!input.createdBy) return { eligible: true };
+  if (input.platform === "slack") {
+    if (!input.roomId) return { eligible: true };
+    const membershipCheck = input.membershipCheck ?? liveRoomMembership;
+    const activeCheck = input.activeCheck ?? liveAccountActive;
+    const [member, active] = await Promise.all([
+      membershipCheck(input.roomId, input.createdBy).catch((): boolean | undefined => undefined),
+      activeCheck(input.createdBy).catch((): boolean | undefined => undefined),
+    ]);
+    return verdictFromChecks(member, active);
+  }
+  if (input.platform === "teams") {
+    // NO ROOM, NOTHING TO ASK — a Teams personal chat carries no channel, so room membership is not
+    // a question that exists there. Silent and eligible, exactly like the Slack branch's own
+    // `!input.roomId` arm, and deliberately NOT a `missing_ids` row: a row on every DM fire would
+    // bury the signal the row exists to carry.
+    if (!input.roomId) return { eligible: true };
+    // 🔴 THERE IS A ROOM AND WE CANNOT ASK ABOUT IT (OPE-1810). A routine created before its team id
+    // or its creator's Azure AD object id was captured reaches here, and the fire proceeds UNCHECKED
+    // — the same fail-open as a Graph read that failed, so it owes the same row. Returning a bare
+    // `{ eligible: true }` here is what let a whole population of routines escape the check in
+    // silence, which is the defect this ticket removes rather than one it may reintroduce.
+    if (!input.teamsTeamId || !input.teamsCreatorAadObjectId) return { eligible: true, teamsMembershipUnresolved: "missing_ids" };
+    const membershipCheck = input.teamsMembershipCheck ?? liveTeamsRoomMembership;
+    const activeCheck = input.teamsActiveCheck ?? liveTeamsAccountActive;
+    const [membership, active] = await Promise.all([
+      // A probe that THROWS is the same fact as a Graph read that failed — it never reaches the
+      // caller as a bare `undefined`, because an unnamed fail-open is the one this ticket removes.
+      membershipCheck(input.teamsTeamId, input.roomId, input.teamsCreatorAadObjectId, input.teamsServiceUrl).catch(
+        (): TeamsRoomMembership => ({ member: undefined, unresolved: "read_error" }),
+      ),
+      activeCheck(input.teamsCreatorAadObjectId).catch((): boolean | undefined => undefined),
+    ]);
+    const verdict = verdictFromChecks(membership.member, active);
+    // An unresolved MEMBERSHIP read still fires (the ruled fail-open), and the cause rides out so
+    // the dispatcher can write its row. An unresolved read that loses to a CONFIRMED-inactive
+    // account carries nothing: that fire is already skipped, with its own reason.
+    if (verdict.eligible && membership.member === undefined) {
+      return { eligible: true, teamsMembershipUnresolved: membership.unresolved };
+    }
+    return verdict;
+  }
+  return { eligible: true };
+}

package/agent/routines/fire-halt.ts

@@ -0,0 +1,57 @@
+// THE ROUTINE PLANE'S HALT CHECK — one predicate, called from BOTH legs.
+//
+// 🔴 THIS PLANE HAS NO CHOKE POINT, WHICH IS WHY THE PREDICATE IS SHARED. A routine fires down two
+// structurally independent paths: the CLOCK leg (`schedules/dispatch.ts` `dispatchTick`, driven by
+// the eve cron) and the EVENT FAN-OUT leg (`routines/ingress.ts` `admitTrigger` → `fanOut`). Their
+// ladders are asymmetric — creator eligibility is clock-only, the audience floor is event-only — and
+// the nearest thing to a shared point, `resolveRoutineTarget`, is deliberately pure and synchronous,
+// so an async store read cannot go there. Two call sites is the honest answer; ONE predicate behind
+// them is what stops the two from drifting into different answers, which is the exact defect
+// `spend/ingress-gate.ts` records happening twice already (a gate that shipped on one leg only).
+//
+// A HALT SKIPS A FIRE. It does not stop a turn a fire already started: after the send
+// (`dispatch.ts`, `ingress.ts`) the turn belongs to eve, and what catches it then is the tool
+// plane's own arrow at that turn's next consequential act. Do not claim the halt is instantaneous.
+//
+// FAIL-CLOSED, like every other halt arrow: an unreadable halt store skips the fire. It costs
+// nothing a broken store was not already costing — both legs read their routines from that same
+// store, so a store that cannot answer this question has no routines to fire either.
+
+import { haltScopeFor, resolveHalt, type HaltDeps } from "../access/halt.js";
+import { auditRoutineSkip, type RoutineAuditDeps } from "./fire-audit.js";
+import { routinePartition } from "./partition.js";
+import type { Routine } from "./routine.js";
+
+/**
+ * Is this routine's fire halted? When it is, the `routine.skip` row (reason `halted`) is written
+ * before this returns true — reusing {@link auditRoutineSkip}, and therefore its per-(routine,
+ * reason) hourly throttle, rather than adding a second skip vocabulary.
+ *
+ * `extra` carries each leg's own context onto the row (the trigger kind on the clock leg, the event
+ * on the fan-out leg), exactly as the over-budget skip beside it does.
+ */
+export async function routineFireHalted(
+  r: Routine,
+  extra: Readonly<Record<string, unknown>> = {},
+  deps: { readonly audit?: RoutineAuditDeps; readonly halt?: HaltDeps } = {},
+): Promise<boolean> {
+  const p = routinePartition(r);
+  const state = await resolveHalt(
+    haltScopeFor({
+      org: p.org,
+      // The surface key carries the DOMAIN axis too — `haltScopeFor` resolves it through the one
+      // shared resolver (`haltDomainForSurfaceKey`), so this leg and every other arrow read the
+      // same answer. A private copy of that resolver here is how the axis went missing elsewhere.
+      scopeKey: p.surfaceKey,
+      // The routine's CREATOR is the person axis. A fire has no acting sender, and the creator is
+      // who the fire is attributed to everywhere else in this plane (the ledger, the audit row,
+      // the seat) — so a `level: "user"` halt on them stops their routines, which is what an
+      // operator halting a person means.
+      ...(r.createdBy ? { principalId: r.createdBy } : {}),
+    }),
+    deps.halt ?? {},
+  );
+  if (!state.halted) return false;
+  await auditRoutineSkip(r, "halted", extra, deps.audit ?? {}).catch(() => false);
+  return true;
+}

package/agent/routines/fire-message.ts

@@ -0,0 +1,76 @@
+// THE FIRE MESSAGE — the one function that decides which protocol a routine's fire is rendered
+// with, and therefore the one definition of "what this routine will actually be told" (OPE-147).
+//
+// WHY IT EXISTS. The selection used to be an inline ternary in schedules/dispatch.ts:
+//
+//     const message = isJobRoutine(r) ? renderJobMessage(r) : r.trigger.kind === "watch" ? renderWatchMessage(r) : renderScheduledMessage(r);
+//
+// That was fine while the dispatcher was the only caller. It stopped being fine the moment
+// `create_routine` gained a PREVIEW: a preview that re-derives the same choice from the same three
+// renderers is a SECOND copy of a rule, and the whole value of a preview is that it cannot lie
+// about what the fire will say. A fourth trigger kind, or a second protocol block, would have to be
+// added in two places and would silently be added in one.
+//
+// So the ternary moved here, the dispatcher calls it, and the preview calls it. There is exactly one
+// answer to "what message does this routine's fire receive", and both the thing that fires it and
+// the thing that describes it read that answer from the same line of code.
+//
+// Framework-free (no eve imports), matching routine.ts / watch.ts / job.ts, so the dispatcher, the
+// tools and the tests all share it without pulling the runtime.
+
+import { isJobRoutine, type Routine } from "./routine.js";
+import { renderScheduledMessage, renderWatchMessage } from "./watch.js";
+import { renderJobMessage } from "./job.js";
+import type { CollectedInput } from "./collector.js";
+
+/** Exactly the routine fields any of the three renderers reads — so a caller with a PROPOSED
+ *  routine (create_routine's preview, before an id is minted) can render one without inventing
+ *  the run-state fields a stored row would have. */
+export type FireMessageInput = Pick<
+  Routine,
+  | "id"
+  | "prompt"
+  | "createdAt"
+  | "lastRunAt"
+  | "report"
+  | "trigger"
+  | "sessionMode"
+  | "lastStateHash"
+  | "jobState"
+  | "jobTainted"
+  // OPE-141: the standing-rules block is rendered by all three renderers below, so it is a field of
+  // the SELECTION's input too — which is what makes `create_routine`'s preview show a routine's
+  // accumulated doctrine rather than a message that will never actually be sent.
+  | "policy"
+  // OPE-151: the follow-ups its earlier runs left are rendered by all three renderers, so they are a
+  // field of the SELECTION's input too — the same argument `policy` above makes.
+  | "followUps"
+>;
+
+/**
+ * The message THIS routine's next fire will receive, protocol block and all.
+ *
+ *   • a DURABLE JOB gets the job protocol (temporal preamble + "where you were" ledger + the
+ *     keep-the-ledger / complete-when-done instruction) — checked FIRST, because a job's stored
+ *     trigger is an ordinary cron/interval and the job protocol supersedes the plain one;
+ *   • a `watch` gets the post-on-diff protocol (observe → record_watch_state → silence sentinel);
+ *   • everything else (cron / interval / once / event) gets the temporal preamble + the prompt.
+ *
+ * The silent block (OPE-149) is rendered INSIDE each of those, so it is carried here for free.
+ *
+ * Renders from whatever `r` the caller passes: the dispatcher passes its PRE-advance in-memory copy
+ * (so "previous run" is the run before this one), and the preview passes a proposed routine with no
+ * `lastRunAt` (so it renders as the FIRST run, which is what a preview is describing).
+ *
+ * `collected` (OPE-151) is THIS fire's pre-run collection, which the dispatcher has already run by
+ * the time it renders. It is a per-FIRE input rather than a field of the row, so it is a parameter
+ * rather than part of {@link FireMessageInput} — but it comes through this one selection for the
+ * same reason everything else does: the `create_routine` preview must be able to describe the shape
+ * of the message the dispatcher will send, and a second renderer would let the two drift. It
+ * defaults to empty, so a preview (which collects nothing) and every routine that declares no
+ * collectors render exactly the message they rendered before.
+ */
+export function renderFireMessage(r: FireMessageInput, collected: readonly CollectedInput[] = []): string {
+  if (isJobRoutine(r)) return renderJobMessage(r, collected);
+  return r.trigger.kind === "watch" ? renderWatchMessage(r, collected) : renderScheduledMessage(r, collected);
+}