@open-everywhere/core 0.1.0

package/dist/agent/routines/fire-auth.d.ts

@@ -0,0 +1,114 @@
+import type { SessionMode } from "../access/resolver.js";
+import { type Routine } from "./routine.js";
+/**
+ * Build the auth `attributes` bag for one routine fire.
+ *
+ * @param r               the routine being fired (supplies the marker + job stamps).
+ * @param destAttributes  the resolved DispatchTarget's platform identity attributes.
+ * @param mode            the fire surface's session mode (drives the root-DM grain stamp).
+ * @param internal        the LIVE internal-trust verdict for the fire's CHANNEL — fail-closed
+ *                        `false` wherever no live check is possible (only a confirmed Slack CHANNEL
+ *                        can be positive today).
+ * @param creatorInternal the LIVE per-fire verdict on the routine's CREATOR (routines/fire-creator.ts
+ *                        recheckFireCreator). POSITIVE-ONLY: pass `true` only on a verdict this fire
+ *                        actually obtained; `undefined` (the default, and the fail-closed answer for
+ *                        every platform that cannot check) stamps nothing.
+ * @param fireId          the caller's host-minted per-fire id (OPE-626) — the same uuid it hands the
+ *                        window divert as the wake id. Omitted ⇒ the bag is byte-identical to
+ *                        before, which is what every unit call site relies on.
+ */
+export declare function routineFireAttributes(r: Routine, destAttributes: Readonly<Record<string, string>>, mode: SessionMode, internal: boolean, creatorInternal?: boolean, fireId?: string): Record<string, string>;
+/** Auth-attribute key naming the webhook a fire came from — pre-existing, lifted here so the hook's
+ *  bag is built in the SAME module as every other triggered fire's (see {@link webhookFireAttributes}). */
+export declare const WEBHOOK_MARKER_ATTR = "open_everywhere_webhook_id";
+/**
+ * Build the auth `attributes` bag for one WEBHOOK fire (webhooks/dispatch.ts) — the THIRD caller of
+ * this module, and the reason it exists (OPE-144).
+ *
+ * IT USED TO BE BUILT INLINE AND STAMPED NO GRAIN AT ALL — no {@link rootDmGrainAttrs}, no job attrs,
+ * no fire marker — while `routineFireAttributes` right here shows that a fire must stamp DELIBERATELY
+ * or `classifySessionId` reads its plain provider token as grain `native`. So a publicly-triggered,
+ * unattended webhook fire got exactly the posture a live human channel turn gets. Two things fix that,
+ * and both are needed:
+ *   • the POSITIVE grain now comes from the thread-grain window divert (routines/fire-window.ts) —
+ *     that is where a fire stops being `native` at all, and it is the load-bearing half;
+ *   • the bag itself is built HERE, beside the routine bag, so the two can never drift apart again
+ *     and a future DM-capable webhook target inherits the standing stamp for free rather than
+ *     silently re-opening the same hole.
+ *
+ * `isDm` IS REACHABLE, contrary to what the old inline code assumed: `assertWebhooksValid` checks
+ * only that the target is a three-segment `slack/…/…` key — it never inspects the id — so a
+ * `slack/T1/D_ABC` DM hook is configurable today, and the caller derives `isDm` from the id prefix
+ * (webhooks/dispatch.ts). That case is exactly why this must not stay a hand-rolled literal.
+ *
+ * HONEST LIMIT, stated rather than papered over: for a CHANNEL target this function's grain
+ * contribution is `{}`. On a deployment where the divert does not apply (delegation disarmed, or
+ * the target surface has no window) a channel webhook fire therefore still lands `native`, exactly
+ * as a clock fire on that same surface does. That is deliberate — narrowing it there would leave
+ * the fire with no hands AND no delegator (see fire-window.ts's flag-off note), which is worse
+ * than what it replaces.
+ *
+ * NO PRINCIPAL AND NO UNCONDITIONAL TRUST — and unlike a routine fire (which since OPE-269 stamps
+ * the attested creator of its stored row), a webhook fire genuinely has nobody to name: it is
+ * triggered by a remote system against a declared hook, and the hook has no creator field whose
+ * standing could be re-derived. So this bag has no principal to attest, rather than one it declines
+ * to stamp. Trust remains a positive live recheck only.
+ *
+ * 🔴 …AND "NOBODY TO NAME" IS SAID OUT LOUD (OPE-278): the bag stamps {@link FIRE_UNATTENDED_ATTR},
+ * so `bindFrom` marks the binding attributed-not-acting WITHOUT any principal to stamp. Before that
+ * marker existed, attestation could only travel as a side effect of naming a creator — so this bag,
+ * having no {@link FIRE_PRINCIPAL_ATTR}, left `principalAttested` unset and identity/binding.ts
+ * `actingPrincipalId` (`attested ? undefined : principalId`) handed back the non-empty
+ * `webhook:<hookId>` service id `webhooks/dispatch.ts` supplies. Every `if
+ * (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree — the routine-authoring class, the
+ * OPE-273 credential/config plane, the OPE-279 skill pair, both memory_admin_* — therefore PASSED
+ * on a webhook fire, exactly as the pre-OPE-269 `principalIdOf` spelling passed on a routine fire:
+ * the same defect shape, one fire family over. Measured before it was fixed, and the measurement is
+ * kept, inverted, as §webhook-limit in scripts/fire-principal-test.ts. The service id itself still
+ * rides `principalId` untouched — the audit trail's answer to WHICH HOOK fired is not the presence
+ * gates' answer to IS ANYONE HERE, and separating those two questions is the fix.
+ *
+ * @param hookId    the hook that fired (the marker the audit/telemetry join reads).
+ * @param teamId    the target's Slack team id.
+ * @param channelId the target's Slack channel id.
+ * @param isDm      is the target a DM-family surface? (a `D…` Slack channel id — see above).
+ * @param internal  the LIVE internal-trust verdict — fail-closed `false` on any failed check.
+ */
+export declare function webhookFireAttributes(hookId: string, teamId: string, channelId: string, isDm: boolean, internal: boolean): Record<string, string>;
+/** Auth-attribute key naming WHICH control-token family verified a caller
+ *  (see {@link serviceTokenFireAttributes}). */
+export declare const TOKEN_FAMILY_ATTR = "oe_token_family";
+/** The two DISJOINT control-token families (OPE-136): the READ family that admits a control read,
+ *  and the WAKE-INJECTION family that admits a test wake. A token of one family verifies against no
+ *  entry of the other, and the stamped value is how an audit reader tells the two doors apart. */
+export type ControlTokenFamily = "read" | "inject";
+/**
+ * Build the auth `attributes` bag for one CONTROL-TOKEN DOOR (control/auth.ts `serviceTokenAuth`
+ * and `injectTokenAuth`) — the FOURTH caller of this module, and the one that is NOT a fire.
+ *
+ * A bearer presented at a control route is not dispatched: it has no routine row, no hook, no
+ * platform target, and therefore no identity, grain, job or marker attributes to stamp. It is here
+ * for the single property this module owns. The door binds its verified caller as the SERVICE
+ * principal `svc:<name>`, and a non-empty service id on `principalId` is EXACTLY what OPE-278
+ * measured answering every `if (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree as if a
+ * human were acting. A token door is machine-to-machine by construction, so that answer is wrong on
+ * every call rather than on an unlucky one. {@link FIRE_UNATTENDED_ATTR} is what makes
+ * `actingPrincipalId` answer `undefined` for such a caller while `principalId` keeps `svc:<name>`
+ * for the audit trail — the same separation of "WHICH service called" from "is a human here" that
+ * the webhook fire's header describes.
+ *
+ * HONEST LIMIT, stated rather than implied: neither door hands its snapshot to an agent session
+ * today. The read route (control/read-route.ts, mounted by channels/control-read.ts) answers plain
+ * JSON GET views and reads `principalId` for its audit row alone, and the test-wake route builds
+ * the injected wake's OWN delivery attributes. The control MCP mount is a THIRD door and not this
+ * one: it authenticates through `adminAuthenticatorFromEnv` into an `AdminIdentity`, which carries
+ * no attribute bag at all, so nothing there gets this marker. No presence gate reads this bag on a
+ * live path yet. The marker is a STANDING
+ * property of the door, so a later route that does carry the snapshot inherits it instead of
+ * re-opening OPE-278 by omission. scripts/unattended-derivation-test.ts §door drives the derivation
+ * end to end and pins the marker-less bag as the failing control.
+ *
+ * @param family which of the two disjoint token families verified this caller.
+ */
+export declare function serviceTokenFireAttributes(family: ControlTokenFamily): Record<string, string>;
+//# sourceMappingURL=fire-auth.d.ts.map

package/dist/agent/routines/fire-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-auth.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-auth.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAA2F,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAErI;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,OAAO,EACV,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAChD,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,OAAO,EACjB,eAAe,CAAC,EAAE,OAAO,EACzB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6ExB;AAED;2GAC2G;AAC3G,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,OAAO,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;gDACgD;AAChD,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AAEnD;;kGAEkG;AAClG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7F"}

package/dist/agent/routines/fire-auth.js

@@ -0,0 +1,254 @@
+// fire-auth — THE one place an UNATTENDED ORIGIN's auth attributes are built. Three builders, three
+// origins: {@link routineFireAttributes} for a routine fire (clock + event fan-out),
+// {@link webhookFireAttributes} for a signed webhook fire, and {@link serviceTokenFireAttributes}
+// for a control-token door (see its own header — a door is not a fire, and it is here for the one
+// property every builder in this module stamps unconditionally, {@link FIRE_UNATTENDED_ATTR}).
+// The principal-gate lint's RULE 4 (access/principal-gate-manifest.ts) enforces the module's
+// monopoly: a session auth naming a SERVICE principal must take its bag from a builder here.
+// Extracted from schedules/dispatch.ts's `markedAuth` (OPE-143) because a
+// SECOND caller exists: the event fan-out (routines/github-fanout.ts). That caller used to build
+// its own bag by hand carrying ONLY the ROUTINE_MARKER attributes — no platform identity — so a
+// fired event routine's session bound to the fallback partition (slack/dev/default) instead of the
+// routine's real surface, and memory silo, skills, bundle, trust and spend attribution all landed
+// on the WRONG partition. There must not be two shapes; there is now one function and two callers.
+//
+// What goes in here is exactly what the clock dispatcher stamped, in the same order:
+//   1. the resolved DispatchTarget's platform identity attributes (team_id / channel_id /
+//      channel_type / chat_id / guild_id / … — whatever that platform's bindFrom mapper reads to
+//      re-derive workspace + surface + mode);
+//   2. the LIVE per-fire internal-trust verdict, positive-only (never a verdict cached at create
+//      time — a channel that goes externally-shared must stop being treated as internal);
+//   3. the root-DM grain stamp, so an autonomous fire into a 1:1 / group DM does NOT get the wide
+//      "native" hands a live human turn there would;
+//   4. the durable-JOB fire stamp (+ taint-forward) that narrows the wake's toolset;
+//   5. the ROUTINE_MARKER link the session-end outcome hook attributes ok/failed back through;
+//   6. the ATTESTED CREATOR (OPE-269) — the routine's stored `createdBy`, plus the LIVE per-fire
+//      verdict on that person's CURRENT standing;
+//   7. the UNATTENDED-ORIGIN marker (OPE-278) — UNCONDITIONAL, in every builder in this module,
+//      because attestation used to travel only as a side effect of point 6's creator id: a fire
+//      with nobody to name (a webhook hook, a creator-less row) bound its dispatcher's non-empty
+//      service principal un-attested, and satisfied every presence gate in the tree;
+//   8. the PER-FIRE ID (OPE-626) — the caller's host-minted `fireWakeId`, so the outcome fold has a
+//      per-fire latch key on the NATIVE path as well as the windowed one.
+//
+// NO FAKE USER PRINCIPAL, and no unconditional trust. Point 6 is neither: the id is the row's own
+// stored creator, and the trust half is re-derived from the platform on every single fire. What
+// this module never does is INVENT a human, or carry a verdict decided at creation time.
+//
+// ⚠️ THE OLD SHAPE, and why it was wrong (OPE-269). This header — and schedules/routine-dispatch.ts
+// — used to say a fire stamps no principal and no trust "because a routine fire has no acting human;
+// trust is a live per-fire recheck". The first clause is true; the second described a recheck that
+// was never performed. Skipping it is not neutral — binding then fell through to the fail-closed
+// default, so a DM fire bound `external` and silently lost the shared read layer the SAME person's
+// live DM gets, with no error and nothing to notice. Two further facts made the old wording
+// misleading rather than merely incomplete: a fire was never principal-LESS (it bound eve's own
+// `eve:app` schedule principal, so every "a fire has no principal" gate in the tree was inert), and
+// the recheck the comment promised is genuinely cheap. So the fire now performs it and stamps the
+// answer. Fail-closed intent is unchanged, and is now actually enforced: no positive verdict this
+// fire ⇒ no stamp ⇒ `external`.
+import { rootDmGrainAttrs } from "../channels/unified-window.js";
+import { jobFireAttrs } from "../access/job-posture.js";
+import { FIRE_PRINCIPAL_ATTR, FIRE_PRINCIPAL_TRUST_ATTR, FIRE_UNATTENDED_ATTR } from "../identity/binding.js";
+import { isJobRoutine, isRoutineModelRole, isSilentRoutine, routinePermissionKey, ROUTINE_MARKER } from "./routine.js";
+/**
+ * Build the auth `attributes` bag for one routine fire.
+ *
+ * @param r               the routine being fired (supplies the marker + job stamps).
+ * @param destAttributes  the resolved DispatchTarget's platform identity attributes.
+ * @param mode            the fire surface's session mode (drives the root-DM grain stamp).
+ * @param internal        the LIVE internal-trust verdict for the fire's CHANNEL — fail-closed
+ *                        `false` wherever no live check is possible (only a confirmed Slack CHANNEL
+ *                        can be positive today).
+ * @param creatorInternal the LIVE per-fire verdict on the routine's CREATOR (routines/fire-creator.ts
+ *                        recheckFireCreator). POSITIVE-ONLY: pass `true` only on a verdict this fire
+ *                        actually obtained; `undefined` (the default, and the fail-closed answer for
+ *                        every platform that cannot check) stamps nothing.
+ * @param fireId          the caller's host-minted per-fire id (OPE-626) — the same uuid it hands the
+ *                        window divert as the wake id. Omitted ⇒ the bag is byte-identical to
+ *                        before, which is what every unit call site relies on.
+ */
+export function routineFireAttributes(r, destAttributes, mode, internal, creatorInternal, fireId) {
+    return {
+        ...destAttributes,
+        ...(internal ? { is_ext_shared: "false", trust_checked: "true" } : {}),
+        // THE UNATTENDED-ORIGIN MARKER (OPE-278) — UNCONDITIONAL, and the unconditionality is the whole
+        // point. The attested-creator stamp below is conditional on the row HAVING a creator, and
+        // `principalAttested` used to be set only as its side effect — so a creator-less row's fire
+        // bound eve's non-empty `eve:app` schedule principal (or the fan-out's `<source>:webhook`) with
+        // no attestation, and satisfied every presence gate in the tree. This marker says "this is a
+        // fire" independently of whether the fire can name anyone, so the two can never be fused again.
+        [FIRE_UNATTENDED_ATTR]: "true",
+        // THE ATTESTED CREATOR (OPE-269) — the ONE carrier of "whose routine is this?" into the fired
+        // session, host-set off the STORED row exactly like the grant/silent/manual stamps beside it.
+        // It is what lets an unattended fire be attributed honestly (audit, spend ledger, the "asked by"
+        // line on a cost-checkpoint card the fire raises) instead of to eve's `eve:app` runtime
+        // principal — and it is deliberately paired with `principalAttested` on the binding, so no
+        // reader can pick up the identity without also learning it is not a human acting.
+        ...(r.createdBy ? { [FIRE_PRINCIPAL_ATTR]: r.createdBy } : {}),
+        // …and the LIVE standing verdict, POSITIVE-ONLY. `=== true` rather than truthiness is
+        // load-bearing: the caller obtains this by awaiting a recheck, and a dropped `await` would hand
+        // us a Promise — truthy, and it would stamp `internal` on a verdict nobody ever received. An
+        // un-awaited promise fails this test and the fire falls back to fail-closed `external`, which is
+        // exactly what an unperformed check should produce.
+        ...(creatorInternal === true ? { [FIRE_PRINCIPAL_TRUST_ATTR]: "internal" } : {}),
+        // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a routine fire builds
+        // its auth BY HAND (bypassing the per-surface buildXxxAuth builders that stamp on live
+        // ingress), so it must stamp the standing grain itself — else the fire carries a native-shaped
+        // token ⇒ classifyTokenGrain "native" ⇒ FULL wide-hands kit on an autonomous fire.
+        ...rootDmGrainAttrs(mode === "dm" || mode === "mpim"),
+        // DURABLE-JOB fire stamp (OPE-111) + the tainted-ledger forward (routines/routine.ts
+        // jobTainted). Empty (byte-identical) for every non-job routine.
+        ...jobFireAttrs(isJobRoutine(r), r.jobTainted === true),
+        [ROUTINE_MARKER.id]: r.id,
+        [ROUTINE_MARKER.surface]: r.surfaceKey,
+        [ROUTINE_MARKER.org]: r.org,
+        // STANDING-GRANT KEY (OPE-152) — the ONE carrier that makes this fire's approvals key on the
+        // ROUTINE rather than on its throwaway session. Derived from the STORED row, so it carries the
+        // row's live promptGeneration: an `edit_routine` between two fires hands the next fire a
+        // DIFFERENT key, which is how an edit invalidates every standing grant without a sweep.
+        // Host-set and model-unforgeable, like the silent/manual stamps beside it, and unconditional
+        // (see ROUTINE_MARKER.permissionKey for why a fire must never fall back to its window token).
+        [ROUTINE_MARKER.permissionKey]: routinePermissionKey(r),
+        // SILENT-FIRE stamp (OPE-149) — the ONE carrier of `report: {kind:"silent"}` into the fired
+        // session. Host-set off the STORED row and model-unforgeable, which is what makes the delivery
+        // gate (routines/report.ts ← hooks/routine-silence.ts) a structural control rather than an
+        // instruction the model could talk itself out of. Positive-only: absent for every ordinary
+        // routine, so their attribute bag is byte-identical to before. It rides the unified-window
+        // divert too — routines/fire-window.ts forwards this whole bag verbatim.
+        ...(isSilentRoutine(r) ? { [ROUTINE_MARKER.silent]: "true" } : {}),
+        // MANUAL-FIRE stamp (OPE-147) — the ONE carrier of "a human asked for this run off-schedule"
+        // (`run_routine_now` → routines/routine.ts manualRunAt) into the fired session, and from there
+        // onto the `routine.fire` join row via hooks/routine-outcome.ts. Host-set off the STORED row
+        // and model-unforgeable, exactly like the silent stamp above: the model cannot make an ordinary
+        // scheduled fire claim it was human-requested, nor hide that a run was. Positive-only, so a
+        // scheduled fire's attribute bag is byte-identical to before.
+        ...(r.manualRunAt !== undefined ? { [ROUTINE_MARKER.manual]: "true" } : {}),
+        // PER-FIRE ID (OPE-626, ROUTINE_MARKER.fire) — the latch key hooks/routine-outcome.ts folds one
+        // fire on. It rides HERE, in the bag both delivery legs carry, because the value it replaces
+        // (`oe_wake_id`) is stamped by the WINDOW DIVERT alone: a fire on the native path carried no
+        // per-fire key at all, so a native-path JOB seat — one session, many fires — folded its first
+        // fire and nothing after it. The dispatcher passes the SAME uuid it gives the divert as the wake
+        // id, so a windowed fire's latch key is unchanged and only the native path gains one.
+        //
+        // Positive-only, so a caller that supplies no id leaves the bag byte-identical.
+        ...(fireId !== undefined && fireId.length > 0 ? { [ROUTINE_MARKER.fire]: fireId } : {}),
+        // PER-ROUTINE MODEL ROLE (OPE-1627, ROUTINE_MARKER.modelRole) — the ONE carrier of the stored
+        // {@link Routine.modelRole} into the fired session, read back by model/routing.ts. Host-set off
+        // the STORED row and model-unforgeable, exactly like the silent and manual stamps above: a fire
+        // cannot talk itself onto a different model.
+        //
+        // Positive-only, and it is validated on the way OUT as well as in: a routine that names no role
+        // stamps nothing, so its bag is byte-identical to before this field existed and the router
+        // resolves the role it always did. That is what makes inheritance the default at the wire.
+        ...(isRoutineModelRole(r.modelRole) ? { [ROUTINE_MARKER.modelRole]: r.modelRole } : {}),
+    };
+}
+/** Auth-attribute key naming the webhook a fire came from — pre-existing, lifted here so the hook's
+ *  bag is built in the SAME module as every other triggered fire's (see {@link webhookFireAttributes}). */
+export const WEBHOOK_MARKER_ATTR = "open_everywhere_webhook_id";
+/**
+ * Build the auth `attributes` bag for one WEBHOOK fire (webhooks/dispatch.ts) — the THIRD caller of
+ * this module, and the reason it exists (OPE-144).
+ *
+ * IT USED TO BE BUILT INLINE AND STAMPED NO GRAIN AT ALL — no {@link rootDmGrainAttrs}, no job attrs,
+ * no fire marker — while `routineFireAttributes` right here shows that a fire must stamp DELIBERATELY
+ * or `classifySessionId` reads its plain provider token as grain `native`. So a publicly-triggered,
+ * unattended webhook fire got exactly the posture a live human channel turn gets. Two things fix that,
+ * and both are needed:
+ *   • the POSITIVE grain now comes from the thread-grain window divert (routines/fire-window.ts) —
+ *     that is where a fire stops being `native` at all, and it is the load-bearing half;
+ *   • the bag itself is built HERE, beside the routine bag, so the two can never drift apart again
+ *     and a future DM-capable webhook target inherits the standing stamp for free rather than
+ *     silently re-opening the same hole.
+ *
+ * `isDm` IS REACHABLE, contrary to what the old inline code assumed: `assertWebhooksValid` checks
+ * only that the target is a three-segment `slack/…/…` key — it never inspects the id — so a
+ * `slack/T1/D_ABC` DM hook is configurable today, and the caller derives `isDm` from the id prefix
+ * (webhooks/dispatch.ts). That case is exactly why this must not stay a hand-rolled literal.
+ *
+ * HONEST LIMIT, stated rather than papered over: for a CHANNEL target this function's grain
+ * contribution is `{}`. On a deployment where the divert does not apply (delegation disarmed, or
+ * the target surface has no window) a channel webhook fire therefore still lands `native`, exactly
+ * as a clock fire on that same surface does. That is deliberate — narrowing it there would leave
+ * the fire with no hands AND no delegator (see fire-window.ts's flag-off note), which is worse
+ * than what it replaces.
+ *
+ * NO PRINCIPAL AND NO UNCONDITIONAL TRUST — and unlike a routine fire (which since OPE-269 stamps
+ * the attested creator of its stored row), a webhook fire genuinely has nobody to name: it is
+ * triggered by a remote system against a declared hook, and the hook has no creator field whose
+ * standing could be re-derived. So this bag has no principal to attest, rather than one it declines
+ * to stamp. Trust remains a positive live recheck only.
+ *
+ * 🔴 …AND "NOBODY TO NAME" IS SAID OUT LOUD (OPE-278): the bag stamps {@link FIRE_UNATTENDED_ATTR},
+ * so `bindFrom` marks the binding attributed-not-acting WITHOUT any principal to stamp. Before that
+ * marker existed, attestation could only travel as a side effect of naming a creator — so this bag,
+ * having no {@link FIRE_PRINCIPAL_ATTR}, left `principalAttested` unset and identity/binding.ts
+ * `actingPrincipalId` (`attested ? undefined : principalId`) handed back the non-empty
+ * `webhook:<hookId>` service id `webhooks/dispatch.ts` supplies. Every `if
+ * (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree — the routine-authoring class, the
+ * OPE-273 credential/config plane, the OPE-279 skill pair, both memory_admin_* — therefore PASSED
+ * on a webhook fire, exactly as the pre-OPE-269 `principalIdOf` spelling passed on a routine fire:
+ * the same defect shape, one fire family over. Measured before it was fixed, and the measurement is
+ * kept, inverted, as §webhook-limit in scripts/fire-principal-test.ts. The service id itself still
+ * rides `principalId` untouched — the audit trail's answer to WHICH HOOK fired is not the presence
+ * gates' answer to IS ANYONE HERE, and separating those two questions is the fix.
+ *
+ * @param hookId    the hook that fired (the marker the audit/telemetry join reads).
+ * @param teamId    the target's Slack team id.
+ * @param channelId the target's Slack channel id.
+ * @param isDm      is the target a DM-family surface? (a `D…` Slack channel id — see above).
+ * @param internal  the LIVE internal-trust verdict — fail-closed `false` on any failed check.
+ */
+export function webhookFireAttributes(hookId, teamId, channelId, isDm, internal) {
+    return {
+        team_id: teamId,
+        channel_id: channelId,
+        channel_type: isDm ? "im" : "channel",
+        ...(internal ? { is_ext_shared: "false", trust_checked: "true" } : {}),
+        // The unattended-origin marker (OPE-278) — see the header: a fire with nobody to name still
+        // says it is a fire, or its service principal answers presence gates as if a human were here.
+        [FIRE_UNATTENDED_ATTR]: "true",
+        ...rootDmGrainAttrs(isDm),
+        [WEBHOOK_MARKER_ATTR]: hookId,
+    };
+}
+/** Auth-attribute key naming WHICH control-token family verified a caller
+ *  (see {@link serviceTokenFireAttributes}). */
+export const TOKEN_FAMILY_ATTR = "oe_token_family";
+/**
+ * Build the auth `attributes` bag for one CONTROL-TOKEN DOOR (control/auth.ts `serviceTokenAuth`
+ * and `injectTokenAuth`) — the FOURTH caller of this module, and the one that is NOT a fire.
+ *
+ * A bearer presented at a control route is not dispatched: it has no routine row, no hook, no
+ * platform target, and therefore no identity, grain, job or marker attributes to stamp. It is here
+ * for the single property this module owns. The door binds its verified caller as the SERVICE
+ * principal `svc:<name>`, and a non-empty service id on `principalId` is EXACTLY what OPE-278
+ * measured answering every `if (!actingPrincipalIdOf(ctx)) throw` presence gate in the tree as if a
+ * human were acting. A token door is machine-to-machine by construction, so that answer is wrong on
+ * every call rather than on an unlucky one. {@link FIRE_UNATTENDED_ATTR} is what makes
+ * `actingPrincipalId` answer `undefined` for such a caller while `principalId` keeps `svc:<name>`
+ * for the audit trail — the same separation of "WHICH service called" from "is a human here" that
+ * the webhook fire's header describes.
+ *
+ * HONEST LIMIT, stated rather than implied: neither door hands its snapshot to an agent session
+ * today. The read route (control/read-route.ts, mounted by channels/control-read.ts) answers plain
+ * JSON GET views and reads `principalId` for its audit row alone, and the test-wake route builds
+ * the injected wake's OWN delivery attributes. The control MCP mount is a THIRD door and not this
+ * one: it authenticates through `adminAuthenticatorFromEnv` into an `AdminIdentity`, which carries
+ * no attribute bag at all, so nothing there gets this marker. No presence gate reads this bag on a
+ * live path yet. The marker is a STANDING
+ * property of the door, so a later route that does carry the snapshot inherits it instead of
+ * re-opening OPE-278 by omission. scripts/unattended-derivation-test.ts §door drives the derivation
+ * end to end and pins the marker-less bag as the failing control.
+ *
+ * @param family which of the two disjoint token families verified this caller.
+ */
+export function serviceTokenFireAttributes(family) {
+    return {
+        [TOKEN_FAMILY_ATTR]: family,
+        // UNCONDITIONAL, like every other builder here — a door has nobody to name at all, so this
+        // marker is the ONLY carrier of "not a human" it can ever have.
+        [FIRE_UNATTENDED_ATTR]: "true",
+    };
+}
+//# sourceMappingURL=fire-auth.js.map

package/dist/agent/routines/fire-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-auth.js","sourceRoot":"","sources":["../../../agent/routines/fire-auth.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,qFAAqF;AACrF,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,0EAA0E;AAC1E,iGAAiG;AACjG,gGAAgG;AAChG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,EAAE;AACF,qFAAqF;AACrF,0FAA0F;AAC1F,iGAAiG;AACjG,8CAA8C;AAC9C,iGAAiG;AACjG,0FAA0F;AAC1F,kGAAkG;AAClG,qDAAqD;AACrD,qFAAqF;AACrF,+FAA+F;AAC/F,iGAAiG;AACjG,kDAAkD;AAClD,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,qFAAqF;AACrF,oGAAoG;AACpG,0EAA0E;AAC1E,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,yFAAyF;AACzF,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,4FAA4F;AAC5F,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,kGAAkG;AAClG,gCAAgC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,cAAc,EAAgB,MAAM,cAAc,CAAC;AAErI;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,CAAU,EACV,cAAgD,EAChD,IAAiB,EACjB,QAAiB,EACjB,eAAyB,EACzB,MAAe;IAEf,OAAO;QACL,GAAG,cAAc;QACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,gGAAgG;QAChG,0FAA0F;QAC1F,4FAA4F;QAC5F,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,CAAC,oBAAoB,CAAC,EAAE,MAAM;QAC9B,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,wFAAwF;QACxF,2FAA2F;QAC3F,kFAAkF;QAClF,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,sFAAsF;QACtF,gGAAgG;QAChG,6FAA6F;QAC7F,iGAAiG;QACjG,oDAAoD;QACpD,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,8FAA8F;QAC9F,uFAAuF;QACvF,+FAA+F;QAC/F,mFAAmF;QACnF,GAAG,gBAAgB,CACjB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CACjC;QACD,qFAAqF;QACrF,iEAAiE;QACjE,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC;QACvD,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE;QACzB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,UAAU;QACtC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG;QAC3B,6FAA6F;QAC7F,+FAA+F;QAC/F,yFAAyF;QACzF,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACvD,4FAA4F;QAC5F,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,yEAAyE;QACzE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,8DAA8D;QAC9D,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,iGAAiG;QACjG,sFAAsF;QACtF,EAAE;QACF,gFAAgF;QAChF,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,6CAA6C;QAC7C,EAAE;QACF,gGAAgG;QAChG,2FAA2F;QAC3F,2FAA2F;QAC3F,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED;2GAC2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,IAAa,EACb,QAAiB;IAEjB,OAAO;QACL,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACrC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,4FAA4F;QAC5F,8FAA8F;QAC9F,CAAC,oBAAoB,CAAC,EAAE,MAAM;QAC9B,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,CAAC,mBAAmB,CAAC,EAAE,MAAM;KAC9B,CAAC;AACJ,CAAC;AAED;gDACgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAOnD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,OAAO;QACL,CAAC,iBAAiB,CAAC,EAAE,MAAM;QAC3B,2FAA2F;QAC3F,gEAAgE;QAChE,CAAC,oBAAoB,CAAC,EAAE,MAAM;KAC/B,CAAC;AACJ,CAAC"}

package/dist/agent/routines/fire-carriage.d.ts

@@ -0,0 +1,37 @@
+import type { Routine } from "./routine.js";
+/** The dispatcher's side: the attribute keys it ATTACHED to this fire. */
+export declare const FIRE_ATTRS_SENT_ACTION = "routine.fire_attrs_sent";
+/** The fired session's side: the attribute keys that ARRIVED on its turn. */
+export declare const FIRE_ATTRS_SEEN_ACTION = "routine.fire_attrs_seen";
+/**
+ * DISPATCHER SIDE. Record the attribute keys this fire is being handed, BEFORE the delivery — so
+ * the row exists even when the delivery then throws and the fire is lost.
+ *
+ * `wakeId` is recorded for the window leg, where it joins the row to the wake. It is deliberately
+ * NOT the join key: a native fire carries no wake identity at all (measured — the degraded rows
+ * report `wakeId: null`), so the two rows are read as a pair on one surface within seconds.
+ */
+export declare function auditFireAttrsSent(routine: Routine, attributes: Readonly<Record<string, unknown>> | undefined, wakeId: string): Promise<void>;
+/**
+ * FIRED-SESSION SIDE. Record the attribute keys that actually arrived on this turn.
+ *
+ * ONE ROW PER TURN, and the caller decides which turns qualify — see the header for why a row count
+ * here is a turn count and not a fire count (OPE-624).
+ *
+ * 🔴 READ THE PAIR AS "WHICH SENT KEY IS MISSING HERE", NEVER AS AN EXACT SET COMPARISON. This side
+ * can legitimately carry keys the SENT row does not, because the fired session's own turn boundary
+ * writes onto the same bag: `hooks/spawn-taint.ts` writes `oe_dispatch_turn` (OPE-1467) on every
+ * turn, and `oe_parent_turn_tainted` on a tainted one. Both hooks answer `turn.started` and eve gives
+ * no ordering guarantee between hook files, so whether an extra key appears is a coin flip. A key the
+ * SENT row lists and this row does not is the carriage defect these rows exist to catch; an extra key
+ * here is not.
+ *
+ * The caller (hooks/fire-carriage.ts) supplies the partition, because resolving it needs a hook
+ * context and this module stays free of one.
+ */
+export declare function auditFireAttrsSeen(where: {
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface: string;
+}, attributes: Readonly<Record<string, unknown>> | undefined, sessionId: string | undefined): Promise<void>;
+//# sourceMappingURL=fire-carriage.d.ts.map

package/dist/agent/routines/fire-carriage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-carriage.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-carriage.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAahE;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC1F,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACzD,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/agent/routines/fire-carriage.js

@@ -0,0 +1,115 @@
+// FIRE-CARRIAGE PROBE (OPE-483) — the two rows that say which side of the session hop lost a
+// triggered fire's auth attributes.
+//
+// WHY IT EXISTS. On the deployed instance a routine fire arrives at its own tool contexts carrying
+// the dispatch target's identity attributes (`team_id` / `channel_id` / `channel_type`) and NONE of
+// the stamps routines/fire-auth.ts builds. Four controls fail together as a result: the fired
+// session binds eve's own `eve:app` schedule principal instead of the routine's attested creator,
+// `unattendedOf` reads `false`, the OPE-273 presence fence on a propose tool passes, and the seat
+// resolves grain `native` because its `oe_grain` stamp is gone too. The same tree, driven through
+// the SAME compiled schedule task on a local host, carries the bag intact — so the loss is on the
+// deployment's own session hop, not in the code that builds the bag.
+//
+// Nothing in the audit trail could tell those two sides apart, so the question "did the dispatcher
+// attach it, or did the session lose it?" had no answer short of a debugger on a serverless
+// function. These two rows answer it from one tick:
+//
+//   • {@link FIRE_ATTRS_SENT_ACTION} — written by the DISPATCHER, naming the keys it attached. ONE
+//     row per fire: the dispatcher writes it once, before the delivery.
+//   • {@link FIRE_ATTRS_SEEN_ACTION} — written by the FIRED SESSION at `turn.started`, naming the
+//     keys that arrived. ONE ROW PER SCHEDULE-AUTHED TURN of that session, which for a fire that
+//     DELEGATES is two: its own turn, and the settlement turn that runs under the same bag when the
+//     delegated work comes back (OPE-624). Delegated CHILD turns are skipped
+//     (hooks/fire-carriage.ts). So a SEEN row count is a turn count, never a fire count.
+//
+// Read them as a pair on one surface, seconds apart. SENT rich + SEEN poor ⇒ the hop drops them.
+// SENT poor ⇒ the dispatcher never attached them and the fault is upstream.
+//
+// 🔴 NAMES ONLY, NEVER VALUES. An auth attribute value can be a person's id, a workspace id or a
+// standing-grant key. {@link attributeKeyNames} returns keys and nothing else, and it is the ONLY
+// way either row is built — the same names/ids-only discipline `turn.tool_gated` and
+// `window.routing_degraded` already keep. A test asserts no value reaches a row.
+//
+// BOTH WRITERS ARE FAIL-SOFT. A probe that can fail a fire is worse than the blindness it replaces,
+// so every read sits inside the try and `appendAudit` is already best-effort by contract.
+//
+// THE SEEN SIDE KEYS ON eve's SCHEDULE AUTH, and that predicate lives in identity/binding.ts
+// (`isScheduleOriginatedAuth`) because the fail-closed attendedness floor reads it too (OPE-497).
+// Deliberately not the routine marker: the marker is exactly what can go missing, so keying on it
+// would make the probe silent in the one case worth observing.
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { routinePartition } from "./partition.js";
+/** The dispatcher's side: the attribute keys it ATTACHED to this fire. */
+export const FIRE_ATTRS_SENT_ACTION = "routine.fire_attrs_sent";
+/** The fired session's side: the attribute keys that ARRIVED on its turn. */
+export const FIRE_ATTRS_SEEN_ACTION = "routine.fire_attrs_seen";
+/**
+ * The KEY NAMES of one auth-attribute bag — sorted, so two rows compare by eye and by test without
+ * caring about insertion order.
+ *
+ * 🔴 The whole point of this function is what it does NOT return. It never reads a value, so no
+ * caller can leak one into an audit row by accident, and there is one place to check that claim.
+ */
+function attributeKeyNames(attributes) {
+    return Object.keys(attributes ?? {}).sort();
+}
+/**
+ * DISPATCHER SIDE. Record the attribute keys this fire is being handed, BEFORE the delivery — so
+ * the row exists even when the delivery then throws and the fire is lost.
+ *
+ * `wakeId` is recorded for the window leg, where it joins the row to the wake. It is deliberately
+ * NOT the join key: a native fire carries no wake identity at all (measured — the degraded rows
+ * report `wakeId: null`), so the two rows are read as a pair on one surface within seconds.
+ */
+export async function auditFireAttrsSent(routine, attributes, wakeId) {
+    try {
+        const p = routinePartition(routine);
+        const attrKeys = attributeKeyNames(attributes);
+        await appendAudit({
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            surface: p.surface,
+            action: FIRE_ATTRS_SENT_ACTION,
+            detail: { routineId: routine.id, wakeId, attrKeys: [...attrKeys], attrCount: attrKeys.length },
+        });
+    }
+    catch {
+        // Observation only — a fire must never fail because we could not describe its own auth.
+    }
+}
+/**
+ * FIRED-SESSION SIDE. Record the attribute keys that actually arrived on this turn.
+ *
+ * ONE ROW PER TURN, and the caller decides which turns qualify — see the header for why a row count
+ * here is a turn count and not a fire count (OPE-624).
+ *
+ * 🔴 READ THE PAIR AS "WHICH SENT KEY IS MISSING HERE", NEVER AS AN EXACT SET COMPARISON. This side
+ * can legitimately carry keys the SENT row does not, because the fired session's own turn boundary
+ * writes onto the same bag: `hooks/spawn-taint.ts` writes `oe_dispatch_turn` (OPE-1467) on every
+ * turn, and `oe_parent_turn_tainted` on a tainted one. Both hooks answer `turn.started` and eve gives
+ * no ordering guarantee between hook files, so whether an extra key appears is a coin flip. A key the
+ * SENT row lists and this row does not is the carriage defect these rows exist to catch; an extra key
+ * here is not.
+ *
+ * The caller (hooks/fire-carriage.ts) supplies the partition, because resolving it needs a hook
+ * context and this module stays free of one.
+ */
+export async function auditFireAttrsSeen(where, attributes, sessionId) {
+    try {
+        const attrKeys = attributeKeyNames(attributes);
+        await appendAudit({
+            org: deploymentOrg(),
+            platform: where.platform,
+            workspace: where.workspace,
+            surface: where.surface,
+            action: FIRE_ATTRS_SEEN_ACTION,
+            detail: { attrKeys: [...attrKeys], attrCount: attrKeys.length, sessionId: sessionId ?? null },
+        });
+    }
+    catch {
+        // Observation only — see the sent-side note.
+    }
+}
+//# sourceMappingURL=fire-carriage.js.map

package/dist/agent/routines/fire-carriage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-carriage.js","sourceRoot":"","sources":["../../../agent/routines/fire-carriage.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,oCAAoC;AACpC,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,qEAAqE;AACrE,EAAE;AACF,mGAAmG;AACnG,4FAA4F;AAC5F,oDAAoD;AACpD,EAAE;AACF,mGAAmG;AACnG,wEAAwE;AACxE,kGAAkG;AAClG,iGAAiG;AACjG,oGAAoG;AACpG,6EAA6E;AAC7E,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,4EAA4E;AAC5E,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,qFAAqF;AACrF,iFAAiF;AACjF,EAAE;AACF,oGAAoG;AACpG,0FAA0F;AAC1F,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,kGAAkG;AAClG,+DAA+D;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,UAAyD;IAClF,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,UAAyD,EACzD,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE;SAC/F,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA0F,EAC1F,UAAyD,EACzD,SAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,aAAa,EAAE;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC"}

package/dist/agent/routines/fire-creator.d.ts

@@ -0,0 +1,26 @@
+import type { SessionMode } from "../access/resolver.js";
+/** Is `principalId` a full internal member of `workspaceId` RIGHT NOW? Fail-closed on any doubt. */
+export type CreatorStandingCheck = (principalId: string, workspaceId?: string) => Promise<boolean>;
+/**
+ * Re-derive whether this fire's CREATOR is currently an internal member, for the one mode where the
+ * answer changes anything (a DM's shared read layer). Returns `undefined` — never `false` — when
+ * there is nothing to ask about, so a caller can tell "checked, and no" apart from "never asked"
+ * in a log; both stamp nothing, because {@link routineFireAttributes} is positive-only.
+ *
+ * @param createdBy  the routine's stored creator principal (absent on pre-OPE-152 rows and on
+ *                   anything armed without a verified sender — no id, no question to ask).
+ * @param platform   the fire's DESTINATION platform (routineReportSurfaceKey's first segment, not
+ *                   the routine's own — a redirected fire is verified where it LANDS).
+ * @param mode       the destination surface's session mode.
+ * @param workspaceId the destination workspace (Slack team id), so a Connect stranger from another
+ *                   workspace resolves external rather than passing on a bare id match.
+ */
+export declare function recheckFireCreator(input: {
+    readonly createdBy: string | undefined;
+    readonly platform: string | undefined;
+    readonly mode: SessionMode;
+    readonly workspaceId?: string;
+    /** Test seam — the live default is the Slack `users.info` composition above. */
+    readonly check?: CreatorStandingCheck;
+}): Promise<boolean | undefined>;
+//# sourceMappingURL=fire-creator.d.ts.map

package/dist/agent/routines/fire-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-creator.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-creator.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,oGAAoG;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAqBnG;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC;CACvC,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAU/B"}