@open-everywhere/provider-github 0.0.0-stage → 0.1.0

package/agent/channels/github.ts

@@ -0,0 +1,1458 @@
+// GitHub — a PROPER conversational surface (not just an event pipe). This adopts eve's
+// native `githubChannel`: an @mention of the bot in an issue, PR, or review comment wakes
+// an agent session, with the repo checked out into the sandbox and the PR diff already in
+// context; the reply comes back as a comment (plus an `eyes` reaction on the triggering
+// comment). It takes GitHub App webhooks at POST /eve/v1/github, verifies the signature,
+// and binds REAL GitHub identity (owner=workspace, repo=surface, issue/PR=anchor) via the
+// onComment hook (agent/channels/github-identity.ts → bindGitHub in identity/binding.ts),
+// so memory + access + routines key off the actual repo/actor/visibility.
+//
+// THREE legs share the one POST /eve/v1/github route:
+//   1. The NATIVE @mention leg (eve's githubChannel — session, checkout, PR diff, reply).
+//   2. The event→Slack routine FAN-OUT (PR opened, CI failed, …) — the pre-native behaviour,
+//      preserved via route-handler composition (see the wrapper note below).
+//   3. The AMBIENT-SUPERVISOR leg (NEW): every NON-mention issue/PR-timeline comment on an
+//      opted-in (ambientSupervisor domain flag), positively-PRIVATE repo is judged by a
+//      standing per-repo supervisor session under a reserved `github:<owner>/<repo>:oe-sup:g<n>`
+//      token — the GitHub adopter of the surface-general ambient pattern (github-supervisor.ts
+//      is the tested core; this file is the thin wiring, mirroring notion.ts). The classifier
+//      DROPS mentions (leg 1 owns them — the legs partition every comment) and fails closed on
+//      public/unknown-privacy repos, an unset slug, and bot/self authors.
+//
+// ── Preserving the Phase-3 event→Slack fan-out (the reconciliation) ──────────────────
+// Before this, github.ts was a CUSTOM defineChannel route that only fanned GitHub events
+// (PR opened, CI failed, issue labelled, …) out to Slack as `event`-routine dispatches —
+// the agent didn't LIVE on GitHub. The native channel wants the SAME path
+// (POST /eve/v1/github), so we RECONCILE rather than drop one.
+//
+// WHY a route WRAPPER and not the native onIssue/onPullRequest/onCheckSuite hooks (the
+// obvious "move the fan-out into the hooks" shape): those inbound hooks are handed only
+// { conversation, delivery, github, repository, sender, thread } — they have NO
+// cross-channel `receive`, so they physically cannot start a Slack session (verified
+// against eve's dispatch internals: buildInboundContext passes no receive/send to the
+// handler). The cross-channel `to` primitive only exists on the ROUTE handler's args. So we keep
+// the native channel intact and wrap its single POST route: on each delivery we run the fan-out
+// FIRST (we have `args.to` here → Slack), then delegate the untouched request to the
+// native handler for the @mention/session/checkout behaviour. Both legs run on the one
+// route. The channel's adapter (kindHint "github", events, context, state) and its
+// `receive` (proactive github sessions) are preserved by spreading the native object and
+// swapping only the route handler — eve still treats this as the github channel, so
+// `send` inside the native handler dispatches a real github turn.
+//
+// ── Supervisor-aware events (the eve #623 axis, used SAFELY) ──────────────────────────
+// eve installs default handlers for turn.started (eyes reaction + repo checkout),
+// message.completed (posts the reply), and turn.failed/session.failed (error comment); an
+// authored `events` entry REPLACES the default for that key (#623's destructive axis). We
+// author exactly those four keys, but each handler forks on the SESSION KIND and delegates
+// every NON-supervisor turn to the default via a PRISTINE second githubChannel instance's
+// compiled adapter (same config ⇒ byte-identical defaults) — so the mention path keeps its
+// checkout/reply/error behaviour untouched. Supervisor turns take the OE arm instead:
+//   • turn.started  — NO eyes reaction (an ambient judge silently reading every comment must
+//     not telegraph 👀 on each one), NO checkout (a judge turn doesn't need the working tree);
+//     snapshot the per-turn reply target from the delivery's auth attributes (eve rewrites
+//     session.auth.current per delivery — the same T1.4 pattern slack.ts/notion.ts use,
+//     because a resumed session's send-state seed is NOT reapplied).
+//   • message.completed — finalMessageActionForTurn (NO_REPLY sentinel + audited no_reply
+//     TOOL both suppress); judged silence writes a github.no_reply audit row (parity with
+//     Slack/Notion); a real reply posts host-side to the SNAPSHOT target via
+//     channel.github.request (installation-token REST), wrapped in postOnce (crash-resume
+//     idempotency, mirroring slack.ts's supervisor-reply). FAIL SAFE: no target ⇒ post
+//     NOTHING, never into a guessed issue.
+//   • turn.failed / session.failed — audit + log, NO error comment (a failed ambient judge
+//     turn must not spam the repo; the reserved posture).
+//
+// The fan-out core (normalize/match/prompt/gate) is the tested logic in
+// agent/routines/events.ts, unchanged. The supervisor core (classify/extract/wake/rotate)
+// is the tested logic in agent/channels/github-supervisor.ts. This route is
+// operator-validated live; the pure cores are unit-tested.
+//
+//   4. The INSTALLATION leg (installationDelivery below): the App's `installation` /
+//      `installation_repositories` events register (or revoke) the owner→installation_id entry the
+//      SCM plane mints tokens with, so a new org installing the App is self-service end-to-end
+//      instead of needing an OE_GITHUB_INSTALLATIONS env edit + redeploy. The env map stays
+//      AUTHORITATIVE; discovered installs only augment it (scm/installations.ts).
+//
+// Point the GitHub App webhook at POST /eve/v1/github (content-type application/json),
+// secret = GITHUB_WEBHOOK_SECRET (REQUIRED — unset rejects every delivery 401, fail-closed;
+// the `webhooks.allowUnverifiedGithub` setting is the dev-only fan-out escape hatch). Subscribe to
+// issue_comment + pull_request_review_comment for @mention turns (issue_comment also feeds
+// the ambient leg), issues / pull_request / check_suite / check_run / workflow_run for
+// the routine fan-out, and installation + installation_repositories for the installation leg.
+//
+// Live e2e: scripts/e2e/scenarios.ts J-GH (capability "github" — self-skips without creds). It
+// posts a real @mention (checkout + reply), verifies the mention gate drops non-mentions, audited
+// silence (github.no_reply over GET /control/v1/audit), and reply-targeting across two issues on
+// one repo supervisor session. Still needs a live opted-in repo + App install + Tommy for
+// provisioning.
+
+import type { HttpRouteDefinition, RouteHandlerArgs } from "eve/channels";
+import { githubChannel, type GitHubChannel, type GitHubChannelState, type GitHubInboundContext, type GitHubComment, type GitHubInboundResult } from "eve/channels/github";
+import { buildGitHubAuth, githubAuthorFacts, githubBotMentioned } from "./github-identity.js";
+import {
+  githubEngagedAdmits,
+  githubEngagedFollowUpReach,
+  githubMachineAuthored,
+  githubWakeAddressing,
+  markGitHubEngaged,
+  resolveGitHubEngagement,
+  type GitHubEngagementVerdict,
+  type GitHubSeamFacts,
+} from "./github-engagement.js";
+import { parseGitHubStopComment, routeGitHubStopComment } from "./github-stop.js";
+import { liveGitHubReactionFeedbackDeps, parseGitHubReactionPollTarget, routeGitHubReactionFeedback } from "./github-reaction-feedback.js";
+import {
+  classifyGitHubAmbientComment,
+  extractGitHubAmbientEvent,
+  githubDispatchAuditDetail,
+  githubSupervisorToken,
+  handleGitHubSupervisorDispatch,
+  shouldRotate,
+  type GitHubAmbientEvent,
+  type GitHubSupervisorDeps,
+} from "./github-supervisor.js";
+// Everything core rides the ONE adapter-api barrel (boundary rule 4). The event→Slack routine
+// fan-out (fanOutGitHubDelivery) + the webhook signature gate (gateGithubDelivery) are core-owned
+// routines-plane helpers this bundle calls; the fan-out's slack-channel/routines internals never
+// cross the barrel (see routines/github-fanout.ts).
+import { extractGitHubInstallationEvent, handleGitHubInstallationDelivery } from "./github-installations.js";
+import {
+  recordGitHubInstallation,
+  forgetGitHubInstallation,
+  supervisorGrainFor,
+  mintRotationToken,
+  claimRuntimeRotation,
+  stampMintedRuntime,
+  grainUsesUnifiedWindow,
+  mintWakeId,
+  vendorInstantEventTime,
+  spreadVendorTs,
+  singleWindowMentionPolicy,
+  isVouchedInternal,
+  divertInboundToUnifiedWindow,
+  finalMessageActionForTurn,
+  completeSupervisorTurn,
+  consumeSupervisorReplyMark,
+  dropClosingProse,
+  resolvePartition,
+  type ChatAuditPartition,
+  auditSupervisorFailure,
+  healPrunedDeploymentStrand,
+  capabilitiesForPlatform,
+  appendAudit,
+  ingressSpendGate,
+  auditAmbientSkip,
+  deploymentOrg,
+  resolveWakeTrustFromContext,
+  getConfig,
+  ambientSupervisorEnabled,
+  engagementTierFor,
+  getOperationalStore,
+  postOnce,
+  gateGithubDelivery,
+  getSettings,
+  fanOutGitHubDelivery,
+  resolveExternalPolicy,
+  externalPolicyOverrideFor,
+  roomIsSilenced,
+  withholdsBody,
+  EXTERNAL_MENTION_ACK,
+  owesSuppressedMentionAck,
+  suppressionRendering,
+  stampNonMemberChatAuth,
+  type IngestedChatMessage,
+  type SupervisorGrain,
+  type UnifiedWindowWake,
+  type EngagementTier,
+  type ExternalPolicy,
+  carryTailForward,
+  type WakeMessageInput,
+  recordWakeTail,
+  seatCatchUp,
+  seatAdmissionFor,
+  ENGAGED_FOLLOW_UP_CONTEXT,
+  OE_ADDRESSED_ATTR,
+  dispatchNativeWakeWithRetry,
+} from "@open-everywhere/core/agent/adapter-api.js";
+
+const ROUTE = "/eve/v1/github";
+const BOT_NAME = process.env.GITHUB_APP_SLUG;
+
+function log(msg: string): void {
+  console.log(`[open-everywhere:routines] ${msg}`);
+}
+
+function slog(msg: string): void {
+  console.log(`[open-everywhere:github-supervisor] ${msg}`);
+}
+
+function ilog(msg: string): void {
+  console.log(`[open-everywhere:github-installations] ${msg}`);
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+/** A raw webhook field read as a POSITIVE integer id, else undefined (OPE-958). GitHub sends
+ *  `in_reply_to_id` as a JSON number and `null` on a thread-opening comment, so `null`, `0` and a
+ *  non-number all have to answer the same "no id here". */
+function num(v: unknown): number | undefined {
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined;
+}
+
+// The event→Slack routine FAN-OUT (fanOut/fanOutDelivery) moved to core's routines/github-fanout.ts
+// (fanOutGitHubDelivery) in OPE-114 stage 4 — it is a routines-subsystem bridge, not the chat
+// surface, and owns the slack-channel + routines internals a bundle must not import. wrapRoute
+// below calls the barrel-exported fanOutGitHubDelivery as its pre-native pre-step.
+
+// --- the ambient-supervisor leg -------------------------------------------------------
+
+/** The supervisor session's durable state: a valid GitHubChannelState (so eve's context
+ *  factory rebuilds cleanly) + the OE marker the event forks key on + the per-TURN reply
+ *  target (turn.started snapshot — the send-state seed is creation-only, see the header).
+ *  `oeUnified` marks a session CREATED as the UNIFIED (org, domain) session (grain fixed for
+ *  the session's lifetime); on that path the reply target ALSO carries the per-wake owner/repo
+ *  so a multi-repo domain session answers into the repo that woke it, never the seed repo. */
+type GitHubSupervisorSessionState = GitHubChannelState & {
+  oeSupervisor?: boolean;
+  oeUnified?: boolean;
+  oeReplyTarget?: { issueNumber: number; owner?: string; repo?: string };
+};
+
+function isSupervisorGitHubState(state: unknown): state is GitHubSupervisorSessionState {
+  return (state as Record<string, unknown> | undefined)?.["oeSupervisor"] === true;
+}
+
+/** Seed state for a supervisor session: repo-scoped, no conversation anchor (the per-turn
+ *  snapshot supplies the reply target), every checkout field null (supervisor turns never
+ *  check out). Satisfies GitHubChannelState so rebuildGitHubContext / the github handle work.
+ *  `unified` stamps `oeUnified` (a session's grain is fixed for its lifetime — eve applies the
+ *  seed at creation only); absent on the per-repo path so flag-off state is byte-identical. */
+function supervisorSeedState(ev: GitHubAmbientEvent, unified: boolean): GitHubSupervisorSessionState {
+  return {
+    ...(unified ? { oeUnified: true } : {}),
+    baseRef: null,
+    baseSha: null,
+    checkoutPath: null,
+    conversationKind: "issue",
+    defaultBranch: null,
+    headRef: null,
+    headSha: null,
+    installationId: ev.installationId ?? null,
+    issueNumber: null,
+    owner: ev.owner,
+    pullRequestNumber: null,
+    repo: ev.repo,
+    repositoryId: ev.repositoryId ?? 0,
+    reviewCommentId: null,
+    reviewThreadRootCommentId: null,
+    triggeringCommentId: null,
+    triggeringUserLogin: null,
+    oeSupervisor: true,
+  };
+}
+
+/**
+ * Does the AMBIENT leg keep this comment — the second half of the two-leg partition (OPE-1695)?
+ * 🔴 THE CHATTINESS FLAG IS BELOW THE CLASSIFIER NOW, AND THAT IS WHAT KEEPS THE LEGS COMPLEMENTARY.
+ * It used to gate the whole leg, which was safe only while a seat REQUIRED `ambientSupervisor`: the
+ * native leg stood down (`shouldSuppressNativeMention`) exactly when this leg was live. Seats are
+ * universal since OPE-1695, so with the flag gating the whole leg a VOUCHED repo whose domain is
+ * addressed-only suppressed the native session AND returned here — and the @mention reached NOBODY.
+ * An ADDRESSED comment is an address, and addressing never depended on the flag; only ambient talk
+ * does, and a refused ambient comment still records its skip row exactly as before.
+ *
+ * 🔴 AN ENGAGED CONTAINER'S PLAIN FOLLOW-UP IS AN ADDRESS TOO (OPE-1740/OPE-1745), AND THAT IS THE
+ * THIRD INPUT. Moving the flag below the classifier fixed the mention and left the follow-up behind:
+ * on the SAME seated, vouched, addressed-only repo the native leg still stands down for every
+ * comment (`shouldSuppressNativeMention` asks `singleWindowMentionPolicy` with `isMention` pinned
+ * true), so the engaged follow-up came here — and a `thread-follow` addressing with the flag off was
+ * refused `domain-refused` before the seam was ever read. Measured on deploy #201: the plain
+ * follow-up in an ENGAGED issue of `oe-e2e-addressed-github` produced
+ * `github.ambient_skipped {reason: "domain-refused"}` three seconds after the mention's reply, and
+ * NO leg answered it. An @mention ENROLLED the container, so the enrolment is what addresses the
+ * comment; the domain opt-in governs UNINVITED talk and has never governed an address.
+ *
+ * Pure, so the partition is a truth table a test can walk: `drop` is the classifier's own refusal
+ * (a bot author, an un-vouched public repo, a mention the native leg owns), and nothing re-opens it.
+ * `engagedFollowUp` is REQUIRED rather than defaulted — a caller that omitted it would silently
+ * restore the refusal this parameter exists to close. {@link githubAmbientLegAdmission} is the one
+ * place that computes it.
+ */
+export function githubAmbientLegKeeps(addressing: string, ambientEnabled: boolean, engagedFollowUp: boolean): boolean {
+  if (addressing === "drop") return false;
+  return addressing === "direct" || engagedFollowUp || ambientEnabled;
+}
+
+/**
+ * The AMBIENT leg's whole admission for one comment: read the §2.5 seam, THEN apply the chattiness
+ * gate with the enrolment fact in hand. One call, so the order cannot drift back.
+ *
+ * 🔴 THE ORDER IS THE FIX. `resolveGitHubEngagement` runs FIRST and its verdict feeds the gate, so an
+ * engaged container's plain follow-up is admitted on an addressed-only domain. Before this, the gate
+ * decided alone and the seam below it never got to speak.
+ *
+ * 🔴 THE COST, STATED. Every kept-by-the-classifier comment now pays ONE engagement-registry read
+ * here, where an ambient-off domain used to return on the gate. The read is the seam — a container's
+ * enrolment cannot be known without it — and it is the SAME read the leg already paid on every
+ * ambient-ON domain. `resolveGitHubEngagement` settles a mention with no round-trip at all.
+ *
+ * `engagedFollowUp` is floored on {@link githubEngagedFollowUpReach}, so a public repo and an inline
+ * review comment are refused exactly as they are on the native leg — this seam never widens an
+ * uninvited turn's reach, it only stops the domain flag from closing a door enrolment opened.
+ *
+ * Exported for the wiring test: `ambientDelivery` is module-private and only runs behind the route's
+ * `waitUntil`, so this is the furthest out a test can drive the decision. That the LEG calls it is
+ * covered by the `J-ENGAGED-github` e2e journey and by nothing offline. It takes NO injected deps —
+ * the wiring test drives it over the REAL operational store and a REAL declared domain, which is the
+ * point of that file.
+ */
+export async function githubAmbientLegAdmission(
+  addressing: string,
+  surfaceKey: string,
+  f: GitHubSeamFacts,
+): Promise<{ readonly keep: boolean; readonly seam: GitHubEngagementVerdict; readonly engagedFollowUp: boolean }> {
+  const seam = await resolveGitHubEngagement(f);
+  const engagedFollowUp = seam.kind === "deliver" && githubEngagedFollowUpReach(f).reachable;
+  return { keep: githubAmbientLegKeeps(addressing, githubAmbientEnabled(surfaceKey), engagedFollowUp), seam, engagedFollowUp };
+}
+
+// Is the ambient supervisor enabled for a repo's surfaceKey? Domain-level opt-in
+// (ambientSupervisorEnabled, default OFF). Fail-closed: any config-load error → OFF.
+function githubAmbientEnabled(surfaceKey: string): boolean {
+  try {
+    return ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains());
+  } catch {
+    return false;
+  }
+}
+
+// The calibration dial (GitHub platform-defaults to `reserved`). Fail-soft: neutral.
+function githubEngagementTier(surfaceKey: string): EngagementTier | undefined {
+  try {
+    return engagementTierFor(surfaceKey, getConfig().loadDomains());
+  } catch {
+    return undefined;
+  }
+}
+
+// UNIFIED cross-surface grain (channels/unified-supervisor.ts) — the one hop the session deps +
+// wake stamp share, mirroring slack-events.ts liveSupervisorDeps' `grainFor`. FAIL-SOFT to the
+// per-container grain (the byte-identical path): a config-load error must degrade to today's
+// behaviour, never take the repo's supervisor down or mis-key its session.
+function githubGrainFor(surfaceKey: string): SupervisorGrain {
+  try {
+    return supervisorGrainFor(surfaceKey, getConfig().loadDomains());
+  } catch {
+    return { unified: false, registryKey: surfaceKey };
+  }
+}
+
+/**
+ * Suppress the NATIVE @mention session for a SINGLE-WINDOW VOUCHED repo? On a crossSurfaceWindow repo
+ * a @mention answered by the native per-conversation session would reply WITHOUT the shared
+ * cross-surface context — that session is a separate eve run under a per-conversation token and can
+ * never join the single window. So we
+ * suppress it and let the ambient/unified leg answer the mention as an addressed `direct` wake
+ * instead. Gated on `singleWindow && the operator VOUCHED the repo internal` — the EXACT predicate the
+ * ambient classifier's `treatMentionAsDirect`/`vouched` keys on, so native-suppress and ambient-keep are
+ * perfectly complementary (never a double reply, never a gap): an un-vouched single-window repo keeps
+ * its native mention agent, because the ambient leg still drops mentions there. Pure, so the gate is
+ * unit-testable without a live config.
+ *
+ * A thin GitHub shim over the SHARED seam (unified-window.ts singleWindowMentionPolicy): the
+ * caller (onComment) consults it only AFTER githubBotMentioned confirmed the comment IS a
+ * mention, so `isMention` is pinned true here; `privacyOk` is the operator-VOUCH floor
+ * (isVouchedInternal / OE_TRUST — resolved by the caller), fail-closed on un-vouched/unknown. The
+ * repo's own `repository.private` flag is NOT consulted here — it is a logged defense-in-depth
+ * signal at the call site, not the window gate.
+ */
+export function shouldSuppressNativeMention(singleWindow: boolean, vouched: boolean): boolean {
+  return singleWindowMentionPolicy(singleWindow, true, vouched).suppressNative;
+}
+
+/** The operator-VOUCH floor for a repo's cross-surface WINDOW admission (mirrors notion.ts): the
+ *  SAME per-surface allowlist that gates the shared memory — isVouchedInternal on the workspaceKey
+ *  `github/<owner>` OR the surfaceKey `github/<owner>/<repo>`, or the OE_TRUST=internal blanket.
+ *  Synchronous, no network. Fail-closed: an un-vouched repo returns false. */
+function githubRepoVouched(owner: string, repo: string): boolean {
+  return isVouchedInternal(`github/${owner}`, `github/${owner}/${repo}`) || process.env.OE_TRUST === "internal";
+}
+
+/**
+ * THE EXTERNAL-PARTICIPANT VERDICT for one GitHub comment — the AUTHOR grain (OPE-533 / OPE-507)
+ * and the ROOM grain (OPE-529 / OPE-504) as one pure decision, so both outcomes are tested without
+ * a webhook, a store or a live repo.
+ *
+ * The two values that are not `proceed` name WHY the agent stays quiet. GitHub owes the same act
+ * for both — see the notice note below — but the audit row must still say which question answered:
+ *   `withheld-author` — the comment's author holds no access grant on the repo.
+ *   `silent-room`     — the room itself is classified external and the operator asked for silence.
+ *
+ * 🔴 THE AUTHOR GRAIN IS TESTED FIRST, mirroring Discord. An excluded author in a silenced room is
+ * an author verdict: the two grains are independent knobs, and a row that named the room would hide
+ * the fact that the person, not the place, decided it.
+ *
+ * THE ROOM LEG NOW READS THE AUTHOR AS EVIDENCE. `ingested` carries the comment's author, so
+ * `roomIsExternalClass`'s GUEST-PRESENT leg answers on GitHub the way it already does on Discord.
+ * `vendorExternal` is still not passed: GitHub's own room signal is `repository.private`, which is
+ * already the window-admission floor read elsewhere (`githubRepoVouched`) — reusing it here would
+ * fold a DIFFERENT question (may this repo join the shared memory window?) into this one (should
+ * the agent stay quiet here?).
+ */
+export type GitHubExternalVerdict = "proceed" | "withheld-author" | "silent-room";
+
+export function githubExternalVerdict(input: {
+  readonly policy: ExternalPolicy;
+  readonly author: IngestedChatMessage;
+  readonly surfaceKey: string;
+}): GitHubExternalVerdict {
+  if (withholdsBody(input.author, input.policy)) return "withheld-author";
+  return roomIsSilenced({ room: { surfaceKey: input.surfaceKey }, ingested: [input.author] }, input.policy) ? "silent-room" : "proceed";
+}
+
+/**
+ * Is this wake suppressed by the external-participant policy? Resolves the policy, applies
+ * {@link githubExternalVerdict}, and records the suppression.
+ *
+ * POSITION IS LOAD-BEARING, mirroring Discord/Teams (OPE-525): every caller checks this BEFORE
+ * the ambient-enabled gate, the spend gate, and any affordance — a suppressed wake must cost
+ * nothing and post nothing.
+ *
+ * THE PRIVATE NOTICE OF BEHAVIOUR 1 IS NOT POSTED, unlike Slack/Discord/Teams, and that holds for
+ * BOTH verdicts. GitHub has no private channel back to a commenter (Notion's own behaviour-1
+ * reasoning), and that notice's text names the organisation, so putting it in a public repo's
+ * timeline would tell the world that this person is classified as an outsider.
+ *
+ * 🔴 AN EXPLICIT @MENTION STILL GETS THE FIXED ACK (OPE-885). That is a DIFFERENT string —
+ * `EXTERNAL_MENTION_ACK` names no person, no organisation, no setting and no verdict, and it is
+ * byte-identical for both verdicts, so a reader cannot tell which grain fired or that one fired at
+ * all. `addressed` is what separates the two cases here, and it is not the addressed/ambient split
+ * Discord makes on its verdict: GitHub's verdict is unchanged, and only the RENDERING keys on it.
+ * An AMBIENT (non-mention) comment stays a fully silent drop, which is the ruling.
+ *
+ * FAIL-SOFT on a config error (mirrors discord-gateway.ts `externalPolicyForRoom`): an unreadable
+ * domain registry degrades to the org default rather than throwing, so a broken config never
+ * takes an otherwise-healthy repo off the air.
+ */
+async function githubExternalSuppressed(
+  surfaceKey: string,
+  owner: string,
+  principalId: string | undefined,
+  author: IngestedChatMessage,
+  /**
+   * THE ACK POSTER — present ONLY where the wake is an explicit @mention. `githubOnComment` passes
+   * it on its mention branch and OMITS it on an engaged plain follow-up (OPE-1501: that leg no
+   * longer returns early on a non-mention comment, so the "by construction" it used to rely on is
+   * gone and the caller states the condition instead). ABSENT on the ambient leg, which runs for
+   * every timeline comment and has not classified addressing yet.
+   *
+   * 🔴 THE TWO LEGS BOTH SEE A MENTION, SO ONLY ONE MAY ACK. A mention comment reaches
+   * `githubOnComment` AND `ambientDelivery` on the same delivery — that is the documented shape the
+   * single-window redirect relies on. Giving the ambient leg a poster too would post the ack twice
+   * for one mention.
+   *
+   * It is eve's own `ctx.thread.post`, which already holds the installation token and already knows
+   * whether this conversation takes a timeline comment or a review-thread reply. A hand-rolled REST
+   * call here would have to re-derive both, and would get the review-thread case wrong.
+   */
+  ackPost?: (message: string) => Promise<unknown>,
+): Promise<boolean> {
+  let policy: ExternalPolicy;
+  try {
+    policy = resolveExternalPolicy(externalPolicyOverrideFor(surfaceKey, getConfig().loadDomains()));
+  } catch {
+    policy = resolveExternalPolicy();
+  }
+  const verdict = githubExternalVerdict({ policy, author, surfaceKey });
+  if (verdict === "proceed") return false;
+  // GitHub reaches no one privately, so `alreadyAnswered` is always false here.
+  // GitHub reaches no one privately and has no room announcement, so nothing can have answered
+  // this mention already — `alreadyAnswered` is a constant false here.
+  const acked =
+    owesSuppressedMentionAck({ addressed: ackPost !== undefined, alreadyAnswered: false }) &&
+    (await ackPost!(EXTERNAL_MENTION_ACK).then(
+      () => true,
+      () => false,
+    ));
+  await appendAudit({
+    org: deploymentOrg(),
+    platform: "github",
+    workspace: owner,
+    surface: surfaceKey,
+    ...(principalId ? { principalId } : {}),
+    action: "github.external_policy_suppressed",
+    detail: { verdict, ...suppressionRendering(acked) },
+  }).catch(() => undefined);
+  slog(`suppressed ${surfaceKey}: externalPolicy verdict "${verdict}"${acked ? " — mention ack posted" : ""}`);
+  return true;
+}
+
+/**
+ * The dispatch shape OE's GitHub ambient/supervisor legs have always used. It was
+ * `SendFn<GitHubChannelState>` until eve 0.31 removed the public `SendFn` (the address moved from
+ * the send options onto `from(address)`); declaring it HERE keeps the whole leg below unchanged and
+ * confines the version-shaped difference to {@link githubSendFrom}.
+ */
+type GitHubSend = (
+  payload: { readonly message: string; readonly context?: readonly string[] },
+  options: { readonly auth: unknown; readonly continuationToken: string; readonly state?: GitHubChannelState },
+) => Promise<unknown>;
+
+/** Adapt eve 0.31's `from(address).send(message, options)` to {@link GitHubSend}. `context` moved
+ *  from the payload into the send options in 0.31; omitted when empty so a no-context wake is
+ *  byte-identical to the pre-0.31 payload. */
+function githubSendFrom(from: RouteHandlerArgs<GitHubChannelState>["from"]): GitHubSend {
+  return (payload, options) =>
+    from(options.continuationToken).send(payload.message, {
+      auth: options.auth,
+      state: options.state,
+      ...(payload.context && payload.context.length > 0 ? { context: payload.context } : {}),
+    } as never);
+}
+
+/**
+ * Live supervisor deps (mirrors notion.ts liveNotionSupervisorDeps): create-or-fetch / rotate /
+ * force-rotate over the channel_session registry with the reserved :oe-sup:g token, and a `wake`
+ * that continues the session under that token with the supervisor seed state. Rotation reuses
+ * shouldRotate AS-IS; a rotation carries the OUTGOING generation's recorded TAIL forward (OPE-794).
+ *
+ * UNIFIED re-key (the Slack reference's exact shape, slack-events.ts liveSupervisorDeps): when the
+ * repo's domain has opted in, the registry ROW is the synthetic `oe-domain::<name>` key and the
+ * token is `oe-dom:<name>:oe-sup:g<gen>` — one row + one token per generation for the WHOLE team,
+ * whichever surface a wake arrives on. Flag-off, `githubGrainFor` returns
+ * `{unified:false, registryKey:surfaceKey}` and the per-repo token below — byte-identical.
+ */
+// Exported (not just internal to ambientDelivery) so a test can drive the `wake` leg directly — the
+// SAME reason liveNotionSupervisorDeps/liveGitHubSupervisorDeps's Slack/Teams siblings are testable
+// without a live webhook. `ambientDelivery` itself stays module-private (see
+// scripts/github-external-policy-room-test.ts's note); this seam is what OPE-970's own test uses.
+export function liveGitHubSupervisorDeps(send: GitHubSend, ev: GitHubAmbientEvent, to?: RouteHandlerArgs["to"]): GitHubSupervisorDeps {
+  const org = deploymentOrg();
+  const store = getOperationalStore();
+  return {
+    async getOrCreateSession(surfaceKey, owner, repo, atIso) {
+      const grain = githubGrainFor(surfaceKey);
+      // OPE-599: claim the runtime-change rotation BEFORE the row read, and unconditionally (the
+      // mint arm must consume it too). Why, and why here: channels/runtime-rotation.ts.
+      const runtimeChanged = await claimRuntimeRotation({ org, registryKey: grain.registryKey, surfaceKey, domainName: grain.domainName, atIso });
+      const existing = await store.getChannelSession(org, grain.registryKey);
+      if (!existing) {
+        const row = await store.rotateChannelSession(org, grain.registryKey, mintRotationToken(grain, 1, () => githubSupervisorToken(owner, repo, 1)), atIso);
+        // OPE-1821: stamp the pair onto the row this build just minted. Without it the seat's next
+        // wake reads NULL, takes the ADOPTED arm and never rotates for the deploy it crossed.
+        await stampMintedRuntime({ org, registryKey: grain.registryKey, surfaceKey, domainName: grain.domainName, atIso });
+        return { token: row.token, generation: row.generation, freshGeneration: true, tail: [] as readonly WakeMessageInput[] };
+      }
+      if (shouldRotate(existing, atIso, { runtimeChanged })) {
+        const gen = existing.generation + 1;
+        // OPE-794: read the OUTGOING generation's tail BEFORE minting its successor. A store read,
+        // fail-soft to empty — a rotation never waits on continuity and never fails for want of it.
+        const tail = await carryTailForward(org, grain.registryKey, existing.token);
+        const row = await store.rotateChannelSession(org, grain.registryKey, mintRotationToken(grain, gen, () => githubSupervisorToken(owner, repo, gen)), atIso);
+        return { token: row.token, generation: row.generation, freshGeneration: true, tail };
+      }
+      // A resume whose first wake never delivered (first_wake_at NULL) is still "fresh" (the H7c
+      // self-heal). Its tail is empty: it was carried forward and cleared at the rotation that
+      // minted this row.
+      // `lastWakeAt` rides out on THIS arm alone: it is the catch-up read's lower bound, and a fresh
+      // or just-rotated generation has none (rotation resets the column), which is exactly the
+      // bootstrap case the two arms above already report through `freshGeneration`.
+      return {
+        token: existing.token,
+        generation: existing.generation,
+        freshGeneration: existing.firstWakeAt == null,
+        tail: [] as readonly WakeMessageInput[],
+        lastWakeAt: existing.lastWakeAt ?? null,
+      };
+    },
+    touchSession: (surfaceKey, atIso) => store.touchChannelSession(org, githubGrainFor(surfaceKey).registryKey, atIso),
+    // THE SINCE-LAST-WAKE CATCH-UP (OPE-1726), through the shared path core holds. GitHub's own
+    // fetch is registered at bundle registration; the admission policy is the DOMAIN's, resolved by
+    // the shared road itself from the request's own channel key (OPE-1857). No `trustFor`: this
+    // surface has no synchronous roster probe for a comment author, so the shared core's FAIL-CLOSED
+    // per-sender default applies — a human sibling reads `unauth` and stays fenced, which is the
+    // honest floor for an author the deployment cannot vouch at wake time.
+    catchUp: (req) => seatCatchUp("github", req),
+    // OPE-794 — file this wake on the live generation's tail ring. Same key derivation as the
+    // rotation read and the spend counter, so all three target one row.
+    recordWake: (entry, token, surfaceKey) => recordWakeTail(org, githubGrainFor(surfaceKey).registryKey, token, entry),
+    now: () => new Date().toISOString(),
+    async wake({ token, auth, message, context, window }) {
+      const surfaceKey = `github/${ev.owner}/${ev.repo}`;
+      // SINGLE-WINDOW diversion (channels/unified-window.ts): a window-carrying wake goes
+      // through eve's cross-channel `to(...).send(...)` into the synthetic `unified` channel — the SAME
+      // primitive this file's fan-out leg already uses toward Slack (fanOut) — so its effective
+      // token is `unified:<raw>`, shared with the domain's Slack wakes: ONE context window.
+      // The unified channel's receive registers the wakeId→origin map entry (durably, before
+      // the send) and re-checks the gates fail-closed. A failure propagates to ambientDelivery's
+      // catch (fail-closed: never delivered without a routable reply target).
+      if (window && to) {
+        try {
+          // THE OWNED-THREAD INGRESS SEAM (§2.6, OPE-1719) — the INBOUND variant, the one Slack's
+          // front route has always used. A wake landing in a container a live task worker or thread
+          // seat OWNS is dispatched to that owner's token instead of the standing seat's. On GitHub
+          // the container and the thread coincide (an issue or pull request IS its own thread), so
+          // every wake on this leg consults ownership. Flag-off, and on every unowned container,
+          // this is a byte-identical passthrough to `divertToUnifiedWindow`.
+          await divertInboundToUnifiedWindow(to, {
+            message,
+            context: [...context],
+            token,
+            window,
+            surfaceKey,
+            auth: auth as unknown as { attributes?: Record<string, unknown> },
+          });
+        } catch (err) {
+          // OPE-970: until now this leg's ONLY trace of a divert failure was `slog("ambient leg
+          // failed: …")` at the outer `ambientDelivery(...).catch` — a console line, no audit row,
+          // nothing a control-plane query or an e2e classifier (FAILED_ACTIONS) could see.
+          // `auditSupervisorFailure` writes the SAME `surface.wake_failed` row Slack/Teams already
+          // write for their own wake failures, then rethrows unchanged.
+          await auditSupervisorFailure(
+            { org: deploymentOrg(), platform: "github", workspace: ev.owner, surface: surfaceKey },
+            "surface.wake_failed",
+            { message: String(err instanceof Error ? err.message : err).slice(0, 500), wakeId: window.wakeId },
+          );
+          throw err;
+        }
+        return;
+      }
+      // eve's SessionAuthContext is a structural superset of OpenEverywhereGitHubAuth (extra
+      // issuer/subject fields optional) — same cast the onComment hook relies on. The unified
+      // seed marker rides the CREATING wake's state (creation-only, grain fixed per session).
+      const unified = githubGrainFor(surfaceKey).unified;
+      try {
+        await dispatchNativeWakeWithRetry(
+          () =>
+            send(
+              { message, context: [...context] },
+              { auth: auth as unknown, continuationToken: token, state: supervisorSeedState(ev, unified) },
+            ),
+          { platform: "github", workspace: ev.owner, surfaceKey },
+        );
+      } catch (err) {
+        // OPE-971: the NATIVE (flag-off) send has no window and no divert — this repo's own
+        // domain has not opted into windowing, so a pruned-deployment strand here was completely
+        // unwrapped. `githubGrainFor(surfaceKey).registryKey === surfaceKey` flag-off (the exact
+        // row `getOrCreateSession` above already rotates), so it's passed straight through.
+        await healPrunedDeploymentStrand({ token, registryKey: surfaceKey, surfaceKey, workspace: ev.owner, platform: "github", atIso: new Date().toISOString(), err });
+        throw err;
+      }
+    },
+  };
+}
+
+/**
+ * The ambient leg for one delivery: extract → domain gate → classify → dispatch. Every exit
+ * short of dispatch is silent-and-cheap (this runs for EVERY webhook delivery on the route).
+ * Fail-closed at each step: no ambient candidate / no opt-in / classifier drop → nothing.
+ */
+async function ambientDelivery(body: string, eventType: string, send: GitHubSend, to?: RouteHandlerArgs["to"]): Promise<void> {
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(body) as Record<string, unknown>;
+  } catch {
+    return;
+  }
+  const ev = extractGitHubAmbientEvent(eventType, payload);
+  if (!ev) return;
+  const surfaceKey = `github/${ev.owner}/${ev.repo}`;
+  // The comment author, in the CORE's own vocabulary — read once, then used by the
+  // external-participant policy below AND by the OPE-466 taint carriage handed to the dispatch.
+  const authorFacts = githubAuthorFacts({ authorAssociation: ev.comment.authorAssociation, actorType: ev.comment.authorType });
+  // THE EXTERNAL-PARTICIPANT POLICY (OPE-529 room grain, OPE-533 author grain): checked first,
+  // above the ambient-enabled gate, the classifier and the spend gate — a suppressed wake must cost
+  // nothing and show nothing. The author evidence is `author_association`, free on this payload.
+  // NO ACK POSTER (OPE-885): this leg has not classified addressing yet, and a mention comment also
+  // reaches `githubOnComment`, which owns the ack. An ambient comment is owed nothing.
+  if (await githubExternalSuppressed(surfaceKey, ev.owner, ev.comment.authorLogin, authorFacts)) {
+    return;
+  }
+  // SEATED REPO: on a repo with a standing seat, onComment suppressed the native mention session, so
+  // the ambient leg KEEPS a @mention (on an operator-VOUCHED repo) as an ADDRESSED `direct` wake the
+  // seat answers; otherwise mentions still DROP to the native path. Same fail-soft grain the native
+  // suppression reads — the two legs share one predicate, so they never double-handle or gap.
+  const singleWindow = grainUsesUnifiedWindow(githubGrainFor(surfaceKey)); // cross-surface, group OR solo (byte-identical flag-off)
+  // WINDOW-ADMISSION FLOOR = the operator VOUCH (identity/trust.ts — the SAME allowlist that gates
+  // the shared memory), NOT the repo-private flag. `ev.repoPrivate` is now a logged SIGNAL only.
+  const vouched = githubRepoVouched(ev.owner, ev.repo);
+  const cls = classifyGitHubAmbientComment(ev.comment, BOT_NAME, { treatMentionAsDirect: singleWindow, vouched });
+  if (cls.addressing === "drop") {
+    slog(`comment on ${surfaceKey}#${ev.issueNumber} dropped: ${cls.reason} (private=${ev.repoPrivate === true}, vouched=${vouched})`);
+    return;
+  }
+  // 🔴 THE §2.5 ENGAGED SEAM'S THREE OBLIGATIONS ON THIS LEG (OPE-1501, OPE-1740). All three are
+  // about a container an @mention ENROLLED, and the registry read that answers them runs FIRST —
+  // above the chattiness gate, because the first obligation IS that gate's third input.
+  //
+  // Machine-authored comments never reach here (`classifyGitHubAmbientComment` drops them), so the
+  // registry read below is only ever paid for a real person's comment.
+  const seamFacts: GitHubSeamFacts = {
+    owner: ev.owner,
+    repo: ev.repo,
+    number: ev.issueNumber,
+    isPrivate: ev.repoPrivate,
+    actorLogin: ev.comment.authorLogin ?? "unknown",
+    isMention: cls.addressing === "direct",
+    authorIsBot: false, // settled by the classifier's own bot/self drops above
+    // This leg only ever sees `issue_comment` deliveries (`extractGitHubAmbientEvent`), so a review
+    // thread never arrives here — the fact is still stated rather than left to a default, because
+    // the drop guard below reads it.
+    conversationKind: ev.isPullRequest ? "pull_request" : "issue",
+  };
+  const admission = await githubAmbientLegAdmission(cls.addressing, surfaceKey, seamFacts);
+  const seam = admission.seam;
+  // (1) THE CHATTINESS GATE, applied through the shared predicate so the two legs cannot drift apart
+  // ({@link githubAmbientLegKeeps} states the whole rule, and {@link githubAmbientLegAdmission} the
+  // order). An ENGAGED container's plain follow-up passes it with the domain flag off; ordinary
+  // ambient talk in an un-enrolled container is refused and audited exactly as before.
+  if (!admission.keep) {
+    // Was a bare `return` — the delivery vanished with no log and no row, which is the one
+    // outcome a deployer cannot debug (OPE-205). Recording it changes nothing about the gate.
+    await auditAmbientSkip({ platform: "github", workspace: ev.owner, surfaceKey, log: slog });
+    return;
+  }
+  if (seam.kind === "hold" && seam.stopped) {
+    // (2) THE STOP. `stand_down` marked this container, and the ambient leg is the one that would
+    // otherwise keep answering — so the suppression has to live here as well as on the native leg,
+    // or the verb would be a stop the loudest path ignores. An @mention clears the flag, which is
+    // why a `direct` comment never reaches this branch: it resolves `engage`, not `hold`.
+    //
+    // 🔴 IT STILL RUNS BELOW THE GATE, and that costs nothing: a stood-down row is never `deliver`,
+    // so `admission.engagedFollowUp` is false for it and the gate refuses a stood-down container's
+    // ambient talk on an addressed-only domain exactly as it did before the seam moved up.
+    slog(`comment on ${surfaceKey}#${ev.issueNumber} suppressed: stood down in ${seam.anchor} — @mention to pull the agent back in`);
+    return;
+  }
+  // `engagedFollowUp` already implies `deliver`; the `kind` test beside it is what narrows `seam` so
+  // the log line below can name the anchor.
+  if (seam.kind === "deliver" && admission.engagedFollowUp && !shouldSuppressNativeMention(singleWindow, vouched)) {
+    // (3) NO DOUBLE HANDLING. On a repo whose mentions the NATIVE leg owns, that leg now answers an
+    // engaged container's plain comments too (`githubOnComment`), so this leg must let it — exactly
+    // as `classifyGitHubAmbientComment` already drops a plain @mention there.
+    //
+    // 🔴 THE GUARD IS THE SHARED PREDICATE, NOT A BARE `singleWindow`. `suppressNative` is
+    // `singleWindow && vouched && isMention` (unified-window.ts), so a single-window repo the
+    // operator has NOT vouched keeps its native session — and a `!singleWindow` test would leave
+    // both legs answering the same comment there. Asking the same function the native suppression
+    // asks is what keeps the two legs partitioned on every combination, exactly as the mention
+    // split already does. Where the native leg IS suppressed, the unified window owns every comment
+    // and dropping here would be a gap rather than a de-dupe.
+    //
+    // 🔴 AND THE DROP IS FLOORED ON THE SAME REACH THE NATIVE ARM IS. `githubEngagedFollowUpReach`
+    // refuses a public or unknown-privacy repo, and the native leg refuses an engaged follow-up
+    // there — so dropping it here as "owned by the native path" would silence a comment neither leg
+    // then answers. On a VOUCHED public repo with ambient on it is the supervisor's to judge,
+    // exactly as it was before this seam existed.
+    slog(`comment on ${surfaceKey}#${ev.issueNumber} dropped: engaged container ${seam.anchor} — owned by the native githubChannel path`);
+    return;
+  }
+  const directMention = cls.addressing === "direct";
+  // The wake's addressing stamp derives from the SHARED seam (unified-window.ts
+  // singleWindowMentionPolicy) — the same pure decision the native suppression and the
+  // classifier's keep-as-direct branch consult. Feeding the classifier's verdict back as the
+  // seam's `isMention` is exact: `direct` is only ever returned for a real @mention, and every
+  // reachable non-drop mention on a single-window VOUCHED repo IS `direct`. Floor = the vouch.
+  const mentionPolicy = singleWindowMentionPolicy(singleWindow, directMention, vouched);
+  // Mint ONCE and carry the same id into both the window and github.dispatched. That makes the
+  // commentId/issueNumber -> wakeId -> ingress/session join exact; GitHub's whole-second vendor
+  // timestamp is latency evidence and is too coarse to serve as identity.
+  const wakeId = singleWindow && vouched ? mintWakeId() : undefined;
+  // Identity: the SAME auth capture the mention path uses (bindGitHub resolves real
+  // visibility/trust from it), so the supervisor session binds/spends/remembers identically.
+  const auth = buildGitHubAuth({
+    owner: ev.owner,
+    repo: ev.repo,
+    repositoryFullName: ev.repositoryFullName,
+    repositoryId: ev.repositoryId,
+    isPrivate: ev.repoPrivate,
+    conversationKind: ev.isPullRequest ? "pull_request" : "issue",
+    issueNumber: ev.isPullRequest ? undefined : ev.issueNumber,
+    pullRequestNumber: ev.isPullRequest ? ev.issueNumber : undefined,
+    installationId: ev.installationId,
+    actorLogin: ev.comment.authorLogin ?? "unknown",
+    actorId: ev.comment.authorId,
+    actorType: ev.comment.authorType,
+    authorAssociation: ev.comment.authorAssociation,
+  });
+  // PER-WAKE TRUST (identity/wake-trust.ts — audit-wedge F3): resolved off the SAME auth
+  // capture the session binds with (the canonical gate — mapper verdict + vouch register +
+  // OE_TRUST, fail-closed external) + the config-as-code admin rosters. Bot authors were
+  // already dropped in classify; the authorType fact still rides in as belt-and-braces.
+  const wakeTrust = resolveWakeTrustFromContext(
+    { channel: { kind: "github" }, session: { auth: { current: auth as unknown as { attributes?: Readonly<Record<string, string>> } } } },
+    { id: ev.comment.authorLogin, isBot: ev.comment.authorType === "Bot" },
+    { principalFallback: true }, // TRIGGER: the comment author IS the bound principal.
+  );
+  await handleGitHubSupervisorDispatch(
+    {
+      surfaceKey,
+      owner: ev.owner,
+      repo: ev.repo,
+      issueNumber: ev.issueNumber,
+      issueTitle: ev.issueTitle,
+      auth,
+      // THE DOMAIN'S ADMISSION POLICY over the wake's context-line slot (OPE-1800), resolved from
+      // the SAME channel key the catch-up dep above resolves its own from — so the seat's two reads
+      // admit an author identically and can never disagree about one message.
+      admit: seatAdmissionFor(surfaceKey),
+      // OPE-466 CARRIAGE (wired by OPE-494) — the ONE comment whose bytes this wake renders. GitHub
+      // hydrates no backscroll siblings into the envelope, so the trigger IS the ingested set.
+      ingested: [authorFacts],
+      trigger: {
+        id: ev.comment.id ?? "unknown",
+        authorLogin: ev.comment.authorLogin,
+        sentAt: ev.comment.createdAt ?? new Date().toISOString(),
+        text: ev.comment.body ?? "(the comment had no text)",
+        trust: wakeTrust,
+      },
+      engagementTier: githubEngagementTier(surfaceKey),
+      // Unified grain for the WAKE stamp (platform address + P5 disclosure). The registry/token
+      // re-key lives in the session deps; both consult the same fail-soft grain resolution.
+      unified: githubGrainFor(surfaceKey).unified,
+      // SINGLE-WINDOW addressed @mention: render `direct-mention` (addressed preamble, envelope +
+      // wake-id kept) so the shared-context supervisor answers it instead of watching silently.
+      directMention,
+      // THE ENROLMENT FACT for the envelope (OPE-2093): the SAME seam verdict the audit row below
+      // promotes to `thread-follow`, so the row and the wake can never disagree about it.
+      threadEngaged: admission.engagedFollowUp,
+      // SINGLE-WINDOW plumbing (channels/unified-window.ts): mint the per-wake id + reply-target
+      // origin when the grain says so — the core renders the id into the envelope and the wake
+      // dep diverts the delivery into the unified channel (one context window with Slack). A
+      // `direct` @mention rides the SAME window path (it's only `direct` when singleWindow holds).
+      // Floored on the operator VOUCH — an un-vouched repo never diverts into the shared window
+      // (it stays in the memory-mediated domain session); the vouch is the sole window admission floor.
+      window: wakeId
+        ? ({
+            wakeId,
+            origin: {
+              platform: "github",
+              owner: ev.owner,
+              repo: ev.repo,
+              issueNumber: ev.issueNumber,
+              ...(ev.installationId !== undefined ? { installationId: ev.installationId } : {}),
+            },
+            // ADDRESSED @mention ⇒ stamp `oe_addressing:"direct-mention"` (via divertToUnifiedWindow
+            // → stampUnifiedWindowAuth) so the unified completion handler bridges the answer to this
+            // wake if the model writes prose instead of calling `reply`. A channel-watch wake omits
+            // it (ambient prose stays hard-dropped).
+            ...(mentionPolicy.addressing !== undefined ? { addressing: mentionPolicy.addressing } : {}),
+            // `vendorTs` (OPE-1716): the comment's own `createdAt`, GitHub's stamp on the event the
+            // webhook reports — the first latency anchor. Absent on a delivery that carried none,
+            // and the ingress row then records no vendor time rather than a clock of ours.
+            ...spreadVendorTs(vendorInstantEventTime(ev.comment.createdAt)),
+          } satisfies UnifiedWindowWake)
+        : undefined,
+    },
+    liveGitHubSupervisorDeps(send, ev, to),
+  );
+  await appendAudit({
+    org: deploymentOrg(),
+    platform: "github",
+    workspace: ev.owner,
+    surface: surfaceKey,
+    principalId: ev.comment.authorLogin,
+    action: "github.dispatched",
+    // 🔴 THE ROW CARRIES THE SEAM'S VERDICT, NOT THE CLASSIFIER'S WORD (OPE-1752). The classifier
+    // calls an engaged follow-up and unowned issue chatter alike `channel-watch`, and this row is
+    // the one place those two must not read alike. `githubWakeAddressing` promotes the engaged one
+    // to `thread-follow`, the same mapping Notion (OPE-1510) and Linear (OPE-1578) already make.
+    // It changes the ROW only: `github-supervisor.ts` derives the wake envelope's own `addressing`
+    // from `directMention`, and the unified-window wake takes `mentionPolicy.addressing` above. The
+    // envelope states the enrolment as `follow-up="thread-engaged"` from `threadEngaged` above.
+    // repoPrivate rides as a defense-in-depth SIGNAL (no longer the window gate — the vouch is).
+    detail: githubDispatchAuditDetail({
+      addressing: githubWakeAddressing(cls.addressing, admission.engagedFollowUp),
+      issueNumber: ev.issueNumber,
+      commentId: ev.comment.id,
+      wakeId,
+      repoPrivate: ev.repoPrivate === true,
+      vouched,
+    }),
+  });
+  slog(`comment on ${surfaceKey}#${ev.issueNumber} → judged wake dispatched`);
+}
+
+// --- the installation leg (self-registering owner→installation map) --------------------
+
+/**
+ * The INSTALLATION leg for one delivery: normalize → learn/revoke → audit. Runs for every webhook
+ * delivery on the route (the extractor returns null for all the non-installation ones, cheaply).
+ * The App's shared-secret gate upstream in wrapRoute already authenticated the body — this leg
+ * adds no second verification path.
+ *
+ * The core (classify + apply) is the tested logic in github-installations.ts; this is the live
+ * wiring onto the core SCM plane's durable map (scm/installations.ts, via the adapter-api barrel).
+ */
+async function installationDelivery(body: string, eventType: string): Promise<void> {
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(body) as Record<string, unknown>;
+  } catch {
+    return;
+  }
+  const ev = extractGitHubInstallationEvent(eventType, payload);
+  if (!ev) return;
+  await handleGitHubInstallationDelivery(ev, {
+    record: (rec) => recordGitHubInstallation(rec),
+    forget: (owner) => forgetGitHubInstallation(owner),
+    audit: (action, detail, workspace) => appendAudit({ org: deploymentOrg(), platform: "github", workspace, action, detail }),
+    log: (m) => ilog(m),
+  });
+}
+
+// --- supervisor-aware events (delegating every non-supervisor turn to eve's defaults) --
+
+// A PRISTINE second githubChannel instance (same config axes that shape the default events:
+// none — api/credentials/progress all unset, matching the real channel below) is the source of
+// eve's DEFAULT handlers. defineChannel compiles authored events into `adapter[<event>]`
+// entries of shape `(data, adapterCtx) => authored(data, enriched(adapterCtx), callbackCtx)`;
+// calling one from inside OUR authored handler (same ALS step scope) re-runs the enrichment
+// harmlessly and rebuilds the callback context — i.e. the default runs EXACTLY as if we had
+// never authored the key. This is how the #623 destructive-replacement axis is used safely:
+// the mention path's checkout/reply/error behaviour is eve's own code, not a replica.
+const pristine = githubChannel({ botName: BOT_NAME });
+type AdapterEventFn = (data: unknown, adapterCtx: unknown) => unknown;
+const defaultEvent = (name: string): AdapterEventFn | undefined =>
+  (pristine as unknown as { adapter?: Record<string, AdapterEventFn> }).adapter?.[name];
+
+/**
+ * Record a NATIVE (@mention) turn that judged SILENCE (OPE-883). Nothing is posted and there is no
+ * session to close, so this row is the ONLY witness that the wake ended.
+ *
+ * `replied` separates the two silences, and they are different facts. A turn that posted through the
+ * `reply` tool and then closed with `no_reply` is the taught, correct shape — `finalMessageActionForTurn`
+ * reads the FINAL message, so that turn arrives here looking silent. A turn with `replied:false`
+ * answered an addressed @mention with nothing at all.
+ *
+ * THE ROW IS NOT GATED BEHIND `audit.silences`, for the reason channels/supervisor-complete.ts states
+ * about its own `github.no_reply` sibling: that flag covers the ambient-CHAT judged-silence rows, the
+ * ~99% majority on a watched room. A native session opens because a member ADDRESSED this app, so
+ * every one of these rows is the rare case an operator hunts for.
+ */
+async function auditNativeGitHubSilence(state: GitHubChannelState, reason: string, replied: boolean, sessionId?: string): Promise<void> {
+  slog(`native turn judged silence (${reason}) on ${state.owner}/${state.repo}#${state.issueNumber ?? "?"} — nothing commented`);
+  // Taint-clean by construction: ids, an enum-shaped reason and booleans only. The dropped text is
+  // never recorded — on the sentinel path it is the model's private rationale.
+  await appendAudit({
+    org: deploymentOrg(),
+    platform: "github",
+    workspace: state.owner,
+    surface: `github/${state.owner}/${state.repo}`,
+    action: "github.no_reply",
+    detail: { issueNumber: state.issueNumber ?? null, reason, replied, route: "native", ...(sessionId ? { sessionId } : {}) },
+  }).catch(() => undefined);
+}
+
+/**
+ * The audit partition a NATIVE completion stamps on its DROP row, rebuilt from the LIVE session
+ * state the way discord.ts and slack.ts rebuild theirs: a completion handler holds no auth ctx, so
+ * the partition comes from the state through the REAL identity seam — owner → workspace, repo →
+ * surface. That is what puts the row on the same partition the `reply` TOOL's own rows land on,
+ * which matters because `reply.post` carries the BARE surface segment (the repo) and a reader
+ * scoped to it must match the drop row and the reply row alike.
+ * 🔴 IT STOPPED SERVING A POST IN OPE-2006. This arm posted the turn's closing prose through
+ * `postTerminalProse` as a `route:"terminal"` `reply.post` row; that plane is deleted, so the
+ * partition now files `turn.supervisor_prose_dropped` instead. What it must match is unchanged.
+ *
+ * `actorLogin` is empty here on purpose: the partition does not read it — `buildGitHubAuth` puts it
+ * in `principalId` and `user_login` only. WHO the turn answered is carried on the audit struct
+ * instead, from `state.triggeringUserLogin`, the way slack.ts, discord.ts and teams.ts carry theirs.
+ *
+ * Null on a state that cannot place itself; the caller then falls back to eve's own poster.
+ */
+function nativeGitHubAuditPartition(state: GitHubChannelState): ChatAuditPartition | null {
+  if (!state.owner || !state.repo) return null;
+  try {
+    return resolvePartition({
+      channel: { kind: "github" },
+      session: {
+        auth: {
+          current: buildGitHubAuth({
+            owner: state.owner,
+            repo: state.repo,
+            actorLogin: "",
+            repositoryId: state.repositoryId,
+            conversationKind: state.conversationKind,
+          }),
+        },
+      },
+    });
+  } catch {
+    return null;
+  }
+}
+
+// The native GitHub conversational channel: @mention → session, sandbox checkout, PR
+// diff in context, comment reply. `onComment` REPLACES eve's default @mention gate so we
+// can (a) keep the SAME mention semantics (githubBotMentioned mirrors eve's gate) and
+// (b) enrich the dispatched auth with the repo owner/name/privacy + actor association the
+// identity mapper needs — eve's own defaultGitHubAuth omits repo.private, which would peg
+// every surface to fail-closed private/external. botName + credentials fall back to env
+// (GITHUB_APP_SLUG / GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY / GITHUB_WEBHOOK_SECRET).
+// Exported for the provider integration test (drives the REAL ingress handler directly with a
+// seeded over-budget scope). The channel below wires it as `onComment`.
+export const githubOnComment = async (ctx: GitHubInboundContext, comment: GitHubComment): Promise<GitHubInboundResult> => {
+    // Same wake rule as eve's built-in gate (that helper isn't publicly exported).
+    const isMention = githubBotMentioned(comment.body, BOT_NAME, comment.author);
+    // 🔴 THE §2.5 ENGAGED SEAM (OPE-1501) IS THE SECOND DOOR OF THIS GATE. Before it, a comment that
+    // was not an @mention returned here and the native leg answered exactly once per mention. Now a
+    // PLAIN comment in a container an @mention already ENGAGED is admitted too, and the seam's own
+    // fail-closed read decides — `channels/github-engagement.ts` owns the policy, this line owns the
+    // wiring. The facts are the same ones the auth below is built from.
+    //
+    // The MARK is further down, after the external-participant policy: an author the operator
+    // excluded must not be able to enrol a container by @mentioning the app in it.
+    const seamFacts: GitHubSeamFacts = {
+      owner: ctx.repository.owner,
+      repo: ctx.repository.name,
+      number: ctx.conversation.issueNumber ?? ctx.conversation.pullRequestNumber ?? undefined,
+      isPrivate: ctx.repository.private,
+      actorLogin: comment.author?.login ?? ctx.sender.login,
+      isMention,
+      // The author gate, in the seam's own vocabulary. `githubBotMentioned` already refuses a
+      // self-authored mention; a PLAIN comment reaches the seam with no such check, so an engaged
+      // container would otherwise admit the app's own reply and loop on itself.
+      authorIsBot: githubMachineAuthored(comment.author?.login ?? ctx.sender.login, comment.author?.type ?? ctx.sender.type, BOT_NAME),
+      // 🔴 THE REACH FACT (see `githubEngagedFollowUpReach`): an INLINE review comment shares its
+      // pull request's anchor, so the non-mention arm refuses one. A mention inside a review thread
+      // still wakes — it never reaches that arm.
+      conversationKind: ctx.conversation.kind,
+    };
+    // THE COST, STATED: every non-mention comment on a PRIVATE repo now pays ONE engagement-registry
+    // read here, where it used to return on the line above. That read is the seam — a container's
+    // engagement cannot be known without it — and it short-circuits the common case (an un-engaged
+    // container) before any config lookup, any policy call or any spend probe below. A public repo
+    // and an inline review comment pay nothing: the reach floors inside `githubEngagedAdmits` refuse
+    // them above the read.
+    if (!isMention && !(await githubEngagedAdmits(seamFacts))) return null;
+    // SINGLE-WINDOW SUPPRESSION (routing-fix §4 touch-point 1): on a crossSurfaceWindow VOUCHED repo,
+    // hand the @mention to the unified window (via the ambient leg's addressed `direct` wake) instead
+    // of the contextless native session. STRICTLY gated — a non-single-window (or un-vouched) repo
+    // is byte-identical (native mention agent intact). Floor = the operator VOUCH (NOT the repo-private
+    // flag). Fail-soft: githubGrainFor degrades to {singleWindow: unset} on a config error ⇒ not
+    // suppressed ⇒ today's native behaviour.
+    const surfaceKey = `github/${ctx.repository.owner}/${ctx.repository.name}`;
+    // The comment author, in the CORE's own vocabulary — read once, then used by the
+    // external-participant policy below AND by the OPE-466 taint carriage stamped onto the auth.
+    const authorFacts = githubAuthorFacts({
+      authorAssociation: str(comment.raw["author_association"]),
+      actorType: comment.author?.type ?? ctx.sender.type,
+    });
+    // THE EXTERNAL-PARTICIPANT POLICY (OPE-529 room grain, OPE-533 author grain): checked first,
+    // above the single-window redirect, the spend gate and every affordance — a suppressed wake
+    // must cost nothing and show nothing regardless of which leg would otherwise have owned this
+    // @mention. An excluded author gets no PRIVATE notice; see githubExternalSuppressed for why.
+    // THE ACK ANCHOR (OPE-885) IS PASSED ONLY FOR AN EXPLICIT @MENTION. It used to be passed
+    // unconditionally, and that was correct while this leg returned early on every non-mention
+    // comment. 🔴 THE ENGAGED SEAM BROKE THAT PRECONDITION: a plain follow-up now reaches this line
+    // too, and posting the fixed ack there would announce an excluded author's classification on a
+    // comment nobody addressed to the agent — exactly what the ambient leg refuses to do, for the
+    // reason its own comment states ("an ambient comment is owed nothing"). A person who ADDRESSED
+    // the app is still owed the one line rather than silence, so the anchor rides `isMention`.
+    if (
+      await githubExternalSuppressed(
+        surfaceKey,
+        ctx.repository.owner,
+        comment.author?.login ?? ctx.sender.login,
+        authorFacts,
+        isMention ? (message) => ctx.thread.post(message) : undefined,
+      )
+    ) {
+      return null;
+    }
+    // 🔴 THE §2.5 MARK (OPE-1501) — an @mention ENROLS this container, and it is written HERE, below
+    // the external-participant policy and ABOVE the single-window suppression. Both positions are
+    // load-bearing:
+    //   • BELOW the policy, because an author the operator excluded must not be able to enrol a
+    //     container by @mentioning the app in it — the suppressed wake costs nothing and writes
+    //     nothing, exactly as its own comment promises.
+    //   • ABOVE the suppression, because a single-window vouched repo answers the mention through the
+    //     unified window instead of this leg. The row is still what `stand_down` marks and what the
+    //     ambient leg's stop check reads there, so skipping the mark would leave the verb with no row
+    //     on precisely the repos that talk the most.
+    // `participating: true` (inside `markGitHubEngaged`) is the re-invitation: an @mention clears a
+    // previous stand-down, which is the documented way back in on every surface with this seam.
+    // Best-effort — the mark never fails a turn.
+    if (isMention) await markGitHubEngaged(seamFacts, comment.id);
+    if (shouldSuppressNativeMention(grainUsesUnifiedWindow(githubGrainFor(surfaceKey)), githubRepoVouched(ctx.repository.owner, ctx.repository.name))) {
+      return null;
+    }
+    // OPE-466 CARRIAGE (wired by OPE-494) — stamped at the BUILD, not at the return, so every
+    // downstream reader of this auth sees the same bag eve will dispatch. The native leg renders one
+    // comment and hydrates no siblings, so the trigger IS the ingested set. The room leg reads the
+    // OPERATOR's trust declaration for the repo. An unmarked wake gets the input object BY
+    // REFERENCE, so the dispatched auth is byte-identical to before this existed.
+    const auth = stampNonMemberChatAuth(
+      buildGitHubAuth({
+        owner: ctx.repository.owner,
+        repo: ctx.repository.name,
+        repositoryFullName: ctx.repository.fullName,
+        repositoryId: ctx.repository.id,
+        isPrivate: ctx.repository.private,
+        conversationKind: ctx.conversation.kind,
+        issueNumber: ctx.conversation.issueNumber ?? undefined,
+        pullRequestNumber: ctx.conversation.pullRequestNumber ?? undefined,
+        // OPE-958 — the review thread's ROOT comment id, so `read_thread` on a GitHub seat can name
+        // the thread this turn arrived in. GitHub omits `in_reply_to_id` on the comment that OPENED
+        // the thread, so the root of a root comment is its own id. Derived ONLY on a review-thread
+        // conversation: an issue or PR timeline comment is not in a review thread, and stamping a
+        // root there would let `read_thread` claim a thread that does not exist.
+        reviewThreadRootCommentId:
+          ctx.conversation.kind === "review_thread" ? (num(comment.raw["in_reply_to_id"]) ?? comment.id) : undefined,
+        installationId: ctx.github.installationId,
+        actorLogin: comment.author?.login ?? ctx.sender.login,
+        actorId: comment.author?.id ?? ctx.sender.id,
+        actorType: comment.author?.type ?? ctx.sender.type,
+        authorAssociation: str(comment.raw["author_association"]),
+      }),
+      [authorFacts],
+      { surfaceKey },
+    );
+
+    // SPEND CAP (pre-flight — the ONE shared gate, spend/ingress-gate.ts, the same function every
+    // other surface and the cross-surface divert call): an over-budget scope DECLINES the turn with
+    // a VISIBLE refusal, never a silent drop, before the model turn. CHECK fails OPEN; a definite
+    // OVER fails CLOSED unless the sender is an admin over this scope.
+    //
+    // POSITION: this is the NATIVE mention leg only. On a single-window VOUCHED repo the mention is
+    // SUPPRESSED above (`shouldSuppressNativeMention` → `return null`) and re-enters through the
+    // ambient leg's window divert, which never reaches this line — that path is gated at the
+    // divert's own choke point (channels/unified.ts windowSpendGate, door "window"). The two are
+    // complementary, exactly like the suppression itself: whichever leg owns the mention gates it.
+    if ((await ingressSpendGate({
+      bindable: { channel: { kind: "github" as const }, session: { auth: { current: auth as unknown as { attributes?: Readonly<Record<string, string>> } } } },
+      door: "mention",
+      principalId: comment.author?.login ?? ctx.sender.login,
+      post: async (text) => { await ctx.thread.post(text); },
+    })) === "declined") {
+      return null; // drop — no model turn
+    }
+
+    // eve's SessionAuthContext is a superset of our capture shape (the extra issuer/subject
+    // fields are optional); we dispatch the enriched auth so bindGitHub resolves real
+    // visibility/trust instead of eve's stock defaultGitHubAuth, which omits repo.private.
+    //
+    // 🔴 AN ENGAGED FOLLOW-UP CARRIES THE ENROLMENT FACT (OPE-1740), AND THIS IS THE ONLY SEAM IT
+    // HAS ON THIS LEG. A non-mention comment reaches this line ONLY past `githubEngagedAdmits`, so
+    // `!isMention` here IS "the §2.5 seam admitted this as a follow-up in a container an @mention
+    // engaged". Every other surface states that fact as `follow-up="thread-engaged"` on its `<wake>`
+    // envelope; the native `githubChannel` session has no envelope at all — eve renders the comment
+    // body and nothing else — so the fact rode on nothing, and on deploy #200 the seat read the
+    // follow-up as somebody else's and answered `no_reply reason:"addressed_to_other"`. The inbound
+    // hook's own `context` array is eve's supported seam for exactly this (`GitHubInboundResult`):
+    // eve merges it with the PR context it builds and delivers it beside the comment.
+    //
+    // A MENTION IS UNCHANGED, and deliberately: it is addressed, so it is owed an answer whatever the
+    // container's enrolment says — the same exclusion every enveloped surface makes.
+    //
+    // AUTHORITATIVE addressing stamp for the link-claim hook (OPE-1788, identity/binding.ts
+    // `currentTurnAddressed`), the same one providers/notion stamps at notion-webhook.ts. `isMention`
+    // is the host-set verdict this leg already computed from the comment's own trigger token — it is
+    // the SAME addressing notion the single-window leg stamps at `singleWindowMentionPolicy`, not a
+    // second one, so the two legs now agree instead of disagreeing on a capability switch.
+    // 🔴 WITHOUT THIS STAMP THE NATIVE GITHUB CLAIM PATH IS UNREACHABLE. eve DELETES the `@bot` token
+    // from the body before delivery (`extractGitHubCommentTrigger` in eve's github/inbound.js), so an
+    // addressed `@bot link <code>` comment arrives as a BARE `link <code>` line. Unstamped, the claim
+    // gate would refuse it and tell the person to @mention — which they just did, and which the strip
+    // makes invisible. That is a dead end, and the native leg is the shipped default: `window.topology`
+    // is `shipped: false`, so a stock deployment never reaches the single-window stamp at all.
+    // Stamped ONLY on a mention: an engaged FOLLOW-UP is not addressed, and it must stay refused.
+    if (isMention) auth.attributes[OE_ADDRESSED_ATTR] = "1";
+    return isMention ? { auth } : { auth, context: [ENGAGED_FOLLOW_UP_CONTEXT] };
+};
+
+const native: GitHubChannel = githubChannel({
+  botName: BOT_NAME,
+  // 🔴 QUEUE, NEVER STEER (OPE-412) — eve's default `steer` cancels the turn in flight when a
+  // message arrives. Same reasoning as the Slack channel; see slack.ts for the full note.
+  turnPolicy: "queue",
+  onComment: githubOnComment,
+  events: {
+    // Supervisor turns: silent (no 👀, no checkout) + the per-turn reply-target snapshot.
+    // Everything else: eve's default (eyes reaction + repo checkout), via the pristine adapter.
+    async "turn.started"(data, channel, ctx) {
+      if (!isSupervisorGitHubState(channel.state)) {
+        await defaultEvent("turn.started")?.(data, channel);
+        return;
+      }
+      const st = channel.state as GitHubSupervisorSessionState;
+      const attrs = ctx?.session?.auth?.current?.attributes as Record<string, unknown> | undefined;
+      // buildGitHubAuth stows issue_number for issues and pull_request_number for PR timeline
+      // comments; both anchor the SAME reply endpoint (/issues/{n}/comments covers PRs too).
+      const anchor = str(attrs?.issue_number) ?? str(attrs?.pull_request_number);
+      const n = anchor !== undefined ? Number(anchor) : NaN;
+      if (!Number.isFinite(n) || n <= 0) {
+        // Missing/odd anchor CLEARS the target (never carry a stale one forward) —
+        // message.completed then fails safe and posts nothing.
+        st.oeReplyTarget = undefined;
+        return;
+      }
+      if (st.oeUnified === true) {
+        // UNIFIED (org, domain) session: the seed state's owner/repo is whichever repo CREATED the
+        // session, but a domain can span many repos — so the reply target must ride THIS wake's
+        // delivery auth (buildGitHubAuth stows owner/repo on every dispatch). Either missing
+        // CLEARS the target: a cross-repo post to a guessed repo is the exact misdelivery the
+        // per-wake snapshot exists to make impossible (P6), so fail safe instead.
+        const owner = str(attrs?.owner);
+        const repo = str(attrs?.repo);
+        st.oeReplyTarget = owner && repo ? { issueNumber: n, owner, repo } : undefined;
+        return;
+      }
+      st.oeReplyTarget = { issueNumber: n };
+    },
+    // Supervisor turns: the terminal outcome is audited and NOTHING is posted here — the visible
+    // reply came from the `reply` tool mid-turn (OPE-811). Everything else: eve's default
+    // reply-poster.
+    async "message.completed"(data, channel, ctx) {
+      if (!isSupervisorGitHubState(channel.state)) {
+        // 🔴 THE NATIVE ARM OWNS THE SILENCE DECISION TOO (OPE-883). eve's default reply-poster
+        // comments the terminal completion VERBATIM, so every silence this deployment knows about
+        // has to be decided HERE, above the delegation, or it reaches the issue as text. Linear's
+        // twin arm was measured doing exactly that on deploy #102 — a turn that called `no_reply`
+        // closed with the literal string "NO_REPLY" and the surface carried it as a comment. This
+        // arm had the identical gap: the sentinel is only ever swallowed by a handler that consults
+        // it, and the old pre-check consulted the silent ROUTINE only.
+        //
+        // The whole silence vocabulary now runs — `no_reply`, the `NO_REPLY` sentinel, an empty
+        // completion, a silent routine — exactly as the supervisor arm below and every chat surface
+        // already do. It also CONSUMES the turn-keyed `no_reply` mark, which this arm never did.
+        //
+        // A tool-calls step is NOT terminal and never comments, so it delegates untouched — and it
+        // must delegate BEFORE the consume, since the tool about to run may BE the `no_reply` call.
+        //
+        // GitHub has NO session to close (unlike Linear's agent session, whose spinner would hang):
+        // the wake is a webhook, so the drop is the whole of the silence. What it does leave is the
+        // audit row — see auditNativeGitHubSilence.
+        if (data.finishReason === "tool-calls") {
+          await defaultEvent("message.completed")?.(data, channel);
+          return;
+        }
+        // OPE-1647: the turn id, so the stand-down silence mark can prove it belongs to THIS turn.
+        // 🔴 THIS ARM DROPS ITS CLOSING PROSE SINCE OPE-2006, so the turn id no longer guards a post
+        // — it decides WHICH ROW the turn files. A stood-down turn resolves `silent` and files
+        // `auditNativeGitHubSilence` under the stand-down reason; without the id the mark is
+        // unprovable, the turn reads as an ordinary drop, and the stand-down leaves no record of
+        // itself. The posting hazard OPE-1647 was filed for — a stood-down conversation getting the
+        // acknowledgement and then the trailing prose, the measured deploy #187 shape — survives on
+        // ONE door only, and it is not this one: Linear's native arm, which hands its ending text to
+        // the agent framework's own poster. (The supervisor arm below passes no id and needs none:
+        // its terminal prose was already dropped under message-tool-only.)
+        const nativeTurnId = (ctx as unknown as { session?: { turn?: { id?: string } } })?.session?.turn?.id;
+        const nativeAction = finalMessageActionForTurn(data.finishReason, data.message, nativeTurnId);
+        // The turn-keyed reply-tool mark, read-and-reset once per TERMINAL completion (the same
+        // destructive read the supervisor arm below does, below its own non-terminal return).
+        const nativeReplied = consumeSupervisorReplyMark(ctx);
+        if (nativeAction.kind === "silent") {
+          await auditNativeGitHubSilence(channel.state, nativeAction.reason, nativeReplied, ctx?.session?.id);
+          return;
+        }
+        // 🔴 THE CLOSING PROSE IS DROPPED, NOT POSTED (OPE-2006). This arm used to post it through
+        // `postTerminalProse` as a `route:"terminal"` `reply.post` row (OPE-1681), with a delegation
+        // to eve's own poster as the fallback. Both are gone, and the DELEGATION goes with the choke
+        // point rather than surviving it: the `reply` tool is the only channel a seat's words leave
+        // by, so leaving one door that still comments the model's ending text would make the drop
+        // untrue on the very surface whose seats read that it holds.
+        // 🔴 THAT COSTS THE REVIEW THREAD ITS INLINE REPLY, AND THE TRADE IS STATED. eve's poster
+        // branched on `conversationKind === "review_thread"` to the inline endpoint
+        // (`/pulls/{n}/comments/{id}/replies`), which this deployment has no arm of its own for. A
+        // review-thread turn must now answer through `reply`, whose GitHub arm posts an issue/PR
+        // TIMELINE comment (`/issues/{n}/comments`) — the answer reaches the pull request rather than
+        // the thread's own line context. That is a PLACEMENT loss, not a delivery loss, and it is the
+        // honest side of the trade: the alternative is a seat told its prose is discarded on a surface
+        // where one door still posts it. An inline-reply arm would close it, and this change has none.
+        // WHAT TELLS THE MODEL is the seat prompt: GitHub declares `closingProseDropped`, so a
+        // conversational seat here reads the `reply-only` delivery arm — inside its persona when the
+        // token is supervisor-shaped, and through the `delivery` slot when it is not
+        // (instructions/access.ts `renderDeliverySlot`).
+        const nativePartition = nativeGitHubAuditPartition(channel.state);
+        // Either number anchors the SAME endpoint (`/issues/{n}/comments` covers PR timelines).
+        const nativeAnchor = channel.state.issueNumber ?? channel.state.pullRequestNumber;
+        // `kind === "post"` is the only remaining case — the `tool-calls` early return above already
+        // sent `buffer-tool-status` to eve's default, and the `silent` verdict returned above — but
+        // the compiler cannot see the first of those, so the guard is what carries `action.text`.
+        if (nativeAction.kind !== "post") return;
+        if (nativePartition !== null) {
+          await dropClosingProse({
+            row: {
+              org: nativePartition.org,
+              platform: nativePartition.platform,
+              workspace: nativePartition.workspace,
+              surface: nativePartition.surface,
+              // WHO this turn answered — the login eve stamped on the state from the triggering
+              // comment's sender. An absent one MEANS "the delivery authenticated nobody", so
+              // leaving it off would make every GitHub native row say something false.
+              ...(channel.state.triggeringUserLogin ? { principalId: channel.state.triggeringUserLogin } : {}),
+            },
+            chars: nativeAction.text.length,
+            ...(ctx?.session?.id ? { sessionId: ctx.session.id } : {}),
+            anchor: { issueNumber: nativeAnchor, conversationKind: channel.state.conversationKind },
+            log: (m) => log(`${m} (${channel.state.owner}/${channel.state.repo}#${nativeAnchor ?? "?"})`),
+          });
+          return;
+        }
+        // No resolvable partition, so there is no row to file it under — the drop still happens and
+        // the log line is the whole record.
+        log(
+          `closing prose DROPPED (${nativeAction.text.length}c) — nothing posted, and no partition to audit it under (${channel.state.owner}/${channel.state.repo}#${nativeAnchor ?? "?"})`,
+        );
+        return;
+      }
+      const sessionId = ctx?.session?.id; // stamped into the terminal audit rows → joins to the transcript
+      const action = finalMessageActionForTurn(data.finishReason, data.message);
+      if (action.kind === "buffer-tool-status") return; // not terminal — check BEFORE consuming below
+      const st = channel.state as GitHubSupervisorSessionState;
+      const target = st.oeReplyTarget;
+      const org = deploymentOrg();
+      // OPE-811: the turn-keyed reply-tool mark, read-and-reset on every TERMINAL completion so it can
+      // never bleed into the next turn — notion.ts's consume-at-top, and slack.ts's before it. It must
+      // sit BELOW the buffer-tool-status return: the tool about to run on an intermediate step might
+      // be the `reply` call itself, so consuming there would erase a mark that is not set yet.
+      const repliedViaTool = consumeSupervisorReplyMark(ctx);
+      // The POST anchor: per-repo sessions post to the seed repo (byte-identical); a UNIFIED
+      // session posts to the repo the per-wake snapshot captured — the seed repo is just
+      // "whichever repo created the session" and would misdeliver across containers.
+      const postOwner = st.oeUnified === true ? target?.owner : st.owner;
+      const postRepo = st.oeUnified === true ? target?.repo : st.repo;
+      // Audit labels prefer the snapshot's container on the unified path (fall back to the seed
+      // for a cleared-target silence row — context, not a post target).
+      const auditOwner = (st.oeUnified === true ? target?.owner : undefined) ?? st.owner;
+      const auditRepo = (st.oeUnified === true ? target?.repo : undefined) ?? st.repo;
+      // The SHARED ticketing completion arm (channels/supervisor-complete.ts) owns the terminal
+      // record. It POSTS NOTHING since OPE-811: GitHub's own post arm now carries a mid-turn route
+      // (github-post-arm.ts — the installation-token issue/PR-timeline comment), so the manifest
+      // declares midTurnPost, the `reply` tool mounts on this seat, and the message-tool-only gate is
+      // LIVE — the turn's closing prose never posts. The github.dispatched row (above) +
+      // replied/no_reply/turn.supervisor_prose_dropped = the "a row closes a row" family.
+      await completeSupervisorTurn({
+        action,
+        ...(sessionId ? { sessionId } : {}),
+        repliedViaTool,
+        midTurnPost: capabilitiesForPlatform("github").midTurnPost,
+        noReplyAction: "github.no_reply",
+        repliedAction: "github.replied",
+        contextRow: { org, platform: "github", workspace: auditOwner, surface: `github/${auditOwner}/${auditRepo}` },
+        repliedRow: { org, platform: "github", workspace: postOwner ?? auditOwner, surface: `github/${postOwner ?? auditOwner}/${postRepo ?? auditRepo}` },
+        silentAnchor: { issueNumber: target?.issueNumber ?? null },
+        droppedAnchor: { issueNumber: target?.issueNumber },
+        repliedAnchor: { issueNumber: target?.issueNumber },
+        log: (m) => slog(m),
+      });
+    },
+    // Supervisor turns: a failed judge turn must NOT spam the repo with an error comment —
+    // audit + log instead. Everything else: eve's default error comment.
+    async "turn.failed"(data, channel) {
+      if (!isSupervisorGitHubState(channel.state)) {
+        await defaultEvent("turn.failed")?.(data, channel);
+        return;
+      }
+      const st = channel.state as GitHubSupervisorSessionState;
+      slog(`supervisor turn failed on ${st.owner}/${st.repo} (audited, no comment posted)`);
+      await auditSupervisorFailure(
+        { org: deploymentOrg(), platform: "github", workspace: st.owner, surface: `github/${st.owner}/${st.repo}` },
+        "github.supervisor_turn_failed",
+        {},
+      );
+    },
+    async "session.failed"(data, channel) {
+      if (!isSupervisorGitHubState(channel.state)) {
+        await defaultEvent("session.failed")?.(data, channel);
+        return;
+      }
+      const st = channel.state as GitHubSupervisorSessionState;
+      slog(`supervisor session failed on ${st.owner}/${st.repo} (audited, no comment posted)`);
+      await auditSupervisorFailure(
+        { org: deploymentOrg(), platform: "github", workspace: st.owner, surface: `github/${st.owner}/${st.repo}` },
+        "github.supervisor_session_failed",
+        {},
+      );
+    },
+  },
+});
+
+// Wrap the native POST /eve/v1/github handler: run the event→Slack fan-out AND the ambient-
+// supervisor leg first (we have cross-channel `receive` + this channel's `send` here), then
+// delegate the request UNCHANGED to the native handler for the @mention/session behaviour.
+// The request body can only be read once, so we buffer it and hand the native handler a fresh
+// Request carrying the same body + headers (it re-verifies the signature itself over that
+// body — same GITHUB_WEBHOOK_SECRET).
+type HttpHandler = HttpRouteDefinition<GitHubChannelState>["handler"];
+function wrapRoute(inner: HttpHandler): HttpHandler {
+  return async (req, args) => {
+    const body = await req.text();
+    // Fan-out gate: preserve the pre-native fail-closed behaviour EXACTLY — an
+    // unauthenticated delivery is rejected for the whole route (the native handler would
+    // 401 it too). The dev escape hatch keeps the fan-out testable without a secret.
+    const rejection = gateGithubDelivery(
+      process.env.GITHUB_WEBHOOK_SECRET,
+      body,
+      req.headers.get("x-hub-signature-256"),
+      getSettings().webhooks.allowUnverifiedGithub,
+    );
+    if (rejection) {
+      log(`webhook rejected: ${rejection}`);
+      return new Response(rejection, { status: 401 });
+    }
+    const eventType = req.headers.get("x-github-event") ?? "";
+    // Ack fast; both OE legs run in the background (their sessions are async), same as before.
+    // The x-github-delivery header is GitHub's own idempotency key — passed through so the fan-out
+    // can drop a REDELIVERY (GitHub retries on any non-2xx) without re-firing every matched event
+    // routine. Passed only AFTER the signature gate above, never before it (OPE-139).
+    args.waitUntil(fanOutGitHubDelivery(body, eventType, args.to, req.headers.get("x-github-delivery")));
+    // ─── THE STOP LEG (OPE-898) ───────────────────────────────────────────────────────────────
+    // GitHub sends no reaction webhook, so the stop affordance on this surface is a bare `stop`
+    // comment read HERE, in the ingress — before any session is minted. See channels/github-stop.ts
+    // for the vendor evidence and the grammar.
+    //
+    // 🔴 IT SUPPRESSES THE AMBIENT LEG FOR ITS OWN DELIVERY. A stop directive must cancel and nothing
+    // else: waking the supervisor on it would start a turn in the room the person just asked the
+    // agent to leave alone. The native @mention leg needs no such guard — `isStopDirective` refuses
+    // every mention spelling, so eve's channel never sees one.
+    const stop = parseGitHubStopComment(body, eventType);
+    if (stop) {
+      args.waitUntil(
+        routeGitHubStopComment(stop, { attachSession: args.attachSession }).then(
+          (o) => slog(`stop comment on ${stop.owner}/${stop.repo}#${stop.number}: ${o.stopped ? o.outcome : o.reason}`),
+          (err) => slog(`stop leg failed: ${String(err)}`),
+        ),
+      );
+    } else {
+      args.waitUntil(ambientDelivery(body, eventType, githubSendFrom(args.from), args.to).catch((err) => slog(`ambient leg failed: ${String(err)}`)));
+    }
+    args.waitUntil(installationDelivery(body, eventType).catch((err) => ilog(`installation leg failed: ${String(err)}`)));
+    // ─── THE REACTION-FEEDBACK LEG (OPE-1502) ─────────────────────────────────────────────────
+    // GitHub pushes no reaction webhook, so a reaction on the agent's own comment is READ rather
+    // than delivered — this leg polls the conversation the delivery names. It runs beside the stop
+    // leg rather than in its `else`, because a stop directive is still an occasion to look. See
+    // channels/github-reaction-feedback.ts for the vendor evidence, the dedupe and the latency.
+    const pollTarget = parseGitHubReactionPollTarget(body, eventType);
+    if (pollTarget) {
+      args.waitUntil(
+        routeGitHubReactionFeedback(pollTarget, liveGitHubReactionFeedbackDeps(BOT_NAME)).then(
+          (outcomes) => {
+            if (outcomes.length > 0) slog(`reaction feedback on ${pollTarget.owner}/${pollTarget.repo}#${pollTarget.number}: ${outcomes.length} recorded`);
+          },
+          (err) => slog(`reaction feedback leg failed: ${String(err)}`),
+        ),
+      );
+    }
+    // Delegate to the native handler with a replayable request (body consumed above).
+    const cloned = new Request(req.url, { method: "POST", headers: req.headers, body });
+    return inner(cloned, args);
+  };
+}
+
+// Spread the native channel and swap only its POST /eve/v1/github route handler. Everything
+// that makes it the github channel — the adapter (kindHint/events/context/state), `receive`
+// (proactive github sessions), cors, the channel sentinel — is preserved, so eve dispatches
+// github turns exactly as the native channel would.
+const routes: GitHubChannel["routes"] = native.routes.map((r) =>
+  r.transport !== "websocket" && r.method === "POST" && r.path === ROUTE
+    ? { ...r, handler: wrapRoute(r.handler) }
+    : r,
+);
+
+const channel: GitHubChannel = { ...native, routes };
+
+export default channel;