@open-everywhere/core 0.1.0

package/agent/channels/session-tail-record.ts

@@ -0,0 +1,172 @@
+// session-tail-record — the two WRITERS behind the standing-seat tail. channels/session-tail.ts owns what a tail IS and how it renders; this file owns how it gets recorded.
+// Two seams in two processes, by design: {@link recordWakeTail} runs in the INGRESS process on the structured trigger message, so a tail never inherits a rendered block, and {@link recordPostTail} runs in the WORKFLOW process only AFTER the surface accepted the post, so a reply the arm refused leaves no memory of having been said. Both are BEST-EFFORT and never throw into a caller — a lost entry costs a little continuity, a throw would cost a wake or a post.
+
+import { defineState } from "eve/context";
+import { getOperationalStore } from "../operational/provider.js";
+import type { OperationalStore } from "../operational/store.js";
+import { noteGenerationForRetirement } from "./generation-retirement.js";
+import { buildTail, type SessionTailWakeRow } from "./session-tail.js";
+import { standingSeatRegistryKey } from "./unified-supervisor.js";
+import { bareTokenFromEveContext, classifySessionId } from "./window-key.js";
+import type { WakeMessageInput, WakeTrust } from "./wake-envelope.js";
+
+/** What the workflow process needs to know to file a post against the right generation. Seeded once
+ *  per turn from the turn-start hook, which is the only place holding a live context. */
+export interface TailWindow {
+  readonly org: string;
+  /** The `channel_session` registry key — the same key the spend hook's counter bump targets. */
+  readonly registryKey: string;
+  /** The generation's bare continuation token. It is the ring's partition, so a straggler post from
+   *  a retired generation files under the retired token and is simply never read again. */
+  readonly token: string;
+  readonly platform?: string;
+  /** WHICH ROOM this turn is happening in — the per-container surface key. On a cross-surface window
+   *  it is what stops the seat's own posts merging into one undifferentiated stream. */
+  readonly container?: string;
+}
+
+const windowSlot = defineState<TailWindow | null>("open-everywhere.session-tail-window", () => null);
+
+/**
+ * WHICH GENERATION, if any, this turn files its posts against — the ONE rule that decides it, kept PURE so it is testable without a live turn. Only a STANDING grain gets a window: a task worker, a thread seat, a native/DM/subagent session and any foreign or unparseable token all answer `null`.
+ * The grain test is deliberately NOT `isSupervisorToken`: a delegated worker's TASK WINDOW token carries that substring, and recording its posts would file them on a ring no rotation ever reads. `rawToken` is eve's continuation token verbatim — the namespace strip is this function's job, not the caller's.
+ */
+export function tailWindowFor(input: {
+  readonly org: string;
+  readonly domainKey: string;
+  /** The PER-CONTAINER surface key, not the registry key: on a cross-surface window the registry row
+   *  is one domain but the rooms are many, and this is what tells them apart. */
+  readonly surfaceKey: string;
+  readonly rawToken: unknown;
+  readonly platform?: string;
+}): TailWindow | null {
+  const token = bareTokenFromEveContext(input.rawToken);
+  if (token === undefined || classifySessionId(token).grain !== "standing") return null;
+  return {
+    org: input.org,
+    registryKey: standingSeatRegistryKey(token, input.domainKey) ?? input.domainKey,
+    token,
+    ...(input.platform ? { platform: input.platform } : {}),
+    container: input.surfaceKey,
+  };
+}
+
+/** Seed the per-turn window facts. Called from the turn-start hook. Silently does nothing outside a
+ *  session context (a sessionless schedule, an eval) — those runs have no seat to record for. */
+export function seedTailWindow(w: TailWindow | null): void {
+  try {
+    windowSlot.update(() => w);
+  } catch {
+    /* no session context — nothing to seed */
+  }
+}
+
+/** The seeded window, or null. Exported for tests. */
+export function tailWindow(): TailWindow | null {
+  try {
+    return windowSlot.get();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Record ONE delivered wake message onto the outgoing generation's ring (ingress process).
+ * `entry` is built by the caller from the trigger it already holds, so this function makes no judgement about trust, authorship or visibility: re-deciding any of it here would be a second opinion that can disagree with the first.
+ * 🔴 THE ROW TYPE REQUIRES `refuted` (OPE-1747, {@link SessionTailWakeRow}). A record site that cannot name its author's refutation does not compile, which is what makes the author grain reach EVERY surface's tail rather than the one surface that remembered. Resolve it through `tailAuthorGrain` over the same facts the taint join reads — never by hand, and never by omitting the field, which the read path takes as UNGRADED.
+ */
+export async function recordWakeTail(
+  org: string,
+  registryKey: string,
+  token: string,
+  entry: SessionTailWakeRow,
+  store: OperationalStore = getOperationalStore(),
+): Promise<void> {
+  try {
+    await store.appendSessionTail(org, registryKey, token, entry);
+  } catch (err) {
+    console.warn(`[open-everywhere:session-tail] wake entry not recorded (${registryKey}): ${String(err)}`);
+  }
+}
+
+/**
+ * Record ONE post the seat actually made (workflow process, from the choke point's success path). A post is always `from: "self"` and `trust: "relay"`, the machine-author floor — never raised for being the agent's own words, because the tier says who authored the bytes.
+ * It has exactly TWO callers, both SHARED seams rather than per-surface wiring, and a new post path that reaches neither must call this itself. `id` is what lets a confirmed `edit_reply` rewrite this exact entry, `wake` says which wake the post answered, and the function does nothing when no window is seeded.
+ */
+export async function recordPostTail(
+  post: {
+    readonly text: string;
+    readonly at: string;
+    readonly platform?: string;
+    readonly id?: string;
+    readonly wake?: string;
+  },
+  store: OperationalStore = getOperationalStore(),
+): Promise<void> {
+  const w = tailWindow();
+  if (!w) return;
+  try {
+    await store.appendSessionTail(w.org, w.registryKey, w.token, {
+      kind: "post",
+      at: post.at,
+      from: "self",
+      trust: "relay" satisfies WakeTrust,
+      // GRADED, and the answer is always the same one (OPE-1747): the seat's own words, authored by
+      // this deployment. Written rather than omitted because an omitted `refuted` reads as UNGRADED,
+      // and a post row that read as ungraded would have the seat's own replies withheld from its
+      // successor generation under `authorGrain: "withhold"`.
+      refuted: false,
+      author: "self",
+      ...(post.platform ?? w.platform ? { platform: post.platform ?? w.platform } : {}),
+      ...(w.container ? { container: w.container } : {}),
+      ...(post.id ? { id: post.id } : {}),
+      ...(post.wake ? { wake: post.wake } : {}),
+      text: post.text,
+    });
+  } catch (err) {
+    console.warn(`[open-everywhere:session-tail] post entry not recorded (${w.registryKey}): ${String(err)}`);
+  }
+}
+
+/**
+ * Rewrite the TEXT of the ring row a confirmed `edit_reply` just changed on the platform — the confirmed-success path ONLY, never a definitive refusal and never an ambiguous outcome, which does not know whether the platform changed anything.
+ * The ring is the seat's own record of the room, so once the room's copy changes the ring's copy must change with it. Matched by `messageId` against the ring's `post` rows, so {@link recordPostTail} threading `id` through is the precondition. Best-effort and silent on a miss.
+ */
+export async function editPostTail(messageId: string, text: string, store: OperationalStore = getOperationalStore()): Promise<boolean> {
+  const w = tailWindow();
+  if (!w) return false;
+  try {
+    return await store.editSessionTailPost(w.org, w.registryKey, w.token, messageId, text);
+  } catch (err) {
+    console.warn(`[open-everywhere:session-tail] post entry not edited (${w.registryKey}): ${String(err)}`);
+    return false;
+  }
+}
+
+/**
+ * THE ROTATION READ (ingress process): take the OUTGOING generation's recorded tail, capped and rendered, and drop its ring. Call it with the token of the generation being RETIRED, before minting its successor.
+ * It returns the wake messages the fresh generation's first wake should carry, oldest-first, or `[]` — the caller's signal to fall back to a capped platform fetch. The ring is CLEARED after the read: it has served its only purpose, and the next generation is already writing its own under a different token.
+ *
+ * 🔴 IT IS ALSO THE ROTATION NOTICE (OPE-627). Every standing seat's rotate leg calls this function, with the token of the generation it is about to retire, and it is the ONE seam that holds that token — so it is where {@link noteGenerationForRetirement} learns which generation is owed a reap of its parked workers. The note is in-memory, costs no I/O, and is a no-op for a per-container token; channels/generation-retirement.ts carries the whole design and the three guards that decide whether the retirement is actually issued. Placed BEFORE the tail read, so a store failure that loses the tail does not also lose the retirement.
+ */
+export async function carryTailForward(
+  org: string,
+  registryKey: string,
+  outgoingToken: string | undefined,
+  store: OperationalStore = getOperationalStore(),
+): Promise<WakeMessageInput[]> {
+  if (!outgoingToken) return [];
+  noteGenerationForRetirement({ org, registryKey, token: outgoingToken });
+  try {
+    const ring = await store.readSessionTail(org, registryKey, outgoingToken);
+    const tail = buildTail(ring);
+    // Cleared AFTER the render, not before: a throw in buildTail would otherwise drop the ring and
+    // lose the tail with no way back. Its own catch — a failed clear costs a bounded number of rows
+    // that nothing reads, which is not worth failing a wake for.
+    await store.clearSessionTail(org, registryKey, outgoingToken).catch(() => {});
+    return tail;
+  } catch (err) {
+    console.warn(`[open-everywhere:session-tail] tail not carried forward (${registryKey}): ${String(err)}`);
+    return []; // fail SOFT to the platform-fetch fallback — a rotation never waits on the tail
+  }
+}

package/agent/channels/session-tail.ts

@@ -0,0 +1,140 @@
+// session-tail — the platform-neutral core behind what a fresh generation remembers of the one before it: one generation's own conversation, RECORDED AS IT HAPPENS — the wake messages the deployment delivered to the seat and the posts the seat made in reply, interleaved oldest-first per window. Nothing else carries over; continuity beyond one generation is the agent's own memory and read tools.
+// Recorded rather than REPLAYED out of the outgoing eve transcript, which the rotate leg cannot reach and which would have to parse its own rendered backscroll back out. Tool calls, tool results, reasoning and the agent's terminal completion prose are deliberately NOT recorded — prose is never a delivery channel here, so text that never reached a room would be a memory of something that did not happen.
+
+import type { WakeMessageInput, WakeTrust } from "./wake-envelope.js";
+import { getSettings } from "../settings/settings.js";
+import type { IngestedChatMessage } from "../access/taint-signal.js";
+import type { AuthorTrustQuery } from "../identity/author-trust.js";
+
+/**
+ * One recorded conversational event on a standing seat's generation.
+ * Deliberately FLAT and small: it is stored as JSON in an operational row, so every field has to survive a round-trip through the store with no adapter knowledge. It carries the facts a wake render needs and nothing else.
+ */
+export interface SessionTailEntry {
+  /** `wake` = a message the room sent that woke the seat; `post` = the seat's own reply. */
+  readonly kind: "wake" | "post";
+  /** ISO-8601 of the event. The ONLY ordering key — one window's ring is one timeline. */
+  readonly at: string;
+  /** Who authored it. A `post` is always `self`; a `wake` is `human` or `bot`. */
+  readonly from: "self" | "human" | "bot";
+  /** The trust tier resolved at ingestion. A `post` is `relay` (a machine author, the floor). */
+  readonly trust: WakeTrust;
+  /**
+   * The surface POSITIVELY REFUTED this author's membership, as {@link IngestedChatMessage.refuted} means it (OPE-1747). Written at EVERY record site through {@link tailAuthorGrain}, so it is present — `true` OR `false` — on every row this deployment records.
+   * 🔴 ABSENT IS NOT "NOT REFUTED". It means the row was written before the field existed, so the author was never graded at all, and `withholdsBody` (access/external-policy.ts) reads that UNKNOWN as the fail-closed answer under `authorGrain: "withhold"`. That is the whole reason the field is written even when the answer is `false`: a present `false` is a graded answer, and only a MISSING field is unknown.
+   */
+  readonly refuted?: boolean;
+  /** The OPERATOR's author-trust register query for this row's author — Discord's and Notion's only per-author refutation, since neither surface can answer the membership question itself. Read by the taint join and by the withhold grain, exactly as it is off a {@link WakeMessageInput}. Absent is normal: most surfaces have a verdict of their own and every unarmed tenant contributes nothing. */
+  readonly authorTrust?: AuthorTrustQuery;
+  /** Display name for the render's `author` attribute. Falls back to the raw id at the caller. */
+  readonly author: string;
+  /** Raw platform author id, where the surface knows one (absent on the seat's own posts). */
+  readonly authorId?: string;
+  /** Platform message id, where the surface knows one. */
+  readonly id?: string;
+  /**
+   * WHICH WAKE THIS POST ANSWERED — `post` rows only. A `wake` row never carries it, because the ring's wake rows are messages from the room and the OE wake id is not one of their facts.
+   * It exists for ONE reader, the should-be-edit policy, which must not tell a turn to fold its answer to one question into the message that answers another. Absent on an older row and on the per-surface reply path, and absent reads as "unknown".
+   */
+  readonly wake?: string;
+  /** The surface this happened on — the reason one ring can hold a whole cross-surface domain. */
+  readonly platform?: string;
+  /**
+   * WHICH ROOM it was said in — the container's surface key, rendered as the message's `container` attribute.
+   * It is the cross-surface context-bleed guard on a flat tail: one window can hold several rooms, and a seat that cannot tell them apart can answer into the wrong one.
+   */
+  readonly container?: string;
+  /** The thread ROOT id when this happened inside a thread. */
+  readonly threadRoot?: string;
+  /** The message text. Untrusted by provenance; the wake renderer wraps and escapes it. */
+  readonly text: string;
+}
+
+/**
+ * A row at a RECORD site: {@link SessionTailEntry} with `refuted` REQUIRED (OPE-1747).
+ * 🔴 REQUIRED HERE, OPTIONAL ON THE READ SHAPE, AND THAT ASYMMETRY IS THE WHOLE DESIGN. The read shape must tolerate a row persisted before the field existed, so it cannot require the field; a WRITER always knows the answer, so it must not be allowed to omit it. `typecheck:all` is then the parity gate: a surface that records a wake without resolving its author's refutation does not compile.
+ */
+export type SessionTailWakeRow = Omit<SessionTailEntry, "refuted"> & { readonly refuted: boolean };
+
+/**
+ * THE ONE ROAD every tail record site resolves its author grain through (OPE-1747) — read straight off the SAME {@link IngestedChatMessage} facts the surface already handed the taint join, so a tail row and the join can never disagree about one author.
+ * Before this existed no record site wrote either field, so `tailEntryToWakeMessage` handed `withholdsBody` neither, `nonMemberChatTrust` had nothing to answer with, and a refuted author's bytes reached the model out of a tail-built envelope on a deployment that had declared they must not.
+ * `refuted` is NORMALISED to a boolean on purpose: a graded "no" must be recorded as `false` rather than omitted, because an omitted field is what the read path reads as UNKNOWN. `authorTrust` stays omitted when the surface has none — there the absence is honest, and both the join and the withhold grain already read a missing register as "contributes nothing".
+ */
+export function tailAuthorGrain(facts: IngestedChatMessage): { readonly refuted: boolean; readonly authorTrust?: AuthorTrustQuery } {
+  return { refuted: facts.refuted === true, ...(facts.authorTrust === undefined ? {} : { authorTrust: facts.authorTrust }) };
+}
+
+/** Hard ceiling on ring rows kept per generation. It is a STORAGE bound, not the context bound —
+ *  {@link selectTail}'s token cap is what decides how much reaches the model. Sized so the cap is
+ *  always the binding constraint for any realistic message length. */
+export const SESSION_TAIL_MAX_ENTRIES = 200;
+
+/** Characters per token, the cheap proxy used wherever no tokenizer is available on this path.
+ *  DELIBERATELY LOW (4 is the common English estimate) so the proxy over-counts rather than under-
+ *  counts and the real token cap is never busted. */
+const CHARS_PER_TOKEN = 4;
+
+/** Per-entry rendered overhead in tokens: the `<message …>` attributes plus the untrusted wrapper.
+ *  Calibrated against the envelope's own render, and rounded UP for the same reason as above. */
+const PER_ENTRY_OVERHEAD_TOKENS = 110;
+
+/** The rendered token cost of one entry, by the proxy above. Pure. */
+export function approxEntryTokens(e: SessionTailEntry): number {
+  return Math.ceil((e.text.length + (e.author.length ?? 0)) / CHARS_PER_TOKEN) + PER_ENTRY_OVERHEAD_TOKENS;
+}
+
+/** The shipped tail cap in tokens. A FUNCTION, not a const: a module-load read in core runs before
+ *  `registerSettings`, so a const could never see an app override (the OPE-409 rule). */
+export function tailTokenCap(): number {
+  return getSettings().rotation.tailTokenCap;
+}
+
+/**
+ * Select the tail that fits the cap: walk the ring NEWEST-FIRST, keep entries while they fit, and return what survived in OLDEST-FIRST order, ready to render.
+ * Most-recent-first selection is the whole policy — no clustering, no spine, no enrichment reachback, no session grouping. It ALWAYS keeps at least one entry when the ring is non-empty, so a single oversized message degrades to "one message" rather than to silence.
+ */
+export function selectTail(ring: readonly SessionTailEntry[], capTokens: number = tailTokenCap()): SessionTailEntry[] {
+  const kept: SessionTailEntry[] = [];
+  let tokens = 0;
+  for (let i = ring.length - 1; i >= 0; i--) {
+    const cost = approxEntryTokens(ring[i]);
+    if (tokens + cost > capTokens && kept.length > 0) break;
+    tokens += cost;
+    kept.unshift(ring[i]);
+  }
+  return kept;
+}
+
+/**
+ * Map one recorded entry onto the wake envelope's {@link WakeMessageInput}. The seat's own post renders `from="self"`, which is what makes the tail read as ITS OWN conversation rather than as channel documentation it happens to hold: a fenced line presents the agent's words as established content with no history, and the agent then quotes its own wording back as a document instead of owning the act.
+ * `trigger` is never set here — a tail entry is context, and the ONE trigger of a wake is the live message that woke it.
+ *
+ * 🔴 IT CARRIES THE AUTHOR GRAIN ACROSS (OPE-1747), so a tail-built envelope is judged by the same two legs a freshly-fetched one is: `refuted` for the surface's own verdict, `authorTrust` for the operator's register. Until it did, `withholdsBody` answered false on every tail sibling and a refuted author's bytes reached the model on a deployment that declared they must not.
+ * A row with NO `refuted` field was written before that field existed, so its author was never graded. It rides as `ungraded: true` — the fail-closed input for the withhold grain, and deliberately NOT `refuted: true`, which would be a claim about the author that nothing measured and would mark the turn on the shipped `taint` grain. A `post` row is exempt by its tier: the seat's own words are `relay`, the machine floor, which every leg refuses to grade.
+ */
+export function tailEntryToWakeMessage(e: SessionTailEntry): WakeMessageInput {
+  return {
+    from: e.from,
+    author: e.author,
+    ...(e.authorId ? { authorId: e.authorId } : {}),
+    id: e.id ?? `${e.kind}:${e.at}`,
+    sentAt: e.at,
+    trust: e.trust,
+    ...(e.refuted === true ? { refuted: true } : {}),
+    ...(e.refuted === undefined ? { ungraded: true } : {}),
+    ...(e.authorTrust === undefined ? {} : { authorTrust: e.authorTrust }),
+    ...(e.container ? { container: e.container } : {}),
+    ...(e.threadRoot ? { type: "thread" as const, threadRoot: e.threadRoot } : {}),
+    body: e.text,
+  };
+}
+
+/**
+ * The whole core in one call: order the ring, cap it, and emit oldest-first wake messages.
+ * The sort by `at` is NOT redundant with the store's ordering: one window's ring takes writes from two processes, so insertion order can differ from real time by the width of that race, and the rendered tail must read as a conversation.
+ */
+export function buildTail(ring: readonly SessionTailEntry[], capTokens: number = tailTokenCap()): WakeMessageInput[] {
+  const ordered = [...ring].sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.kind.localeCompare(b.kind));
+  return selectTail(ordered, capTokens).map(tailEntryToWakeMessage);
+}

package/agent/channels/slack-bridge.ts

@@ -0,0 +1,125 @@
+// slack-bridge — the ONE registration seam for the Slack behaviours core's generic spine still needs. Core owns the seam and the fail-closed defaults; registerSlackProvider() registers the live arms at app boot.
+// With no bundle registered every default mirrors "Slack not configured": a form post answers undefined, a read call throws, a display name is undefined, the internal-channel trust gate stays closed, the DM-partner verdict is external, and the channel is undefined so a dispatcher dry-runs rather than mis-addressing a send.
+
+import type { Channel } from "eve/channels";
+import type { BindableContext } from "../identity/binding.js";
+import { processRegistrySlot } from "../lib/process-registry.js";
+import { swallowRoomOp } from "./egress-spoof.js";
+
+/** The Slack Web API caller shape — matches the bundle's `slackForm` exactly (method + form body,
+ *  optional token override; undefined on any failure). */
+export type SlackFormFn = (method: string, body: string, token?: string) => Promise<Record<string, unknown> | undefined>;
+
+/** The fail-loud read-call shape — matches the bundle's `callSlackRead` (throws on missing token /
+ *  non-ok response). */
+export type SlackReadCallFn = (
+  operation: string,
+  params: Record<string, string | number | boolean>,
+) => Promise<{ readonly ok: boolean; readonly error?: string; readonly [key: string]: unknown }>;
+
+/** Everything the generic spine consumes from the Slack provider. */
+export interface SlackBridge {
+  /** Raw form-encoded Web API POST (chat.postMessage / chat.update / users.info / …). */
+  readonly form: SlackFormFn;
+  /** Fail-loud Web API call (reactions.add, files.*, chat.postMessage where an error must surface). */
+  readonly readCall: SlackReadCallFn;
+  /** Cached users.info display-name lookup. */
+  readonly fetchUserDisplayName: (userId: string) => Promise<string | undefined>;
+  /** Cached conversations.info display-name lookup. */
+  readonly fetchChannelDisplayName: (channelId: string) => Promise<string | undefined>;
+  /** The bot's own display name (auth.test plus users.info, cached). This member stays the bundle's one source for that name; instructions/access.ts reads it through the per-surface bot-display-name registry instead. */
+  readonly botDisplayName: () => Promise<string | undefined>;
+  /** Fail-closed TTL-cached conversations.info internal-channel gate. */
+  readonly confirmChannelInternal: (channelId: string) => Promise<boolean>;
+  /** DM-partner membership verdict from a users.info payload (fail-closed to external). */
+  readonly partnerFactsFromInfo: (info: unknown, expectedTeamId?: string) => { dmPartnerTrust: "internal" | "external" };
+  /** The Slack eve channel definition — what a dispatcher passes to `receive()`. */
+  readonly channel: Channel<any, any, any>;
+}
+
+// PROCESS-GLOBAL slot: registerSlackProvider() writes from one module identity while core reads from another.
+// Most readers below degrade to undefined or false when unregistered, so a split registry silently behaves as "no Slack provider wired". See lib/process-registry.ts.
+const bridgeSlot = processRegistrySlot<SlackBridge>("slack-bridge.v1");
+
+/** Register (or replace) the Slack bridge. Called once from registerSlackProvider() at boot. */
+export function registerSlackBridge(b: SlackBridge): void {
+  bridgeSlot.set(b);
+}
+
+export function _resetSlackBridgeForTest(): void {
+  bridgeSlot.set(null);
+}
+
+/** The registered bridge, or null when no Slack provider is wired (callers fail closed). */
+export function slackBridge(): SlackBridge | null {
+  return bridgeSlot.get();
+}
+
+/**
+ * The Slack Web API methods that CHANGE WHAT A ROOM SEES, and therefore take the egress spoof's shared exit. An ALLOWLIST rather than a "not a read" heuristic: a new WRITE missing from this set is a coverage hole, while a new READ needs no edit at all — the safer direction, because a read swallowed by mistake would blind the agent.
+ * This is the SECOND layer, not the first: the reply, card, notice, edit and reaction spines each gate BEFORE resolving a transport, because they owe their caller a usable answer. This layer covers every OTHER core feature that posts through the bridge directly and carries no gate of its own.
+ */
+const SLACK_ROOM_WRITE_METHODS = new Set([
+  "chat.postMessage",
+  "chat.postEphemeral",
+  "chat.update",
+  "chat.delete",
+  "chat.scheduleMessage",
+  "reactions.add",
+  "reactions.remove",
+  "files.getUploadURLExternal",
+  "files.completeUploadExternal",
+]);
+
+/**
+ * The synthetic answer a swallowed Slack write hands back — Slack's own success shape, so every caller's `ok`/`ts` check reads exactly as it would on a live workspace.
+ * `ts` rides on every shape: a caller that wants one gets one, and a caller that does not simply ignores it.
+ */
+function spoofedSlackWrite(method: string): Record<string, unknown> {
+  return { ok: true, ts: `spoof-slack-${Date.now()}`, channel: "spoof-slack-channel", method };
+}
+
+/** `slackForm` through the bridge — undefined when unregistered (≙ no bot token configured).
+ *  A room-write method under `OE_EGRESS_SPOOF` is swallowed here and answered `ok: true`. */
+export const bridgeSlackForm: SlackFormFn = async (method, body, token) => {
+  if (SLACK_ROOM_WRITE_METHODS.has(method) && swallowRoomOp(`a slack ${method} call`)) return spoofedSlackWrite(method);
+  return bridgeSlot.get() ? bridgeSlot.get()!.form(method, body, token) : undefined;
+};
+
+/** `callSlackRead` through the bridge — THROWS when unregistered (the same fail-loud posture a
+ *  missing bot token always produced on this path). A room-write operation under `OE_EGRESS_SPOOF`
+ *  is swallowed BEFORE that check, so a spoofed run needs no Slack provider to post nothing. */
+export const bridgeSlackReadCall: SlackReadCallFn = async (operation, params) => {
+  if (SLACK_ROOM_WRITE_METHODS.has(operation) && swallowRoomOp(`a slack ${operation} call`)) {
+    return spoofedSlackWrite(operation) as { readonly ok: boolean; readonly [key: string]: unknown };
+  }
+  if (!bridgeSlot.get()) throw new Error("no Slack provider is registered — the Slack Web API is unavailable (registerSlackProvider).");
+  return bridgeSlot.get()!.readCall(operation, params);
+};
+
+export async function bridgeFetchUserDisplayName(userId: string): Promise<string | undefined> {
+  return bridgeSlot.get() ? bridgeSlot.get()!.fetchUserDisplayName(userId) : undefined;
+}
+
+export async function bridgeFetchChannelDisplayName(channelId: string): Promise<string | undefined> {
+  return bridgeSlot.get() ? bridgeSlot.get()!.fetchChannelDisplayName(channelId) : undefined;
+}
+
+export async function bridgeBotDisplayName(): Promise<string | undefined> {
+  return bridgeSlot.get() ? bridgeSlot.get()!.botDisplayName() : undefined;
+}
+
+/** Fail-closed: unregistered ⇒ never "internal". */
+export async function bridgeConfirmChannelInternal(channelId: string): Promise<boolean> {
+  return bridgeSlot.get() ? bridgeSlot.get()!.confirmChannelInternal(channelId) : false;
+}
+
+/** Fail-closed: unregistered ⇒ the partner verdict is external. */
+export function bridgePartnerFactsFromInfo(info: unknown, expectedTeamId?: string): { dmPartnerTrust: "internal" | "external" } {
+  return bridgeSlot.get() ? bridgeSlot.get()!.partnerFactsFromInfo(info, expectedTeamId) : { dmPartnerTrust: "external" };
+}
+
+/** The Slack channel definition, or undefined when no provider is wired (dispatchers dry-run). */
+export function bridgeSlackChannel(): Channel<any, any, any> | undefined {
+  return bridgeSlot.get()?.channel;
+}

package/agent/channels/stand-down-silence.ts

@@ -0,0 +1,110 @@
+// stand-down-silence — THE TURN THAT HAS ALREADY SPOKEN INTO A STOOD-DOWN CONVERSATION ENDS SILENT (OPE-1647).
+// A `stand_down` asks the model for one line back and then the end of the turn. Two mechanisms already carry half of that: `tools/reply.ts` re-reads the stored stop per post and allows exactly ONE (channels/reply-signal.ts §STOPPED), and `tools/no_reply.ts` refuses the silence call while that one line is still owed (§STOOD-DOWN). Neither reaches the turn's FINAL TEXT.
+// 🔴 ONE DOOR IS LEFT WHERE THAT TEXT STILL POSTS, AND THIS MODULE IS WHY IT SHUTS (OPE-2006). The chat surfaces and GitHub's native arm DROP their closing prose structurally now (`channels/closing-prose-drop.ts`), so the latch has nothing to shut there. Linear's NATIVE arm still hands a non-silent verdict to the framework's default poster, which emits the terminal text as a visible comment — that is the door this guard covers.
+// 🔴 THAT IS THE DOOR THE SHIP MEASURED. On deploy #187 the seat stood down at 09:40:42, drew `reply.no_reply_after_stand_down` at 09:40:46 — the REFUSAL, which records no silence — posted its acknowledgement through `reply` at 09:40:50, and then posted its trailing prose at 09:41:01 because nothing had recorded silence for `finalMessageActionForTurn` to read. The `no_reply` the model called was refused, so the one signal that drops terminal text was never set. J-ENGAGED-slack's `observedSilent` gate reads the second post.
+// SO THE REPLY PATH LATCHES SILENCE WHERE IT SPENDS THE STAND-DOWN VALVE. `spendStoppedAck` (tools/reply.ts) runs after a post has really landed into a conversation the read saw as stopped — the exact moment the owed acknowledgement is known to be OUT — and that is the only writer here.
+// 🔴 IT LATCHES ON THE POST, NEVER ON THE STAND-DOWN, and the difference is the whole safety of this module. `stand_down` names one route per delivery arm (OPE-1580): on a seat whose closing prose the host DROPS the acknowledgement travels by `reply`, and on a seat whose closing prose POSTS the acknowledgement IS the turn's final text. Latching at the stand-down would drop that text on the second kind of seat, which is precisely the lost acknowledgement OPE-1580 closed. A seat that never calls `reply` never reaches `spendStoppedAck`, so its final text still posts.
+// TURN-ID KEYED, and NOT the bare read-and-reset channels/no-reply-signal.ts uses. That older shape is what OPE-805 had to fix on §POSTED: a mark its own turn never consumed answered a LATER turn's read. The fail direction matters more here than there — this signal SILENCES text the model has already written, and a cross-surface session coalesces conversations, so a bled latch would drop an answer owed to a room nobody stopped.
+// FAIL-OFF in every direction: no context, no turn id, a turn id that does not match, or any throw reads as "post it". An unwritable slot leaves the turn exactly as it behaved before this module existed, and the reply tool's own §STOPPED refusal still bounds the runaway.
+
+import { defineState } from "eve/context";
+
+/** The turn a stand-down silence latch was set under. A plain object, not a bare boolean — the turn
+ *  id is what stops a latch this turn never consumed from silencing a later turn. */
+interface StandDownSilence {
+  readonly turnId: string;
+  readonly silent: true;
+}
+
+const slot = defineState<StandDownSilence | null>("open-everywhere.stand-down-silence", () => null);
+
+/**
+ * The `FinalMessageAction.reason` a turn silenced by this latch carries. Its own string, never
+ * folded into the `no_reply` tool's reason: an operator reading "why did this turn go quiet" must be
+ * able to tell a judged silence from a stop the agent was asked to honour, and the two say different
+ * things about whether the seat behaved.
+ */
+export const STAND_DOWN_SILENCE_REASON = "stand-down: this turn already posted its acknowledgement into the stopped conversation";
+
+/**
+ * The audit action the ONE post a stored stand-down allows carries — written by `tools/reply.ts`
+ * where it spends the valve, so the row exists exactly when a post really landed.
+ *
+ * 🔴 IT IS THE SEPARATOR THE PLANE WAS MISSING (OPE-1647). `reply.post` says a message went out; it
+ * does not say whether the conversation was stopped at the time, and the ship report could not tell
+ * a post made through a door that read the stop from one made by a door that never did. This row is
+ * written only by the former. It carries `detail.anchor` — the engagement registry's own key — so it
+ * joins to `engagement.stood_down` and to the `reply.post` beside it on one value rather than on a
+ * partition that names a whole channel.
+ *
+ * 🔴 IT COVERS THE `reply` VERB ONLY, AND AN ABSENT ROW IS NOT A VIOLATION BY ITSELF. On Linear's
+ * native arm — the one seat left whose closing prose posts — the acknowledgement a stand-down asks
+ * for IS the turn's final text (OPE-1580), emitted by the framework's own default poster. That door
+ * reads no stored stop, so it writes no row here, and that post is the legitimate acknowledgement
+ * rather than a stop violation. What the row separates is the two DOORS. Reading it as a verdict on
+ * intent would mark the very acknowledgement OPE-1580 exists to preserve.
+ */
+export const REPLY_STAND_DOWN_ACK_ACTION = "reply.stand_down_ack";
+
+/** Latch this turn silent: a post has LANDED into a conversation the stored stand-down is on, so the
+ *  one line the stop asked for is out and the turn's trailing text must not follow it. No-op without
+ *  a turn id — an unidentifiable turn can carry no latch, and the guard then stays OFF. */
+export function markStandDownSilenceThisTurn(turnId: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  try {
+    slot.update(() => ({ turnId, silent: true }));
+  } catch {
+    /* no session context here — the guard degrades to OFF, exactly as the header says */
+  }
+}
+
+/**
+ * PEEK without consuming: is this turn latched silent? For a mid-turn reader that must not disturb
+ * the read-and-reset contract `message.completed` owns — the same split `peekNoReplyThisTurn`
+ * (channels/no-reply-signal.ts) makes for the silence signal.
+ * `false` whenever `turnId` is unidentifiable or does not match the turn the latch was set under.
+ */
+export function peekStandDownSilenceThisTurn(turnId: string | undefined): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = slot.get();
+    return cur !== null && cur.turnId === turnId;
+  } catch {
+    return false;
+  }
+}
+
+// THE DURABLE HALF OF THE LATCH IS GONE WITH THE DOOR IT GUARDED (OPE-1652, deleted by OPE-2006).
+// `standDownSilenceLatchedDurably` read `stoppedAck` off the turn's durable row so that a turn
+// INTERRUPTED before its step completed, and then REPLAYED, still dropped its trailing prose — the
+// slot above is serialized into the turn STEP, so a replay reads it empty. It had exactly ONE caller,
+// `postTerminalProse`, and that poster is deleted: the chat surfaces and GitHub's native arm now drop
+// closing prose STRUCTURALLY, so a replayed turn on those seats posts nothing whatever the slot says.
+// 🔴 THE RESIDUAL IS STATED RATHER THAN GUARDED. Linear's native arm still posts its closing prose
+// through the framework's default poster, and that arm never called the durable read — it reads the
+// slot through `finalMessageActionForTurn`, which is synchronous. So a REPLAYED stood-down turn on
+// Linear's native arm can still post trailing prose. That was true before this deletion too; nothing
+// regressed, and closing it needs the durable read on a synchronous decision, which is its own change.
+// `stoppedAck` itself is untouched and still read by `tools/reply.ts` (§STOPPED), which is what bounds
+// the runaway.
+
+/**
+ * Read-and-reset: is this turn latched silent? Called once, on the terminal branch, by
+ * `finalMessageActionForTurn`.
+ *
+ * 🔴 IT ALWAYS CLEARS, AND IT ONLY ANSWERS TRUE FOR ITS OWN TURN. The two halves are separate
+ * promises and both are load-bearing. Clearing unconditionally — including on a caller that passes
+ * NO turn id — is what stops a latch from outliving the turn that set it. Comparing the turn id is
+ * what stops a latch whose own turn never completed from silencing the next one. A caller with no
+ * turn id therefore gets today's behaviour, never a silence this function cannot prove is owed.
+ */
+export function consumeStandDownSilenceThisTurn(turnId: string | undefined): boolean {
+  try {
+    const cur = slot.get();
+    const was = turnId !== undefined && turnId.length > 0 && cur !== null && cur.turnId === turnId;
+    slot.update(() => null);
+    return was;
+  } catch {
+    return false;
+  }
+}