@open-everywhere/core 0.1.0

package/dist/agent/identity/binding.js

@@ -0,0 +1,1050 @@
+// SurfaceBinding is the platform-agnostic identity a session runs under: each platform contributes a mapper that translates its native identity into this one shape, and the rest of the system never sees a platform-specific field.
+// Identity lives in session.auth.current.attributes, not in channel.metadata, so a mapper reads those attributes plus channel.kind and this module interprets them into mode, visibility and trust.
+import { readBindingBridge, stampBindingBridge, bridgedContext } from "./binding-bridge.js";
+import { normalizePlatform, platformFromKind } from "./platform.js";
+import { seg, deploymentOrg, ambientWorkspace, ambientSurface } from "./deployment-identity.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { declaredSurfaceTrust } from "./trust.js";
+import { UNNAMED_TENANT } from "./principal-key.js";
+import { bareTokenFromEveContext, classifySessionId, parseWindowToken, sessionGrantKeyFromToken } from "../channels/window-key.js";
+import { sourcesForWindow, decodeSources } from "../channels/window-sources.js";
+import { ROUTINE_MARKER, routinePermissionKeyStamped } from "../routines/routine.js";
+import { processRegistryMap } from "../lib/process-registry.js";
+// A LEAF import (OPE-585): access/task-wake-signal.ts reaches only `eve/context`, so it closes no
+// cycle in this module's cone — the same property access/taint-signal.ts's own leaf imports rely on.
+import { taskWakeThisTurn, uningressedTurn } from "../access/task-wake-signal.js";
+import { delegatedBindingAdopted, delegatedBindingThisTurn, delegatedSlotState } from "./delegated-binding.js";
+import { frozenSurfaceBindingFrom } from "./frozen-surface-binding.internal.js";
+/**
+ * The GROUP-rung key a mapper's {@link RawIdentity.trustGroup} contributes, or `undefined` when the
+ * mapper set nothing or set something malformed (fail-closed: no rung).
+ *
+ * SHAPE ONLY — core validates `<marker>:<id>` over the same safe charset every key segment uses and
+ * learns no vendor word. A value that would need sanitising is REFUSED rather than repaired: `seg()`
+ * would strip the colon and silently turn a group key into a surface key that could collide with a
+ * real room.
+ */
+function trustGroupKey(platform, workspace, group) {
+    const key = trustGroupKeyFor(`${platform}/${workspace}`, group);
+    return key === undefined ? undefined : { groupKey: key };
+}
+/**
+ * The same GROUP-rung key from a workspace key a caller ALREADY holds — the shape a gate reading a
+ * resolved partition has (OPE-1538: the Teams single-window privacy floor). Exported so the rung has
+ * ONE spelling: a gate that composed `${workspaceKey}/${group}` by hand would drift from the binding
+ * the moment either side's validation changed, and the two must agree or a `public` group carve-out
+ * demotes on one plane and not the other. Returns `undefined` on a malformed group, fail-closed.
+ */
+export function trustGroupKeyFor(workspaceKey, group) {
+    if (group === undefined || !/^[a-zA-Z0-9._-]+:[a-zA-Z0-9._-]+$/.test(group))
+        return undefined;
+    return `${workspaceKey}/${group}`;
+}
+/**
+ * The ENTERPRISE-rung key a mapper's {@link RawIdentity.trustEnterprise} contributes, or `undefined`
+ * when the mapper set nothing (fail-closed: no rung, so the walk reaches nothing it would not have
+ * reached before).
+ *
+ * SPELLED, NOT REFUSED — the opposite of {@link trustGroupKey}, and for a structural reason. A group
+ * key needs a colon that `seg()` would strip, so repairing it could silently turn it into a surface
+ * key; an enterprise id occupies the TENANT slot, where `seg()` is already the one spelling every
+ * other tenant id goes through. An id that cleans to nothing has no key.
+ */
+function trustEnterpriseKey(platform, enterprise) {
+    const spelled = seg(enterprise, "");
+    if (spelled.length === 0)
+        return undefined;
+    return { enterpriseKey: `${platform}/${spelled}` };
+}
+/** The one sanitiser for a platform id used as a key segment: the surface key, the memory partition, the domain roster, every audit row and a resource grant all use this spelling, and a second copy of the charset is how two of them drift apart. It is idempotent, and the 100-character clamp is its only lossy step. */
+export function surfaceKeySegment(value) {
+    return seg(value, "");
+}
+// Re-exported so this module stays the one name callers say for the deployment's org; the
+// definition lives in the leaf `deployment-identity.ts` so a boot-time caller that cannot import
+// the identity layer's graph still reads the SAME spelling (OPE-1438).
+export { deploymentOrg } from "./deployment-identity.js";
+function authOf(ctx) {
+    return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+// Auth principalId, treating empty string as absent so it falls through to a
+// platform attribute (e.g. Slack's user_id) rather than binding a blank id. Exported (OPE-645) so
+// a chat channel's `turn.started` handler — the one point in a terminal reply's lifecycle where
+// `ctx.session.auth` is still THIS turn's live delivery, not a later queued one — can snapshot the
+// same principal `bindFrom` itself falls back to, without pulling in the whole platform-mapper +
+// binding-bridge machinery `bindFrom` runs (which needs a `channel.kind` a channel event's own ctx
+// never carries).
+export function authPrincipalId(ctx) {
+    const pid = authOf(ctx)?.principalId;
+    return pid && pid.length > 0 ? pid : undefined;
+}
+function attr(a, keys) {
+    if (!a)
+        return undefined;
+    for (const k of keys) {
+        const v = a[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+        if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+            return v[0];
+    }
+    return undefined;
+}
+// These two host-set attributes carry a triggered fire's stored creator into the binding, and routines/fire-auth.ts is their only writer, off the stored row and a live per-fire recheck of that person's standing. They are attributes rather than eve's auth.principalId on purpose: the creator's id then travels together with principalAttested, so no reader picks up the identity with the flag stripped off.
+/** Host-set: the STORED creator principal an autonomous fire is bound as ({@link SurfaceBinding.principalAttested}). */
+export const FIRE_PRINCIPAL_ATTR = "oe_fire_principal";
+/** Host-set: the LIVE per-fire verdict on that creator's CURRENT standing. POSITIVE-ONLY — the only
+ *  value that means anything is the literal `"internal"`; absent/anything else is fail-closed. */
+export const FIRE_PRINCIPAL_TRUST_ATTR = "oe_fire_principal_trust";
+/** Host-set marker that a trigger produced this session and nobody is acting on it; only the literal true counts, and every fire-auth bag builder stamps it. It exists beside the creator stamp because a webhook fire or a creator-less routine row has nobody to name, and it affects the attestation flag only, never trust. */
+export const FIRE_UNATTENDED_ATTR = "oe_fire_unattended";
+/** The attested creator this delivery carries, or undefined on an ordinary (human-acting) turn. */
+function attestedFirePrincipal(ctx) {
+    const a = authOf(ctx)?.attributes;
+    const id = attr(a, [FIRE_PRINCIPAL_ATTR, "oeFirePrincipal"]);
+    if (id === undefined)
+        return undefined;
+    return { id, internal: attr(a, [FIRE_PRINCIPAL_TRUST_ATTR, "oeFirePrincipalTrust"]) === "internal" };
+}
+/** The attested creator id this delivery carries, when it carries one. Use it for AUDIT DETAIL only and never as the reply's author, because the schedule or service principal stays the actor a fired turn speaks as; it is undefined on an ordinary human turn, on a webhook fire and on a creator-less routine row, where there is genuinely nobody to name. */
+export function attestedFireCreatorId(ctx) {
+    return attestedFirePrincipal(ctx)?.id;
+}
+/** Does this delivery declare an UNATTENDED origin ({@link FIRE_UNATTENDED_ATTR})? Positive-only,
+ *  like the trust stamp: only the literal `"true"` counts, anything else reads as a live turn. */
+function unattendedOrigin(ctx) {
+    return attr(authOf(ctx)?.attributes, [FIRE_UNATTENDED_ATTR, "oeFireUnattended"]) === "true";
+}
+// eve hands every schedule handler this exact auth slot but exports it from no public entry point, so the three fields are restated here and pinned against eve's dist by the integration tier: a rename must fail loudly.
+// Attendedness fails CLOSED over three independent host-set facts, the unattended stamp, the routine marker and eve's schedule auth, and a hit on any one means nobody is acting; no live human turn can produce any of them.
+export const SCHEDULE_APP_AUTHENTICATOR = "app";
+export const SCHEDULE_APP_PRINCIPAL_ID = "eve:app";
+export const SCHEDULE_APP_PRINCIPAL_TYPE = "runtime";
+/**
+ * Was this session started by a SCHEDULE handler? Mirrors eve's own `isScheduleAppAuth` predicate —
+ * all three fields, never the attributes — so a session that merely looks app-shaped cannot answer
+ * yes, and so the answer survives a fire that arrives with an empty attribute bag.
+ */
+export function isScheduleOriginatedAuth(auth) {
+    return (auth?.authenticator === SCHEDULE_APP_AUTHENTICATOR &&
+        auth?.principalId === SCHEDULE_APP_PRINCIPAL_ID &&
+        auth?.principalType === SCHEDULE_APP_PRINCIPAL_TYPE);
+}
+/** Is a ROUTINE FIRE's own marker on this delivery? routines/fire-auth.ts is the only writer of it,
+ *  and it writes it onto nothing but a fire — so its presence alone means nobody is acting. */
+function routineMarkerDelivery(ctx) {
+    return attr(authOf(ctx)?.attributes, [ROUTINE_MARKER.id]) !== undefined;
+}
+/** THE FAIL-CLOSED ATTENDEDNESS FLOOR (OPE-497) — see the block above for why it has three arms. */
+function unattendedDelivery(ctx) {
+    return unattendedOrigin(ctx) || routineMarkerDelivery(ctx) || isScheduleOriginatedAuth(authOf(ctx));
+}
+/**
+ * The principal ACTING on this turn — `binding.principalId` unless it is merely ATTESTED, in which
+ * case there is no acting human and the answer is `undefined`.
+ *
+ * 🔴 THIS IS THE AUTHORITY FENCE (OPE-269). Call it — never `binding.principalId` — anywhere an
+ * identity is about to become a PERMISSION: admin standing (access/roles.ts), the personal
+ * connector universe (`dm:<principal>`, access/request.ts), and the "a human is in the room asking
+ * for this" gates on routine-mutating tools. `principalId` itself stays the honest answer to WHO,
+ * which is what audit rows, the spend ledger and an approval card's "asked by" line need.
+ *
+ * Deliberately a function over the binding rather than a second field: a field would be one more
+ * thing every SurfaceBinding literal has to remember to set correctly, and forgetting it would
+ * fail OPEN. This derives the answer from the flag the ONE constructor (bindFrom) sets.
+ */
+export function actingPrincipalId(binding) {
+    return binding.principalAttested ? undefined : binding.principalId;
+}
+/**
+ * IS NOBODY WATCHING THIS TURN? `true` on a routine/webhook/cron fire, `false` on a live human turn.
+ * The binding-taking form; `access/request.ts` `unattendedOf(ctx)` is the ctx-taking twin, and the
+ * pair mirrors {@link actingPrincipalId} / `actingPrincipalIdOf` deliberately.
+ *
+ * 🔴 THIS IS A SECURITY CONTROL (OPE-440). The approver chain turns `ask` into `deny` when it reads
+ * `true`, so "ask when nobody can answer" IS "deny". Every approval site derives the value through
+ * this function or its twin, and `lint:principal-gate` rule 5 refuses any other spelling — reading
+ * `binding.principalId` here would answer "a human is present" for every fire, because a fire binds
+ * as its routine's attested creator.
+ */
+export function unattendedFrom(binding) {
+    return actingPrincipalId(binding) === undefined;
+}
+// The Slack identity mapper lives in the provider-slack bundle and registers at app boot. Unregistered, a slack bind falls back to bindLocal, the fail-closed default every unregistered platform gets.
+// The Linear identity mapper lives in the provider-linear bundle and registers at app boot; its contract is surface = the TEAM (the silo grain), issue = the post-back anchor, fail-closed private visibility, demotion-only guest trust.
+// currentTurnIssue below stays in core, because the neutral entity-actions spine reads it.
+// The Teams identity mapper lives in the provider-teams bundle and registers at app boot.
+// The GitHub chat-surface identity mapper lives in the provider-github bundle and registers at app boot: workspace = owner, surface = repo, mode = channel.
+// The Discord identity mapper lives in the provider-discord bundle and registers at app boot.
+// The Notion identity mapper lives in the provider-notion bundle and registers at app boot.
+// This mapper names no workspace and no surface on purpose: carriesPlatformIdentity runs it, and a value the deployment declares about itself must never make an identity-less delivery look like it carried a surface.
+// The ambient workspace and surface are gap-fillers applied in bindFrom; the mode, visibility and trust stand-ins stay on env, because they are clamped enums rather than identifiers.
+const ENV_MODES = new Set(["channel", "dm", "mpim"]);
+const bindLocal = (ctx) => {
+    const envMode = process.env.OE_MODE;
+    const envVis = process.env.OE_VISIBILITY;
+    const envTrust = process.env.OE_TRUST; // dev/test override for the memory gate
+    return {
+        workspace: undefined,
+        surface: undefined,
+        // OPE-1867: UNDEFINED when the operator declared nothing, rather than the old blind "channel".
+        // The effective mode is unchanged — bindFrom's own `?? "channel"` tail supplies it — but the
+        // binding can now say the value was GAP-FILLED. Declaring `OE_MODE` is a resolution: the
+        // operator answered for the surface, which is exactly what a mapper does.
+        mode: envMode && ENV_MODES.has(envMode) ? envMode : undefined,
+        visibility: envVis === "private" ? "private" : "public",
+        // Only honour OE_TRUST when explicitly set; otherwise leave undefined so bindFrom's
+        // platform-aware default applies (internal for local, external for unknown platforms).
+        trust: envTrust === "external" ? "external" : envTrust === "internal" ? "internal" : undefined,
+        principalId: authPrincipalId(ctx) ?? process.env.OE_PRINCIPAL,
+        target: undefined,
+    };
+};
+// The mapper registry is process-global, not module-private: a provider may register from one module identity while bindFrom reads from another. A missing mapper falls back to bindLocal, fail closed and silent, so a split registry looks exactly like an uninstalled platform; local is the hardcoded fallback and never a registry key.
+const MAPPERS = processRegistryMap("identity-mappers.v1");
+/** Register or replace one platform's identity mapper. A provider bundle calls this once at boot, so adding a platform needs no downstream change. */
+export function registerIdentityMapper(platform, mapper) {
+    if (!admitProviderRegistration(platform, "identity-mapper"))
+        return;
+    MAPPERS.set(platform, mapper);
+}
+/**
+ * Every platform that has REGISTERED a mapper, sorted. Read by `lint:surface-parity` to hold the
+ * §7.1 identity-mapper row to what the bundles actually registered. Distinct from asking `bindFrom`
+ * about a platform, which answers for every string by falling back to `bindLocal`.
+ */
+export function registeredIdentityMapperPlatforms() {
+    return [...MAPPERS.keys()].sort();
+}
+/**
+ * Resolve the full surface binding from runtime context. Platform is `channel.kind`
+ * (the channel's `kindHint`, e.g. "slack") or OE_PLATFORM, defaulting to
+ * "local". The platform's mapper supplies identity; anything it leaves undefined
+ * falls back to env stand-ins, then to stable defaults (so the key stays constant
+ * across `eve dev` runs and cross-session recall is testable today).
+ */
+/** eve exposes a channel kind in two forms: the bare platform inside tool and step contexts, and a namespaced channel:slack inside lifecycle and hook contexts. Every kind comparison goes through platformFromKind, because a raw equality check silently fails in hook contexts; that bug shipped once, as the identity line falling back to generic. */
+/** eve derives a session's kind from the channel file's slug, not from its kindHint, so a platform served by a file not named after it binds as the slug and misses the mapper registry (measured 2026-07-06: gateway sessions bound as discord-gateway). Alias every such channel file in identity/platform.ts. */
+// An eve subagent child runs this bundle, but eve replaces its adapter, so its channel kind is subagent and it inherits the PARENT's whole auth attribute bag: every inherited host stamp describes the parent, not the child.
+// Three host-set discriminators identify a child, the typed session.parent, the channel kind and the subagent continuation token, and the predicate ORs them because each surface exposes a different subset; a false negative leaves a child on the parent's grain, wake identity and delegation route.
+/** eve's framework channel kind for a built-in/declared subagent child (`FRAMEWORK_CHANNEL_KINDS`). */
+export const SUBAGENT_CHANNEL_KIND = "subagent";
+/** The PARENT session id eve's typed linkage names, or undefined on a root run. Read through a local
+ *  cast (the {@link currentTurnId} precedent) so no eve type reaches this module. */
+export function subagentParentSessionId(ctx) {
+    const id = ctx.session?.parent?.sessionId;
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/** The seat a delegated worker was spawned from: eve's rootSessionId, or the immediate parent.sessionId when the linkage names no root. A verb whose effect belongs to the CONVERSATION keys on this and not on currentSessionId, which names the one-shot run that ends before a person answers; it reads eve's typed session.parent only, never the continuation token, whose greedy subagent parse yields a scope key that names no session. */
+export function delegationRootSessionId(ctx) {
+    try {
+        const parent = ctx.session?.parent;
+        const root = parent?.rootSessionId;
+        if (typeof root === "string" && root.length > 0)
+            return root;
+        return subagentParentSessionId(ctx);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Is THIS context an eve-minted SUBAGENT CHILD run (built-in `agent` or a declared subagent)?
+ * See the block above for the three discriminators and why the OR is the safe shape. PURE and
+ * fail-soft — never throws, so it is callable from every gate that must narrow on it.
+ */
+export function isSubagentChildContext(ctx) {
+    try {
+        if (subagentParentSessionId(ctx) !== undefined)
+            return true;
+        // RAW kind, deliberately not channelPlatform — that function RESOLVES a subagent context to its
+        // parent's origin platform (that is its job below), so asking it here would always answer "slack".
+        // Same reasoning as isUnifiedWindowContext's raw read.
+        if (platformFromKind(ctx.channel?.kind) === SUBAGENT_CHANNEL_KIND)
+            return true;
+        return classifySessionId(ctx.channel?.continuationToken).kind === "subagent";
+    }
+    catch {
+        return false;
+    }
+}
+export function channelPlatform(ctx) {
+    // A subagent child takes an origin hop: eve copies the parent's whole auth bag, so reading the inherited platform stamp resolves the PARENT's mapper against the PARENT's attributes and the two bindings come out identical, which is the invariant hooks/egress.ts enforces because the child shares the parent's sandbox.
+    // Fail-closed with no stamp (no mapper, then bindLocal), and this arm runs BEFORE the unified arm, so a child of a non-unified session that carries the stamp is healed too.
+    if (platformFromKind(ctx.channel?.kind) === SUBAGENT_CHANNEL_KIND) {
+        const delegated = delegatedBindingThisTurn(currentTurnId(ctx));
+        if (delegated !== undefined)
+            return normalizePlatform(delegated.platform);
+        const inherited = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+        return inherited ? normalizePlatform(inherited) : SUBAGENT_CHANNEL_KIND;
+    }
+    const kind = platformFromKind(ctx.channel?.kind ?? process.env.OE_PLATFORM);
+    // SINGLE-WINDOW unified sessions (channels/unified.ts): the channel is synthetic — the REAL
+    // platform is per-DELIVERY, stamped into the auth attributes by the surface's diversion
+    // (channels/unified-window.ts stampUnifiedWindowAuth). Resolving it here means every
+    // downstream consumer (the MAPPERS registry, partitions, capabilities) sees the ORIGINATING
+    // surface exactly as it would on that surface's own channel — the auth attributes ARE that
+    // surface's own capture. Fail-closed: no stamp → "unified" (no mapper → bindLocal → the
+    // env-stand-in partition, same as any unknown kind — never a guessed platform). Unreachable
+    // when the feature is off (no unified channel session exists), so flag-off is byte-identical.
+    if (kind === "unified") {
+        const stamped = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+        return stamped ? normalizePlatform(stamped) : kind;
+    }
+    return kind;
+}
+/** Is this context a session on the synthetic single-window `unified` channel (channels/
+ *  unified.ts)? Checks the RAW kind — deliberately NOT {@link channelPlatform}, which resolves a
+ *  unified session to its per-delivery ORIGIN platform (that is its job). Used by the reply
+ *  tool to select its map-addressed unified variant. */
+export function isUnifiedWindowContext(ctx) {
+    return platformFromKind(ctx.channel?.kind) === "unified";
+}
+/**
+ * The origin surface of the delivery driving this turn, resolvable from a tool-execute context, which carries no channel object at all, so every gate written against ctx.channel answers undefined inside an execute.
+ * The three arms weaken in order: channelPlatform, the per-delivery platform stamp, then bindFrom. local is not an origin and reports undefined, which a caller treats as a REFUSAL, never as a pass.
+ */
+export function turnOriginPlatform(ctx) {
+    const live = channelPlatform(ctx);
+    if (live !== undefined)
+        return live;
+    const stamped = attr(authOf(ctx)?.attributes, ["oe_platform", "oePlatform"]);
+    if (stamped)
+        return normalizePlatform(stamped);
+    const bound = bindFrom(ctx).platform;
+    return bound === "local" ? undefined : bound;
+}
+/**
+ * The wake id of the delivery driving THIS turn (the `oe_wake_id` auth stamp
+ * channels/unified-window.ts writes). eve rewrites `session.auth.current` from each delivery's
+ * auth and coalesces a multi-delivery turn to the LAST delivery's auth, so this is the current
+ * turn's wake — the authority fence the single-window reply tool validates against so a model
+ * can't target a wakeId from a prior turn or another conversation.
+ *
+ * THIS IS THE TURN'S ADDRESS, and three classes of turn are refused one here rather than at each of
+ * the many consumers: a subagent child (OPE-393), a background-task settlement that has read a
+ * terminal view (OPE-585 — it answers under the TASK's own id), and a settlement that has read none
+ * (OPE-597 — it answers `undefined`). Undefined off the single-window path too (no stamp). */
+export function currentWakeId(ctx) {
+    // 🔴 A SUBAGENT CHILD HAS NO WAKE IDENTITY (OPE-393). MEASURED 2026-08-11: the child's auth bag
+    // carries the PARENT's `oe_wake_id` byte-identically (its `turn.tool_gated` audit rows were stamped
+    // with the parent's wakeId), so a child holding `reply` held a VALID address into the human's live
+    // thread — it could speak into a conversation that never asked it anything, bypassing the seat's
+    // fold-in entirely. A child's output has exactly one legitimate route: the subagent-result leg back
+    // to its parent.
+    //
+    // NEUTRALISED AT THE SOURCE rather than at each consumer, because the consumers are many and the
+    // fail directions are already right: `reply` refuses (resolveAnswerableReplyTarget cannot resolve a
+    // target from `undefined`), `no_reply`/`react`/`complete_thread`/`spawn_*` degrade
+    // to "no wake", and every audit row writes `wakeId: null`. One neutralisation, no consumer left to
+    // forget. {@link currentTurnAddressing} / {@link currentTurnAddressed} are neutralised the same way
+    // just below — the addressing stamp is the other half of the same inherited claim.
+    if (isSubagentChildContext(ctx))
+        return undefined;
+    // 🔴 A BACKGROUND-TASK SETTLEMENT WAKE HAS NO STAMP OF ITS OWN (OPE-585). MEASURED 2026-08-15:
+    // eve wakes the delegating parent through the session's own command hook with NO auth
+    // (`wakeTaskParentStep`), and eve writes the turn's auth only when a delivery brings one — so the
+    // task-woken turn inherits the PREVIOUS wake's `oe_wake_id` and holds a live address into
+    // whichever conversation happened to run last. The settlement edge installs the task's OWN
+    // host-minted wake id (channels/task-wake.ts), and it wins here, at the source, for the same
+    // reason the subagent-child neutralisation above is at the source: the consumers are many.
+    //
+    // TURN-SCOPED, so the override cannot outlive the turn that adopted it — the slot refuses to
+    // answer for any turn but the one stamped into it, and an unreadable turn id answers `undefined`,
+    // which falls straight through to the inherited stamp (the pre-OPE-585 behaviour).
+    const turnId = currentTurnId(ctx);
+    const adopted = taskWakeThisTurn(turnId);
+    if (adopted !== undefined)
+        return adopted;
+    // A turn that meets no settlement edge holds no address of its own: it kept the previous delivery's wake id and could reply into a conversation that asked nothing, so the honest answer is none. Every consumer then refuses or throws an instructive error, except the question bridge, which drops a worker's question with an audit row and no model-visible error.
+    if (uningressedTurn(turnId))
+        return undefined;
+    return inheritedWakeStampOf(ctx);
+}
+/**
+ * The RAW `oe_wake_id` auth stamp, with every override in {@link currentWakeId} bypassed.
+ *
+ * Two callers, both of which want the stamp as a FACT rather than as an address:
+ *   • the `unified.task_wake` audit row's `inheritedWakeId` field — the stale id the turn would
+ *     otherwise have replied under, which is what makes the defect countable after the fix;
+ *   • {@link deliveryStampOf}, as its fallback.
+ *
+ * 🔴 NEVER USE THIS TO ADDRESS A REPLY. It is exactly the value OPE-393, OPE-585 and OPE-597 each
+ * decided a turn may not speak under; {@link currentWakeId} is the only reader that answers that
+ * question.
+ *
+ * 🔴 ONE READER USES IT TO NAME, NEVER TO POST (OPE-1869), and the distinction is the whole licence.
+ * `hooks/spawn-taint.ts` offers this stamp as a delegated read's SECOND provenance address, because
+ * the seat REPLIES under it while the settling turn answers under the task's own minted wake. It is
+ * not a post target there and it is not trusted on sight: `channels/delegated-provenance.ts`
+ * `delegatedSecondAddress` reads both wake rows back and admits the stamp only where they resolve to
+ * the same conversation — which is what keeps OPE-585's "whichever conversation ran last" out.
+ */
+export function inheritedWakeStampOf(ctx) {
+    return attr(authOf(ctx)?.attributes, ["oe_wake_id", "oeWakeId"]);
+}
+/** The per-delivery discriminator the turn boundary compares: a value byte-identical to the previous turn's proves this turn brought no delivery of its own. It falls back to the raw wake stamp for a bag written before the nonce existed, and it stays pure and override-free, because the boundary must read what eve delivered rather than what a later edge installed. */
+export function deliveryStampOf(ctx) {
+    return attr(authOf(ctx)?.attributes, ["oe_delivery_id", "oeDeliveryId"]) ?? inheritedWakeStampOf(ctx);
+}
+/** The eve turn id, read off the session handle rather than the auth bag. It is turn-constant, and undefined outside an active turn compares unequal to any stored id, so the same-turn re-accept fence fails closed; it is present on tool and hook callback contexts but ABSENT on the step.started resolver context, where a caller falls back to the resolver event's own turnId field. */
+export function currentTurnId(ctx) {
+    const turn = ctx.session?.turn;
+    return typeof turn?.id === "string" && turn.id.length > 0 ? turn.id : undefined;
+}
+/** This session's own durable id; sessionId is a defensive fallback that no measured eve context uses. Pair it with currentTurnId for a unique key, because eve mints turn ids as turn_0, turn_1 and so on, so two warm sessions collide on turn number alone. */
+export function currentSessionId(ctx) {
+    const session = ctx.session;
+    const id = session?.id;
+    if (typeof id === "string" && id.length > 0)
+        return id;
+    const legacy = session?.sessionId;
+    return typeof legacy === "string" && legacy.length > 0 ? legacy : undefined;
+}
+/**
+ * The BARE window token of the session THIS delivery woke (the host-set `oe_window_token` stamp,
+ * channels/unified-window.ts OE_WINDOW_TOKEN_ATTR — stamped by divertToUnifiedWindow on every
+ * delivery). The FALLBACK identity channel for `ctx.channel.continuationToken`, which is
+ * session-static and can be ABSENT at tool-execute time on a resumed seat (the live-found
+ * 2026-07-16 refusal on a legitimate standing window) — per-wake auth attributes are fresh on
+ * every delivery, exactly like the oe_grain stamp that survived the same turn. Host-set only,
+ * unforgeable (§AUTH-ATTRIBUTE PROVENANCE, channels/unified-window.ts); the stamp names the
+ * DISPATCHED-TO session (a task worker's stamp is its task
+ * token), so grain/recursion classification over it stays truthful. Undefined off the
+ * single-window path (no stamp).
+ */
+export function currentWindowToken(ctx) {
+    return attr(authOf(ctx)?.attributes, ["oe_window_token", "oeWindowToken"]);
+}
+/**
+ * The bare session/window token THIS turn runs under — the key a per-session "Approve for session"
+ * memo is stored/consulted under (OPE-53 pr.open, OPE-11 connector writes). Prefers the live
+ * continuation token (namespace-stripped), falling back to the host-set window-token stamp
+ * ({@link currentWindowToken}) — `ctx.channel` can be blank at tool-execute on a resumed seat.
+ * Undefined ⇒ the turn's session can't be identified, so session-approval is simply never
+ * offered/consulted for it (safe: a card is always minted). Shared by open_pull_request.ts's
+ * propose path so the key is derived identically wherever it is consulted.
+ *
+ * TASK-grain wakes collapse to their PARENT window ({@link sessionGrantKeyFromToken}): on the
+ * unified topology every wake runs in a spawned task session whose token embeds the wakeId, so
+ * keying the memo on the raw token made every wake a different "session" and a grant could never
+ * be seen again (live-caught 2026-07-25: S-PR-SESSION leg 2 drew a fresh card on a granted window).
+ * The conversation the human granted is the WINDOW; the task is plumbing.
+ */
+export function proposingSessionId(ctx) {
+    // A ROUTINE FIRE keys on the ROUTINE, not on the throwaway session it happens to run in
+    // (OPE-152). This ONE swap is the whole run-time half: every consult site and the click path's
+    // memo write already read this function (or the frozen `sessionId` it produced), so a grant a
+    // human gives an unattended flow outlives the fire, and the next fire finds it. The key is
+    // host-set on the fire's auth bag off the STORED row (routines/fire-auth.ts), so it carries the
+    // routine's live generation — and an `edit_routine` therefore hands the next fire a different
+    // key, invalidating the whole standing set with no sweep.
+    const routineKey = routinePermissionKeyStamped(authOf(ctx)?.attributes);
+    if (routineKey !== undefined)
+        return routineKey;
+    // A native subagent child keys its PARENT's session-approval memo deliberately: delegating a piece of the work must not escape a card the human declined, nor ask them again for one they approved, and one memo means a revoke takes both sides back at once.
+    // The arm is explicit because a hook context would otherwise key a different memo than a tool context; a dispatched task worker is a separate session and still asks its own cards.
+    if (isSubagentChildContext(ctx)) {
+        const inherited = currentWindowToken(ctx);
+        if (inherited !== undefined)
+            return sessionGrantKeyFromToken(inherited);
+    }
+    const raw = ctx.channel?.continuationToken;
+    const token = bareTokenFromEveContext(raw) ?? currentWindowToken(ctx);
+    return token === undefined ? undefined : sessionGrantKeyFromToken(token);
+}
+/**
+ * The ADDRESSING of the delivery driving THIS turn (`oe_addressing`, written by
+ * channels/unified-window.ts stampUnifiedWindowAuth ONLY for an addressed `direct-mention` wake).
+ * It marks the wake as OWED a reply, which is what the envelope tells the seat. It is NOT a delivery
+ * path: since OPE-1982 the unified channel's completion handler drops a turn's closing prose on EVERY
+ * addressing and re-drives it once towards the `reply` tool, so it no longer selects a route.
+ * 🔴 IT IS STILL LOAD-BEARING IN THREE PLACES, and reading it as audit-only is how a later change
+ * moves a tool gate without noticing: it classifies the drop row's `addressing` field (an owed
+ * answer nobody received stays countable apart from ambient chatter); `hooks/job-posture.ts` reads
+ * `direct-mention` as a HUMAN PRINCIPAL in the turn, which feeds the job-session tool restriction;
+ * and `access/analytics-scope.ts`'s `isAmbientNonAddressedTurn` degrades analytics rows mode to
+ * aggregates without it. Undefined off the single-window path or for a non-addressed (watch) wake.
+ */
+export function currentTurnAddressing(ctx) {
+    // A SUBAGENT CHILD inherits this stamp verbatim too (OPE-393) — see {@link currentWakeId}. Nobody
+    // addressed the child; a brief was handed to it. Neutralised for the same reason and in the same
+    // direction: every consumer treats absence as "ambient / no requestor", which is the narrower
+    // answer (connector disclosure's leg 2 stops running, the job hook stops reading a human into the
+    // room, the analytics ambient test is unreachable at `task` grain).
+    if (isSubagentChildContext(ctx))
+        return undefined;
+    return attr(authOf(ctx)?.attributes, ["oe_addressing", "oeAddressing"]);
+}
+/**
+ * Was the delivery driving THIS turn ADDRESSED to the agent (a `direct`/addressed wake — @mention,
+ * DM, or a surface's name-drop), as opposed to a judged/ambient/channel-watch wake? Reads the
+ * host-set `oe_addressed` auth stamp a surface dispatch writes on its direct wakes (identity/
+ * bot-name.ts OE_ADDRESSED_ATTR), OR the single-window `oe_addressing="direct-mention"`/`"direct"`
+ * stamp (stampUnifiedWindowAuth) which already means addressed.
+ *
+ * 🔴 AUTHORITATIVE AND FAIL-CLOSED. This is the signal the link-claim hook gates its relaxed
+ * `link <code>` recognition on (hooks/link-claim.ts): an addressed single-author body may carry a
+ * leading address token, a judged multi-author ENVELOPE may not (that is the F1 attack surface). The
+ * stamp is HOST-SET (§AUTH-ATTRIBUTE PROVENANCE, channels/unified-window.ts) — a model or untrusted
+ * body cannot forge it — and a MISSING stamp reads as NOT addressed ⇒ the strict whole-message anchor
+ * applies ⇒ nothing regresses on a surface that has not (yet) stamped it.
+ */
+export function currentTurnAddressed(ctx) {
+    // The third inherited addressing claim (OPE-393) — `oe_addressed` rides the same verbatim copy.
+    // A child was never addressed by anyone, and this stamp's one consumer (hooks/link-claim.ts) uses
+    // it to RELAX a recogniser, so answering false is the fail-closed direction.
+    if (isSubagentChildContext(ctx))
+        return false;
+    const a = authOf(ctx)?.attributes;
+    const flag = attr(a, ["oe_addressed", "oeAddressed"]);
+    if (flag !== undefined)
+        return flag === "1" || flag.toLowerCase() === "true";
+    const addressing = attr(a, ["oe_addressing", "oeAddressing"]);
+    return addressing === "direct-mention" || addressing === "direct";
+}
+/** The platform-resolved integration name stamped on THIS delivery's auth (identity/bot-name.ts
+ *  OE_BOT_NAME_ATTR), when a surface with a live integration name set it (Notion). Feeds the
+ *  addressed link-claim recogniser's name-token set so a name-drop that matches the deployment's
+ *  ACTUAL integration name is stripped even without OE_AGENT_* configured. Undefined ⇒ the recogniser
+ *  falls back to the env/brand tokens only. */
+export function currentTurnBotName(ctx) {
+    return attr(authOf(ctx)?.attributes, ["oe_bot_name", "oeBotName"]);
+}
+/**
+ * The Linear ISSUE the delivery driving THIS turn is anchored to (`issue_id`, falling back to
+ * `issue_identifier`) — the authoritative per-wake issue the surface's identity capture stowed
+ * (channels/linear-identity.ts buildLinearAuth), the SAME source the Linear supervisor's turn.started
+ * reply-target snapshot reads. This is the DEFAULT issue for read_linear_issue: unlike Notion (whose
+ * binding.surface IS the page being read), a Linear session's `surface` is the TEAM (the silo grain,
+ * see bindLinear) — the CONTAINER, not the entity — so `bindFrom(ctx).surface` is the wrong default
+ * (it would fetch a team id as an issue). The issue lives in the auth attributes, not `surface`;
+ * reading it here is the authoritative anchor, NOT a guess derived from the team. Undefined when no
+ * issue was stamped (e.g. a unified turn whose stamp omits it) ⇒ the tool requires an explicit arg.
+ */
+export function currentTurnIssue(ctx) {
+    return attr(authOf(ctx)?.attributes, ["issue_id", "issueId", "issue_identifier", "issueIdentifier"]);
+}
+/**
+ * The Notion PAGE the delivery driving THIS turn is anchored to — `page_id`, the raw per-wake stamp
+ * the surface's identity capture stows (channels/notion-identity.ts, whose `pageId` is "the page the
+ * comment lives on").
+ *
+ * 🔴 THE RAW ATTRIBUTE, NOT `bindFrom(ctx).surface`, AND THE DIFFERENCE IS THE POINT. A Notion
+ * session's `surface` IS the page, but it is the SANITIZED partition segment — `seg()`-passed, and
+ * defaulted to a placeholder on an under-identified event — so it is a partition key, not an id you
+ * can compare against one a Notion API call returned. `channels/read-reach.ts` compares exactly that
+ * way, to decide whether a record's id already appeared in the room, so it needs the id the host
+ * stamped. Undefined on every turn woken somewhere other than a Notion page.
+ */
+export function currentTurnPage(ctx) {
+    return attr(authOf(ctx)?.attributes, ["page_id", "pageId"]);
+}
+/** The raw Linear organization id off this turn's auth attributes: the credential SELECTOR a Linear tool call needs, because a Linear token is workspace-scoped and the exact organization id is the registry key. It is deliberately not the binding's sanitized workspace segment, and it is undefined when this turn stamped no organization, where the caller falls back to the org-free credential chain. */
+export function currentTurnOrganization(ctx) {
+    return attr(authOf(ctx)?.attributes, ["organization_id", "organizationId"]);
+}
+/**
+ * The GitHub issue/PR the delivery driving THIS turn is anchored to — owner + repo + exactly one of
+ * issue/PR number, read off THIS turn's RAW auth attributes rather than a stored session-open
+ * snapshot, so a unified session's per-delivery GitHub turn resolves its OWN anchor (mirrors
+ * {@link currentTurnIssue}'s Linear counterpart). Reads the same attributes bindGitHub interprets,
+ * but DIRECTLY (not via the resolved binding.target) so it stays CORE-SELF-CONTAINED after the
+ * github chat-surface mapper moved into @open-everywhere/provider-github (OPE-114 stage 4): the
+ * githubEntityAdapter / SCM plane stay in core and must not depend on a bundle registration. The
+ * platform gate is kind-derived (bindFrom's platform comes from the channel kind, not the mapper).
+ * Undefined when this turn isn't a GitHub delivery, or the webhook carried no owner/repo/number —
+ * the caller (entity-ref default resolution) then requires an explicit ref rather than guessing.
+ */
+export function currentTurnGithubTarget(ctx) {
+    // Kind-derived platform gate (channelPlatform resolves the originating surface from the channel
+    // kind — or the unified-window oe_platform stamp — WITHOUT the mapper registry), so this stays
+    // core-self-contained regardless of whether the github bundle's mapper is registered.
+    if (channelPlatform(ctx) !== "github")
+        return undefined;
+    const a = authOf(ctx)?.attributes;
+    const owner = attr(a, ["owner"]);
+    const repo = attr(a, ["repo"]);
+    if (!owner || !repo)
+        return undefined;
+    // Anchor selection mirrors the GitHub mapper, and exactly one anchor is emitted.
+    const conversationKind = attr(a, ["conversation_kind", "conversationKind"]);
+    const issueNumber = attr(a, ["issue_number", "issueNumber"]);
+    const pullRequestNumber = attr(a, ["pull_request_number", "pullRequestNumber"]);
+    const isPrKind = conversationKind === "pull_request" || conversationKind === "review_thread";
+    if (isPrKind && pullRequestNumber)
+        return { owner, repo, number: Number(pullRequestNumber), isPr: true };
+    if (issueNumber)
+        return { owner, repo, number: Number(issueNumber), isPr: false };
+    if (pullRequestNumber)
+        return { owner, repo, number: Number(pullRequestNumber), isPr: true };
+    return undefined;
+}
+/**
+ * Per-turn surface fence for a per-surface read tool, called inside execute: a cross-surface session carries turns from several surfaces while the session.started mount gate saw only the opener's origin, so this requires THIS turn's origin to equal the tool's surface and throws on anything else.
+ * It fails closed hard: a turn whose origin cannot be named at all is refused, never waved through.
+ */
+/** OPE-732 — thrown by {@link assertTurnSurface}. Lets the five async call sites distinguish this
+ *  fence's refusal from any other thrown Error (without parsing message text) and audit it before
+ *  rethrowing. `assertTurnSurface` itself stays PURE and synchronous — no store access, no signature
+ *  change — the audit write happens at each async caller. Deliberately no `.name` override: `String(err)`
+ *  stays "Error: …", so every existing message-regex `assert.throws` assertion is unaffected. */
+export class TurnOriginFenceError extends Error {
+    surface;
+    constructor(message, surface) {
+        super(message);
+        this.surface = surface;
+    }
+}
+export function assertTurnSurface(ctx, surface) {
+    const origin = turnOriginPlatform(ctx);
+    if (origin === surface)
+        return;
+    throw new TurnOriginFenceError(origin === undefined
+        ? `this tool reads ${surface}, but this turn's origin surface could not be resolved — a per-surface read only runs on a turn this deployment can place on ${surface}.`
+        : `this tool reads ${surface}, but the message that woke this turn came from ${origin} — ` +
+            `on a cross-surface session a per-surface read tool only runs on a turn from its OWN surface (what you can recall across surfaces is the shared context, not another surface's live reads).`, surface);
+}
+/** Classify a raw continuation token's grain from its shape alone (the BACKSTOP signal). Delegates to
+ *  the ONE typed codec {@link classifySessionId} (channels/window-key.ts) — which strips eve's
+ *  `unified:<raw>` send-prefix, tests task (`t/`) + thread-seat (`s/`) window tokens BEFORE the
+ *  standing `:oe-sup:g` suffix, and fail-softs a non-string / unrecognised token to "native" (full
+ *  hands, the pre-gate default). Byte-identical to the former inline classifier (task→task,
+ *  thread-seat→thread, window/container-supervisor→standing, else→native), pinned by
+ *  scripts/session-id-codec-test.ts. A thread-seat token still fails CLOSED to `thread` (narrow),
+ *  never `task`, so a lost `oe_grain` stamp cannot re-widen a thread seat. */
+function classifyTokenGrain(token) {
+    return classifySessionId(token).grain;
+}
+/**
+ * The grain the HOST STAMPED on this delivery, unreconciled, or `undefined` when no stamp reads as a grain.
+ *
+ * 🔴 IT IS NOT {@link windowGrainOf}, AND THE DIFFERENCE IS THE POINT. On a DELEGATED CHILD, `windowGrainOf`
+ * answers `task` by the subagent-child override, while eve copies the PARENT's whole auth bag into the child —
+ * so the stamp there describes the SEAT the worker was spawned from, and this is the one reader of that fact.
+ * A caller asking what THIS session's own hands are takes `windowGrainOf` and never this: the reconciliation
+ * below (the spoof/bug guard) is exactly what this function skips.
+ *
+ * Host-set and model-unreachable (channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE). An unrecognised value
+ * answers `undefined` rather than a guess, so a caller must state what it does with an unreadable stamp.
+ */
+export function stampedWindowGrainOf(ctx) {
+    const stamped = attr(authOf(ctx)?.attributes, ["oe_grain", "oeGrain"]);
+    return stamped === "standing" || stamped === "task" || stamped === "native" || stamped === "thread" ? stamped : undefined;
+}
+/**
+ * The grain of THIS session. PRIMARY = the host-stamped `oe_grain` auth attribute
+ * (channels/unified-window.ts stampUnifiedWindowAuth / channels/unified.ts dispatchTaskWindow) — set
+ * by OE host code at dispatch, never model-authored, so it is unforgeable and stable for the session's
+ * life (verified + source-cited ONCE in channels/unified-window.ts §AUTH-ATTRIBUTE PROVENANCE). BACKSTOP = {@link classifyTokenGrain} (the token shape). PURE — a function of the stamp and the
+ * token only (no eve, no store) — so each grain is mint-and-assert testable, exactly as §S3 requires.
+ *
+ * SPOOF/BUG guard, fail-CLOSED to NARROW: if the stamp claims a FULL grain (task/native) while the
+ * token independently classifies a NARROWER grain, the wider claim LOSES. A stamped task grain on a
+ * non-task token is a bug, not a capability grant.
+ *
+ * The one deliberate exception is the DEGRADATION case: a blank/unreadable token (the known
+ * session.started degradation, §S3 fragile point) is NOT a positive narrow signal — it is the ABSENCE
+ * of the token, so the stamp stays primary (a legit async worker whose `t/` token degraded keeps its
+ * `task` grain). This is why the guard distinguishes an ABSENT/blank token (stamp wins) from a token
+ * that is PRESENT and positively classifies `native` (a real `cse_…` @mention seat — a `task` stamp
+ * there is a bug/forge, since a legit worker always rides a `t/` token — so it is narrowed). Closes the
+ * T2 asymmetry the adversarial review flagged (F2): `task` on a present native token no longer keeps
+ * wide hands, WITHOUT regressing the degraded-worker path (blank token).
+ */
+export function windowGrainOf(ctx) {
+    // A subagent child is task grain, overriding any inherited grain stamp: measured, a child of a standing seat resolved standing and was stripped to the conversational roster.
+    // It sits FIRST, above the stamp-versus-token reconciliation, because neither the stamp nor the token describes this session; task hands are not a widening, because the child is credentialed identically to its parent and holds no delegation route and no wake identity.
+    if (isSubagentChildContext(ctx))
+        return "task";
+    const rawToken = ctx.channel?.continuationToken;
+    const stamped = stampedWindowGrainOf(ctx);
+    const tokenGrain = classifyTokenGrain(rawToken);
+    // A token is a POSITIVE signal only when it is actually present; a non-string/empty token is the
+    // degradation sentinel (classifyTokenGrain also returns "native" for it), where the stamp stays primary.
+    const tokenPresent = typeof rawToken === "string" && rawToken.length > 0;
+    if (stamped !== undefined) {
+        // SPOOF/BUG guard, fail-CLOSED to NARROW: a stamp claiming a grain WIDER than the token positively
+        // shows LOSES. ORIGINAL (Stage-C, preserved byte-identical): a task/native stamp on a positively-
+        // STANDING token → standing. EXTENDED (Stage T2): a `task` stamp (the sole wide-hands grain) on a
+        // positively-narrow THREAD-seat token → thread; and (F2) on a PRESENT native token → native — a
+        // forged/buggy wide stamp never re-widens a narrow seat. A blank token (tokenPresent === false)
+        // takes none of these branches, so the stamp stays primary for the degraded legit worker.
+        if ((stamped === "task" || stamped === "native") && tokenGrain === "standing")
+            return "standing";
+        if (stamped === "task" && tokenGrain === "thread")
+            return "thread";
+        if (stamped === "task" && tokenGrain === "native" && tokenPresent)
+            return "native";
+        return stamped;
+    }
+    return tokenGrain;
+}
+/**
+ * The short WORKER TASK LABEL stamped on a task-window worker's OPENING delivery (OPE-508, the reply
+ * display-name/prefix TIER signal) — a PURE read of the `oe_task_label` auth attribute, mirroring
+ * {@link windowGrainOf}'s attribute-read style but with no token-shape backstop (there is no text to
+ * recover from a token — only the host stamp carries it). Undefined on every non-worker turn, and on
+ * a worker turn woken by a LATER message in its own thread (the stamp is not re-derived on a resumed
+ * wake, unlike `oe_grain` — see channels/unified-window.ts's OE_TASK_LABEL_ATTR header). Callers that
+ * need a bracket on every worker turn regardless fall back to a generic label when this is undefined
+ * — see channels/turn-delivery.ts's {@link ReplierLabel}-producing `replierLabelFor`.
+ */
+export function windowTaskLabelOf(ctx) {
+    return attr(authOf(ctx)?.attributes, ["oe_task_label"]);
+}
+/** The sources vector stamped on THIS delivery: a pure read of the host-set stamp, with no config and no store. Undefined when the stamp is absent, on a normal non-unified session or a resumed pre-stamp session, and the caller then picks the fallback. */
+export function windowSourcesOf(ctx) {
+    const a = authOf(ctx)?.attributes;
+    if (!a)
+        return undefined;
+    const decoded = decodeSources(a["oe_sources"] ?? a["oeSources"]);
+    return decoded.length > 0 ? decoded : undefined;
+}
+/** The sources vector for this session, fail-closed: the host stamp first, then a recompute from the continuation token's window and domain plus the domain config, then the single origin platform, never empty and never a wider set. domains is injected so the resolver stays pure and testable. */
+export function resolveWindowSources(ctx, domains) {
+    const stamped = windowSourcesOf(ctx);
+    if (stamped)
+        return stamped;
+    // Both fallbacks have to work inside an execute, where ctx.channel is absent: the window-token stamp stands in for the continuation token, and turnOriginPlatform for the origin. A resolver context carries both, so resolve-time behaviour is unchanged; eve namespaces a window-channel send with a unified prefix, so strip it before parsing the token.
+    const tok = ctx.channel?.continuationToken ?? currentWindowToken(ctx);
+    const raw = typeof tok === "string" && tok.startsWith("unified:") ? tok.slice("unified:".length) : tok;
+    const key = parseWindowToken(raw);
+    if (key) {
+        const recomputed = sourcesForWindow(key.windowId, key.domain, domains);
+        if (recomputed.length > 0)
+            return recomputed;
+    }
+    const origin = turnOriginPlatform(ctx);
+    return origin ? [origin] : [];
+}
+/** Resolve a bridged, identity-less context through the same platform hop the live path uses. That heals a stamped raw channel slug and adds the unified-to-origin hop, so the bridged fallback binds the REAL origin surface instead of unified, which resolved no mapper and desynced memory writes from reads on the very channel the bridge exists to keep in sync. */
+export function bindBridged(bridged) {
+    const bctx = bridgedContext(bridged);
+    const platform = seg(channelPlatform(bctx), "local");
+    const raw = (MAPPERS.get(platform) ?? bindLocal)(bctx);
+    return { platform, raw };
+}
+/**
+ * The platform + {@link RawIdentity} a LIVE context resolves through the mapper registry — the first
+ * hop of {@link bindFrom}, factored out so {@link carriesPlatformIdentity} answers "does this
+ * context carry a platform identity?" with the SAME two lines that ask it. Normalizing the kind (see
+ * {@link channelPlatform}) is what makes the mapper registry match in BOTH forms: without it the
+ * hook path resolves no mapper and fails closed to `external`, desyncing memory READS (hook) from
+ * WRITES (tool) on the very same internal channel. (`seg` would turn the ":" into "-", so the strip
+ * happens BEFORE the sanitize.)
+ */
+function rawIdentityFrom(ctx) {
+    const platform = seg(channelPlatform(ctx), "local");
+    return { platform, raw: (MAPPERS.get(platform) ?? bindLocal)(ctx) };
+}
+/**
+ * Does this context carry a PLATFORM IDENTITY of its own — a workspace or a surface its platform
+ * mapper can read off the delivered auth attributes?
+ *
+ * This is the exact question {@link bindFrom}'s bridged fallback asks, exported because it is also
+ * the question {@link refreshBindingStamp} asks on both sides of its downgrade test.
+ * A bag can be non-empty and still answer FALSE: the OE window stamps (`oe_platform`, `oe_wake_id`,
+ * `oe_grain`, `oe_window_token`, `oe_sources`) are host metadata about the delivery, not the
+ * platform's own identity attributes (Slack's `team_id`/`channel_id`, Discord's `guild_id`, …).
+ */
+export function carriesPlatformIdentity(ctx) {
+    return namesASurface(rawIdentityFrom(ctx).raw);
+}
+/** Did a mapper resolve either half of a surface address off this identity? The ONE spelling of the
+ *  test — {@link bindFrom}'s bridged-fallback trigger, {@link carriesPlatformIdentity} and
+ *  {@link refreshBindingStamp}'s downgrade test all read it, so the three cannot drift apart. */
+function namesASurface(raw) {
+    return raw.workspace !== undefined || raw.surface !== undefined;
+}
+/** The one production entry point for the binding bridge. A stamp that names a surface may not be replaced by a context that names none, but the rule is a DOWNGRADE test only: the same bag carries a fire's attested creator and unattended marker, and refusing an identity-less fire's write would hand its tool contexts an ATTENDED reading. */
+export function refreshBindingStamp(ctx) {
+    if (!carriesPlatformIdentity(ctx)) {
+        const established = readBindingBridge();
+        if (established !== null && namesASurface(bindBridged(established).raw))
+            return "kept";
+    }
+    stampBindingBridge(ctx);
+    return "stamped";
+}
+// The bridge is a session-scoped slot and eve gives a native subagent child a NEW durable session, so a child inherits the delivery's auth bag and nothing else; the heal writes the platform's own attributes back onto that bag, and it rides the four eve dist facts that scripts/native-subagent-test.ts section D9 pins.
+// It may never copy a host stamp of either prefix: a stale wake id is the cross-conversation address that was refused three times, and a stale routine marker would widen a live seat to the fire posture.
+/** The two prefixes every HOST-set auth stamp uses. The heal copies neither — see the block above. */
+const HOST_STAMP_PREFIXES = ["oe_", "open_everywhere_"];
+/**
+ * Write the session's established platform identity back onto THIS delivery's auth attributes, so a subagent child's verbatim inherited copy sees the identity the seat already binds.
+ * It can only restore, never escalate: it runs only when the delivery names no surface, writes only keys the bag lacks, repeats bindFrom's cross-platform fence, and derives its answer from a read-back, so a frozen or cloned bag reports unwritable rather than a false healed.
+ */
+export function healDeliveryIdentity(ctx) {
+    try {
+        if (carriesPlatformIdentity(ctx))
+            return "not-needed";
+        const bridged = readBindingBridge();
+        if (bridged === null)
+            return "no-stamp";
+        const hop = bindBridged(bridged);
+        if (!namesASurface(hop.raw))
+            return "no-stamp";
+        const platform = seg(channelPlatform(ctx), "local");
+        if (MAPPERS.get(platform) !== undefined && hop.platform !== platform)
+            return "cross-platform";
+        const auth = authOf(ctx);
+        if (auth === null)
+            return "no-delivery";
+        if (auth.attributes === undefined)
+            auth.attributes = {};
+        const bag = auth.attributes;
+        for (const [key, value] of Object.entries(bridged.attributes)) {
+            if (HOST_STAMP_PREFIXES.some((p) => key.startsWith(p)))
+                continue;
+            if (bag[key] !== undefined)
+                continue;
+            bag[key] = value;
+        }
+        // THE READ-BACK, not a count of assignments: it asks the question the caller actually has.
+        return carriesPlatformIdentity(ctx) ? "healed" : "unwritable";
+    }
+    catch {
+        return "unwritable";
+    }
+}
+/**
+ * The fail-closed backstop for a child that lost its parent's binding: the heal depends on a mutation of an eve-owned object surviving into the child, and a release that freezes or clones the bag takes it away silently, leaving the child on the org-default partition with no grants and the wrong memory partition.
+ * Narrow on purpose: true only when the inherited platform stamp resolves a REGISTERED mapper and the child still names no surface, so eve dev, evals and unit contexts can never trip it.
+ */
+export function subagentBindingLost(ctx) {
+    try {
+        if (!isSubagentChildContext(ctx))
+            return false;
+        if (delegatedBindingThisTurn(currentTurnId(ctx)) !== undefined)
+            return false;
+        if (MAPPERS.get(seg(channelPlatform(ctx), "local")) === undefined)
+            return false;
+        if (carriesPlatformIdentity(ctx))
+            return false;
+        const bridged = readBindingBridge();
+        return bridged === null || !namesASurface(bindBridged(bridged).raw);
+    }
+    catch {
+        return false; // fail-soft: an unreadable context must not kill a session on a guess
+    }
+}
+/**
+ * Does {@link bindFrom} answer this context with the `subagent/…/unresolved` sentinel, and why?
+ * `undefined` for every context that is not a delegated child, or that holds its dispatch binding.
+ * `no-context` is the eve-context-scope class (OPE-2106): the slot holds the binding, but the caller
+ * runs outside eve's context and cannot read it. `empty` is a child whose slot holds nothing.
+ */
+export function delegatedBindingUnresolved(ctx) {
+    try {
+        if (!isSubagentChildContext(ctx))
+            return undefined;
+        if (delegatedBindingThisTurn(currentTurnId(ctx)) !== undefined)
+            return undefined;
+        const state = delegatedSlotState();
+        return state === "adopted" ? undefined : state;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function bindFrom(ctx) {
+    // An internal continuation (today, an approval decision wake) carries the exact binding frozen
+    // from the wake that proposed the action. Its rendered trigger is system-authored and its live
+    // auth intentionally carries no clicker's platform identity, so the ordinary mapper road would
+    // otherwise fall through to the ambient/env stand-in. Admit only the strict host stamp, on the
+    // synthetic unified channel, for this deployment and the same stamped origin platform.
+    if (isUnifiedWindowContext(ctx)) {
+        const frozen = frozenSurfaceBindingFrom(ctx);
+        if (frozen !== undefined && frozen.org === deploymentOrg() && normalizePlatform(frozen.platform) === channelPlatform(ctx))
+            return frozen;
+    }
+    // A delayed native child can start after a sibling surface has replaced the standing seat's
+    // current auth. Its dispatch wake is the authority: hooks/binding-bridge.ts restores that
+    // host-captured binding before any worker tool or access resolver runs. The child session is
+    // dedicated to that dispatch; approval/input resumes remain under the same authority.
+    if (isSubagentChildContext(ctx)) {
+        const delegated = delegatedBindingThisTurn(currentTurnId(ctx));
+        if (delegated !== undefined)
+            return delegated;
+        // Until the async lifecycle hook resolves the durable dispatch snapshot, a native child has no
+        // surface authority. Never let an earlier hook consume Eve's launch-time auth: on a shared seat
+        // it may belong to a later sibling wake. The sentinel also answers a caller that runs outside
+        // eve's context scope, where the slot cannot be read (see delegatedBindingUnresolved).
+        if (!delegatedBindingAdopted()) {
+            return {
+                org: deploymentOrg(),
+                platform: "subagent",
+                workspace: UNNAMED_TENANT,
+                surface: "unresolved",
+                // No `modeResolved` (OPE-1867), deliberately: this sentinel names no real conversation, so
+                // `channel` is the fail-closed default and never a classification. A report must not
+                // publish `subagent//unresolved` as a room on the strength of it.
+                mode: "channel",
+                visibility: "private",
+                trust: "external",
+            };
+        }
+    }
+    let { platform, raw } = rawIdentityFrom(ctx);
+    // The attested creator of a triggered fire (OPE-269), read BEFORE the bridged fallback and
+    // re-read from the bridge below — a fire whose tool contexts arrive identity-less must not lose
+    // its creator (it would silently fall back to eve's `eve:app` schedule principal, which is the
+    // pre-OPE-269 behaviour this exists to replace).
+    let fire = attestedFirePrincipal(ctx);
+    // The unattended-origin marker (OPE-278) — read alongside the creator stamp, from the same bag,
+    // for the same reason: a fire whose tool contexts arrive identity-less must not lose it (the
+    // fallback would silently hand its non-empty service id back to every presence gate). Since
+    // OPE-497 the read is the three-armed FAIL-CLOSED floor, so the loss of one attribute — or of the
+    // whole bag — can no longer answer "a human is present".
+    let unattended = unattendedDelivery(ctx);
+    // Identity-less context (no platform ids at all — tool contexts of send()-created
+    // sessions arrive like this in prod): fall back to the identity a hook of THIS
+    // session stamped, instead of silently binding the env-default "dev" partition.
+    // See identity/binding-bridge.ts. Real contexts (mention path, hooks) never trigger
+    // this — their mapper resolves at least a workspace or surface.
+    if (!namesASurface(raw)) {
+        const bridged = readBindingBridge();
+        if (bridged) {
+            const hop = bindBridged(bridged);
+            // 🔴 THE CROSS-PLATFORM FENCE (OPE-603). A standing window seat can serve SEVERAL platforms at
+            // once (a cross-surface domain), so "the identity this session last established" is only the
+            // right answer when this delivery names the SAME platform. The delivery names it in its own
+            // `oe_platform` stamp, which is host-set and unforgeable, so the test is cheap and honest.
+            // It applies ONLY when the live context resolved a REGISTERED platform: the classic bridged
+            // case — a `send()`-created session whose tool context carries no stamp at all — resolves the
+            // synthetic "unified"/"subagent" kind, which has no mapper, and it must still bridge (that is
+            // the whole reason the bridge exists). A genuine mismatch refuses the hop and falls to the env
+            // stand-in, i.e. fail-closed to `external` — never a neighbouring surface's grants.
+            if (MAPPERS.get(platform) === undefined || hop.platform === platform) {
+                ({ platform, raw } = hop);
+                // The bridge stamps the whole attribute bag verbatim, so the fire stamps ride it — and they
+                // ride TOGETHER, which is what keeps a bridged fire attested rather than fail-open. The
+                // unattended marker takes the identical ride: same bag, same verbatim carriage — and the
+                // bridge carries `authenticator` too (OPE-497), so the schedule-auth arm of the floor below
+                // survives the reconstitution rather than being the one arm a bridged fire loses.
+                fire ??= attestedFirePrincipal(bridgedContext(bridged));
+                unattended ||= unattendedDelivery(bridgedContext(bridged));
+                console.warn(`[open-everywhere:binding-bridge] context carried no platform identity — bound via the session's stamped ${platform} identity`);
+            }
+        }
+    }
+    const local = bindLocal(ctx); // gap-filler for missing fields
+    // OPE-1867 — THE MODE, AND WHETHER ANYTHING ACTUALLY RESOLVED IT. `resolvedMode` is undefined
+    // exactly when neither the platform mapper nor an `OE_MODE` declaration could classify this
+    // conversation; `mode` then gap-fills `channel` so every reader keeps a usable value, and
+    // `modeResolved` is what lets the one reader that PUBLISHES a surface refuse the default.
+    const resolvedMode = raw.mode ?? local.mode;
+    const mode = resolvedMode ?? "channel";
+    // Resolve the storage keys up-front (same derivation as memory/partition.ts) so the
+    // per-surface trust allowlist can be consulted against the EXACT key it'll be filed
+    // under. A workspace-level vouch (`<platform>/<workspace>`) covers every surface under
+    // it; a surface-level vouch narrows to one. See identity/trust.ts.
+    // The fallback literal is identity/principal-key.ts's UNNAMED_TENANT, imported rather than
+    // re-typed: the principal composer REFUSES that exact string as a tenant rung (OPE-309), so the
+    // two spellings must not be able to drift apart.
+    // The deployment's declared AMBIENT room is the last rung before the built-in defaults, and it
+    // is read HERE rather than in `bindLocal` on purpose (OPE-1545): a value the deployment declares
+    // about itself fills a gap, and must never make an identity-less delivery look like it carried a
+    // surface — see the bindLocal header, and `carriesPlatformIdentity` below it.
+    const workspace = seg(raw.workspace ?? ambientWorkspace(), UNNAMED_TENANT);
+    const surface = seg(raw.surface ?? ambientSurface(), "default");
+    // The DOMAIN grain, resolved here (not only at the return below) because a declaration written on
+    // the CONTAINER — the Discord channel a thread lives in, the Teams channel a conversation belongs
+    // to — must reach the room inside it. Raw surface first: an exact declaration on the room itself
+    // always beats one on its container.
+    const domainSurfaceSeg = raw.domainSurface ? seg(raw.domainSurface, surface) : undefined;
+    const declared = declaredSurfaceTrust({
+        tenantKey: `${platform}/${workspace}`,
+        surfaceKeys: domainSurfaceSeg !== undefined && domainSurfaceSeg !== surface
+            ? [`${platform}/${workspace}/${surface}`, `${platform}/${workspace}/${domainSurfaceSeg}`]
+            : [`${platform}/${workspace}/${surface}`],
+        ...(trustGroupKey(platform, workspace, raw.trustGroup) ?? {}),
+        ...(trustEnterpriseKey(platform, raw.trustEnterprise) ?? {}),
+    });
+    const vouched = declared === "internal" ? "internal" : undefined;
+    // The operator's public declaration sits ABOVE the mapper because it maps to external, the floor: it can only lower, so it is safe by construction, and the matching internal promotion stays BELOW the mapper, so uncertainty never resolves up.
+    // DMs and group DMs are out of scope, because there trust asks whether the PARTNER is internal; a public declaration leaves vouched undefined and the DM gate fails the partner closed.
+    const declaredExternal = mode === "channel" && declared === "public" ? "external" : undefined;
+    // The LIVE per-fire verdict on a triggered fire's attested creator (OPE-269) — POSITIVE-ONLY, so
+    // it can only ever raise a surface that would otherwise fail closed, never demote one the mapper
+    // positively verified. That ordering is why a CHANNEL fire is untouched by this: its mapper
+    // verdict (`trust_checked`/`is_ext_shared`, stamped by the dispatcher's own live
+    // conversations.info recheck) is already positive, so it wins on the left.
+    const fireTrust = fire?.internal === true ? "internal" : undefined;
+    // Trust precedence, and the DEMOTE-ABOVE / PROMOTE-BELOW asymmetry is the whole of it:
+    //   1. the operator's `public` DECLARATION (a demotion to the floor — can only ever lower);
+    //   2. the platform mapper's own verdict (a real membership check, or a positively-external
+    //      Slack channel that must STAY external);
+    //   3. the fire's live creator recheck;
+    //   4. this deploy's per-surface `internal` declaration (a PROMOTION — "deny by default,
+    //      allow-list exceptions", and it must stay below the mapper);
+    //   5. the blanket OE_TRUST env;
+    //   6. a platform-aware default — `internal` for local/dev (so memory works under `eve dev` and
+    //      tests), `external` for any real platform (FAIL CLOSED on the gate).
+    let trust = declaredExternal ?? raw.trust ?? fireTrust ?? vouched ?? local.trust ?? (platform === "local" ? "internal" : "external");
+    // For a DM, trust means is the DM PARTNER an internal member, because it selects the DM's shared read layer.
+    // A mapper's positive verification, an explicit vouch of this DM's key, a blanket OE_TRUST of internal, or a fire whose creator was re-verified internal THIS FIRE are honoured; anything else fails closed to external, and the per-user DB silo is granted regardless.
+    if (mode === "dm" &&
+        platform !== "local" &&
+        process.env.OE_TRUST !== "internal" &&
+        !raw.trustVerified &&
+        vouched !== "internal" &&
+        fire?.internal !== true) {
+        trust = "external";
+    }
+    return {
+        // Tenant: deployment-level today (env), a per-request lookup when hosted. See the
+        // SurfaceBinding.org doc for why this isn't a per-platform mapper concern.
+        org: deploymentOrg(),
+        platform,
+        workspace,
+        surface,
+        // Domain/spend grain (see the field doc): sanitized like `surface` (it builds scope
+        // keys). Only surfaced when the mapper actually resolved one AND it differs from the
+        // surface itself — a degenerate equal value would just be noise for consumers.
+        domainSurface: domainSurfaceSeg !== undefined && domainSurfaceSeg !== surface ? domainSurfaceSeg : undefined,
+        mode,
+        // Spread conditionally, like every other optional field on this object: an unresolved mode
+        // omits the key rather than carrying an explicit `undefined`, so a deep-equal over a binding
+        // does not start seeing a new key on a surface nothing classified.
+        ...(resolvedMode === undefined ? {} : { modeResolved: true }),
+        visibility: raw.visibility ?? local.visibility ?? "public",
+        trust,
+        // The operator's declaration, BEFORE the join above folded it in behind the mapper. Spread
+        // conditionally so an undeclared room omits the key entirely rather than carrying an explicit
+        // `undefined` — every other optional field on this object does the same, and a deep-equal over a
+        // binding must not start seeing a new key on a deployment that declared nothing.
+        ...(declared === undefined ? {} : { declaredTrust: declared }),
+        // The attested creator WINS over the mapper (OPE-269). It has to: on a fire the mapper reads
+        // eve's schedule principal off the auth slot (`eve:app`, channel/schedule-auth.js) and that is a
+        // non-empty string, so a lower-precedence stamp would never be reached. The pairing with
+        // `principalAttested` below is what makes this safe — see that field's doc.
+        principalId: fire?.id ?? raw.principalId ?? local.principalId,
+        // ATTESTED on an attested-creator fire — and on ANY unattended origin (OPE-278), even one with
+        // nobody to name. The webhook fire's `webhook:<hookId>` (and a creator-less row's `eve:app`)
+        // stays on `principalId` for audit/provenance; what the marker removes is only its ability to
+        // answer "is a human here, acting" — actingPrincipalId returns undefined for both.
+        ...(fire || unattended ? { principalAttested: true } : {}),
+        target: raw.target,
+        // Not seg()-sanitized: a thread ts ("1234.5678") is a Slack API parameter, never a
+        // storage path segment, and it comes from the platform's own verified event payload.
+        threadTs: raw.threadTs,
+        // Not seg()-sanitized either, and for a stricter reason than threadTs: this key must equal, byte
+        // for byte, the key the platform's own ingress passed to markThreadEngaged. A repaired value
+        // would address a row that no wake gate ever reads.
+        engagementKey: raw.engagementKey,
+        // The ROOM-grain opt-in (OPE-1511). It carries the platform's own raw room id for the audit
+        // trail; the room row's ADDRESS is never taken from here but derived from the partition
+        // (`channels/engagement.ts` roomEngagementAddress), so the wake that writes the row and the
+        // stop that marks it cannot drift apart on two spellings of one id.
+        roomEngagementKey: raw.roomEngagementKey,
+        // Not seg()-sanitized, for the same reason: must equal, byte for byte, the real message id a
+        // reaction event carries (turnAnchorKey matches on it exactly).
+        anchorMessageId: raw.anchorMessageId,
+        // Not seg()-sanitized, for the same reason again: the stop trigger names the platform's own raw
+        // container id, and `turnChannelKey` matches on it exactly.
+        anchorChannelId: raw.anchorChannelId,
+    };
+}
+//# sourceMappingURL=binding.js.map