@open-everywhere/core 0.1.0

package/agent/channels/platform-failure.ts

@@ -0,0 +1,45 @@
+// platform-failure — one vocabulary for "what kind of failure was that", shared by every terminal verb that asks a platform to act. The rule it serves lives in channels/turn-terminal-actions.ts.
+// The SHAPE of the answer is the signal, never the words in it: an arm's own `applied === false` first, then the numeric HTTP status, where a 4xx is definitive except 408 and 429. An error carrying neither signal is AMBIGUOUS, which fails closed.
+
+/** DEFINITIVE = the platform proves nothing happened. AMBIGUOUS = it may have. */
+export type PlatformFailureClass = "definitive" | "ambiguous";
+
+/** Statuses that are 4xx yet carry no proof either way. */
+const AMBIGUOUS_CLIENT_STATUSES: ReadonlySet<number> = new Set([408, 429]);
+
+/**
+ * The platform HTTP status an arm attached to a thrown error, or undefined.
+ * Only a finite NUMBER is read, so nothing an arm attaches can smuggle a body, a URL or a token into an audit row.
+ */
+export function platformFailureStatus(err: unknown): number | undefined {
+  const status = (err as { status?: unknown } | null | undefined)?.status;
+  return typeof status === "number" && Number.isFinite(status) ? status : undefined;
+}
+
+/** Which class is this failure? See the header — two signals, no string matching. */
+export function platformFailureClass(err: unknown): PlatformFailureClass {
+  if ((err as { applied?: unknown } | null | undefined)?.applied === false) return "definitive";
+  const status = platformFailureStatus(err);
+  if (status !== undefined && status >= 400 && status < 500 && !AMBIGUOUS_CLIENT_STATUSES.has(status)) return "definitive";
+  return "ambiguous";
+}
+
+/**
+ * Stamp an error as a DEFINITIVE failure — the call did NOT take effect at the platform. Exported through adapter-api.ts so a provider arm can say it about its own calls.
+ * Say it only where the arm KNOWS: a decided refusal, or a pre-flight the host refused. Never about a call whose answer never arrived.
+ */
+export function markNotApplied<E extends Error>(err: E): E {
+  return Object.assign(err, { applied: false as const });
+}
+
+/**
+ * Copy the failure signals from one error onto another — for a caller that RE-WRAPS a platform error in its own copy.
+ * Without this a re-wrap silently downgrades every failure to AMBIGUOUS: the signals live on the error OBJECT, not in its message, so `new Error(old.message)` drops them. Both fields travel or neither does.
+ */
+export function carryFailureSignals<E extends Error>(from: unknown, to: E): E {
+  const applied = (from as { applied?: unknown } | null | undefined)?.applied;
+  if (applied === false) markNotApplied(to);
+  const status = platformFailureStatus(from);
+  if (status !== undefined) Object.assign(to, { status });
+  return to;
+}

package/agent/channels/policy-pages.ts

@@ -0,0 +1,15 @@
+// Deployment mount for the two PUBLIC policy pages — `GET /privacy` and `GET /terms`. The
+// behaviour lives in pages/policy-pages.ts; the text is the operator's, declared as
+// `policyPages.privacy` / `policyPages.terms` in `agent/settings/settings.ts`.
+// GET only, and both answer 200 with or without operator text: `teams-app/manifest.json` points
+// `privacyUrl` and `termsOfUseUrl` here, and a route that 404s is the defect this mount removes.
+
+import { defineChannel, GET } from "eve/channels";
+import { PRIVACY_PAGE_PATH, TERMS_PAGE_PATH, policyPageResponse } from "../pages/policy-pages.js";
+
+export default defineChannel({
+  routes: [
+    GET(PRIVACY_PAGE_PATH, async () => policyPageResponse("privacy")),
+    GET(TERMS_PAGE_PATH, async () => policyPageResponse("terms")),
+  ],
+});

package/agent/channels/post-arms.ts

@@ -0,0 +1,321 @@
+// post-arms — the ONE cross-surface POST registry behind the reply, unified and redrive spines: a per-platform arm registry keyed by `platform`, so those spines hold ZERO vendor imports and dispatch by a RUNTIME key instead of a hardcoded compile-time switch. Each provider owns all of its own posting in one module and registers a single arm here.
+// ONE ARM PER PROVIDER, MEMBERS OPTIONAL: presence IS the declaration, and undefined means unsupported, never faked. An absent member means the spine returns an honest "cannot post here" or throws a LOUD, token-free "no post arm" rather than silently mis-routing. Arms import the spine types as TYPES only, so there is no runtime cycle back, and the registry itself owns no vendor code.
+
+import type { BindableContext } from "../identity/binding.js";
+import type { ReplyTarget, ReplierLabel } from "./reply-post.js";
+import type { EditLocus } from "./reply-edit.js";
+import type { UnifiedWakeOrigin } from "./unified-window.js";
+import type { UnifiedReplyDeps } from "./unified-reply.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { soleAdmittedTenantFromConfig } from "../access/tenant-admission.js";
+import { appendAudit } from "../audit/audit.js";
+import { expandLinkSet } from "../identity/link-store.js";
+import { isTenantScopedPlatform, tryPrincipalKey } from "../identity/principal-key.js";
+import type { LinkedAccount } from "../identity/link-store.js";
+import { processRegistryMap } from "../lib/process-registry.js";
+
+/**
+ * The bag a mid-turn {@link PostArm.resolveTarget} reads from — the binding's post-back target, narrowed by the spine so an arm needs no binding import of its own.
+ * Every value comes from the per-delivery auth the surface stowed, NEVER a tool argument: `reply` can only post where it was woken.
+ */
+export interface TargetResolveBag {
+  str(k: string): string | undefined;
+  num(k: string): number | undefined;
+  readonly threadTs?: string;
+  /** The raw bindable ctx, for the rare arm that needs a field the bag doesn't pre-narrow. */
+  readonly ctx: BindableContext;
+}
+
+/**
+ * Where a DM delivery landed — public ids only (safe for an audit row; never the content).
+ */
+export interface DirectMessageDelivery {
+  /** The DM conversation/channel id the message landed in (Slack: `conversations.open`'s channel id). */
+  readonly surfaceId: string;
+  /** The platform message id of the delivered message. */
+  readonly messageId: string;
+}
+
+/**
+ * One tappable action a DM may carry beside its text, platform-NEUTRAL by construction. THE TEXT MUST STAND ON ITS OWN: an arm with no component plane ignores `actions`, and an arm that renders them may still have its buttons stripped by the platform, so a caller must never write copy that only makes sense with a button.
+ * `id` is the CALLER's own opaque routing key — it is what comes back on the click, so the caller owns its grammar and its length budget. `label` is core-owned copy and never model text: it renders inside the agent's own message.
+ */
+export interface DirectMessageAction {
+  readonly id: string;
+  readonly label: string;
+  /** What the tap MEANS, so each surface picks its own affirmative/destructive styling. */
+  readonly intent: "affirm" | "reject";
+}
+
+/**
+ * What {@link PostArm.deliverDirectMessage} is asked to do — a principal, the text, and optionally a row of tappable actions.
+ * Deliberately free of hosting topology and surface identity: the caller names WHO, never WHERE, and opening or reusing the 1:1 conversation is the provider's business.
+ */
+export interface DirectMessageRequest {
+  /** The bare platform principal id of the recipient (Slack member id, Discord user id, …). */
+  readonly principalId: string;
+  readonly text: string;
+  /** Tappable shortcuts. Ignored by an arm with no component plane — see {@link DirectMessageAction}. */
+  readonly actions?: readonly DirectMessageAction[];
+}
+
+/**
+ * The `dm.delivery.skipped` audit `detail.reason` — one greppable string, shared by the emitter
+ * and its test (same convention as `UNADMITTED_TENANT_DROP_REASON` in access/tenant-admission.ts).
+ */
+export const DM_WORKSPACE_UNREACHABLE_REASON = "workspace-unreachable";
+
+/** Can THIS deployment's arm even reach `targetTenant`? `reachable: false` is the loud floor
+ *  (OPE-354); the two `reachable: true` shapes are collapsed into one — a caller that wants to know
+ *  WHY it was told "go ahead" doesn't need to, because both mean the same thing: attempt the send. */
+export type DmWorkspaceReachability =
+  | { readonly reachable: true }
+  | { readonly reachable: false; readonly targetTenant: string; readonly armTenant: string };
+
+/**
+ * PURE decision table for the DM-workspace floor: it takes the arm's own tenant as an argument, so the table is unit-testable without a config. It is the DETECTION seam ONLY — it never picks a credential and never changes which token an arm uses, it just tells the caller whether to bother trying.
+ * THREE branches answer `reachable: true` on purpose, stated so a future reader does not "fix" them into a skip: a platform whose ids are vendor-global has no same-platform workspace to alias across; a blank target tenant is not evidence of a FOREIGN workspace, so comparing it would invent a mismatch rather than detect one; and an UNDETERMINED arm tenant is the FAIL-OPEN-ON-UNKNOWN pin, because today's code always attempts the send and this floor must never newly refuse a delivery that used to go through. It answers false only when the arm tenant is KNOWN and differs.
+ */
+export function classifyDmWorkspaceReachability(platform: string, targetTenant: string | undefined, armTenant: string | undefined): DmWorkspaceReachability {
+  if (!isTenantScopedPlatform(platform)) return { reachable: true };
+  const target = typeof targetTenant === "string" ? targetTenant.trim() : "";
+  if (target.length === 0) return { reachable: true };
+  if (armTenant === undefined) return { reachable: true };
+  if (armTenant === target) return { reachable: true };
+  return { reachable: false, targetTenant: target, armTenant };
+}
+
+/** {@link classifyDmWorkspaceReachability} against the registered app config's sole admitted tenant
+ *  for `platform` (access/tenant-admission.ts) — the real call this floor makes at DM-delivery time. */
+export function dmWorkspaceReachableFromConfig(platform: string, targetTenant: string | undefined): DmWorkspaceReachability {
+  return classifyDmWorkspaceReachability(platform, targetTenant, soleAdmittedTenantFromConfig(platform));
+}
+
+/**
+ * REACT: where a react lands, for a provider whose react target is not a specific message but the conversation ANCHOR — the issue or ticket the surface tracks.
+ * Deliberately its own small union rather than a narrowing of the reply target: a reaction primitive can address an issue or comment id and never an agent-session id, so a react must resolve its anchor on its own account even on the agent-session reply route. Slack keeps its own direct implementation and never populates this type.
+ */
+export type ReactTarget =
+  // `organizationId` picks the workspace-scoped Linear credential (OPE-875), exactly as it does on
+  // the two Linear {@link ReplyTarget} variants. Absent ⇒ the unchanged primary chain.
+  | { readonly platform: "linear"; readonly issueId: string; readonly organizationId?: string }
+  | { readonly platform: "github"; readonly owner: string; readonly repo: string; readonly issueNumber: number; readonly installationId?: number }
+  // The one variant with message-level granularity, tracking the same (channel, message) pair the surface's own reaction op already takes.
+  | { readonly platform: "discord"; readonly channelId: string; readonly messageId: string };
+
+/**
+ * Is this post the WHOLE answer to its wake, or one part of an answer still being written? The reply tool's own `done` input is the fact. Most arms never need it — a chat surface treats every post the same way — but one does: an agent-session route ENDS the session with a terminal activity, so a non-terminal part posted as one makes the real answer unpostable.
+ * ABSENT MEANS TERMINAL. Every caller with no `done` to give is by construction posting a complete answer, so the default is the one that needs no thought.
+ */
+export interface PostIntent {
+  /** True ⇒ this post completes the answer to its wake. False ⇒ another part follows. An arm that
+   *  is handed NO {@link PostIntent} at all must read that as terminal — see the note above. */
+  readonly terminal: boolean;
+}
+
+export interface PostArm {
+  readonly platform: string;
+  /** MID-TURN: build this surface's {@link ReplyTarget} from the binding, or null when unresolvable. */
+  resolveTarget?(bag: TargetResolveBag): ReplyTarget | null;
+  /**
+   * MID-TURN: post a resolved target and return the platform message id, throwing a token-free error if it did not land. The `reply` tool's choke point funnels through this one call, and since OPE-2006 it is the only caller — the terminal-prose poster that shared it is deleted.
+   * `replier` is passed ONLY when {@link displayNameCapable} is true for this arm; every other arm never sees it, because the spine bakes the tier bracket into the text first.
+   */
+  dispatchReply?(target: ReplyTarget, text: string, replier?: ReplierLabel): Promise<string>;
+  /**
+   * Does this arm's `dispatchReply` apply a worker-turn REPLIER label itself, through a native per-message display-name override?
+   * Undefined or false means the spine renders the shared bracket-prefix fallback onto the body BEFORE calling `dispatchReply`, and `replier` is never passed down.
+   */
+  readonly displayNameCapable?: boolean;
+  // NO `splitText` MEMBER (deleted by OPE-2006). It split long TERMINAL prose to a surface's message
+  // cap, and `postTerminalProse` was its only reader: the `reply` TOOL has never read an arm's
+  // splitter on any surface and still posts whole. With that poster deleted the member had no reader
+  // at all, so the three arms that declared it (github, discord, teams) were declaring dead capability.
+  // The per-surface splitters that still have a real caller are untouched: `splitForDiscord`
+  // (discord-post.ts, discord-gateway.ts) and `splitTeamsMessageText`, which teams-post-arm.ts's own
+  // dispatch chunks with. GitHub's `splitGitHubComment` had no other caller, so it went with the
+  // member — a tested function nothing calls is dead code, not spare capacity.
+  /**
+   * UNIFIED: post a single-window reply for this origin and return the message id. `deps` carry the test-injectable per-surface overrides, and an arm resolves `deps.postX ?? live` itself.
+   * `replier` is passed only when {@link displayNameCapable} is true; a test-injected override, when present, is used verbatim and never sees it.
+   */
+  dispatchUnified?(origin: UnifiedWakeOrigin, text: string, deps: UnifiedReplyDeps, replier?: ReplierLabel, intent?: PostIntent): Promise<string>;
+  /**
+   * UNIFIED, WITH A COMPONENT PLANE (OPE-1720): post the same single-window reply AND a row of tappable {@link DirectMessageAction}s beside it, returning the message id. This is what lets an interactive card — eve's bridged `tool-approval`, and the tap-through choices that follow it — reach a unified origin at all; until it existed `dispatchUnified` took one string, so a DM seat could only ever be shown a question as prose.
+   * PRESENCE IS THE DECLARATION, exactly as it is for {@link deliverDirectMessage}: an arm without this member has no unified component plane and the spine posts the TEXT through {@link dispatchUnified} instead — never a faked or silently dropped button row. 🔴 AN ARM MUST NOT IMPLEMENT IT UNTIL THE TAP ROUTE EXISTS ON ITS SURFACE. A button that settles nothing is worse than no button on a governed approval: the person taps Approve, the turn stays parked, and the room cannot tell. The text still stands on its own here for the same reason it does on a DM ({@link DirectMessageAction}), so the fallback loses the shortcut and never the meaning.
+   * `deps` carry the same test-injectable per-surface overrides `dispatchUnified` reads. A test override that cannot carry components is honoured verbatim, so an injected post never renders a card the test did not ask for.
+   */
+  dispatchUnifiedActions?(
+    origin: UnifiedWakeOrigin,
+    text: string,
+    actions: readonly DirectMessageAction[],
+    deps: UnifiedReplyDeps,
+    replier?: ReplierLabel,
+    intent?: PostIntent,
+  ): Promise<string>;
+  /**
+   * UNIFIED: complete an OPEN session for a turn that judged SILENCE — only for a surface that holds a session across the divert. NO MODEL PROSE ever posts through this member, and what the arm leaves in the room is the ARM's decision: a surface with no invisible close renders a fixed HOST ack.
+   * `answered` says the turn ALREADY answered this origin's own container through a SIBLING wake, which the spine proves from the per-turn reply record and never from the model. The session still closes; only the line changes, and an arm that ignores the flag closes exactly as it did before.
+   */
+  closeUnifiedSilently?(origin: UnifiedWakeOrigin, deps: UnifiedReplyDeps, answered?: boolean): Promise<void>;
+  /**
+   * EDIT: rewrite the text of a message THIS deployment already posted, in place. Both reply spines share this ONE member — the caller resolves the locus from the session binding or the frozen wake origin, so an arm never has to know which spine asked. It throws token-free when the platform rejected the edit, and returns nothing, because an edit mints no new message id.
+   * PRESENCE IS THE DECLARATION: an arm without it cannot edit and the spine refuses with an audited `no-edit-arm`, while `edit_reply` stays mounted on every surface regardless. Two absences are PLATFORM LIMITS rather than not-yets — an agent-activity reply has no update mutation, and a comment API with no update endpoint. THE ARM MUST NEVER TREAT ITS OWN CHECK AS THE FENCE: ownership is decided against the own-post ledger before this is ever called.
+   */
+  editMessage?(locus: EditLocus, messageId: string, text: string): Promise<void>;
+  /**
+   * CAN {@link editMessage} ACTUALLY BE ISSUED at this locus, under the credential it would resolve? (OPE-1753.)
+   * PRESENCE IS THE DECLARATION, and absence means "nothing narrows it beyond the member existing" — so an arm that adds no fence keeps today's answer exactly.
+   * 🔴 IT EXISTS BECAUSE `editMessage`'S PRESENCE IS NOT THE WHOLE ANSWER. A credential may carry endpoint rules that forbid the very method the edit issues, and those rules are enforced in-process before any byte leaves (`access/credential-endpoints.ts`). Notion is the measured case: the arm PATCHes `/v1/comments/{id}` while this deployment's channel key declares `GET,POST` on purpose, so every edit was refused before dispatch — and the should-be-edit policy, reading only the member's presence, kept steering the seat at a verb that could never work.
+   * It must be READ-ONLY and cheap, it must never throw (an arm that cannot decide answers true, leaving today's behaviour), and it decides only whether to OFFER an edit — the fence itself stays the wall.
+   */
+  editReachable?(locus: { readonly platform: string; readonly channelId: string }): Promise<boolean>;
+  /**
+   * EDIT, ADDRESS HALF: move the host-resolved edit locus onto the conversation the reply ACTUALLY landed in, for a surface that can post somewhere its frozen wake origin cannot name. Exactly one arm needs it, and the reason is structural — a thread that IS its own channel id, opened during the turn, leaves the reply at an address the frozen origin never carried.
+   * It is called BEFORE the ownership fence, so the ledger read and the transport both address the conversation the message is in. It must be READ-ONLY — it resolves an address and must never create the container it names — and it returns `locus` unchanged whenever it cannot prove a better one.
+   */
+  retargetEditLocus?(origin: UnifiedWakeOrigin, locus: EditLocus): Promise<EditLocus>;
+  /** REDRIVE: a token-free "where the dropped answer was owed" description (public ids only). */
+  describeRedriveTarget?(origin: UnifiedWakeOrigin): string;
+  /** REDRIVE: a best-effort primary container id for the corrective envelope (cosmetic; never routes). */
+  redriveContainerId?(origin: UnifiedWakeOrigin): string;
+  /**
+   * DM: open, or reuse, the 1:1 direct-message conversation with `principalId` and post `text` there, returning the DM surface and message ids. Throws token-free if it did not land.
+   * ABSENT means this provider cannot DM-deliver, and the governance arm then REFUSES fail-closed — it never falls back to rendering org-scope substance in the room. One surface cannot cold-address a person at all: its arm posts into a captured 1:1 chat, opens one from a captured region, or refuses out loud when it has neither.
+   */
+  deliverDirectMessage?(input: DirectMessageRequest): Promise<DirectMessageDelivery>;
+  /**
+   * REACT: resolve this surface's {@link ReactTarget} from the binding, or null when unresolvable. It mirrors {@link resolveTarget}'s bag pattern but is independent of it — see {@link ReactTarget} for why.
+   * It is called only for a non-Slack platform, and its presence is what lets a react reach a ticketing surface at all.
+   */
+  resolveReactTarget?(bag: TargetResolveBag): ReactTarget | null;
+  /**
+   * REACT: leave a reaction at `target`. `emoji` is the model's bare, lowercase name, which some platforms' own vocabulary matches directly, so those arms pass it straight through.
+   * An arm whose platform uses a narrower vocabulary maps it internally, and throws an honest, token-free error naming that surface's real options when the name has no equivalent — never a silent no-op.
+   */
+  react?(target: ReactTarget, emoji: string): Promise<void>;
+}
+
+// Populated at module load by the per-provider arm imports at the bottom of this file: the registry owner does the wiring, so each arm file stays free of any dependency on this module.
+// PROCESS-GLOBAL, because providers register their arm from one module identity while reply-posting resolves from another, and a split registry means an arm posts NOTHING, silently.
+const POST_ARMS = processRegistryMap<PostArm>("post-arms.v1");
+
+/** Register (or replace) one provider's post arm. Called once per provider at module load — see the
+ *  bottom of this file. Exported so a future surface registers the same way. */
+export function registerPostArm(arm: PostArm): void {
+  if (!admitProviderRegistration(arm.platform, "post-arm")) return;
+  POST_ARMS.set(arm.platform, arm);
+}
+
+/** The arm for `platform`, or undefined when no provider registered one — or the platform itself is
+ *  undefined (channelPlatform returns `string | undefined`) — so the spine refuses/returns null,
+ *  never a faked or mis-routed post. */
+export function postArm(platform: string | undefined): PostArm | undefined {
+  return platform === undefined ? undefined : POST_ARMS.get(platform);
+}
+
+/** The platforms with ANY post arm registered — for the "no arm" refusal messages. */
+export function registeredPostArmPlatforms(): readonly string[] {
+  return [...POST_ARMS.keys()];
+}
+
+/** The platforms whose arm implements {@link PostArm.deliverDirectMessage} — for the refusal copy. */
+export function directMessageCapablePlatforms(): readonly string[] {
+  return [...POST_ARMS.values()]
+    .filter((a) => typeof a.deliverDirectMessage === "function")
+    .map((a) => a.platform);
+}
+
+/** Does `platform` support DM delivery? Checked BEFORE any pane substance is computed, so the
+ *  governance arm can refuse without ever materialising what it can't deliver. */
+export function canDeliverDirectMessage(platform: string | undefined): boolean {
+  return typeof postArm(platform)?.deliverDirectMessage === "function";
+}
+
+/** Can a unified post on `platform` carry tappable actions — that is, does its arm implement
+ *  {@link PostArm.dispatchUnifiedActions}? Read BEFORE a caller mints any click state, so a surface
+ *  with no component plane never writes a ticket row for buttons that will not be posted. */
+export function canPostUnifiedActions(platform: string | undefined): boolean {
+  return typeof postArm(platform)?.dispatchUnifiedActions === "function";
+}
+
+/** The platforms whose arm can carry tappable actions on a unified post — for the same honest
+ *  "which surfaces actually do this" answer {@link directMessageCapablePlatforms} gives for DMs. */
+export function unifiedActionCapablePlatforms(): readonly string[] {
+  return [...POST_ARMS.values()]
+    .filter((a) => typeof a.dispatchUnifiedActions === "function")
+    .map((a) => a.platform);
+}
+
+/**
+ * Deliver `text` to `principalId`'s DM on `platform` through that provider's post arm.
+ * It throws a LOUD, token-free error when the platform has no DM arm, naming the platforms that do — the same refuse-rather-than-mis-route posture the dispatch spines take, and what keeps the governance DM arm fail-closed on a provider that cannot DM.
+ */
+export async function dispatchDirectMessage(platform: string | undefined, input: DirectMessageRequest): Promise<DirectMessageDelivery> {
+  const arm = postArm(platform);
+  const deliver = arm?.deliverDirectMessage;
+  if (!arm || !deliver) {
+    const capable = directMessageCapablePlatforms();
+    throw new Error(
+      `no DM-delivery arm for platform "${platform ?? "(unknown)"}" — DM delivery is implemented by: ${capable.length ? capable.join(", ") : "(no provider)"}.`,
+    );
+  }
+  return await deliver.call(arm, input);
+}
+
+/**
+ * Tell EVERY confirmed member of a link-set that it changed. It is NOT a gate and must never become one: under the collapsed consent model MEMBERSHIP IS THE CONSENT, and any confirmed member may grow or sever the set. What this adds is the one thing that collapse left missing — a compromised account cannot change the shape of somebody's identity QUIETLY, because the person hears about it on their other accounts.
+ * BEST-EFFORT on every axis, and each is a real hole: only an account on a DM-CAPABLE surface is reachable, and the registry is the only honest answer to which those are; if the set's ONLY DM-capable account is the compromised one, the notice goes to the attacker and nobody else; a throwing or hanging arm must never fail the tool turn; and a member on a workspace this deployment's arm cannot reach is SKIPPED WITH AN AUDIT ROW, a loud non-delivery rather than a new hole. It never throws, and returns how many deliveries actually landed.
+ */
+export async function notifyLinkSetMembers(
+  org: string,
+  linkSetId: string,
+  text: string,
+  opts?: { readonly except?: readonly LinkedAccount[] },
+): Promise<number> {
+  let delivered = 0;
+  try {
+    const skip = new Set((opts?.except ?? []).map((a) => tryPrincipalKey(a.platform, a.tenant, a.nativeId)).filter((k): k is string => k !== undefined));
+    // `expandLinkSet` already excludes `suggested` and `revoked` rows and returns [] for a
+    // suspended/revoked set — so an unproven or withdrawn account is never told, matching what the
+    // membership read itself believes.
+    const members = await expandLinkSet(org, linkSetId);
+    for (const m of members) {
+      const key = tryPrincipalKey(m.platform, m.tenant, m.nativeId);
+      if (key !== undefined && skip.has(key)) continue;
+      if (!canDeliverDirectMessage(m.platform)) continue;
+      // THE CHEAP HONEST FLOOR. The request still names WHO and never WHERE, so this does not close the multi-workspace DM gap — it stops the SILENT half of it.
+      // When this deployment's arm can name a SINGLE tenant it serves for the platform, and that differs from the member's own recorded tenant, the send is refused BEFORE it is attempted — a skip, not a throw — and the reason goes on an audit row rather than a console line. An INDETERMINATE arm tenant still attempts the send, so this floor can only add loudness to an already-mis-routing delivery and can never break one that used to work.
+      const reach = dmWorkspaceReachableFromConfig(m.platform, m.tenant);
+      if (!reach.reachable) {
+        await appendAudit({
+          org,
+          platform: m.platform,
+          workspace: reach.targetTenant,
+          action: "dm.delivery.skipped",
+          detail: {
+            reason: DM_WORKSPACE_UNREACHABLE_REASON,
+            linkSetId,
+            targetWorkspaceId: reach.targetTenant,
+            armWorkspaceId: reach.armTenant,
+          },
+        }).catch(() => undefined);
+        console.log(`[open-everywhere:identity] link-set ${linkSetId}: SKIPPED notifying ${key ?? `${m.platform} account \"${m.nativeId}\"`} — its workspace ("${reach.targetTenant}") is not the one this deployment's ${m.platform} credential serves ("${reach.armTenant}"); see the dm.delivery.skipped audit row.`);
+        continue;
+      }
+      try {
+        await dispatchDirectMessage(m.platform, { principalId: m.nativeId, text });
+        delivered++;
+      } catch (err) {
+        // Per-account, so one dead arm does not silence the rest of the set.
+        console.log(`[open-everywhere:identity] link-set ${linkSetId}: could not notify ${key ?? `${m.platform} account \"${m.nativeId}\"`}: ${String(err)}`);
+      }
+    }
+  } catch (err) {
+    console.log(`[open-everywhere:identity] link-set ${linkSetId}: member notification skipped: ${String(err)}`);
+  }
+  return delivered;
+}
+
+// Provider arm registration, imported HERE rather than the other way round, so each provider arm file stays free of any dependency on this registry: it exports its arm object and the registry owner wires it.
+// This is also the single place the vendor import graph is pulled in, and it is unchanged overall — the spines already imported every one of these vendors before the arms moved out of them.

package/agent/channels/proactive-dm-manifest.ts

@@ -0,0 +1,113 @@
+// Every direct message this deployment STARTS with a person, declared in one closed table. A DM the agent starts is a message its recipient did not ask for, and the recipient's own stop is the control that answers it — so the question "which planes does the stop reach?" must have ONE written answer rather than as many answers as there are call sites.
+// 🔴 THE DEFECT THIS TABLE EXISTS TO CLOSE (OPE-1855): the stop was read on the `chat.dm` plane alone, while the credential-grant plane opened its own DM road straight at a post arm. Each module was correct on its own, so no unit test could see it. A person who told the agent to stop still received the grant card and the first-use notice, and neither message carried the line that says how to stop.
+// The rule this table states, and `scripts/proactive-dm-road-test.ts` enforces: a module that starts a DM either takes the ROAD (`deliverProactiveDm`, which reads the stop, appends the footer, records the delivery and writes the audit row) or is declared here as `exempt` with a reason a reviewer can weigh. There is no third state.
+// 🔴 WHAT THE LINT ACTUALLY CHECKS, so nobody reads more into it than it proves. It refuses a post-arm DM call in ANY module that is not the road itself or an `exempt` row's module — and that includes the `outranks` rows, so a plane that is on the road cannot quietly open a second one beside it, which is exactly how this defect was born. It reads whole-line comments as prose and a line-leading `deliverDirectMessage:` or `deliverDirectMessage?` as the interface member or an arm's registration; everything else on those names is a call site.
+
+/** One DM plane. A closed union, so a plane cannot reach the road without being declared. */
+export type ProactiveDmPlane =
+  | "chat.dm"
+  | "credential.grant.card"
+  | "credential.grant.notice"
+  | "credential.grant.consent"
+  | "identity.link-set"
+  | "identity.link-consent"
+  | "governance.pane";
+
+/** Where the recipient's stop stands on a plane. `outranks` is the road: the stop refuses the send, whatever the operator granted. `exempt` is a plane that still addresses a post arm directly, and every one of them is a RULING somebody has to defend rather than an oversight nobody can see.
+ * 🔴 THE RULE THAT DECIDES A NEW PLANE: a stop request throttles chattiness, so an important or host-originated message stays exempt. "Stop DMing me" does not mean never DM me; it means you are DMing me too much. */
+export type ProactiveDmStopStanding = "outranks" | "exempt";
+
+export interface ProactiveDmPlaneRow {
+  readonly plane: ProactiveDmPlane;
+  /** The repo-relative modules that emit this plane's DM — what the totality lint greps. */
+  readonly modules: readonly string[];
+  /** What the person receives, in one line. */
+  readonly what: string;
+  readonly stop: ProactiveDmStopStanding;
+  /**
+   * TRUE when a delivery on this plane marks the recipient's `dm_audience` DELIVERY RECORD — the fact `chat.dm` reads to tell a first message from a later one, so that the first one takes an approval card and later ones flow.
+   * 🔴 IT IS THE `chat.dm` PLANE'S FACT AND NOBODY ELSE'S. A grant card that marked it would spend the chat plane's one card on a message nobody proposed there: the next `dm_person` to that person would FLOW, with the model's bytes reaching a human that no reviewer ever saw. The record and the stop are two different questions about one address, and only the stop is shared.
+   */
+  readonly recordsDelivery: boolean;
+  /** Why this plane does not take the road. REQUIRED on `exempt` and absent on `outranks`; the lint pins both directions, so an exemption cannot be added without writing its reason down. */
+  readonly exemptBecause?: string;
+}
+
+/**
+ * THE TABLE. One row per plane, and the lint refuses a DM emitter that appears in no row.
+ * The line between the two standings is WHO THE MESSAGE IS FOR. A plane that carries somebody else's errand to the recipient takes the road: a third party asked, and the recipient's stop is the only thing that answers for them. A plane that tells a person about their OWN identity, or answers a handshake that person themselves began, is a different act, and the stop does not reach it: a stop request throttles chattiness, so an important or host-originated message stays exempt. The three `exempt` rows below are that rule applied, and `scripts/proactive-dm-road-test.ts` pins each one.
+ */
+export const PROACTIVE_DM_PLANES: readonly ProactiveDmPlaneRow[] = [
+  {
+    plane: "chat.dm",
+    modules: ["packages/core/agent/tools/dm_person.ts", "packages/core/agent/approvals/chat-dm.ts"],
+    what: "A message the model wrote, to a person an operator granted.",
+    stop: "outranks",
+    recordsDelivery: true,
+  },
+  {
+    plane: "credential.grant.card",
+    modules: ["packages/core/agent/access/credential-grant-card.ts"],
+    what: "The card that asks an owner to lend their own connector credential to somebody else's conversation.",
+    stop: "outranks",
+    recordsDelivery: false,
+  },
+  {
+    plane: "credential.grant.notice",
+    modules: ["packages/core/agent/access/credential-grant-notice.ts"],
+    what: "The once-per-grant notice that the owner's credential was just used.",
+    stop: "outranks",
+    recordsDelivery: false,
+  },
+  {
+    plane: "credential.grant.consent",
+    modules: ["packages/core/agent/access/credential-grant-card.ts"],
+    what: "The link an owner opens to connect their own account before they can answer a grant card.",
+    stop: "outranks",
+    recordsDelivery: false,
+  },
+  {
+    plane: "identity.link-set",
+    modules: ["packages/core/agent/channels/post-arms.ts", "packages/core/agent/tools/unlink_identity.ts"],
+    what: "The alert that an account joined or left the recipient's own linked identity.",
+    stop: "exempt",
+    recordsDelivery: false,
+    exemptBecause:
+      "It is not somebody else's errand: it tells a person that their OWN identity changed, and it is the only thing that makes a quiet takeover loud. A stop request throttles chattiness and this message is important, so it stays exempt — a security alert about the recipient themselves is not what a person is asking to be spared.",
+  },
+  {
+    plane: "identity.link-consent",
+    modules: [
+      "packages/core/agent/tools/link_identity.ts",
+      "packages/core/agent/identity/link-consent.ts",
+      "packages/core/agent/hooks/link-claim.ts",
+    ],
+    what: "The link handshake: the challenge sent to a named TARGET account, and the answer sent back to the account that started it.",
+    stop: "exempt",
+    recordsDelivery: false,
+    // 🔴 THE TWO HALVES ARE NOT ALIKE, AND THE WEAKER ONE DECIDES THE ROW. `identity/link-consent.ts`
+    // and `hooks/link-claim.ts` answer the initiator's own act. `tools/link_identity.ts` does NOT:
+    // it COLD-DMs the target account, which began nothing, and that file's own comment says an
+    // attacker who initiates at your account produces an unexpected DM naming a stranger. So the
+    // stop does not reach a message a stranger can make arrive, and the reason must say so rather
+    // than describe the comfortable half.
+    exemptBecause:
+      "Mixed, and stated at its weakest: the answers `identity/link-consent.ts` and `hooks/link-claim.ts` send go back to the account that began the handshake, but `tools/link_identity.ts` cold-DMs the named TARGET account, which began nothing — it is the challenge that proves that account's ownership, and its copy names the initiator so the person can judge it. A stopped person can therefore still be made to receive that challenge, repeatedly, by anyone who names their account. It stays exempt on the rule that a stop request throttles chattiness: a challenge against the recipient's own account is important, and silencing it would let a link be claimed without the one message that can contest it. The repetition is the real cost, and it belongs to a rate limit on this plane rather than to the stop. NO SUCH RATE LIMIT EXISTS TODAY: `tools/link_identity.ts` names that gap in its own header, and one DM per TTL-bounded single-use request is the only bound the plane has.",
+  },
+  {
+    plane: "governance.pane",
+    modules: ["packages/core/agent/access/pane-venue.ts"],
+    what: "An admin's own pane read — a usage report, a spend report, a connector disclosure — delivered privately back to the admin who asked for it.",
+    stop: "exempt",
+    recordsDelivery: false,
+    exemptBecause:
+      "It answers the recipient's own tool call. The DM is the private venue for a pane they just asked for, because an org-grain read must not land in a room, so it is a reply rather than a message the agent starts. A stop request throttles chattiness, and an answer the person asked for this minute is not chattiness — silencing it would drop the reply to their own command.",
+  },
+];
+
+/** One plane's row. THROWS on a plane with no row — an undeclared plane must never reach a send. */
+export function proactiveDmPlaneRow(plane: ProactiveDmPlane): ProactiveDmPlaneRow {
+  const row = PROACTIVE_DM_PLANES.find((r) => r.plane === plane);
+  if (row === undefined) throw new Error(`proactive DM plane "${plane}" is not declared in PROACTIVE_DM_PLANES`);
+  return row;
+}

package/agent/channels/propose-scope.ts

@@ -0,0 +1,90 @@
+// propose-scope — WHICH ROOM A PROPOSAL BELONGS TO on a coalesced turn (OPE-1756).
+//
+// THE DEFECT, in one sentence: every propose site derives its scope with `resolvePartition(ctx)`, and
+// a turn that carries a SINGLE auth snapshot — the LAST delivery merged into it — then names
+// whichever room happened to arrive last, not the room that asked. `approvals/flow.ts` reads that key
+// twice: for the approver chain and its pre-approval rules, and for the break-glass HALT address. A
+// seat asked to file a ticket in room A, with an unrelated aside queued from room B, carded the ask
+// against B's approvers and read B's halt.
+//
+// 🔴 THE MERGE THAT PRODUCES THAT TURN IS UNREACHABLE TODAY, AND THIS CODE STAYS ANYWAY (OPE-2041).
+// eve 0.52.5 narrowed its ADJACENT-QUEUED batching rule to "Only batch adjacent queued deliveries
+// when their full auth contexts match", enforced by `jsonValuesEqual(c.auth, t.auth)` in
+// `takeBufferedTurnDelivery`. OE stamps `oe_wake_id` and a per-delivery `oe_delivery_id` into
+// `auth.attributes`, so two AUTH-CARRYING deliveries on one unified window never compare equal and
+// eve never folds them. The measurement OPE-1756 was written against was taken on eve 0.39.0, before
+// the rule existed. (eve's OTHER merge arm — a task COMPLETION COHORT — still fires, and is not this
+// defect: those deliveries carry no `auth` at all, so no room's auth can displace another's.) What
+// follows is therefore a DEFENSIVE GUARD, not a live fix: it is correct either way, it costs one
+// read, and it is the right shape the day eve batches authenticated deliveries again.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the impossibility offline and reds the
+// day it stops holding.
+//
+// 🔴 THE FIX IS THE ROAD THE REPLY PATH ALREADY TAKES, not a second one. `reply` corrects the same
+// coalescing for delegated work through `claimTasksForAddressedWake` + `retargetTaskWakes`: the wake
+// the turn ADDRESSED is the turn's own statement about which conversation it is working for, it has
+// already passed the reply fence, and it is host-minted rather than model-authored. This module reads
+// that same signal and answers the surface key the addressed wake was DISPATCHED from.
+//
+// WHY THE WAKE ROW CARRIES THE KEY AT ALL. A `UnifiedWakeOrigin` names a container and a thread and
+// nothing else — `unifiedThreadRef` answers `slack/<channel>`, never `slack/<team>/<channel>` — so no
+// origin can be reassembled into the three-segment `platform/workspace/surface` key a scope needs.
+// The divert knows it (`input.surfaceKey`) and now writes it beside the origin as a tolerated extra
+// field, exactly as `addressing` rides there (channels/unified-window.ts).
+//
+// FAIL-SOFT ON EVERY UNKNOWN, and the fallback is today's answer. No turn, no addressed wake, a row
+// minted before the field existed, an expired row, a store that could not be paged, a malformed key —
+// all answer the caller's own `resolvePartition(ctx)` key. So a proposal can never be scoped to
+// NOWHERE: the worst unknown costs exactly the behaviour that shipped.
+//
+// 🔴 THE BOUND, STATED RATHER THAN ROUNDED UP: THE FIRST ADDRESSED WAKE WINS. `claimTasksForAddressedWake`
+// records the first wake a turn addresses and later replies never change it (access/dispatch-origin-signal.ts).
+// So a turn that answers room A and then raises a proposal for an ask that came from room B scopes
+// that proposal to A — where `resolvePartition(ctx)` would have answered B, and B was right. That is
+// one wrong room traded for another, not a strict improvement, and it is the same bound the delegation
+// re-point already runs under: the turn's FIRST statement about which conversation it is working for
+// is the only host-minted signal there is. Closing it needs a per-CALL address, which no propose site
+// has and which this task does not hold.
+
+import { currentTurnId, type BindableContext } from "../identity/binding.js";
+import type { Partition } from "../memory/partition.js";
+import { addressedWakeThisTurn } from "../access/dispatch-origin-signal.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { wakeSurfaceKeyFromTargetJson } from "./unified-window.js";
+
+/** A fully-qualified `platform/workspace/surface` key has exactly three non-empty segments. A stored
+ *  value that is not one is not a scope key, and a caller must never be handed one: `parseScopeKey`
+ *  would read it as a different address shape entirely (a bare domain name, a `user:` key). */
+function isSurfaceKey(value: string): boolean {
+  const parts = value.split("/");
+  return parts.length === 3 && parts.every((p) => p.length > 0);
+}
+
+/**
+ * The scope key a proposal raised on THIS turn belongs to — the surface the ADDRESSED wake was
+ * dispatched from, or `partition.surfaceKey` when this turn names no addressed wake or the row cannot
+ * answer.
+ *
+ * `partition` is the caller's own `resolvePartition(ctx)`, already computed for its memory tier and
+ * its venue walk. Those keep reading the turn's own ctx on purpose, and the split is the point:
+ * MEMORY BELONGS TO THE SEAT, while a governed proposal belongs to THE ROOM THAT ASKED. Its `org` is
+ * what the wake row was written under, so it is read from here rather than from a second opinion
+ * about which org this turn is in.
+ *
+ * Never throws — a propose site may not fail because a store blipped, and a failed read here would
+ * turn a card into a tool error.
+ */
+export async function proposalScopeKey(ctx: BindableContext, partition: Pick<Partition, "org" | "surfaceKey">): Promise<string> {
+  const fallback = partition.surfaceKey;
+  try {
+    const addressed = addressedWakeThisTurn(currentTurnId(ctx));
+    if (addressed === undefined || addressed.length === 0) return fallback;
+    if (partition.org.length === 0) return fallback;
+    const json = await getOperationalStore().getUnifiedWakeTarget(partition.org, addressed);
+    if (!json) return fallback;
+    const surfaceKey = wakeSurfaceKeyFromTargetJson(json);
+    return surfaceKey !== undefined && isSurfaceKey(surfaceKey) ? surfaceKey : fallback;
+  } catch {
+    return fallback;
+  }
+}