@open-everywhere/provider-slack 0.1.0

package/agent/channels/slack-identity.ts

@@ -0,0 +1,520 @@
+// Pure Slack→OpenEverywhere identity capture AND interpretation. The Slack channel (slack.ts)
+// calls the capture half to stow RAW Slack facts (team/channel/user ids + channel_type +
+// is_private) into the session auth context's `attributes`; the INTERPRETATION of those facts into
+// mode/visibility/trust (slackMode/slackVisibility/slackTrust + the bindSlack mapper) moved here
+// from core identity/binding.ts in OPE-114 stage 4 — still one tested place for the
+// security-critical "is this private?" decision, now on the bundle side of the boundary.
+
+import { AsyncLocalStorage } from "node:async_hooks";
+import {
+  declaredWorkspaceTrust,
+  rootDmGrainAttrs,
+  surfaceKeySegment,
+  type BindableContext,
+  type IdentityMapper,
+  type RawIdentity,
+  type SessionMode,
+  type Visibility,
+} from "@open-everywhere/core/agent/adapter-api.js";
+
+/** Structural match for eve's SessionAuthContext (attributes + principal). */
+export interface OpenEverywhereSlackAuth {
+  readonly authenticator: string;
+  readonly principalId: string;
+  readonly principalType: string;
+  readonly attributes: Record<string, string>;
+}
+
+export interface SlackIdentityInput {
+  readonly userId: string;
+  readonly teamId?: string;
+  /**
+   * The Enterprise Grid organisation the event's workspace belongs to (`E…`), when the event
+   * envelope carried one (OPE-1508). Absent on an ordinary single-workspace install, and absent on
+   * any ingress that never sees the envelope — `slackEnterpriseIdFromEnvelope` (slack-events.ts) is
+   * the one reader, and slack-events.ts's own note says which ingresses reach it.
+   */
+  readonly enterpriseId?: string;
+  readonly channelId: string;
+  readonly threadTs?: string;
+  /** "channel" | "group" | "im" | "mpim" — as known. */
+  readonly channelType?: string;
+  readonly isPrivate?: boolean;
+  /**
+   * Whether this conversation is externally shared (Slack Connect / cross-org). When
+   * we positively determined it (a conversations.info fetch succeeded), this is a
+   * boolean; `undefined` means we never determined it — the memory trust gate fails
+   * closed on `undefined` for real channels (see binding.ts slackTrust).
+   */
+  readonly isExternal?: boolean;
+  /** True iff a conversations.info lookup succeeded, so `isExternal` is authoritative. */
+  readonly trustChecked?: boolean;
+  /**
+   * For a DM only: whether the PARTNER is an internal member, positively determined via a
+   * users.info lookup ("internal"|"external"). `undefined` = not determined → the binding
+   * fails closed (external), so a DM's shared read layer is `public`, never org/dm-shared.
+   */
+  readonly dmPartnerTrust?: "internal" | "external";
+}
+
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export function buildSlackAuth(input: SlackIdentityInput): OpenEverywhereSlackAuth {
+  const attributes: Record<string, string> = {
+    channel_id: input.channelId,
+    user_id: input.userId,
+  };
+  if (input.teamId) attributes.team_id = input.teamId;
+  if (input.enterpriseId) attributes.enterprise_id = input.enterpriseId;
+  if (input.threadTs) attributes.thread_ts = input.threadTs;
+  if (input.channelType) attributes.channel_type = input.channelType;
+  if (typeof input.isPrivate === "boolean") attributes.is_private = String(input.isPrivate);
+  if (typeof input.isExternal === "boolean") attributes.is_ext_shared = String(input.isExternal);
+  if (typeof input.trustChecked === "boolean") attributes.trust_checked = String(input.trustChecked);
+  if (input.dmPartnerTrust) attributes.dm_partner_trust = input.dmPartnerTrust;
+  // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 DM OR an mpim (group
+  // DM) is a STANDING seat ⇒ narrowed hands — both are closed multi-party conversations with no
+  // channel identity. A DM is unambiguously channelType "im" (the DM path always sets it); the
+  // id-prefix "D" is the slackMode fallback for a DM with no type captured. mpim is ONLY matched via
+  // the explicit channelType — Slack's legacy "G"-prefixed ids are ambiguous between mpim and a
+  // private "group" channel, so there is no safe id-prefix fallback for it (unlike "D"/DM);
+  // channelType undefined ⇒ never inferred as mpim (fails closed to unstamped/full, not over-narrowed).
+  const isDmFamily = input.channelType === "im" || input.channelType === "mpim" || (input.channelType === undefined && input.channelId.startsWith("D"));
+  Object.assign(attributes, rootDmGrainAttrs(isDmFamily));
+  return { authenticator: "slack", principalId: input.userId, principalType: "slack-user", attributes };
+}
+
+// ── THE FORWARDED ENVELOPE — how the NATIVE FORWARD keeps its enterprise rung (OPE-1559) ────────
+//
+// THE PROBLEM. `enterprise_id` sits on the Slack `event_callback` ENVELOPE, never on the inner
+// event (slack-events.ts `slackEnterpriseIdFromEnvelope` states that, and it is the one reader).
+// `slack-front.ts` forwards an ordinary `app_mention` to eve's native `slackChannel`, and eve hands
+// the handler a `SlackMessage` whose `raw` is the INNER event. The envelope is gone by then, and
+// eve's inbound context exposes none, so `slack.ts` had no envelope to read the rung off.
+//
+// THE CARRIER. The front route stows the envelope's rung for the extent of ONE forward, and
+// `slack.ts` reads it back inside that forward. Nothing else may write it.
+//
+// WHY AsyncLocalStorage AND NOT A MODULE GLOBAL. One process serves many Slack deliveries at once.
+// A module global would let workspace A's Grid id reach workspace B's mention — the one direction
+// that WIDENS trust, because a stamped rung can vouch a room the operator never declared. An
+// AsyncLocalStorage scopes the value to the async call tree of the single forward that wrote it,
+// which is exactly the extent of one delivery. Same primitive and same reasoning as
+// approvals/arming-context.ts and access/connector-scope.ts.
+//
+// 🔴 AND THE READ STILL MATCHES THE MESSAGE. Async scoping alone would already be correct, so this
+// is belt-and-braces on a value that can only ever widen trust: the stow carries the message the
+// envelope described, and {@link forwardedSlackEnterpriseId} answers only for THAT message. A
+// carrier that somehow outlived its forward therefore stamps nothing, rather than stamping the
+// wrong room. The key is `(channelId, ts)` — a Slack channel id is unique across Slack and a `ts` is
+// unique within a channel, so the pair names one message. `teamId` is deliberately NOT in the key:
+// `slack.ts` heals a missing team from the domain config, so a team-keyed read would refuse a
+// healed message and lose the rung it just carried.
+//
+// FAIL-CLOSED IN BOTH DIRECTIONS. No carrier, a non-Grid envelope, or a mismatched message all
+// answer `undefined`, and `buildSlackAuth` then stamps no `enterprise_id` — which is precisely the
+// behaviour before this existed: the room declares nothing and the member plane refuses.
+export interface ForwardedSlackEnvelope {
+  /** The Enterprise Grid organisation the forwarded envelope named (`E…`). */
+  readonly enterpriseId: string;
+  /** The channel of the inner event the envelope carried. */
+  readonly channelId: string;
+  /** The `ts` of the inner event the envelope carried. */
+  readonly ts: string;
+}
+
+const forwardedEnvelope = new AsyncLocalStorage<ForwardedSlackEnvelope>();
+
+/**
+ * Run `fn` with `envelope` readable by anything it awaits. ONE caller — `slack-front.ts`'s
+ * `forwardNative`, around the hand-off to eve's native `slackChannel`. Do not wrap anything else:
+ * the value means "the envelope of the delivery being forwarded right now", and a second writer
+ * would make that false.
+ *
+ * `undefined` runs `fn` with NO carrier, so an ordinary single-workspace install (and any body the
+ * front could not parse) costs one `AsyncLocalStorage.run` and stows nothing.
+ */
+export function withForwardedSlackEnvelope<T>(envelope: ForwardedSlackEnvelope | undefined, fn: () => T): T {
+  return envelope === undefined ? fn() : forwardedEnvelope.run(envelope, fn);
+}
+
+/**
+ * The Enterprise Grid organisation of the message being handled on the native forward, or
+ * `undefined` outside a forward, on a non-Grid delivery, or for any message the carrier does not
+ * describe. See the block above for why the match is checked rather than assumed.
+ */
+export function forwardedSlackEnterpriseId(message: { readonly channelId: string; readonly ts: string }): string | undefined {
+  const carried = forwardedEnvelope.getStore();
+  if (!carried) return undefined;
+  return carried.channelId === message.channelId && carried.ts === message.ts ? carried.enterpriseId : undefined;
+}
+
+export interface ChannelFacts {
+  readonly channelType?: string;
+  readonly isPrivate?: boolean;
+  /** Externally shared (Slack Connect / cross-org). undefined = not determined. */
+  readonly isExternal?: boolean;
+  /** True iff a conversations.info lookup succeeded (so isExternal is authoritative). */
+  readonly trustChecked?: boolean;
+  /** THE APP's OWN membership of this conversation, from `conversations.info`'s `is_member`.
+   *  undefined = the response did not say (Slack omits the field on a DM, and a private room the
+   *  app cannot see answers `channel_not_found` instead of a channel object). It is the app's
+   *  membership, never a person's — {@link ChannelFacts} carries no person. */
+  readonly appInChannel?: boolean;
+  /** DM partner trust (internal|external), positively determined via users.info; undefined = not determined. */
+  readonly dmPartnerTrust?: "internal" | "external";
+}
+
+/**
+ * The Enterprise Grid organisation a `users.info` user object belongs to (`E…`), or `undefined`.
+ * Grid nests it as `enterprise_user: { enterprise_id }`; an ordinary workspace's user object carries
+ * no such field, so every level is probed rather than assumed (Slack's raw JSON).
+ */
+function enterpriseIdOfUser(u: Record<string, unknown>): string | undefined {
+  const eu = u["enterprise_user"];
+  if (!eu || typeof eu !== "object") return undefined;
+  const id = (eu as Record<string, unknown>)["enterprise_id"];
+  return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+
+/**
+ * Does the operator's tracked config vouch this Slack WORKSPACE — the rung walk a person's home
+ * workspace goes through when it is NOT the workspace the event arrived in (OPE-1508, Tommy's ruling
+ * of 2026-09-07).
+ *
+ * 🔴 THE PROBLEM IT SOLVES. On Enterprise Grid a person's home `team_id` is their own workspace, not
+ * the workspace the message was posted in, so the plain `team_id === expectedTeamId` test read every
+ * Grid colleague as a stranger. The fix is NOT to stop comparing: it is to ask the register whether
+ * the author's OWN workspace is vouched, and the enterprise rung is what lets one line answer for
+ * every workspace in the Grid —
+ * `defineSurface({ key: "slack/E0GRID", trust: "internal" })`.
+ *
+ * 🔴 ABSENCE INFERS NON-MEMBER, which is the ruling's other half. An undeclared sibling workspace is
+ * a GUEST here, exactly as a Slack Connect stranger from an unrelated org is. The operator vouches by
+ * writing a line in `agent/identity/surfaces.ts`; there is no probe that could infer it, and a Grid
+ * an operator has not named is not one this deployment has asserted anything about.
+ *
+ * PURE and SYNCHRONOUS — the register read is (identity/trust.ts's own contract), so this adds no
+ * I/O to a leg that already pays for one `users.info`.
+ */
+export function slackWorkspaceVouched(teamId: string | undefined, enterpriseId: string | undefined): boolean {
+  const team = surfaceKeySegment(teamId);
+  if (team.length === 0) return false; // no workspace named ⇒ nothing to ask about ⇒ not vouched
+  const enterprise = surfaceKeySegment(enterpriseId);
+  return (
+    declaredWorkspaceTrust(`slack/${team}`, enterprise.length === 0 ? undefined : `slack/${enterprise}`) === "internal"
+  );
+}
+
+/**
+ * DM-partner trust from a `users.info` response — the authoritative source for "is this person an
+ * internal member?". Defensive (Slack's raw JSON) and FAIL-CLOSED: a missing/failed lookup, a guest
+ * (restricted / ultra_restricted), a Connect stranger, a deleted account, or a workspace this
+ * deployment does not admit all yield `external`. Mirrors channelFactsFromInfo for the DM universe,
+ * and — since OPE-466 — it is also the ONE reader behind the per-author membership probe
+ * (`slackAuthorIsMember`), so a DM partner and a channel/group-DM author cannot drift apart on what
+ * a member is.
+ *
+ * 🔴 THE WORKSPACE TEST IS A RUNG WALK, NOT AN EQUALITY (OPE-1508). The author's OWN workspace
+ * answers first and needs no declaration: `team_id === expectedTeamId` is a member, which is what
+ * every single-workspace deployment has always relied on. A DIFFERENT workspace then asks the
+ * operator's register through {@link slackWorkspaceVouched}, so an Enterprise Grid colleague whose
+ * home `team_id` is a sibling workspace is a member when the operator declared the Grid, and a guest
+ * when they did not. Read the ruling in {@link slackWorkspaceVouched}.
+ *
+ * 🔴 AN ABSENT `expectedTeamId` IS A GUEST QUESTION, NOT A SKIPPED ONE. A caller that knows no
+ * workspace gets the register walk alone, so an undeclared author is a guest. The body says which
+ * live envelope produces that absence and what admitting it cost.
+ *
+ * 🔴 A BOT IS JUDGED BY ITS WORKSPACE, WITH NO CARVE-OUT (OPE-1508, the same ruling). `is_bot` used
+ * to refute on its own, which marked the deployment's OWN admitted apps as guests — including the
+ * e2e driver bot in a group DM. It is gone from the refutation: the workspace's own app carries that
+ * workspace's `team_id` and is a member, a foreign app carries another and is a guest unless the
+ * operator vouched its workspace. `deleted` still refutes, because a deleted account is not a member
+ * of anything.
+ *
+ * 🔴 WHAT THIS WIDENS — EVERY CONSUMER, NOT THE FIRST ONE. This verdict has four readers, and both
+ * halves of the ruling (a bot is not refuted; a declared foreign workspace is admitted) reach all
+ * four. Naming one and calling it plain is how a wrong claim survives:
+ *   1. the 1:1 DM's SHARED READ LAYER — `internal` selects the org brain, so a DM with the
+ *      workspace's own app now binds `internal` where it bound `external`;
+ *   2. the CHAT AUTHOR TAINT — `slackAuthorIsMember` (slack-events.ts), which stamps
+ *      `oe_chat_nonmember`, fences the author's words, and is what the member plane refuses on;
+ *   3. the APPROVAL CLICKER FLOOR leg D (access/../approvals/clicker-floor.ts), through
+ *      `slackClickerIsGuest` — who may EXECUTE a member-tier approval card;
+ *   4. the HITL ANSWER FLOOR leg B (approvals/input-response-floor.ts), same probe — who may resume
+ *      a parked turn, which is a spend commitment.
+ * So a workspace-installed app's bot user, and a person in a partner workspace the operator declared
+ * internal, now clear (3) and (4) where they were refused as guests. That is the ruling applied
+ * consistently rather than a side effect — the bot rule was asked and answered at the author leg,
+ * and one function is what keeps the four readers from disagreeing — but it is a wider change than
+ * the DM layer alone, so it is written here in full.
+ *
+ * The guest flags are unchanged and still refute on every one of the four. Consumers (3) and (4)
+ * describe this same rule in their own headers, corrected under OPE-1558 — they sit behind the merge
+ * fence's approvals-plane rule, which is why the correction landed in its own reviewed change rather
+ * than in this one.
+ */
+export function partnerFactsFromInfo(info: unknown, expectedTeamId?: string): { dmPartnerTrust: "internal" | "external" } {
+  const u = (info as { user?: Record<string, unknown> } | null)?.user;
+  if (!u || typeof u !== "object") return { dmPartnerTrust: "external" }; // lookup failed → fail closed
+  const guestOrStranger = Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+  const deleted = Boolean(u["deleted"]);
+  const homeTeamId = typeof u["team_id"] === "string" ? (u["team_id"] as string) : undefined;
+  // 🔴 NO EXPECTED WORKSPACE IS NOT AN OWN-WORKSPACE ANSWER. This used to read the absence as
+  // "member", which admitted EVERY author the guest flags did not refute. The absence is reachable
+  // from the callers, not hypothetical: `slack-events.ts` builds its `teamId` as
+  // `envelope.team_id ?? e.team` and `slack-input-response.ts` reads the raw `team_id` attribute, so
+  // an inbound payload that names no workspace hands `undefined` down here. The shape expected to
+  // produce it is a Grid ORG-WIDE install, which carries an `enterprise_id`; that vendor detail is
+  // NOT verified here, and nothing below rests on it — the arm is fail-closed either way. With
+  // `is_bot` gone from the refutation (the ruling above), a
+  // FOREIGN app's bot user carrying no `is_restricted` / `is_stranger` flag then resolved as a
+  // MEMBER — no `oe_chat_nonmember` stamp, no untrusted fence, and the same wrong verdict on both
+  // approval floors. So absence falls to the register walk below, exactly as a differing workspace
+  // does: ABSENCE INFERS NON-MEMBER. A Grid the operator declared still answers `internal` here,
+  // because the walk reads the author's OWN home workspace and enterprise off `users.info` and needs
+  // nothing from the envelope.
+  const ownWorkspace = expectedTeamId !== undefined && expectedTeamId.length > 0 && homeTeamId === expectedTeamId;
+  const admittedWorkspace = ownWorkspace || slackWorkspaceVouched(homeTeamId, enterpriseIdOfUser(u));
+  const internal = !guestOrStranger && !deleted && admittedWorkspace;
+  return { dmPartnerTrust: internal ? "internal" : "external" };
+}
+
+/** What an app_mention envelope tells us directly (often just channel_type). */
+export function channelFactsFromRaw(raw: Record<string, unknown>): ChannelFacts {
+  const channelType = typeof raw["channel_type"] === "string" ? (raw["channel_type"] as string) : undefined;
+  return { channelType };
+}
+
+/**
+ * Facts from a `conversations.info` response — the authoritative source for the
+ * public/private bit AND the external-sharing bit that app_mention events don't carry.
+ * Defensive: the response is Slack's raw JSON, so everything is probed, never assumed.
+ *
+ * External sharing is the memory trust signal: a Slack Connect / shared / org-shared
+ * channel may contain people outside the org, so its memory is gated off entirely
+ * (binding.ts slackTrust). We treat ANY of is_shared / is_ext_shared / is_org_shared /
+ * is_pending_ext_shared as external. A successful fetch sets `trustChecked: true` so the
+ * binding can distinguish "checked, internal" from "never checked" (which fails closed).
+ */
+export function channelFactsFromInfo(info: unknown): ChannelFacts {
+  const ch = (info as { channel?: Record<string, unknown> } | null)?.channel;
+  if (!ch || typeof ch !== "object") return {};
+  const isPrivate = typeof ch["is_private"] === "boolean" ? (ch["is_private"] as boolean) : undefined;
+  const isExternal = Boolean(
+    ch["is_ext_shared"] || ch["is_org_shared"] || ch["is_shared"] || ch["is_pending_ext_shared"],
+  );
+  let channelType: string | undefined;
+  if (ch["is_im"]) channelType = "im";
+  else if (ch["is_mpim"]) channelType = "mpim";
+  else if (ch["is_group"] || ch["is_private"]) channelType = "group";
+  else if (ch["is_channel"]) channelType = "channel";
+  // `is_member` is the APP's own membership of the room. Slack sends it for a channel/group and
+  // omits it for a DM, so a missing field stays undefined rather than becoming false — the
+  // readability rule (slack-events.ts appCanReadConversation) decides what a missing field means
+  // per channel type, and this function only reports what Slack said.
+  //
+  // 🔴 THE PRIVATE-CHANNEL HALF IS MEASURED (OPE-1447, 2026-09-08). A live `conversations.info` on a
+  // private fixture channel the caller is in answered `is_member: true` — the field is PRESENT for a
+  // private channel, so `appCanReadConversation` returns readable and the shortcut route keeps that
+  // room's files. It also answered `is_private: true, is_channel: true, is_group: false`: Slack no
+  // longer returns the legacy `is_group` shape for a private channel, which is why the `is_private`
+  // arm above is load-bearing rather than belt-and-braces. Measured with a USER token, not the app's
+  // bot token, so what stays unproven is narrow: whether a BOT token gets the same field.
+  const appInChannel = typeof ch["is_member"] === "boolean" ? (ch["is_member"] as boolean) : undefined;
+  // The fetch succeeded (we have a channel object), so trust is authoritatively known.
+  return { channelType, isPrivate, isExternal, trustChecked: true, ...(appInChannel === undefined ? {} : { appInChannel }) };
+}
+
+/**
+ * Can THIS APP read the conversation {@link channelFactsFromInfo} just described? Positive and
+ * FAIL-CLOSED: it says yes only on a probe that SUCCEEDED and said the app is in the room.
+ *
+ * The rule differs by channel type because Slack's answer does:
+ *   • a `channel` or `group` carries `is_member`, which is exactly "is this app in the room" — the
+ *     fact `conversations.history` enforces when it refuses a non-member with `not_in_channel`. A
+ *     public channel the app never joined answers `is_member: false` on a lookup that otherwise
+ *     SUCCEEDS, so `trustChecked` alone would admit it;
+ *   • an `im` or `mpim` carries no `is_member`, so this arm rests on an INFERENCE, not on a checked
+ *     fact: Slack is documented to answer `conversations.info` for a DM only to an app that is in
+ *     it, and a room the app cannot see answers `channel_not_found` — which reaches here as no
+ *     channel object at all, hence no `trustChecked`. STILL UNMEASURED (OPE-1447), in the same sense
+ *     `shortcutWakeKey`'s trigger-id assumption is: no offline tier can drive a live
+ *     `conversations.info` against a DM the app is not in. A 2026-09-08 attempt got as far as a
+ *     `channel_not_found` for a non-member caller, which POINTS the right way but proves nothing:
+ *     neither e2e Slack token holds `im:read`, so the member CONTROL could not be driven, and
+ *     `channel_not_found` without it may be the no-scope answer rather than the no-membership one.
+ *     Settling it needs one probe under the app's own BOT token, on a ship soak. If the inference is
+ *     wrong, this arm admits that DM's files. The channel/group arm below does not depend on it;
+ *   • anything else — a failed probe, a missing token, an unrecognised channel type — is NO.
+ *
+ * The Slack shortcut route reads it (OPE-1442): Slack delivers a `message_action` for a room the
+ * app is not in, so this is what keeps the target message's FILES from being fetched with the bot
+ * token out of a room the agent's own channel reads refuse.
+ */
+export function appCanReadConversation(facts: ChannelFacts): boolean {
+  if (facts.trustChecked !== true) return false;
+  if (facts.channelType === "im" || facts.channelType === "mpim") return true;
+  return facts.appInChannel === true;
+}
+
+// --- the identity MAPPER (moved out of core identity/binding.ts in OPE-114 stage 4) ---------
+// Interprets the raw facts the Slack channel stowed in auth attributes:
+//   team_id, channel_id, channel_type ("channel"|"group"|"im"|"mpim"),
+//   is_private ("true"|"false"), user_id.
+// Registered by registerSlackProvider() via registerIdentityMapper("slack", bindSlack).
+
+/** The trust verdict a mapper contributes — mirrors core binding.ts's Trust union. */
+type Trust = NonNullable<RawIdentity["trust"]>;
+
+/** Slack channel_type / id → session mode (channel | dm | mpim). */
+export function slackMode(channelType: string | undefined, channelId: string | undefined): SessionMode {
+  if (channelType === "im") return "dm";
+  if (channelType === "mpim") return "mpim";
+  if (channelType === "channel" || channelType === "group") return "channel";
+  // No type captured — the `D` id prefix reliably marks a DM; otherwise assume a channel.
+  if (channelId && channelId.startsWith("D")) return "dm";
+  return "channel";
+}
+
+/**
+ * Slack facts → visibility. FAIL CLOSED: anything we can't positively confirm as
+ * a public channel is treated as `private`, so a surface's learnings never leak
+ * up to shared memory on an under-specified event. (A correctly-wired channel
+ * always sets is_private, so the fail-closed branch is the misconfigured/unknown
+ * case, where private is the safe default.)
+ */
+export function slackVisibility(
+  channelType: string | undefined,
+  isPrivate: string | undefined,
+  mode: SessionMode,
+): Visibility {
+  if (isPrivate === "true") return "private";
+  if (isPrivate === "false") return "public";
+  // DMs / group-DMs are never "public" surfaces.
+  if (mode === "dm" || mode === "mpim") return "private";
+  if (channelType === "channel") return "public"; // an explicit public channel
+  return "private"; // unknown -> fail closed
+}
+
+/**
+ * Slack sharing facts → trust. FAIL CLOSED for shared memory: a positively
+ * externally-shared channel (`is_ext_shared="true"`) is `external`; so is a channel we
+ * never managed to check (`trust_checked` not "true") — because on a real Slack channel
+ * we always attempt conversations.info, so an absent check means the lookup failed and
+ * we can't vouch for the membership.
+ *
+ * 🔴 A GROUP DM READS THE PLATFORM'S POSITIVE EXTERNAL SIGNAL, EXACTLY AS A CHANNEL DOES
+ * (OPE-1486, Tommy's 2026-09-07 ruling). A group DM is a shared room with several people in it,
+ * so `binding.trust` on an mpim is the DEMOTION half of the member plane's G4b vouch
+ * (access/member-plane.ts `roomVouchedInternalFrom`): the operator's declaration vouches the room
+ * at any rung, and the platform's `is_ext_shared` is what forbids that declaration re-promoting a
+ * Slack Connect group DM. Returning a blanket `internal` here made that demotion unreachable, so a
+ * cross-org group DM was vouched under a workspace-wide `internal` line.
+ *
+ * 🔴 THE mpim DEMOTION IS POSITIVE-ONLY — the channel's `trust_checked` fail-close does NOT apply
+ * to it, and that asymmetry is the ruling rather than an oversight. A group DM has no shared-memory
+ * silo to protect (it is DM-family), and its `conversations.info` needs the separate `mpim:read`
+ * scope, so failing an unchecked mpim closed would demote every group DM in a workspace that never
+ * granted that scope — a deployment-wide regression bought for no signal. What demotes an mpim is
+ * evidence, never the absence of it. 🔴 THE LIMIT THAT BUYS: a workspace WITHOUT `mpim:read` resolves
+ * neither fact, so a Slack Connect group DM there is still vouched under a coarse declaration. The
+ * runbook (docs/deploy/surfaces/slack.md) states that precondition to the operator.
+ *
+ * `binding.trust` on an mpim has READERS BEYOND G4b, and every one of them TIGHTENS on this
+ * demotion: the role resolve falls to the `public` domain, domain skills drop, and the
+ * access-request, agent-create and identity-link paths refuse. None widens, and memory is untouched
+ * — a group DM reads no shared silo at any trust (memory/resolve.ts).
+ *
+ * A 1:1 DM never reaches the sharing question at all: `bindSlack` binds a `dm` from the PARTNER's
+ * verified trust, so `mode === "dm"` here answers the personal silo's `internal` unchanged.
+ */
+export function slackTrust(
+  isExternal: string | undefined,
+  trustChecked: string | undefined,
+  mode: SessionMode,
+): Trust {
+  if (mode === "dm") return "internal"; // personal silo; the partner's trust is bindSlack's own read
+  if (isExternal === "true") return "external"; // Slack Connect / shared / org-shared — a group DM too
+  if (mode === "mpim") return "internal"; // DM-family: demoted by evidence only, never by its absence
+  if (trustChecked !== "true") return "external"; // never confirmed → fail closed
+  return "internal";
+}
+
+// The two attribute helpers are LOCAL COPIES of core binding.ts's module-private probes (attr /
+// authPrincipalId) — deliberately not barrel ports (the notion bundle set the precedent): they are
+// three-line structural reads over the public BindableContext shape, and a mapper author outside
+// core is expected to read its own platform's attributes itself.
+
+type AuthAttrs = Readonly<Record<string, string | readonly string[]>> | undefined;
+
+function slackAuthOf(ctx: BindableContext): { attributes?: AuthAttrs; principalId?: string } | null {
+  return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+
+function slackAttr(a: AuthAttrs, keys: readonly string[]): string | undefined {
+  if (!a) return undefined;
+  for (const k of keys) {
+    const v = a[k];
+    if (typeof v === "string" && v.length > 0) return v;
+    if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0) return v[0];
+  }
+  return undefined;
+}
+
+// Auth principalId, treating empty string as absent so it falls through to the user_id
+// attribute rather than binding a blank id.
+function slackAuthPrincipalId(ctx: BindableContext): string | undefined {
+  const pid = slackAuthOf(ctx)?.principalId;
+  return pid && pid.length > 0 ? pid : undefined;
+}
+
+// Eve's own auth identities (e.g. the approval-resume step's ctx, rebuilt from the
+// approval click rather than our wake stamp) carry the composite "slack:<team>:<user>"
+// AuthKey form, where buildSlackAuth stamps the RAW user id. Every scopeKey (grants,
+// partition, memory) is keyed on the raw id, so a composite resolving here splits the
+// caller's identity across the approval boundary (live 2026-07-21: the post-approval
+// connector gate refused "ungranted" — scopeKey dm:slack:T…:U… vs the granted dm:U…).
+// Raw Slack ids never contain ":", so collapsing to the last segment is loss-free.
+function rawSlackPrincipal(pid: string | undefined): string | undefined {
+  if (!pid || !pid.startsWith("slack:")) return pid;
+  const last = pid.slice(pid.lastIndexOf(":") + 1);
+  return last.length > 0 ? last : undefined;
+}
+
+export const bindSlack: IdentityMapper = (ctx): RawIdentity => {
+  const a = slackAuthOf(ctx)?.attributes;
+  const channelId = slackAttr(a, ["channel_id", "channelId"]);
+  const channelType = slackAttr(a, ["channel_type", "channelType"]);
+  const isPrivate = slackAttr(a, ["is_private", "isPrivate"]);
+  const mode = slackMode(channelType, channelId);
+  // For a DM, trust = the verified PARTNER trust (users.info, stowed by slack.ts). Absent →
+  // undefined → bindFrom fails the DM closed. For a channel, the conversations.info verdict.
+  const dmRaw = slackAttr(a, ["dm_partner_trust", "dmPartnerTrust"]);
+  const dmPartnerTrust: Trust | undefined = dmRaw === "internal" || dmRaw === "external" ? dmRaw : undefined;
+  return {
+    workspace: slackAttr(a, ["team_id", "teamId"]),
+    // The ENTERPRISE rung above the workspace (OPE-1508). Present only on an Enterprise Grid event
+    // whose envelope carried `enterprise_id`, so an ordinary install contributes nothing and its
+    // trust walk is unchanged. Core spells it and composes `slack/<enterpriseId>`; one declaration
+    // at that key vouches every workspace in the Grid, and the workspace's own line still wins.
+    trustEnterprise: slackAttr(a, ["enterprise_id", "enterpriseId"]),
+    surface: channelId,
+    mode,
+    visibility: slackVisibility(channelType, isPrivate, mode),
+    trust: mode === "dm" ? dmPartnerTrust : slackTrust(slackAttr(a, ["is_ext_shared", "isExtShared"]), slackAttr(a, ["trust_checked", "trustChecked"]), mode),
+    trustVerified: mode === "dm" ? dmPartnerTrust !== undefined : undefined,
+    principalId: rawSlackPrincipal(slackAuthPrincipalId(ctx)) ?? slackAttr(a, ["user_id", "userId"]),
+    // Routine post-back targets the channel (a fresh message), not an old thread.
+    target: channelId ? { channelId } : undefined,
+    // Eve's adapter sets thread_ts to the triggering message's own ts when it isn't a
+    // thread reply, so a channel mention always carries the thread its reply lands in.
+    // The unified divert forwards the RAW event auth, which for a top-level mention has
+    // no thread_ts — its anchor rides the oe_reply_anchor stamp instead (unified-window.ts
+    // OE_REPLY_ANCHOR_ATTR), so approval cards/post_file/notices thread under the mention
+    // on the divert path exactly as they do natively (live-found 2026-07-19: J3's card
+    // posted to the channel root). The wake ORIGIN stays anchor-free — §S2/ownership
+    // still read a top-level wake as top-level.
+    threadTs: slackAttr(a, ["thread_ts", "threadTs"]) ?? slackAttr(a, ["oe_reply_anchor", "oeReplyAnchor"]),
+  };
+};