@open-everywhere/core 0.1.0

package/agent/access/taint-enforcement.ts

@@ -0,0 +1,183 @@
+// The reviewed source-tier table DECIDES whether an ingestion marks the turn, and enforcement is RELAXATION-ONLY by ruling: a site that does not taint today never starts, so decideIngestion(src, false) is false for every kind, forever. The kill switch taint.tierMode restores each site's own pre-flip call, and every unrecognised value falls to dryrun because that is the over-tainting direction.
+
+import { defineState } from "eve/context";
+import { classifyIngestion, type IngestionSource, type IngestionVerdict } from "./taint-tiers.js";
+import { getSettings, type TaintTierMode as SettingsTaintTierMode, type TaintMode } from "../settings/settings.js";
+
+/** Whether the table DECIDES (enforced) or merely observes (dryrun). The vocabulary is declared once, in the settings schema. */
+export type TaintTierMode = SettingsTaintTierMode;
+
+export type { TaintMode };
+
+// taint.mode and taint.tierMode are different questions: tierMode asks HOW a mark is decided and both its values still mark, while mode asks whether the tainted-turn model runs at all. Turning it off costs the gate sinks their ask-floor, the provenance disclosure, the durable memory mark and the delegation withdrawal, but it does NOT touch the fence, whose envelope and defang ride every ingested body in both modes.
+
+/** Does this deployment run the tainted-turn model? `on` is the shipped default (OPE-399). */
+export function taintMode(): TaintMode {
+  return getSettings().taint.mode;
+}
+
+/** Per call, never cached: getSettings resolves fresh, so a test can flip it mid-process without a module reload. There is no env path to this answer. */
+export function taintEnabled(): boolean {
+  return taintMode() !== "off";
+}
+
+/** Per call, never cached — a module-load constant would need a rebuild to revert, which is the opposite of a kill switch. `enforce`, `enforced` and unset mean enforced; EVERYTHING else, typos included, means dryrun, which restores the over-tainting behaviour so a misspelling can only ever fail toward more marking. */
+export function taintTierMode(): TaintTierMode {
+  return getSettings().taint.tierMode;
+}
+
+/** One divergence, as the sink receives it. Names and verdicts ONLY — never ingested content, the
+ *  same hard rule every audit detail in this repo carries. */
+export interface TaintVerdictRow {
+  /** `over-taint` (the site's own call taints, the table says trusted) / `under-taint` (the reverse)
+   *  / `assumed` (the two agree, but only via the fail-closed default). */
+  readonly divergence: "over-taint" | "under-taint" | "assumed";
+  readonly kind: IngestionSource["kind"];
+  /** A taint-clean label the site supplied — a tool or connector NAME, never content. */
+  readonly label?: string;
+  /** Which world wrote this row. `enforced` ⇒ the table decided (subject to `applied`); `dryrun` ⇒
+   *  the kill switch is set and the site's own call decided, exactly as before OPE-324. */
+  readonly mode: TaintTierMode;
+  /** Did the table's verdict decide the live taint here? True only for an ENFORCED site that would otherwise have tainted, so an over-taint row with applied true says the mark was not set. It is false for every under-taint row, every dryrun row, and every render-time declarer. */
+  readonly applied: boolean;
+  /** What the SITE's own pre-flip call does, read as an EFFECT rather than as a call. At a render-time site the two come apart: the render runs where the taint half no-ops, so what decides the reader's turn is whether a seeded auth attribute rides the delivery. */
+  readonly taintsToday: boolean;
+  /** What the TABLE says. Under `mode: enforced` with `applied: true`, this IS the live decision. */
+  readonly tableTier: IngestionVerdict["tier"];
+  /** True when the table reached that tier via the fail-closed default, not via real metadata. */
+  readonly assumed: boolean;
+  readonly reason: string;
+}
+
+type Sink = (row: TaintVerdictRow) => void;
+
+let sink: Sink | null = null;
+
+/** Install the sink that persists a divergence. Called once at module load by hooks/spawn-taint.ts —
+ *  see this file's header for why it is injected rather than imported. Idempotent by overwrite. */
+export function registerTaintVerdictSink(fn: Sink | null): void {
+  sink = fn;
+}
+
+/** Test seam: the currently installed sink, so a test can save/restore it without guessing. */
+export function currentTaintVerdictSink(): Sink | null {
+  return sink;
+}
+
+/** What the dedupe slot holds. `turn` is the eve turn id the `keys` belong to; `undefined` means "no
+ *  turn boundary has been observed yet", which reads as belonging to whatever turn is running. */
+interface VerdictSeen {
+  readonly turn?: string;
+  readonly keys: readonly string[];
+}
+
+const seen = defineState<VerdictSeen>("open-everywhere.taint-dryrun-seen", () => ({ keys: [] }));
+
+/** Read defensively: the slot key is unchanged from when it held a bare string array, so a session resumed across either deploy hands one back. A legacy list is honoured as the CURRENT turn's keys, so the next provable boundary clears it. */
+function readSeen(v: unknown): VerdictSeen {
+  if (Array.isArray(v)) return { keys: v.filter((k): k is string => typeof k === "string") };
+  if (typeof v === "object" && v !== null && "keys" in (v as Record<string, unknown>)) {
+    const s = v as { turn?: unknown; keys?: unknown };
+    return {
+      turn: typeof s.turn === "string" ? s.turn : undefined,
+      keys: Array.isArray(s.keys) ? s.keys.filter((k): k is string => typeof k === "string") : [],
+    };
+  }
+  return { keys: [] };
+}
+
+/** Drops the dedupe memo at the turn boundary, keyed on the eve turn id so a re-entered turn keeps its memo. It differs from the taint signal's reset in one arm: an UNREADABLE turn id CLEARS here, because the unsafe failure of an observer is silence while the unsafe failure of the signal is a lost mark. It is a LOG boundary only and must never reach decideIngestion's answer. */
+export function beginTaintVerdictTurn(turnId: string | undefined): void {
+  try {
+    seen.update((cur) => {
+      const state = readSeen(cur);
+      if (turnId !== undefined && state.turn === turnId) return state; // same turn re-entered ⇒ keep the memo
+      return { ...(turnId !== undefined ? { turn: turnId } : {}), keys: [] };
+    });
+  } catch {
+    /* no session context here — nothing to reset, and never a reason to disturb the turn */
+  }
+}
+
+/** Has this turn already reported this (kind, divergence)? Fail-soft: no context ⇒ never deduped. */
+function firstThisTurn(key: string): boolean {
+  try {
+    let fresh = false;
+    seen.update((cur) => {
+      const state = readSeen(cur);
+      if (state.keys.includes(key)) return state;
+      fresh = true;
+      return { ...state, keys: [...state.keys, key] };
+    });
+    return fresh;
+  } catch {
+    return true;
+  }
+}
+
+/** `siteWouldTaint` is the CEILING, not decoration: enforced answers it AND the table's untrusted verdict, dryrun answers it alone, so this never mints a mark the site did not already have. It NEVER throws and its failure answer is siteWouldTaint, and an undeclared site keeps its own call verbatim and writes no row. */
+export function decideIngestion(src: IngestionSource | undefined, siteWouldTaint: boolean): boolean {
+  // The master switch runs BEFORE the undeclared-site arm, and the order is the point: an undeclared site is the one that taints unconditionally, so checking later would leave every ungoverned site still marking on a taint-off deployment. No row is written either, because a divergence log about a dead control would misread as an armed one.
+  if (!taintEnabled()) return false;
+  if (src === undefined) return siteWouldTaint;
+  try {
+    const mode = taintTierMode();
+    const verdict = classifyIngestion(src);
+    const wouldTaint = verdict.tier === "untrusted";
+    // The table governs only where the site had a mark to give up. `applied` is the honest record of
+    // that, and it is what a reader of the log uses to tell "we relaxed this" from "we noticed this".
+    const applied = mode === "enforced" && siteWouldTaint;
+    const decision = applied ? wouldTaint : siteWouldTaint;
+    // The row is written LAST and behind noteRow's own catch, so an exploding sink cannot reach `decision`. With the sink call inside this try, a throwing log fell through to the fallback and silently resurrected a mark the table had dropped.
+    noteRow(src, verdict, { mode, applied, siteWouldTaint });
+    return decision;
+  } catch {
+    /* the table must never disturb the read it governs — fall back to the site's own call */
+    return siteWouldTaint;
+  }
+}
+
+/** Records what the table said for a site that decides its own taint anyway — the render-time declarers and the fence-only GitHub seams. Rows from here always carry applied false, and it never throws and never changes behaviour. */
+export function noteIngestionVerdict(src: IngestionSource | undefined, taintsToday: boolean): void {
+  if (!taintEnabled()) return; // OPE-399 — no live model, nothing to observe against
+  if (src === undefined) return;
+  try {
+    noteRow(src, classifyIngestion(src), { mode: taintTierMode(), applied: false, siteWouldTaint: taintsToday });
+  } catch {
+    /* an observer must never disturb the read it is observing */
+  }
+}
+
+/** Silent when site and table agree on REAL metadata, so the log stays short enough to read. TOTALLY SWALLOWING: everything from the dedupe read to the sink call runs inside this catch, so no failure of the log can propagate into decideIngestion's answer. */
+function noteRow(
+  src: IngestionSource,
+  verdict: IngestionVerdict,
+  ctx: { mode: TaintTierMode; applied: boolean; siteWouldTaint: boolean },
+): void {
+  try {
+    const wouldTaint = verdict.tier === "untrusted";
+    const divergence: TaintVerdictRow["divergence"] | null =
+      ctx.siteWouldTaint && !wouldTaint
+        ? "over-taint"
+        : !ctx.siteWouldTaint && wouldTaint
+          ? "under-taint"
+          : verdict.assumed
+            ? "assumed"
+            : null;
+    if (divergence === null) return; // site and table agree on real metadata — the boring case
+    if (!firstThisTurn(`${src.kind}:${divergence}`)) return;
+    sink?.({
+      divergence,
+      kind: src.kind,
+      ...(src.label !== undefined ? { label: src.label } : {}),
+      mode: ctx.mode,
+      applied: ctx.applied,
+      taintsToday: ctx.siteWouldTaint,
+      tableTier: verdict.tier,
+      assumed: verdict.assumed,
+      reason: verdict.reason,
+    });
+  } catch {
+    /* the log must never disturb the read it observes, nor the verdict that governs it */
+  }
+}

package/agent/access/taint-signal.ts

@@ -0,0 +1,297 @@
+// The per-turn signal that this turn ingested untrusted external content, carried in a per-session eve state slot. The turn boundary clears it only on positive proof of a new turn id, so every failure of the reset keeps the older, stricter value, and a missing eve context reads as not tainted.
+
+import { defineState } from "eve/context";
+import type { IngestionKind } from "./taint-tiers.js";
+// TYPE-ONLY, and it has to stay that way: this module sits inside audit/audit.ts's transitive import
+// cone (see access/taint-enforcement.ts's header), so a VALUE import of a channels/ module here
+// would close a module-init cycle. A type import erases at compile time and closes nothing.
+import type { WakeTrust } from "../channels/wake-envelope.js";
+import { taintEnabled } from "./taint-enforcement.js";
+// VALUE imports, and safe for the same reason taint-enforcement.ts's are: identity/trust.ts reaches
+// only the settings module and a pure string grammar, and settings/settings.ts reaches nothing in
+// audit.ts's cone. Neither touches channels/, which is the direction the note above forbids.
+import { declaredSurfaceTrust } from "../identity/trust.js";
+// Safe for the SAME reason (OPE-516): identity/author-trust.ts is a deliberate value-import LEAF —
+// it reaches only two zero-dependency string grammars, and imports `Group` type-only precisely so
+// this cone stays clean. Read its header before adding an import to it.
+import { authorRefutedByRegister, type AuthorTrustQuery } from "../identity/author-trust.js";
+import { getSettings } from "../settings/settings.js";
+
+// The taint off switch is checked in the mark and in the two readers, so everything downstream goes inert without importing a setting. Both sides are gated because the slot is durable: a session resumed across the deploy can hand back a true written under the old posture.
+
+/** What the slot holds: the eve turn id the bit belongs to, plus the classes of source this turn ingested, in first-seen order and deduped. A mark may carry no kind, so an empty list means no breakdown available, never not tainted. */
+interface TaintState {
+  readonly turn?: string;
+  readonly tainted: boolean;
+  readonly kinds?: readonly string[];
+}
+
+const slot = defineState<TaintState>("open-everywhere.untrusted-ingested", () => ({ tainted: false }));
+
+/** Read the durable value defensively. The slot key is UNCHANGED from when it held a bare boolean,
+ *  so a session resumed across the OPE-299 deploy hands back `true`/`false`. A legacy `true` is
+ *  honoured as tainted-with-no-turn — the STRICTER migration: it survives until the first boundary
+ *  that can positively prove a new turn, rather than evaporating on resume. */
+function readState(v: unknown): TaintState {
+  if (v === true) return { tainted: true };
+  if (v === false || v === undefined || v === null) return { tainted: false };
+  if (typeof v === "object" && "tainted" in (v as Record<string, unknown>)) {
+    const s = v as { turn?: unknown; tainted?: unknown; kinds?: unknown };
+    const kinds = Array.isArray(s.kinds) ? s.kinds.filter((k): k is string => typeof k === "string") : [];
+    return {
+      turn: typeof s.turn === "string" ? s.turn : undefined,
+      tainted: s.tainted === true,
+      ...(kinds.length > 0 ? { kinds } : {}),
+    };
+  }
+  return { tainted: false };
+}
+
+/** Clears the signal at a turn boundary, called exactly once and first from the turn.started hook. An undefined turn id is not an error: the boundary cannot be proven, so the slot keeps what it had. */
+export function beginTaintTurn(turnId: string | undefined): void {
+  try {
+    slot.update((cur) => {
+      const state = readState(cur);
+      if (turnId === undefined) return state; // cannot prove a new turn ⇒ keep the stricter answer
+      if (state.turn === turnId) return state; // same turn re-entered ⇒ never re-clear mid-turn
+      return { turn: turnId, tainted: false };
+    });
+  } catch {
+    /* no session context here — nothing to reset, and never a reason to disturb the turn */
+  }
+}
+
+/** Marks that this turn ingested untrusted content, optionally naming the class of source, which is disclosure material and decides nothing. Called on every wrap, because wrapping stops structural breakout and not semantic injection, and it takes no turn id: it writes into whatever turn the boundary last established. */
+export function markUntrustedIngestedThisTurn(kind?: IngestionKind): void {
+  // OPE-399: `taint.mode: "off"` ⇒ no mark is ever written, so no flip observer fires either (which
+  // is what keeps the native-subagent taint marker out of the store on an opted-out deployment).
+  if (!taintEnabled()) return;
+  let flipped = false;
+  let kindsGrew = false;
+  try {
+    slot.update((cur) => {
+      const state = readState(cur);
+      const kinds = state.kinds ?? [];
+      // MONOTONIC in both fields: the bit only ever sets, and the kind list only ever grows (first
+      // seen first, deduped). A repeat mark with no kind is a no-op on an already-tainted turn, so
+      // the common case still writes nothing new.
+      const nextKinds = kind !== undefined && !kinds.includes(kind) ? [...kinds, kind] : kinds;
+      if (state.tainted && nextKinds.length === kinds.length) return state;
+      if (!state.tainted) flipped = true;
+      if (nextKinds.length > kinds.length) kindsGrew = true;
+      return { turn: state.turn, tainted: true, ...(nextKinds.length > 0 ? { kinds: nextKinds } : {}) };
+    });
+  } catch {
+    /* no session context here — nothing to signal, never blocks the ingestion path */
+  }
+  // FIRST MARK OF THIS TURN ONLY (see registerTaintFlipObserver). Outside the `update` callback on
+  // purpose: `slot.update` is a state-transition function and must stay free of side effects, so a
+  // re-invocation by the serializer can never fire an observer twice.
+  if (flipped) notifyTaintFlipped();
+  // EVERY DISTINCT NEW KIND (see registerTaintKindObserver) — the seam the forward stamp needs, and
+  // the reason the flip seam alone lost every source after the first. Outside the callback for the
+  // same reason, and AFTER the flip so an observer of both sees the bit before it sees the breakdown.
+  if (kindsGrew) notifyTaintKindsGrew();
+}
+
+// A callback registry rather than a direct call: this module sits inside audit.ts's import cone, so a static import of anything store-shaped would close a module-init cycle. The seam fires on the false-to-true transition, not on every mark.
+
+type TaintFlipObserver = () => void;
+
+const flipObservers: TaintFlipObserver[] = [];
+
+/**
+ * Observe the moment THIS turn's taint bit goes false → true. Registered once at module load by
+ * hooks/spawn-taint.ts. Observers are side-effect-only and must never throw to the ingestion path —
+ * {@link notifyTaintFlipped} swallows anything they raise, because a failure to record a taint fact
+ * may not be allowed to fail the read that produced it (the approval-card control is primary).
+ */
+export function registerTaintFlipObserver(observer: TaintFlipObserver): void {
+  flipObservers.push(observer);
+}
+
+function notifyTaintFlipped(): void {
+  for (const observer of flipObservers) {
+    try {
+      observer();
+    } catch {
+      /* an observer is a recorder, never a gate — the mark itself has already landed */
+    }
+  }
+}
+
+// This seam fires once per distinct new kind, and its observers must return synchronously: they may never await and never read the store, or store latency lands in the ingestion path. An observer that writes durably must chain its own writes, because this seam and the flip seam both fire on a turn's first mark.
+
+type TaintKindObserver = () => void;
+
+const kindObservers: TaintKindObserver[] = [];
+
+/**
+ * Observe the moment THIS turn's kind list GROWS — including the first kind of the turn, which also
+ * fires the flip seam. Registered once at module load by hooks/spawn-taint.ts. Same swallowing
+ * contract as {@link registerTaintFlipObserver}, and the same reason for it.
+ */
+export function registerTaintKindObserver(observer: TaintKindObserver): void {
+  kindObservers.push(observer);
+}
+
+function notifyTaintKindsGrew(): void {
+  for (const observer of kindObservers) {
+    try {
+      observer();
+    } catch {
+      /* an observer is a recorder, never a gate — the mark itself has already landed */
+    }
+  }
+}
+
+/** Did this turn ingest untrusted external content? The bit is marking, not gating: it changes a verdict only at the gate-tier sinks, where it floors the decision to ask. Fail-soft, so no session context reads false. */
+export function untrustedIngestedThisTurn(): boolean {
+  if (!taintEnabled()) return false; // OPE-399 — including over a durable `true` written before the flip
+  try {
+    return readState(slot.get()).tainted;
+  } catch {
+    return false;
+  }
+}
+
+/** Would a mark here actually land? The render-time ingestion sites call this instead of hardcoding false, so a render path that ever ran in-turn shows up as an over-taint row rather than a premise nobody re-checks. It reads the slot and never creates state. */
+export function taintMarkLands(): boolean {
+  try {
+    slot.get();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * WHICH classes of source this turn ingested, for disclosure (OPE-307). Ordered first-seen,
+ * deduped, and DELIBERATELY ALLOWED TO BE EMPTY on a tainted turn — the auth-attribute seeds mark
+ * without a kind, so an empty list means "no breakdown", never "clean". Always read alongside
+ * {@link untrustedIngestedThisTurn}, never instead of it. Fail-soft: no session context → empty.
+ */
+export function taintKindsThisTurn(): readonly string[] {
+  if (!taintEnabled()) return []; // OPE-399 — no breakdown, because there is no marking to break down
+  try {
+    return readState(slot.get()).kinds ?? [];
+  } catch {
+    return [];
+  }
+}
+
+// A triggered fire renders its prompt in the ingress process, outside any turn, so the mark would no-op there. The taint is carried instead by a host-set auth attribute that the turn.started hook seeds into the per-turn slot.
+
+/** Auth attribute marking a TRIGGERED FIRE whose opening prompt carries untrusted external content.
+ *  Host-set at dispatch, model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE
+ *  PROVENANCE), and consumed by hooks/spawn-taint.ts at `turn.started`. */
+export const OE_TAINTED_FIRE_ATTR = "oe_tainted_fire";
+
+/** Positive-only: an untainted fire gets an empty bag, so nothing has to reason about a false string. The tainted flag is the caller's own judgement, and a config webhook always renders its raw body wrapped while an event fire is tainted unless the delivery was redacted. */
+export function taintedFireAttrs(tainted: boolean): Record<string, string> {
+  return tainted ? { [OE_TAINTED_FIRE_ATTR]: "true" } : {};
+}
+
+// Taint keys on ingestion, not on presence: a turn marks when a message a non-member wrote actually enters the session context. A chat wake renders outside any turn, so the carriage is the same host-set auth attribute, and this leg never routes through decideIngestion.
+
+/** Auth attribute marking a chat wake whose ingested content includes a message written by an author
+ *  the surface's identity gate could not vouch as a member. Host-set at the wake dispatch,
+ *  model-unforgeable (see channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE), and consumed by
+ *  hooks/spawn-taint.ts at `turn.started`. */
+export const OE_CHAT_NONMEMBER_ATTR = "oe_chat_nonmember";
+
+/**
+ * The attribute fragment a chat wake spreads into the woken session's auth bag. POSITIVE-ONLY, for
+ * the same reason as {@link taintedFireAttrs}: a member-only wake gets `{}`, so its bag is
+ * byte-identical to before this existed and nothing has to reason about a `"false"` string.
+ *
+ * `nonMember` is the JOIN the dispatching surface computes — see {@link nonMemberChatTrust}.
+ */
+export function nonMemberChatAttrs(nonMember: boolean): Record<string, string> {
+  return nonMember ? { [OE_CHAT_NONMEMBER_ATTR]: "true" } : {};
+}
+
+/** One ingested message, as the join reads it: the resolved per-message tier, plus the surface's
+ *  POSITIVE refutation of its author. See {@link nonMemberChatTrust} for why both are needed. */
+export interface IngestedChatMessage {
+  readonly trust?: WakeTrust;
+  /**
+   * The surface POSITIVELY refuted this author's membership — `users.info` said guest/stranger,
+   * `member.pending` said screening-incomplete, Entra said `userType: "guest"`. `false` and absent
+   * both mean "not refuted", which includes "the probe could not answer": absence of evidence is
+   * never evidence, and this leg fails OPEN.
+   */
+  readonly refuted?: boolean;
+  /** The author-trust register's answer for this message's author, which is the OPERATOR's refutation where refuted is the SURFACE's. Absent, or present on an unarmed tenant, contributes nothing: silence is never a declaration, and both directions fail open. */
+  readonly authorTrust?: AuthorTrustQuery;
+  /**
+   * THIS MESSAGE'S AUTHOR WAS NEVER GRADED (OPE-1747) — set only where that is a POSITIVE fact about the message, not a missing probe: today, a persisted session-tail row written before the row shape carried `refuted` at all (channels/session-tail.ts).
+   * 🔴 IT IS THE WITHHOLD GRAIN'S INPUT ALONE, AND THE TAINT JOIN NEVER READS IT. {@link nonMemberChatTrust} fails OPEN by design — "absence of evidence is never evidence" — so an ungraded row must not mark a turn, or every old row would start marking. `withholdsBody` (access/external-policy.ts) is the opposite question, asked by a deployment that DECLARED non-member bytes must not reach the model, and there UNKNOWN is the fail-closed answer: it withholds. Keeping the two answers on one field is what lets the shipped `taint` grain stay byte-identical while the `withhold` grain fails closed.
+   */
+  readonly ungraded?: boolean;
+}
+
+/** The wake-trust tiers that name a HUMAN author. `relay` is the machine floor and is deliberately
+ *  absent — see {@link nonMemberChatTrust}. An entry with NO tier is not on this list either, which
+ *  is what keeps the register leg from grading an author the surface never graded. */
+const HUMAN_TIERS: ReadonlySet<WakeTrust> = new Set<WakeTrust>(["principal", "peer", "unauth"]);
+
+/** Marks only on a positive refutation, never on bare unauth, which is a three-way disjunction that once made every human-authored turn on an undeclared guild mark. The two sources of refutation are the surface's verdict and the operator's register, and a relay machine author is deliberately excluded. */
+export function nonMemberChatTrust(m: IngestedChatMessage): boolean {
+  if (m.trust === "relay") return false; // machine author — below peer, but not a person outside the org
+  if (m.refuted === true) return true; // the SURFACE positively refuted this author
+  // THE REGISTER LEG (OPE-516) — the OPERATOR's refutation, for Discord and Notion, which have no
+  // surface verdict to give. It requires a POSITIVELY-HUMAN tier rather than merely "not relay":
+  // an entry the surface never graded must not be graded here either, or an ungraded machine author
+  // would start marking every turn it posts on — the always-on-bit failure, arriving by a third door.
+  if (m.authorTrust === undefined || m.trust === undefined || !HUMAN_TIERS.has(m.trust)) return false;
+  return authorRefutedByRegister(m.authorTrust);
+}
+
+/** The operator's declaration for the room a chat wake fires on, and the keys it is read at. */
+export interface ChatWakeRoom {
+  /**
+   * The DOMAIN-grain surface key of the room (`platform/tenant/surface`) — the container an operator
+   * actually declares, which is the channel rather than a thread inside it. Absent ⇒ the room leg
+   * cannot resolve and contributes nothing (fail-open, like every other carriage leg here).
+   */
+  readonly surfaceKey?: string;
+  /** The GROUP-rung key when the platform has one (Teams' `teams/<tenant>/team:<id>`). */
+  readonly groupKey?: string;
+  /**
+   * This wake is a DM or group DM. DMs are OUT of scope for the `public` tier: on a DM the trust
+   * plane asks about the PARTNER, not about the room, so a room declaration means something else
+   * there. A DM contributes NO room leg and is judged by its author leg alone.
+   */
+  readonly dm?: boolean;
+}
+
+/** A room declared public marks, a room declared internal does not, and an undeclared room follows the taint.undeclaredSurface setting, shipped clean. Undeclared is never read as public: silence means the operator has not declared, not that the room is open to the world. */
+export function chatRoomMarks(room: ChatWakeRoom): boolean {
+  if (room.dm === true || room.surfaceKey === undefined) return false;
+  const segs = room.surfaceKey.split("/");
+  if (segs.length < 3) return false; // not a surface-grain key — nothing to resolve
+  const declared = declaredSurfaceTrust({
+    tenantKey: segs.slice(0, 2).join("/"),
+    surfaceKeys: [room.surfaceKey],
+    ...(room.groupKey === undefined ? {} : { groupKey: room.groupKey }),
+  });
+  if (declared === "public") return true;
+  if (declared === "internal") return false;
+  return getSettings().taint.undeclaredSurface === "mark";
+}
+
+/** The join over one wake: the room leg, then the author leg over every ingested message. The two are additive and neither subsumes the other, because the room gates audience and the register gates authority, and an entry the surface could not grade contributes nothing. */
+export function chatWakeIngestsNonMember(ingested: readonly IngestedChatMessage[], room: ChatWakeRoom): boolean {
+  return chatRoomMarks(room) || ingested.some(nonMemberChatTrust);
+}
+
+/** Stamps the carriage onto the delivery auth when either leg says yes, returning the input auth by reference when neither does. The room argument is required rather than optional, because a call site that silently lost the room leg would lose the entire trust statement on Discord and Notion. */
+export function stampNonMemberChatAuth<A extends { attributes?: Record<string, unknown> }>(
+  auth: A,
+  ingested: readonly IngestedChatMessage[],
+  room: ChatWakeRoom,
+): A {
+  if (!chatWakeIngestsNonMember(ingested, room)) return auth;
+  return { ...auth, attributes: { ...(auth.attributes ?? {}), ...nonMemberChatAttrs(true) } };
+}

package/agent/access/taint-tiers.ts

@@ -0,0 +1,168 @@
+// The code-pinned table that decides whether reading from a source taints the turn; declaring sites reach it through access/taint-enforcement.ts.
+// Enforcement is RELAXATION-ONLY (a site that taints may stop, a site that does not never starts), the granularity is source-instance-binary, and a row whose deciding metadata is ABSENT fails closed to untrusted with `assumed: true`.
+
+/** Does the source taint the turn that reads it? */
+export type IngestionTier = "trusted" | "untrusted";
+
+/** The classes of ingestion OE has. One row of the table each — adding an ingestion site means
+ *  naming its kind here, which is the point: a new read tool cannot quietly invent its own policy. */
+export type IngestionKind =
+  /** Chat message bodies + backscroll on a conversational surface (Slack / Discord / Teams). */
+  | "chat-message"
+  /** Notion page bodies and page comments. */
+  | "notion"
+  /** Linear issue bodies and comments. */
+  | "linear"
+  /** GitHub: PR review feedback, issue bodies, diffs. */
+  | "github"
+  /** A connector / MCP tool result. */
+  | "connector"
+  /** web_fetch, web_search, browser_*. */
+  | "web"
+  /** A webhook delivery payload. */
+  | "webhook"
+  /** A routine's event body (the hydrated entity a triggered fire is about). */
+  | "routine-event"
+  /** A delegated worker's returned result. */
+  | "delegation-result"
+  /** describe_image's model-authored description + OCR of an image. */
+  | "image-description"
+  /** read_file_upload's file content. */
+  | "file-upload"
+  /** The `aws` CLI's stdout/stderr — CloudWatch log bodies, DynamoDB items, S3 listings, EC2 tags. */
+  | "aws"
+  /** A skill script's self-declared external fetch (OPE-361): a sandbox script wrapped bytes it
+   *  fetched in the stdout taint envelope, and the host (bash `toModelOutput`) routed the span
+   *  here. Unconditionally untrusted, no metadata branch — a sandbox script may only ADD taint. */
+  | "skill-declared"
+  /** The federated `search` tool's result. Unconditionally untrusted with no metadata branch: one call can federate several connectors, so no single instance's trust tier could stand for the row. */
+  | "work-search";
+
+/** What a site declares about the bytes it is ingesting. Sites pass THIS; they never inline a tier
+ *  decision. Every field beyond `kind` is a fact about the SOURCE INSTANCE, readable at read time —
+ *  never a judgement, and never anything derived from the content itself. */
+export interface IngestionSource {
+  readonly kind: IngestionKind;
+  /** GitHub: `repository.private` as the API reports it. Absent ⇒ fail-closed. */
+  readonly repoPrivate?: boolean;
+  /** Notion / Linear: the BOUND workspace's declared tier. Absent ⇒ fail-closed. */
+  readonly workspaceTrust?: "internal" | "public";
+  /** Connector / MCP: the GRANT's declared `contentOrigin` for this connection AND this tool
+   *  (reviewed config; a grant may declare per-tool exceptions). Absent ⇒ fail-closed, which is also
+   *  the ruled DEFAULT for a connection whose grant says nothing. */
+  readonly grantContentOrigin?: "internal" | "external";
+  /** Chat: the read returned at least one message whose author was POSITIVELY REFUTED as a non-member. Absent and `false` mean the same thing here and neither is fail-closed, because this is a positive refutation rather than an instance fact, and the whole author plane fails OPEN. */
+  readonly authoredByNonMember?: boolean;
+  /** A short taint-CLEAN label for the audit row — a tool or connector NAME, never content. */
+  readonly label?: string;
+}
+
+export interface IngestionVerdict {
+  readonly tier: IngestionTier;
+  readonly reason: string;
+  /** True when the deciding metadata was ABSENT and the fail-closed default decided instead. */
+  readonly assumed: boolean;
+}
+
+const untrusted = (reason: string, assumed = false): IngestionVerdict => ({ tier: "untrusted", reason, assumed });
+const trusted = (reason: string): IngestionVerdict => ({ tier: "trusted", reason, assumed: false });
+
+/** The fail-closed answer, used by every row whose deciding metadata is missing. */
+function unknownInstance(what: string): IngestionVerdict {
+  return untrusted(`${what} could not be read at ingestion time, so the source instance is unproven — fail-closed to untrusted`, true);
+}
+
+/** The table: one case per IngestionKind. Pure, with no I/O, no context and no clock, so it is testable row by row and safe to call from anywhere. */
+export function classifyIngestion(src: IngestionSource): IngestionVerdict {
+  switch (src.kind) {
+    case "chat-message":
+      // The one branch: a chat read that returned a POSITIVELY-REFUTED non-member's message taints. REFUTE-ONLY, never "not vouched" - a probe that cannot answer, an unarmed tenant and a bot author all leave it absent, and a members-only read is never marked.
+      if (src.authoredByNonMember === true) {
+        return untrusted(
+          "a chat message written by an author POSITIVELY REFUTED as a non-member — the surface's own identity probe or the operator's author-trust register said guest/stranger/unlisted, so a person outside the org authored bytes this turn read",
+        );
+      }
+      // A member-authored chat body never integrity-taints: the wake body is rendered at INGRESS outside any turn, the authors are members verified by the surface's own identity system, and an external surface is already classified by surface trust one layer up.
+      return trusted("a chat message body on a member-authored surface; external surfaces are classified by surface trust one layer up, not here");
+
+    case "notion":
+    case "linear":
+      // Follow the BOUND workspace's declared tier. An internal Notion/Linear workspace is org
+      // property with org membership — the same trust basis as a private chat channel — and taints
+      // nothing. A public workspace is a stranger's typing surface and taints.
+      if (src.workspaceTrust === "internal") return trusted(`the bound ${src.kind} workspace is declared internal — org-member-authored, same basis as a private channel`);
+      if (src.workspaceTrust === "public") return untrusted(`the bound ${src.kind} workspace is declared public — anyone can author into it`);
+      return unknownInstance(`the bound ${src.kind} workspace's declared tier`);
+
+    case "github":
+      // REPO VISIBILITY, and it is the one row whose metadata is genuinely available at read time
+      // (`repository.private` rides every API response OE already fetches). A PRIVATE org repo is
+      // org property. A PUBLIC repo takes PR bodies, review comments and diffs from anyone with a
+      // fork — that is a stranger's typing surface with extra steps, and it taints.
+      if (src.repoPrivate === true) return trusted("a private org repository — its issues, reviews and diffs are org-authored");
+      if (src.repoPrivate === false) return untrusted("a PUBLIC repository — a PR body, review comment or diff can be authored by anyone with a fork");
+      return unknownInstance("the repository's `private` flag");
+
+    case "connector":
+      // The grant declares it, per connection and optionally per tool, in reviewed config. The question is who AUTHORS the bytes rather than how the connection is reached, and silence defaults to external because it must never read as an assurance.
+      if (src.grantContentOrigin === "internal") return trusted("the connection's grant declares `contentOrigin: internal` for this tool in reviewed bundle config — org members author what it returns");
+      if (src.grantContentOrigin === "external") return untrusted("the connection's grant declares `contentOrigin: external` for this tool — the bytes it returns are authored outside the org");
+      return untrusted("the connection's grant declares no content origin — the ruled DEFAULT is external/untrusted, because silence in config must never read as an assurance", true);
+
+    case "web":
+      // No instance to classify. A fetched page, a search result and a browsed DOM are the open
+      // internet; there is no configuration under which they are not.
+      return untrusted("the open web — no bound instance, no membership, no configuration that could make it internal");
+
+    case "webhook":
+      return untrusted("a webhook delivery payload — authored by whoever can reach the endpoint");
+
+    case "routine-event":
+      return untrusted("a routine's event body — the hydrated entity an outside party's action produced");
+
+    case "delegation-result":
+      // No site declares this kind since OPE-1145; the row stays because the switch must be total and its answer is the safe one. The surviving native return leg establishes a worker's taint through a durable marker row (access/subagent-taint.ts) that fails CLOSED, which this table never consults.
+      return untrusted("a delegated worker's result — untrusted by provenance: a worker's prose distils whatever wide-hands reads it made");
+
+    case "image-description":
+      // Ratified exception to the instance-binary rule (2026-08-08): always untrusted regardless of who posted the image. The bytes are a second model's transcription of pixels nobody proof-read, so the poster's own trustworthiness says nothing about the payload.
+      return untrusted("describe_image: a second model's transcription of pixels nobody proof-read — untrusted regardless of who posted it (ratified exception to the instance-binary rule, 2026-08-08)");
+
+    case "file-upload":
+      // Always untrusted regardless of who uploaded it (ruled 2026-08-07): "a member uploaded it" is a claim about the UPLOAD, not the FILE. No metadata branch, so this row needs no uploader identity and its verdicts are exact, never `assumed`.
+      return untrusted("a file upload — always untrusted regardless of who uploaded it (ruled 2026-08-07: authorship ≠ provenance; instructions inside a file are data, never acted on)");
+
+    case "aws":
+      // Unconditionally untrusted, and a POSITIVE ruling rather than the fail-closed default, so `assumed` stays false. An AWS account is a SUBSTRATE, not an authoring surface - nothing gates who writes a log line, a table item or an object body - and a per-service branch OE cannot decide correctly would be false precision.
+      return untrusted("the `aws` CLI's own output — an AWS account is a SUBSTRATE, not an authoring surface: nothing gates who writes a log line, a table item or an object body, so org ownership of the account says nothing about who wrote the bytes");
+
+    case "skill-declared":
+      // Unconditionally untrusted with no metadata branch, and that is the security property rather than an omission: the sandbox is an untrusted execution environment, so this row has no field a sandbox-emitted envelope could set to reach `trusted`. The envelope may only ever ADD taint.
+      return untrusted("a skill script's self-declared external fetch — a sandbox script vouching for its own bytes may only ADD taint, never relax; unconditional, no metadata branch");
+
+    case "work-search":
+      // Unconditionally untrusted: one call can mix several connectors' hits in a single result, so no one instance's trust tier could stand for the whole row.
+      return untrusted("the federated search tool's result — a single call can mix several connectors' hits, so no one instance's trust tier could stand for the whole row; titles are arbitrary workspace text either way");
+  }
+}
+
+/** Every kind, for the row-by-row test and for anything that wants to enumerate the table. */
+export const INGESTION_KINDS: readonly IngestionKind[] = [
+  "chat-message",
+  "notion",
+  "linear",
+  "github",
+  "connector",
+  "web",
+  "webhook",
+  "routine-event",
+  "delegation-result",
+  "image-description",
+  "file-upload",
+  "aws",
+  "skill-declared",
+  "work-search",
+];
+
+// Within-generation compaction deliberately has no row: the summary is produced and consumed inside one generation and never crosses an ingestion seam.
+// FRAGILE POINT: any future feature that pipes a compaction summary OUT, into a memory write, a delegation brief or anything a next generation reads, creates that seam and needs its own ratified row there.