@open-everywhere/core 0.1.0

package/agent/spend/dm-mask.ts

@@ -0,0 +1,134 @@
+// THE DM MASK — the ONE road every spend, usage and analytics report takes before it publishes a
+// surface key (OPE-1862).
+//
+// Its own module rather than a section of spend/reporting.ts, so the cap ledger's rollup
+// (spend/store.ts) can fold a group's disclosure without importing the reporting layer that already
+// imports it.
+//
+// The STORE keeps full per-DM resolution (usage_events / ledger rows are unchanged);
+// REPORTS collapse every DM surface into one "(dms)" bucket per platform/workspace, so a
+// report posted into a channel never reveals which individuals DM the agent or how much
+// (Tommy, 2026-07-05).
+//
+// 🔴 DETECTION IS THE ROW'S OWN STAMP, NEVER THE SHAPE OF ITS SURFACE ID (OPE-1862). Each row
+// carries `surfaceMode` — the conversation mode its turn's binding resolved (hooks/spend.ts
+// `turnSurfaceMode`), written on `spend_ledger` and `usage_events` alike. Every platform's
+// identity layer answers for its own surfaces, so a Discord snowflake and a Teams `19:…`
+// conversation id mask exactly as a Slack `D…` id does.
+//
+// WHAT THIS REPLACED, AND WHY IT WAS A LEAK. The old test fell back to `/^D[A-Z0-9]{5,}$/` on the
+// third key segment — a SLACK channel-id shape. Slack DMs masked; Discord and Teams DMs did not,
+// and were named line by line in reports posted into channels. The shape test is gone. Nothing may
+// reintroduce one: a report that has to guess what a surface id means has already failed.
+//
+// 🔴 AND IT FAILS CLOSED. A row nothing stamped is UNCLASSIFIED, and an unclassified row's key is
+// masked too — into its own `(unclassified)` bucket, never into `(dms)`. The separate bucket is
+// deliberate: folding an unstamped CHANNEL row into `(dms)` would report channel spend as DM spend,
+// which is a false statement about where the money went. Unclassified rows are the pre-OPE-1862
+// ledger and usage rows, and any row whose writer had no binding to read a mode from.
+
+/** What a row says about its own conversation — the one input the mask routes on. */
+export type SurfaceDisclosure =
+  /** A one-to-one direct message: the key names an individual, so it is never published. */
+  | "dm"
+  /** A channel or a group DM: the key names a room, so it is published as it stands.
+   *  A group DM stays visible on purpose — a group is not an individual (Tommy, 2026-07-05). */
+  | "open"
+  /** Nothing on the row can classify it, so the key is masked rather than guessed. */
+  | "unknown";
+
+/** A row either reader can mask: the ledger's (mode only) and usage's (mode + origin tag). */
+export interface DmMaskableRow {
+  readonly surfaceKey: string;
+  /** The conversation mode its turn's binding resolved ({@link import("../operational/store.js").SurfaceMode}). */
+  readonly surfaceMode?: string;
+  /** The turn's ORIGIN tag (hooks/spend.ts `turnKind`) — a fallback for rows written before
+   *  `surfaceMode` existed, and only for the two values that answer this question at all. */
+  readonly kind?: string;
+}
+
+/**
+ * Classify one row. STAMPED FACTS ONLY, narrowest first, and never the surface id.
+ *
+ * The `kind` arm reads the two legacy spellings that do answer "was this a DM": `turnKind` returns
+ * "dm" only for a DM turn, and "channel" only when the binding RESOLVED something else. Its other
+ * values — "routine", "supervisor", "subagent", "sandbox", "unclassified" — win that tag BEFORE the
+ * DM test runs, so they say nothing about the conversation and land in "unknown", which masks. That
+ * is the routine-fired-in-a-DM row the old id-shape test published on every platform but Slack.
+ *
+ * 🔴 THE "RESOLVED" IN THAT SENTENCE IS LOAD-BEARING, AND IT USED TO BE UNTRUE (OPE-1867).
+ * `turnKind` ended `mode === "dm" ? "dm" : "channel"`, and the binding gap-fills `channel` when
+ * nothing classified the conversation — so a Teams personal chat whose activity carried no
+ * `conversationType` reached this arm tagged "channel" and was PUBLISHED, even once the row's own
+ * `surfaceMode` was correctly left absent. An unresolvable turn now tags "unclassified", so both
+ * inputs to this function agree and the row masks.
+ */
+export function surfaceDisclosureOf(row: DmMaskableRow): SurfaceDisclosure {
+  if (row.surfaceMode === "dm") return "dm";
+  if (row.surfaceMode === "channel" || row.surfaceMode === "mpim") return "open";
+  if (row.kind === "dm") return "dm";
+  if (row.kind === "channel") return "open";
+  return "unknown";
+}
+
+/**
+ * The disclosure of a GROUP of rows that share one surface key — what a re-aggregated report line
+ * may say, when the rows behind it were folded away.
+ *
+ * A STAMPED answer beats an unstamped one, and "dm" beats everything: one surface is one
+ * conversation, so a group's stamped rows all agree, and a legacy unstamped row beside them adds
+ * no doubt about what the surface is. A group with NO stamped row anywhere stays "unknown" and
+ * masks. An empty group is "unknown" too — nothing classified it.
+ */
+export function foldDisclosure(rows: Iterable<DmMaskableRow>): SurfaceDisclosure {
+  let open = false;
+  for (const row of rows) {
+    const disclosure = surfaceDisclosureOf(row);
+    if (disclosure === "dm") return "dm";
+    if (disclosure === "open") open = true;
+  }
+  return open ? "open" : "unknown";
+}
+
+/** The masked bucket key a DM row reports under: "platform/workspace/(dms)". */
+export function dmBucketKey(surfaceKey: string): string {
+  return bucketKey(surfaceKey, "(dms)");
+}
+
+/** The masked bucket key an UNCLASSIFIED row reports under: "platform/workspace/(unclassified)".
+ *  Deliberately not `(dms)` — see the fail-closed note above. */
+export function unclassifiedBucketKey(surfaceKey: string): string {
+  return bucketKey(surfaceKey, "(unclassified)");
+}
+
+function bucketKey(surfaceKey: string, bucket: string): string {
+  const parts = surfaceKey.split("/");
+  return parts.length >= 2 ? `${parts[0]}/${parts[1]}/${bucket}` : bucket;
+}
+
+/**
+ * THE ONE MASKING DECISION every report and every `query_analytics` grouping goes through: the key
+ * a row of this disclosure may be published under. Only an `open` row keeps its own key.
+ */
+export function maskSurfaceKey(surfaceKey: string, disclosure: SurfaceDisclosure): string {
+  switch (disclosure) {
+    case "dm":
+      return dmBucketKey(surfaceKey);
+    case "unknown":
+      return unclassifiedBucketKey(surfaceKey);
+    default:
+      return surfaceKey;
+  }
+}
+
+/** {@link maskSurfaceKey} for a RAW row that still carries its own stamps. */
+export function maskedSurfaceKeyOf(row: DmMaskableRow): string {
+  return maskSurfaceKey(row.surfaceKey, surfaceDisclosureOf(row));
+}
+
+/** Mask one row's surfaceKey (returns the SAME object when nothing changes, so open paths stay
+ *  allocation-free). Apply BEFORE aggregation so masked rows group naturally into their bucket. */
+export function maskDmSurfaceKey<T extends DmMaskableRow>(row: T): T {
+  const masked = maskedSurfaceKeyOf(row);
+  return masked === row.surfaceKey ? row : { ...row, surfaceKey: masked };
+}

package/agent/spend/ingress-gate.ts

@@ -0,0 +1,349 @@
+// The INGRESS SPEND GATE — ONE implementation of the attended-wake spend decision, called at every
+// door a wake can arrive through (OPE-33, generalised).
+//
+// WHY THIS MODULE EXISTS, AND WHY IT LIVES IN CORE. It began as `slack-spend-gate.ts` because the
+// gate used to live inline in `slack.ts`'s `onInbound` and a delivery-path change routed around it:
+// since eve 0.27.5 the compiled `slackChannel` drops any message it considers self-authored BEFORE
+// the mention hooks run, so driver-app-authored mentions re-entered through the engagement front
+// route, which had no gate at all — a capped surface silently kept spending. The fix then was
+// structural: the gate is a WAKE-ADMISSION decision, so it belongs at every point a wake is about to
+// dispatch a model turn, with the decision logic, the refusal copy, the admin-bypass semantics and
+// the audit row existing exactly ONCE.
+//
+// The SAME defect recurred one layer up. Commit `6687d86f` gave Teams/GitHub/Linear/Notion/Telegram
+// their own attended gates — as five hand-copied blocks, each on that surface's NATIVE ingress leg.
+// But every one of those surfaces ALSO has a SINGLE-WINDOW (crossSurfaceWindow) leg, and on three of
+// them the window path returns BEFORE the native gate (Linear's suppress-and-divert early return,
+// GitHub's mention suppression, Teams' front-door divert), so on the flagship feature the attended
+// mention was un-capped again. Five copies is exactly the condition under which a sixth door goes
+// unguarded, so the copies collapse back to this one function, and the cross-surface window's own
+// choke point (channels/unified.ts `divertToUnifiedWindow`, door `"window"`) calls it too.
+//
+// Discord's native leg was the LAST holdout and joined in OPE-302 — kept hand-rolled for a while
+// only because its refusal text was byte-pinned by scenario goldens, which made migrating a
+// behaviour change rather than a refactor. Discord alone therefore never wrote the `spend.gate`
+// row, and its refusal said "whole server" where every other door said "whole workspace" — so on
+// the one surface that reaches the agent through BOTH a native leg and the window divert, which
+// door declined you decided which sentence you read. There is now no surface with a gate of its
+// own: every door in the system is this function.
+//
+// POSTURE (unchanged, and load-bearing in both directions):
+//   • the CHECK fails OPEN — a broken budget read must never take the agent off the air, and it says
+//     so loudly (a silent catch here is indistinguishable from "under cap" from the outside);
+//   • a definite OVER fails CLOSED — a visible refusal is posted and the wake is DROPPED (no model
+//     turn). The post is best-effort and sits in its own try/catch with the decline OUTSIDE it, so a
+//     LOST refusal still declines: a message we failed to deliver must not buy a turn;
+//   • an admin over the scope proceeds as AUDITED SUDO with a visible (hourly-throttled) warning —
+//     the guardrail binds the team, never locks out the budget owner (spend/bypass.ts).
+//
+// Deps are injected (`checkOverBudget` / `bypassFor` / `appendGateAudit` / `post`) so the decision
+// table is unit-tested without a store, a config or a live surface.
+
+import { resolvePartition, domainKeyOf } from "../memory/partition.js";
+import { bindFrom, type BindableContext } from "../identity/binding.js";
+import { scopeOverBudget } from "./check.js";
+import { capBypassFor } from "./bypass.js";
+import { getOperationalStore } from "../operational/provider.js";
+import type { SessionMode } from "../access/resolver.js";
+import type { CapLayer } from "./spend.js";
+
+/** Which ingress CHOKEPOINT asked. Recorded on the `spend.gate` audit row so a live probe can tell
+ *  "the mention path refused" from "the engagement path refused" — the exact ambiguity that made the
+ *  2026-07-25 cap fixture unfalsifiable. `join` is the channel-join intro turn; `window` is the
+ *  cross-surface single-window divert (channels/unified.ts), the door every surface's single-window
+ *  leg funnels through regardless of which native leg it bypassed on the way. `answer` (OPE-588) is
+ *  an eve-owned HITL widget click (`onInputResponse` on Slack/Teams) — a click that RESUMES a parked
+ *  turn is a decision to spend more, taken through a button, on a scope that was never asked whether
+ *  it could afford it. */
+export type SpendGateDoor = "mention" | "engagement" | "join" | "window" | "answer";
+
+/** proceed = admit the wake (under cap, or an admin bypassing it, or the check failed open).
+ *  declined = the surface is over cap and the requestor has no bypass: the refusal has already
+ *  been posted and the caller MUST drop the wake (no model turn). */
+export type SpendGateDecision = "proceed" | "declined";
+
+/** The tripped-cap verdict shape (spend/spend.ts CapVerdict) — structural so a provider shim needn't
+ *  widen the adapter-api barrel just to name it. `layer`/`scopeKey` (OPE-274) are optional here for
+ *  the same reason: a shim's injected verdict predates them and must keep type-checking. */
+interface Verdict {
+  readonly over: boolean;
+  readonly reason?: string;
+  readonly layer?: CapLayer;
+  readonly scopeKey?: string;
+}
+
+/** The `spend.gate` audit row (operational/store.ts AuditInput's shape — structural for the same
+ *  reason as {@link Verdict}). */
+export interface SpendGateAuditRow {
+  readonly ts: string;
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  readonly action: string;
+  readonly detail?: Readonly<Record<string, unknown>>;
+}
+
+/** The two emoji the visible copy leads with. Slack renders its own SHORTCODES (`:no_entry:`) and
+ *  nothing else does, so the badge is a parameter rather than a fork of the sentences — the copy
+ *  itself is the thing that must not drift. */
+export interface SpendGateBadges {
+  readonly refusal: string;
+  readonly warning: string;
+}
+
+/** Unicode badges — correct on every surface that renders plain text (Discord/Teams/GitHub/Linear/
+ *  Notion, and the cross-surface window, whose refusal can land on ANY of them). */
+export const UNICODE_SPEND_BADGES: SpendGateBadges = { refusal: "⛔", warning: "⚠️" };
+
+/** Slack mrkdwn shortcodes — the historical copy, kept exact so Slack's rendered refusal is
+ *  byte-identical to what it has always posted. */
+export const SLACK_SPEND_BADGES: SpendGateBadges = { refusal: ":no_entry:", warning: ":warning:" };
+
+export interface IngressSpendGateInput {
+  /** The pre-session bindable for the triggering message/event — the SAME derivation the session's
+   *  own auth will use, so the gate scopes the real workspace/surface. */
+  readonly bindable: BindableContext;
+  /** dm/mpim/channel. Since OPE-267 a DM is capped like anything else, so this no longer decides
+   *  WHETHER the gate bites — it selects the refusal variant (a DM can't be told "DM me") and
+   *  reaches checkCap's `perDomain` criteria layer. Omitted ⇒ derived from the bindable, which is
+   *  what every door that has no independent mode resolution should do. */
+  readonly mode?: SessionMode;
+  /** The triggering user (admin-bypass lookup). Absent ⇒ no bypass is possible. */
+  readonly principalId?: string;
+  /** A platform workspace reference for the audit row only (Slack's team id, historically) — emitted
+   *  as `team` when supplied, omitted entirely when not. The row already carries the partition's own
+   *  workspace at the top level; this is the raw platform id for a live probe. */
+  readonly workspaceRef?: string | null;
+  readonly door: SpendGateDoor;
+  /** Post the refusal / bypass warning into the triggering conversation. Best-effort by contract:
+   *  a throw here never changes the decision. */
+  readonly post: (text: string) => Promise<void>;
+  /** Which badges the copy leads with. Defaults to {@link UNICODE_SPEND_BADGES}. */
+  readonly badges?: SpendGateBadges;
+  // --- seams (live defaults; injected in tests) ---
+  readonly checkOverBudget?: (bindable: BindableContext, mode: SessionMode) => Promise<Verdict>;
+  readonly bypassFor?: (input: {
+    readonly org: string;
+    readonly principalId: string | undefined;
+    readonly surfaceKey: string;
+    readonly reason?: string;
+  }) => Promise<{ readonly warn: boolean } | null>;
+  readonly appendGateAudit?: (row: SpendGateAuditRow) => Promise<void>;
+}
+
+/**
+ * The refusal a capped, non-admin surface gets. LOAD-BEARING copy: while this scope is over cap
+ * EVERY wake here is dropped, so the message has to carry the whole remedy — the model gets no
+ * follow-up turn in which to explain itself.
+ *
+ * 🔴 TWO QUESTIONS, ANSWERED FROM TWO DIFFERENT FACTS (OPE-1860). Every earlier version tangled
+ * them, and a group-DM refusal then told the reader a lie in two places at once.
+ *
+ *   1. WHOSE BUDGET STOPPED YOU, and WHICH KEY RAISES IT — the VERDICT's `layer` and `scopeKey`
+ *      decide this, and nothing else may. One table ({@link CAP_LAYER_COPY}) names the three
+ *      layers, so the DM, group-DM and channel variants describe a layer identically.
+ *   2. HOW YOU REACH AN ADMIN — the VENUE decides this. A channel refusal says "DM me to propose
+ *      an override", because a DM is where an admin goes to raise a channel's cap. A DM refusal
+ *      cannot: the reader is being declined IN the DM, so "DM me" is a loop with no exit, and
+ *      `capBypassFor` already let an org admin through before this text could render.
+ *
+ * WHAT THE TANGLE COST. The direct-message branch was ONE fixed sentence that asserted "This is a
+ * cap on your own usage" for every layer and named the conversation key alone. In a GROUP DM that
+ * claim is unreachable-by-construction — `spend/check.ts` resolves a per-user cap on `mode === "dm"`
+ * only, so an mpim breach is always the surface's or the workspace's — and the key it offered was
+ * the conversation's, which an admin raises to no effect while the workspace cap that actually bit
+ * stands untouched. The reader is then refused again by a cap nobody moved.
+ *
+ * 🔴 SO THE COPY MAY NEVER SAY "your own" FROM ANYTHING BUT `layer === "user"`. That is the
+ * assertion `spend-test.ts`'s (mode × layer) table pins, including the mpim × user cell, which must
+ * stay unreachable.
+ */
+export interface SpendRefusalCopyInput {
+  /** checkCap's human sentence — "this group DM reached its monthly budget — …". */
+  readonly reason?: string;
+  /** The SPEND-grain key of the conversation the refusal posts into (domainKeyOf). */
+  readonly surfaceKey: string;
+  /** `platform/workspace`. */
+  readonly workspaceKey: string;
+  /** Where the refusal posts — it decides the ROUTE to an admin, never whose cap bit. */
+  readonly mode: SessionMode;
+  /** WHICH cap bit ({@link CapVerdict.layer}) — it LABELS the key below. Absent ⇒ the copy names
+   *  no layer of its own and offers both addressable keys. */
+  readonly layer?: CapLayer;
+  /** The breached cap's own scope key ({@link CapVerdict.scopeKey}) — the key an admin raises. */
+  readonly layerKey?: string;
+  readonly badge?: string;
+}
+
+/** What a place is called, in the reader's own terms. ONE table, so a layer cannot be named one
+ *  way in a DM and another way in a channel. */
+const PLACE_WORD: Record<SessionMode, string> = { dm: "this DM", mpim: "this group DM", channel: "this channel" };
+
+/**
+ * WHAT AN ADMIN MUST RAISE, per breached layer. The three variants read this same table — that is
+ * the parity `spend-test.ts` asserts — so a layer cannot be labelled one way in a DM and another
+ * way in a channel.
+ *
+ * 🔴 THE COPY CARRIES NO SECOND CLAIM ABOUT WHOSE CAP BIT, and that is deliberate. `reason`
+ * (checkCap) already opens with the layer in the reader's own terms — "you've reached your own
+ * monthly budget — the per-user cap on …", "this group DM reached its monthly budget — the
+ * per-surface cap on …". A sentence restating it would be repetition on every correct refusal, and
+ * repetition is not what OPE-1860 found: the defect was a fixed sentence that CONTRADICTED the
+ * reason ("this is a cap on your own usage" over a workspace breach) and a key that raised the
+ * wrong cap. So the layer is named once, in prose by `reason`, and once structurally by the label
+ * below on the key that actually moves.
+ */
+const CAP_LAYER_COPY: Record<CapLayer, { readonly keyLabel: (mode: SessionMode) => string }> = {
+  user: { keyLabel: () => "your own allowance" },
+  surface: { keyLabel: (mode) => PLACE_WORD[mode] },
+  workspace: { keyLabel: () => "whole workspace" },
+};
+
+export function spendRefusalCopy(input: SpendRefusalCopyInput): string {
+  const { reason, surfaceKey, workspaceKey, mode, layer, layerKey } = input;
+  const badge = input.badge ?? UNICODE_SPEND_BADGES.refusal;
+  const inDm = mode === "dm" || mode === "mpim";
+
+  // THE ROUTE TO AN ADMIN — this is what the venue decides. A DM refusal cannot say "DM me": the
+  // reader is being declined IN the DM, and `capBypassFor` already let an org admin through before
+  // this text could render, so whoever reads it is by construction not an admin.
+  const remedy = inDm
+    ? "I can't raise it from in here. Ask an org admin to raise it: permanently in the spend-budgets config, or temporarily by asking me from a channel to propose an override — an admin approves that on a card."
+    : "An admin can raise this permanently in the spend-budgets config, or DM me to propose a temporary override — an admin approves it on a card.";
+
+  // THE KEYS — the breached cap's own key first, because that is the one an admin must raise, and
+  // this conversation's key beside it when they differ, because that is how an admin finds the
+  // room. With no layer to name, both keys are offered, exactly as the pre-OPE-1860 channel
+  // variant did.
+  const breached = layer && layerKey ? `${CAP_LAYER_COPY[layer].keyLabel(mode)} = \`${layerKey}\`` : undefined;
+  const here = `${PLACE_WORD[mode]} = \`${surfaceKey}\``;
+  const keys = breached
+    ? breached === here
+      ? breached
+      : `${breached}, ${here}`
+    : `${here}, whole workspace = \`${workspaceKey}\``;
+
+  return `${badge} I'm holding off${inDm ? "" : " here"} — ${reason}. ${remedy} Scope keys for the override: ${keys}.`;
+}
+
+/** The visible half of the sudo semantics: an admin spends past the cap, but the room is told
+ *  (throttled to one per surface per hour by capBypassFor; every bypass still audits). */
+export function spendBypassWarnCopy(reason: string | undefined, badge: string = UNICODE_SPEND_BADGES.warning): string {
+  return `${badge} ${reason} — proceeding because you're an admin. Ask me here to raise or clear the cap (an approval card follows), or change it permanently in the spend-budgets config.`;
+}
+
+/**
+ * Decide whether a wake may spend. Never throws: any failure of the check itself is FAIL-OPEN (a
+ * broken budget read must not take the agent off the air) with a loud warn — a silent catch here is
+ * indistinguishable from "under cap" from the outside (live-debug 2026-07-25).
+ *
+ * EXCEPTION (sudo semantics, spend/bypass.ts): an admin over this scope proceeds past the cap with a
+ * visible warning + an audit row — the guardrail binds the team, never locks out the budget owner.
+ * What counts as admin evidence is per-surface: the config roster everywhere, plus a provider's own
+ * registered native check where one exists (access/native-admin.ts — Discord's guild-ADMINISTRATOR
+ * leg is the reference; Slack's payloads carry no workspace-admin standing, so it is roster-only,
+ * the same asymmetry as the approval cards).
+ */
+export async function ingressSpendGate(input: IngressSpendGateInput): Promise<SpendGateDecision> {
+  const check = input.checkOverBudget ?? liveCheckOverBudget;
+  const bypass = input.bypassFor ?? capBypassFor;
+  const audit = input.appendGateAudit ?? liveAppendGateAudit;
+  const badges = input.badges ?? UNICODE_SPEND_BADGES;
+  try {
+    const partition = resolvePartition(input.bindable);
+    // trust: lets the gate resolve the dm/public criteria perDomain layer too (see spend/check.ts)
+    // — cheap here since bindFrom is a pure derivation over facts already resolved by the caller,
+    // no extra I/O.
+    const binding = bindFrom(input.bindable);
+    const mode = input.mode ?? binding.mode;
+    const verdict = await check(input.bindable, mode);
+    // Per-wake gate-decision AUDIT row, OVER-ONLY (narrowed 2026-07-25 after S10 went green — the
+    // per-wake unconditional row was a debugging aid): an under-cap pass is the silent normal; a row
+    // means the cap actually bit. `door` names the ingress path. Console logging proved unobservable
+    // — the webhook function's console output never reaches `vercel logs` — so the decision rides the
+    // audit trail where the control API can read it.
+    try {
+      if (verdict.over)
+        await audit({
+          ts: new Date().toISOString(),
+          org: partition.org,
+          platform: partition.platform,
+          workspace: partition.workspace,
+          surface: partition.surface,
+          action: "spend.gate",
+          detail: {
+            // The SPEND-grain key (domainKeyOf — a Discord thread names its parent channel): the key
+            // the cap actually gates and the key an override proposal must target.
+            key: domainKeyOf(partition),
+            mode,
+            door: input.door,
+            ...(input.workspaceRef !== undefined ? { team: input.workspaceRef } : {}),
+            over: verdict.over,
+            ...(verdict.reason ? { reason: verdict.reason } : {}),
+          },
+        });
+    } catch {
+      /* observability only — never block the wake */
+    }
+    if (!verdict.over) return "proceed";
+    const granted = await bypass({
+      org: binding.org,
+      principalId: input.principalId,
+      // The SPEND grain again (bypass.ts:84-86 documents the contract): the roster leg resolves the
+      // domain covering the CAPPED scope, and the bypass audit / warn-throttle rows land on that
+      // same key — never a per-thread surfaceKey the cap never gated.
+      surfaceKey: domainKeyOf(partition),
+      reason: verdict.reason,
+    });
+    if (granted) {
+      if (granted.warn) {
+        try {
+          await input.post(spendBypassWarnCopy(verdict.reason, badges.warning));
+        } catch {
+          /* best-effort */
+        }
+      }
+      return "proceed";
+    }
+    try {
+      await input.post(
+        spendRefusalCopy({
+          ...(verdict.reason !== undefined ? { reason: verdict.reason } : {}),
+          surfaceKey: domainKeyOf(partition),
+          workspaceKey: `${binding.platform}/${binding.workspace}`,
+          // The VENUE — it picks the route to an admin, never the claim about whose cap bit.
+          mode,
+          // WHICH CAP BIT, and its own key, both straight off the verdict (OPE-274/OPE-1860) —
+          // never synthesised here. `checkCap` already decided; the copy only renders it.
+          ...(verdict.layer !== undefined ? { layer: verdict.layer } : {}),
+          ...(verdict.scopeKey !== undefined ? { layerKey: verdict.scopeKey } : {}),
+          badge: badges.refusal,
+        }),
+      );
+    } catch {
+      /* best-effort */
+    }
+    return "declined"; // drop the wake: declined, not degraded
+  } catch (e) {
+    /* never let budget checking block a task — but say WHY it failed open (live-debug 2026-07-25:
+       a silent catch here is indistinguishable from "under cap" from the outside) */
+    console.warn(`[open-everywhere:spend-gate] check failed OPEN (door=${input.door}): ${e instanceof Error ? e.message : String(e)}`);
+    return "proceed";
+  }
+}
+
+/** Live budget check: partition, trust and the ATTRIBUTED principal all re-derived from the same
+ *  bindable the gate resolved. The principal turns on the per-user budget axis (OPE-268) — it is
+ *  `binding.principalId`, the id this turn's spend will be RECORDED under, so the cap and the
+ *  ledger measure the same person (see spend/check.ts's note on why this is deliberately not the
+ *  `actingPrincipalId` fence). */
+function liveCheckOverBudget(bindable: BindableContext, mode: SessionMode): Promise<Verdict> {
+  const binding = bindFrom(bindable);
+  return scopeOverBudget(resolvePartition(bindable), mode, new Date().toISOString(), binding.trust, binding.principalId);
+}
+
+/** Live audit sink (the operational store's append). */
+function liveAppendGateAudit(row: SpendGateAuditRow): Promise<void> {
+  return getOperationalStore().appendAudit(row);
+}