@open-everywhere/core 0.1.0

package/dist/agent/routines/fire-creator.js

@@ -0,0 +1,78 @@
+// fire-creator — THE live per-fire recheck of a routine CREATOR's current standing (OPE-269).
+//
+// WHY A RECHECK AND NOT A STORED VERDICT. A routine outlives the turn that armed it, often by
+// months. Freezing "this person was an internal member" at creation is the same
+// re-open-the-leak mistake identity/binding.ts warns about for channels: someone leaves the org, is
+// downgraded to a guest, or moves to another workspace, and a stamp written last March keeps
+// vouching for them. So nothing about standing is stored — the answer is re-derived from the
+// platform on EVERY fire, with the same staleness bound a live inbound turn accepts (the bundle's
+// own users.info TTL cache), and the fire's memory layer follows the answer immediately.
+//
+// WHY IT MATTERS AT ALL. Before this, the dispatcher skipped the check instead of performing it, so
+// binding fell through to the fail-closed default: a DM fire bound `external` and resolved the
+// `public` criteria domain rather than `dm` (memory/resolve.ts). On a deployment with a live `dm`
+// domain and no `public` one — the shipped shape — that is not "slightly less context", it is the
+// shared read layer silently resolving to nothing. Same personal silo, no org brain, no error.
+//
+// THE SHAPE OF "CANNOT CHECK". Only a Slack DM can be positively verified today, through the same
+// `users.info` answer a live DM's own partner check reads (channels/slack-bridge.ts — core composes
+// it from the bridge rather than reaching into the bundle, so an unregistered Slack provider fails
+// closed to `external` exactly like every other unbridged call). Discord / Teams have no
+// membership-verification gate even on their INBOUND paths, so their fires stamp nothing and bind
+// `external` — which is precisely what a live human turn on those surfaces gets. This module never
+// guesses: the absence of a positive answer IS the answer.
+//
+// A CHANNEL fire does not consult this. Its trust comes from the channel's own live
+// conversations.info recheck (schedules/dispatch.ts `confirmInternal`), which is already positive
+// and already wins; asking about the creator too would be a second network read that could not
+// change the verdict.
+import { bridgePartnerFactsFromInfo, bridgeSlackForm } from "../channels/slack-bridge.js";
+/**
+ * The live default, Slack-only: `users.info` on the creator, read through the SAME fail-closed
+ * verdict function a live DM's partner check uses (`partnerFactsFromInfo` — guest, stranger,
+ * deleted, bot, or a different team all resolve `external`).
+ *
+ * Fail-soft AND fail-closed, which are different things and both required: a thrown lookup must not
+ * take the tick down (fail-soft), and its absence must not read as a pass (fail-closed) — so every
+ * error path returns `false`, never a rethrow and never a default of `true`.
+ */
+const liveCreatorStanding = async (principalId, workspaceId) => {
+    try {
+        const info = await bridgeSlackForm("users.info", new URLSearchParams({ user: principalId }).toString());
+        if (!info)
+            return false; // no Slack provider registered / no bot token ⇒ unverifiable
+        return bridgePartnerFactsFromInfo(info, workspaceId).dmPartnerTrust === "internal";
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Re-derive whether this fire's CREATOR is currently an internal member, for the one mode where the
+ * answer changes anything (a DM's shared read layer). Returns `undefined` — never `false` — when
+ * there is nothing to ask about, so a caller can tell "checked, and no" apart from "never asked"
+ * in a log; both stamp nothing, because {@link routineFireAttributes} is positive-only.
+ *
+ * @param createdBy  the routine's stored creator principal (absent on pre-OPE-152 rows and on
+ *                   anything armed without a verified sender — no id, no question to ask).
+ * @param platform   the fire's DESTINATION platform (routineReportSurfaceKey's first segment, not
+ *                   the routine's own — a redirected fire is verified where it LANDS).
+ * @param mode       the destination surface's session mode.
+ * @param workspaceId the destination workspace (Slack team id), so a Connect stranger from another
+ *                   workspace resolves external rather than passing on a bare id match.
+ */
+export async function recheckFireCreator(input) {
+    if (!input.createdBy)
+        return undefined;
+    // DM-ONLY, and that is a scope statement rather than a limitation: `trust` selects the shared read
+    // layer only for a DM (memory/resolve.ts), and a channel fire's verdict is already settled by its
+    // own live channel recheck. Anywhere else this call could only spend a network read to reach a
+    // conclusion nothing consults.
+    if (input.mode !== "dm")
+        return undefined;
+    if (input.platform !== "slack")
+        return undefined; // no membership-verification gate elsewhere
+    const check = input.check ?? liveCreatorStanding;
+    return check(input.createdBy, input.workspaceId);
+}
+//# sourceMappingURL=fire-creator.js.map

package/dist/agent/routines/fire-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-creator.js","sourceRoot":"","sources":["../../../agent/routines/fire-creator.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,EAAE;AACF,8FAA8F;AAC9F,gFAAgF;AAChF,oGAAoG;AACpG,6FAA6F;AAC7F,6FAA6F;AAC7F,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAC/F,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,yFAAyF;AACzF,kGAAkG;AAClG,mGAAmG;AACnG,2DAA2D;AAC3D,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,+FAA+F;AAC/F,sBAAsB;AAEtB,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAM1F;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAyB,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,6DAA6D;QACtF,OAAO,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,mGAAmG;IACnG,kGAAkG;IAClG,+FAA+F;IAC/F,+BAA+B;IAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,4CAA4C;IAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC;IACjD,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC"}

package/dist/agent/routines/fire-disclosure.d.ts

@@ -0,0 +1,70 @@
+import { resolveAudienceFloor, type AudienceFloor, type RoomRoster } from "../access/audience-floor.js";
+import type { UnifiedWakeOrigin } from "../channels/unified-window.js";
+/** The verdict on whether a room may hear a trigger-sourced fire. `floor` is carried on BOTH arms so
+ *  an allow can be telemetered later without reshaping the type. */
+export type FireDisclosureVerdict = {
+    readonly ok: true;
+    readonly floor: AudienceFloor;
+}
+/** The room's audience floor was POSITIVELY resolved to `guest` — today, an externally-shared
+ *  Slack channel (connector-disclosure.ts narrowing n2: `hasGuest` is the CHANNEL's external bit,
+ *  not a per-member classification). */
+ | {
+    readonly ok: false;
+    readonly reason: "audience-floor";
+    readonly floor: AudienceFloor;
+};
+/** The facts {@link classifyFireDisclosure} judges — resolved by the caller so the classifier is
+ *  pure and matrix-testable (the classifyConnectorDisclosure / classifyPaneVenue precedent). */
+export interface FireDisclosureInput {
+    /** The room's floor, from the ONE primitive (access/audience-floor.ts). */
+    readonly floor: AudienceFloor;
+    /** The live roster the floor came from — read for its `resolved` bit (the inert rule above). */
+    readonly roster: RoomRoster;
+}
+/**
+ * The pure decision. One leg, deliberately: an OBSERVED `guest` floor refuses; everything else —
+ * including an unobservable roster whose floor is `guest` by fail-closed default — allows.
+ */
+export declare function classifyFireDisclosure(input: FireDisclosureInput): FireDisclosureVerdict;
+/** Injectable edges — the live default is the shared, memoized audience-floor seam. */
+export interface FireDisclosureDeps {
+    readonly floor?: typeof resolveAudienceFloor;
+}
+/**
+ * Resolve one room's disclosure verdict for a trigger-sourced fire. `surfaceKey` is the routine's
+ * own `platform/workspace/surface` key — the same string the member supplier is keyed on.
+ *
+ * FAIL-OPEN on a throw: the floor seam is best-effort by contract (its live supplier already
+ * swallows platform errors into UNRESOLVED_ROSTER), but an INJECTED one might not, and a disclosure
+ * layer above a fail-closed authorization gate must never convert a transient platform blip into a
+ * dead routine fleet.
+ */
+export declare function checkFireDisclosure(surfaceKey: string, deps?: FireDisclosureDeps): Promise<FireDisclosureVerdict>;
+/**
+ * The withheld-fire notice. CONTENT-FREE: the routine's OE-minted id (`r-xxxxxxxx`, store.ts
+ * newRoutineId) is the only variable in it. Everything a reader might want — which event, which
+ * repo, what the routine watches — is exactly what must not be said in a room that just failed the
+ * disclosure check, so it is said in the `routine.skip` audit row instead, which has an entitled
+ * audience by construction. Partial disclosure is still disclosure.
+ */
+export declare function fireWithheldNoticeText(routineId: string): string;
+/** Injectable edges for the notice — the live default posts through the routine's own wake origin. */
+export interface FireWithheldNoticeDeps {
+    readonly post?: (origin: UnifiedWakeOrigin, text: string) => Promise<string>;
+}
+/**
+ * Post the withheld-fire notice into the routine's own surface. Returns whether a message landed.
+ *
+ * Routed through the routine's `DispatchTarget.origin` — the SAME host-derived wake origin the fire
+ * itself would have replied through — so there is no second delivery mechanism to keep in step, and
+ * so the notice is HOST-composed rather than a model turn. That last part is load-bearing twice
+ * over: a model turn would need the event in its context (the thing we are withholding), and it
+ * would make an inbound delivery stream into an inference-spend amplifier.
+ *
+ * FAIL-SOFT, always: the skip row is the durable record and has already been written. A surface with
+ * no declared origin, or a dead token, must never turn "I withheld a fire" into a thrown error that
+ * takes out the rest of the fan-out loop.
+ */
+export declare function announceFireWithheld(routineId: string, surfaceKey: string, origin: UnifiedWakeOrigin | undefined, deps?: FireWithheldNoticeDeps): Promise<boolean>;
+//# sourceMappingURL=fire-disclosure.d.ts.map

package/dist/agent/routines/fire-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-disclosure.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-disclosure.ts"],"names":[],"mappings":"AA0GA,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAExG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAMvE;oEACoE;AACpE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE;AACtD;;wCAEwC;GACtC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE7F;gGACgG;AAChG,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,qBAAqB,CAKxF;AAcD,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQ3H;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED,sGAAsG;AACtG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/agent/routines/fire-disclosure.js

@@ -0,0 +1,193 @@
+// TRIGGERED-FIRE AUDIENCE DISCLOSURE (OPE-166, extended OPE-183) — consumer #3 of the
+// audience-floor seam, and the ONE disclosure policy every unattended fire rides.
+//
+// TWO LEGS USE IT, ONE POLICY:
+//   • the GitHub EVENT fan-out (routines/github-fanout.ts, OPE-166) — the original consumer;
+//   • the config-declared WEBHOOK hook (webhooks/dispatch.ts, OPE-183) — added because a config
+//     hook is a standing, unattended, human-authored instruction that fires ARBITRARY EXTERNAL
+//     PAYLOAD content into one room, and nothing on that path asked whether the room was a fit
+//     audience for it either. That leg cannot be normalized onto the event plane's admitTrigger
+//     (OPE-179 refused the collapse: a config hook is authorized by an operator's MERGED CODE
+//     DECLARATION — id → target → instruction — not by a subscription filter over a normalized
+//     event, so there is nothing on that plane for it to be routed by) — but it does not need to
+//     be, because this check operates on the
+//     TARGET, not the payload. That is the whole reason it transplants cleanly.
+// Everything below is written in terms of "a fire"; where it says EVENT specifically, that is the
+// OPE-166 leg's own worked example, not a narrowing of the policy.
+//
+// ⚠️ THE TWO LEGS DIFFER IN ONE PLACE ONLY, and it is downstream of this module: the event leg
+// posts a content-free withheld notice into the refused room ({@link announceFireWithheld}),
+// throttled by fire-audit.ts's per-(routine, reason) hour window. The webhook leg posts NOTHING —
+// it has no such throttle, so a notice there would let one secret-holder drive channel spam at
+// request rate. It records the refusal in its own existing `webhook.declined` audit row instead.
+//
+// THE HOLE THIS CLOSES. OPE-163 settled "can": the read grant over the scope path the delivery
+// proved — non-empty per core, with the source's own adapter choosing which step is authoritative
+// (routines/event-authz.ts, checked per fire in github-fanout.ts). That answers
+// whether the DOMAIN may read the content. It says nothing about whether the ROOM the routine
+// reports into is an appropriate audience for it. Those are different questions, and OE already
+// treats them as different questions elsewhere — a domain granted `repos:[acme/payments]` so
+// someone could ask about PRs in #general does not thereby make #general a fit venue for a security
+// issue whose TITLE carries a live customer id. Events are where the gap bites, because a fire is
+// UNATTENDED and RECURRING: nobody chose this particular content for this particular room.
+//
+// ── THE FOUR DECISIONS THE TICKET ASKED FOR, AND WHY ──────────────────────────────────────────
+//
+// (1) THE CHECK IS ROOM-GRAIN, NOT CONTENT-GRAIN — neither "the summary" nor "the hydrated body".
+//     Both candidate answers are wrong for the same reason: NEITHER is what reaches the room. The
+//     summary and the hydrated body both go into the fire's PROMPT (github-fanout.ts eventPrompt →
+//     `ingestUntrusted`); what lands in the channel is MODEL OUTPUT. A classifier over either is a
+//     proxy for something it does not control, and a content classifier ("does this title carry a
+//     customer id?") is a DLP model this project does not have and must not invent here.
+//     assertConnectorDisclosure has the same shape and gives the same answer: it never inspects the
+//     connector's data — it refuses the CONNECTION for the room. So does this. The question is
+//     "may this room hear org-internal trigger-sourced content AT ALL", and the answer does not
+//     depend on which event arrived.
+//
+// (2) FIRE TIME, NOT ARM TIME. Membership changes after arming — a channel becoming Slack-Connect
+//     shared a month after a routine was armed IS the threat, so an arm-time verdict is stale by
+//     construction. The per-fire cost is ~zero: resolveRoomRoster's memo is ~15 min and is SHARED
+//     with the governance tripwire and the connector gate, so N routines on one channel in one
+//     delivery cost one platform call between them, and usually zero. A SECOND arm-time check was
+//     deliberately NOT added: it could not be authoritative, so it would be either a duplicate (a
+//     dead branch by the time it mattered) or a divergent second policy. What arm time actually
+//     needed — "the human finds out" — is delivered by (3) instead, at the moment it is true.
+//
+// (3) THE REFUSAL IS VISIBLE, TWICE. A silent skip is precisely the "why didn't it tell me" failure
+//     the audit wedge exists to prevent (and the failure disable-notice.ts was written to fix for
+//     the sibling case). So a withheld fire writes a `routine.skip` row with reason
+//     `audience_floor` — the SHARED forensics vocabulary (fire-audit.ts), never a new action, per
+//     OPE-145 — AND posts one host-composed line into the room through the routine's own
+//     `DispatchTarget.origin`, the same arm announceSelfDisable uses. The notice is CONTENT-FREE by
+//     construction: it names the OE-minted routine id and nothing else. Not the event summary, not
+//     the scope path, not the routine's prompt (which disable-notice.ts DOES echo, and which here
+//     would leak the very intent — "watch security issues in acme/payments" — into the room we just
+//     refused). It is throttled by being posted only when the skip row was actually EMITTED, so an
+//     inbound delivery stream cannot turn a standing misconfiguration into channel spam; the
+//     throttle is fire-audit.ts's existing per-(routine, reason) hour window, not a second one.
+//
+// (4) IT DOES NOT COMPOSE WITH THE TAINT MODEL — IT IS ORTHOGONAL, AND THAT IS THE POINT. A webhook
+//     fire is structurally UNTAINTED (OPE-163 C3): no human turn preceded it, so there is no taint
+//     to carry. Anything keyed on taint is therefore INERT on exactly this path. This check reads
+//     the ROOM's live roster and nothing about the content's provenance, which is why it fires here
+//     at all. scripts/event-disclosure-test.ts demonstrates that directly: every case it drives is a
+//     plain webhook delivery, and the refusal still happens.
+//
+// ── FAIL-OPEN ON AN UNOBSERVABLE ROOM, REFUSE ONLY ON AN OBSERVED GUEST ───────────────────────
+// The authentication/authorization boundary on this path is checkEventReadGrant, and it fails
+// CLOSED. This is the layer above it: a disclosure judgement over a fact the platform may simply
+// not be able to report. Exactly one production member supplier exists in the tree (the Slack
+// bundle's — connector-disclosure.ts narrowing n1 states it and scripts/connector-disclosure-test.ts
+// §5 pins it), so on Discord/Teams/GitHub/Linear/Notion resolveRoomRoster yields UNRESOLVED_ROSTER,
+// whose floor is `guest`. Refusing on THAT would stop every event routine on every non-Slack surface
+// from firing — a silent, total product outage dressed as a security fix. So this reads the roster's
+// `resolved` bit alongside the floor, identically to connector-disclosure.ts leg 1: OBSERVED guest ⇒
+// refuse; unobservable ⇒ inert, byte-identical to the pre-OPE-166 fire.
+//
+// ── WHY THIS IS NOT A DEAD GUARD (the standing house rule) ────────────────────────────────────
+// It fires in a SHIPPED configuration: a Slack workspace (supplier registered at boot), an event
+// routine armed in an externally-shared / Slack-Connect / org-shared channel (which is what sets
+// `hasGuest` — see narrowing n2), and a delivery whose read grant passes. Note it is strictly MORE
+// live than connector leg 1, whose third narrowing (n3) is that the DM-only wall defaults ON and so
+// leaves it seeing DM turns only: a routine's surface is a CHANNEL by construction, so there is no
+// equivalent wall in front of this one. It is live on the default posture.
+//
+// The OPE-183 leg is live for the same reason and a narrower one: a config hook's target is
+// SLACK-ONLY by construction (webhooks/config.ts assertWebhooksValid requires a `slack/TEAM/
+// CHANNEL` triple), and Slack is the one surface with a member supplier — so unlike most guards,
+// its triggering condition is reachable on 100% of the surfaces it can fire into.
+//
+// ⚠️ THE UNRESOLVED ARM IS LOAD-BEARING, NOT A DEFAULT INHERITED FROM THE EVENT LEG. On the
+// webhook leg it is reachable for entirely ordinary internal channels (the live supplier reports
+// `resolved: false` for a channel with more than ONE PAGE of members, among other cases) and a
+// refused delivery is LOST — the route acks 200 and fires in the background, so there is no
+// redelivery and no next tick. The full argument, and why fail-open there is not a hole, is in
+// webhooks/dispatch.ts at the call site.
+import { resolveAudienceFloor } from "../access/audience-floor.js";
+import { postUnifiedReply } from "../channels/unified-reply.js";
+function log(msg) {
+    console.log(`[open-everywhere:routines] ${msg}`);
+}
+/**
+ * The pure decision. One leg, deliberately: an OBSERVED `guest` floor refuses; everything else —
+ * including an unobservable roster whose floor is `guest` by fail-closed default — allows.
+ */
+export function classifyFireDisclosure(input) {
+    if (input.roster.resolved && input.floor === "guest") {
+        return { ok: false, reason: "audience-floor", floor: input.floor };
+    }
+    return { ok: true, floor: input.floor };
+}
+/**
+ * The admin set this leg judges against: EMPTY, on purpose.
+ *
+ * {@link classifyFireDisclosure} only ever acts on the `guest` verdict, and `guest` is the one floor
+ * computeAudienceFloor decides BEFORE it consults the admin set at all (`!resolved || hasGuest`
+ * returns first). Passing an admin set here would be decoration implying a dependency this leg does
+ * not have — and it would drag `getConfig().loadDomains()` into the fan-out loop for a value that
+ * cannot change the answer. The independence is a real claim about a function in another module, so
+ * it is PINNED by a differential assertion in scripts/event-disclosure-test.ts, not asserted here.
+ */
+const NO_ADMINS = new Set();
+/**
+ * Resolve one room's disclosure verdict for a trigger-sourced fire. `surfaceKey` is the routine's
+ * own `platform/workspace/surface` key — the same string the member supplier is keyed on.
+ *
+ * FAIL-OPEN on a throw: the floor seam is best-effort by contract (its live supplier already
+ * swallows platform errors into UNRESOLVED_ROSTER), but an INJECTED one might not, and a disclosure
+ * layer above a fail-closed authorization gate must never convert a transient platform blip into a
+ * dead routine fleet.
+ */
+export async function checkFireDisclosure(surfaceKey, deps = {}) {
+    try {
+        const resolution = await (deps.floor ?? resolveAudienceFloor)(surfaceKey, NO_ADMINS);
+        return classifyFireDisclosure(resolution);
+    }
+    catch (err) {
+        log(`audience floor unresolvable for ${surfaceKey} (${String(err)}) — fire disclosure inert`);
+        return { ok: true, floor: "guest" };
+    }
+}
+/**
+ * The withheld-fire notice. CONTENT-FREE: the routine's OE-minted id (`r-xxxxxxxx`, store.ts
+ * newRoutineId) is the only variable in it. Everything a reader might want — which event, which
+ * repo, what the routine watches — is exactly what must not be said in a room that just failed the
+ * disclosure check, so it is said in the `routine.skip` audit row instead, which has an entitled
+ * audience by construction. Partial disclosure is still disclosure.
+ */
+export function fireWithheldNoticeText(routineId) {
+    return (`🔒 Routine \`${routineId}\` had something to report and I withheld it. This channel's audience ` +
+        `floor resolved to "guest" — it is externally shared, or carries an observed guest/external ` +
+        `member — so org-internal content from a trigger source can't be delivered here. Nothing about ` +
+        `the event is in this message, deliberately. Move the routine to an internal channel (or remove ` +
+        `the external members) and it will resume by itself; the full reason is in the audit log.`);
+}
+/**
+ * Post the withheld-fire notice into the routine's own surface. Returns whether a message landed.
+ *
+ * Routed through the routine's `DispatchTarget.origin` — the SAME host-derived wake origin the fire
+ * itself would have replied through — so there is no second delivery mechanism to keep in step, and
+ * so the notice is HOST-composed rather than a model turn. That last part is load-bearing twice
+ * over: a model turn would need the event in its context (the thing we are withholding), and it
+ * would make an inbound delivery stream into an inference-spend amplifier.
+ *
+ * FAIL-SOFT, always: the skip row is the durable record and has already been written. A surface with
+ * no declared origin, or a dead token, must never turn "I withheld a fire" into a thrown error that
+ * takes out the rest of the fan-out loop.
+ */
+export async function announceFireWithheld(routineId, surfaceKey, origin, deps = {}) {
+    if (!origin) {
+        log(`withheld-fire notice SKIPPED for ${routineId} [${surfaceKey}] — no post-back origin for this surface (audit row still written)`);
+        return false;
+    }
+    try {
+        await (deps.post ?? postUnifiedReply)(origin, fireWithheldNoticeText(routineId));
+        log(`withheld-fire notice posted for ${routineId} [${surfaceKey}]`);
+        return true;
+    }
+    catch (err) {
+        log(`withheld-fire notice FAILED for ${routineId} [${surfaceKey}]: ${String(err)}`);
+        return false;
+    }
+}
+//# sourceMappingURL=fire-disclosure.js.map

package/dist/agent/routines/fire-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-disclosure.js","sourceRoot":"","sources":["../../../agent/routines/fire-disclosure.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,kFAAkF;AAClF,EAAE;AACF,+BAA+B;AAC/B,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,+FAA+F;AAC/F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,iGAAiG;AACjG,6CAA6C;AAC7C,gFAAgF;AAChF,kGAAkG;AAClG,mEAAmE;AACnE,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,kGAAkG;AAClG,+FAA+F;AAC/F,iGAAiG;AACjG,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,gFAAgF;AAChF,8FAA8F;AAC9F,gGAAgG;AAChG,6FAA6F;AAC7F,oGAAoG;AACpG,kGAAkG;AAClG,2FAA2F;AAC3F,EAAE;AACF,iGAAiG;AACjG,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,yFAAyF;AACzF,oGAAoG;AACpG,+FAA+F;AAC/F,gGAAgG;AAChG,qCAAqC;AACrC,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,gGAAgG;AAChG,8FAA8F;AAC9F,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,yFAAyF;AACzF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,gGAAgG;AAChG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,qGAAqG;AACrG,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,8FAA8F;AAC9F,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,wEAAwE;AACxE,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,4FAA4F;AAC5F,6FAA6F;AAC7F,iGAAiG;AACjG,kFAAkF;AAClF,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,4FAA4F;AAC5F,+FAA+F;AAC/F,yCAAyC;AAEzC,OAAO,EAAE,oBAAoB,EAAuC,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGhE,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;AACnD,CAAC;AAoBD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA0B;IAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAwB,IAAI,GAAG,EAAU,CAAC;AAOzD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,IAAI,GAAuB,EAAE;IACzF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrF,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,mCAAmC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,CACL,gBAAgB,SAAS,wEAAwE;QACjG,6FAA6F;QAC7F,gGAAgG;QAChG,iGAAiG;QACjG,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,UAAkB,EAClB,MAAqC,EACrC,IAAI,GAA2B,EAAE;IAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,oCAAoC,SAAS,KAAK,UAAU,oEAAoE,CAAC,CAAC;QACtI,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,mCAAmC,SAAS,KAAK,UAAU,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,mCAAmC,SAAS,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/routines/fire-eligibility.d.ts

@@ -0,0 +1,87 @@
+import { type SlackFormFn } from "../channels/slack-bridge.js";
+import { type TeamsAccountActiveCheck, type TeamsMembershipUnresolved, type TeamsRoomMembershipCheck } from "../channels/teams-bridge.js";
+import type { RoutineSkipReason } from "./fire-audit.js";
+/** Room-membership probe: is `userId` CURRENTLY a member of `channelId`? `undefined` = the probe
+ *  could not answer (no token, an API error, an unresolvable channel) — never a "no". */
+export type RoomMembershipCheck = (channelId: string, userId: string) => Promise<boolean | undefined>;
+/** Account-status probe: is `userId`'s account CURRENTLY active (not deleted)? `undefined` = the
+ *  probe could not answer. */
+export type AccountActiveCheck = (userId: string) => Promise<boolean | undefined>;
+/**
+ * Slack room-membership probe (pure but for the injected `form`): paginate `conversations.members`
+ * looking for `userId`, bounded at {@link ROOM_MEMBER_MAX_PAGES}. Exported (not the cache-wrapped
+ * live wrapper below) so the pagination + fail-open logic is unit-testable with a canned form
+ * function, no bridge registration or network call — the same split
+ * teams-fire-eligibility.ts's `teamsRoomMembershipViaGraph` draws for the Teams leg.
+ */
+export declare function slackRoomMembershipViaConversationsMembers(channelId: string, userId: string, form: SlackFormFn): Promise<boolean | undefined>;
+/**
+ * Live Slack room-membership probe: {@link slackRoomMembershipViaConversationsMembers} through the
+ * real bridge, TTL-cached per (channel, user) on the same clock the rest of this tree's trust
+ * probes use (`dmTrustTtlMs` — identity/trust.ts). A cache hit costs nothing; a miss costs at most
+ * {@link ROOM_MEMBER_MAX_PAGES} Web API calls, once per (channel, user) per TTL window regardless
+ * of how many routines share that creator+room. Only a CONFIRMED result (the whole roster seen, or
+ * the creator found early) is cached — an unresolved probe, including a page-bound hit with more
+ * roster left unseen, is never cached, so the very next check gets a fresh chance to resolve it.
+ */
+export declare const liveRoomMembership: RoomMembershipCheck;
+/** Test seam — drop both in-process caches so one test can't inherit another's verdicts. */
+export declare function _resetFireEligibilityCachesForTest(): void;
+/** The Teams probe contracts live on the bridge (channels/teams-bridge.ts) and are re-exported here
+ *  for this module's own callers. ONE declaration, not two: this module carried its own identical
+ *  copy of both signatures, and nothing would have made the two disagree LOUDLY — each side
+ *  typechecks against its own copy, so a change to one alone compiles. */
+export type { TeamsRoomMembershipCheck, TeamsAccountActiveCheck, TeamsMembershipUnresolved };
+export interface FireEligibilityInput {
+    readonly createdBy: string | undefined;
+    /** The fire's DESTINATION platform (routineReportSurfaceKey's first segment) — a redirected fire
+     *  is checked where it LANDS, matching fire-creator.ts's recheckFireCreator. */
+    readonly platform: string | undefined;
+    /** The room the fire posts into — the resolved DispatchTarget's channel id. Slack-only field;
+     *  Teams' room fields are {@link FireEligibilityInput.teamsTeamId} + this same `roomId` read as
+     *  the Teams CHANNEL id (Graph needs both — see teams-read.ts's two-level-id note). */
+    readonly roomId: string | undefined;
+    /** Test seam — the live default is {@link liveRoomMembership}. */
+    readonly membershipCheck?: RoomMembershipCheck;
+    /** Test seam — the live default is {@link liveAccountActive}. */
+    readonly activeCheck?: AccountActiveCheck;
+    /** Teams only (OPE-522): the routine's TEAM id — a Graph channel-membership read needs team +
+     *  channel, not the channel alone. Absent ⇒ the Teams leg is a no-op (eligible), same posture as
+     *  an absent `roomId` on Slack. */
+    readonly teamsTeamId?: string;
+    /** Teams only (OPE-522): the creator's Azure AD OBJECT id — see the file header for why this is a
+     *  different value from `createdBy` on this platform. Absent ⇒ the Teams leg is a no-op. */
+    readonly teamsCreatorAadObjectId?: string;
+    /** Teams only (OPE-1810): the routine's regional Bot Connector endpoint. The membership read needs
+     *  it to turn `teamsTeamId` (the Connector's `19:…` spelling) into the Microsoft 365 group id every
+     *  Graph `/teams/{team-id}/…` URL takes. Absent ⇒ the read is unresolvable on a team whose group id
+     *  is not already cached, which is a fail-OPEN arm and is audited as `team_id_unresolved`. */
+    readonly teamsServiceUrl?: string;
+    /** Test seam — the live default is {@link liveTeamsRoomMembership}. */
+    readonly teamsMembershipCheck?: TeamsRoomMembershipCheck;
+    /** Test seam — the live default is {@link liveTeamsAccountActive}. */
+    readonly teamsActiveCheck?: TeamsAccountActiveCheck;
+}
+export type FireEligibility = {
+    readonly eligible: true;
+    /**
+     * OPE-1810, Teams only: the fire proceeds, but the room-membership read could NOT answer, and
+     * this names why. Present ONLY on that arm — a Teams fire whose creator was confirmed present
+     * carries nothing, so the field's presence is itself the signal the dispatcher audits. A
+     * fail-open that leaves no row is indistinguishable from a pass, which is what the Teams leg
+     * looked like on every fire before this ticket.
+     */
+    readonly teamsMembershipUnresolved?: TeamsMembershipUnresolved;
+} | {
+    readonly eligible: false;
+    readonly reason: RoutineSkipReason;
+};
+/**
+ * Is this fire's creator still eligible to have it run? Positive-only refusal: a CONFIRMED "no"
+ * (removed from the room, or an inactive account) skips the fire; anything else — no creator to
+ * check, an unsupported platform, an unresolvable room, or a probe that could not answer — is
+ * eligible. Never throws: both probes are already internally fail-soft, but a caller that races a
+ * network read still gets a definite answer either way.
+ */
+export declare function checkFireEligibility(input: FireEligibilityInput): Promise<FireEligibility>;
+//# sourceMappingURL=fire-eligibility.d.ts.map

package/dist/agent/routines/fire-eligibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fire-eligibility.d.ts","sourceRoot":"","sources":["../../../agent/routines/fire-eligibility.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAE9B,KAAK,wBAAwB,EAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;yFACyF;AACzF,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;AAEtG;8BAC8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;AASlF;;;;;;GAMG;AACH,wBAAsB,0CAA0C,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA8BnJ;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,mBAQhC,CAAC;AAyBF,4FAA4F;AAC5F,wBAAgB,kCAAkC,IAAI,IAAI,CAGzD;AAED;;;0EAG0E;AAC1E,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;AAU7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;oFACgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;2FAEuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,kEAAkE;IAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC;IAC/C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;uCAEmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gGAC4F;IAC5F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C;;;kGAG8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;CACrD;AAED,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CAChE,GACD;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAYrE;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChG"}