@open-everywhere/provider-slack 0.1.0

package/agent/channels/slack-shortcut.ts

@@ -0,0 +1,336 @@
+// SLACK SHORTCUTS AS A WAKE ORIGIN (OPE-1376).
+//
+// Slack gives a person two ways to hand something to an app without typing at it: a MESSAGE
+// shortcut (the `…` overflow menu on one message) and a GLOBAL shortcut (the ⚡ composer /
+// search-bar entry). Both arrive on the app's INTERACTIVITY Request URL as a urlencoded
+// `payload=…` body — the same URL and the same body family as a button click, never as an
+// Events API `event_callback`.
+//
+// 🔴 A SHORTCUT IS A WAKE ORIGIN, NOT A NEW PLANE. This module does exactly one thing: it turns a
+// shortcut payload into the {@link ParsedMessageEvent} the rest of the Slack front door already
+// speaks. Every downstream property — the partition, the seat, the window, the dedupe, the spend
+// gate, the external-participant policy, the wake trust tier — is then derived by the SAME code a
+// mention or a DM goes through. Nothing here decides posture, and nothing here posts.
+//
+// WHY OE OWNS THE PAYLOAD RATHER THAN FORWARDING IT TO EVE. eve 0.48.0 added an `onShortcut` hook
+// to `slackChannel`, and `slack.ts` does not configure one. So a forwarded shortcut is a
+// guaranteed no-op today. The hook could not carry this work either: `SlackShortcutContext`
+// (eve's own type) hands the handler a workspace API handle and NOTHING else — no session, no
+// resolved seat, no `send`. The machinery that turns an inbound Slack event into a wake on the
+// right window lives in `slack-front.ts`, so the shortcut is classified and handled there, beside
+// the approval click, and never forwarded.
+//
+// 🔴 THE PRINCIPAL IS THE INVOKER, NEVER THE MESSAGE AUTHOR. A message shortcut names two people:
+// whoever clicked it, and whoever wrote the message it was clicked on. The wake binds to the
+// CLICKER. Binding to the author would let one person invoke a shortcut on another person's
+// message and get a turn that runs with the author's access, memory scope and admin standing —
+// the message body is the CONTENT, and content never selects the principal. See
+// {@link shortcutMessageEvent}, which is the only place the two identities meet.
+
+import {
+  ingestUntrusted,
+  noteIngestionVerdict,
+  taintMarkLands,
+  type WakeAttachment,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { parseSlackFiles, type ParsedMessageEvent } from "./slack-events.js";
+import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
+
+/**
+ * A decoded Slack shortcut invocation, narrowed to the fields a wake needs.
+ *
+ * The two shortcut families share every field but the target: a `message` shortcut carries the
+ * channel it was invoked in and the message it was invoked on; a `global` shortcut carries
+ * neither, because Slack fires it from the composer with no conversation in scope.
+ *
+ * Field-compatible with eve's own `SlackShortcut` union (`eve/channels/slack`), which is the
+ * public contract for the same two payloads. We parse the raw payload ourselves because eve's
+ * `parseShortcutPayload` is internal to its interactivity handler and is not exported.
+ */
+export interface ParsedSlackShortcut {
+  /** `message` for a `message_action` payload, `global` for a `shortcut` payload. */
+  readonly kind: "message" | "global";
+  /** The shortcut's registered callback id — the operator-chosen name of this trigger. */
+  readonly callbackId: string;
+  /** Slack's per-invocation trigger id — unique per click. Used as the wake's idempotency key on
+   *  the ASSUMPTION that a Slack redelivery of one click carries the same trigger id. UNMEASURED:
+   *  Slack documents stable-`event_id` retry semantics for the Events API, not for interactivity
+   *  payloads. If the assumption is wrong the cost is a double wake, which is the same fail-open
+   *  posture the rest of the dedupe layer already takes. See {@link shortcutWakeKey}. */
+  readonly triggerId: string;
+  /** The Slack user who invoked the shortcut. The wake's principal. */
+  readonly userId: string;
+  readonly teamId?: string;
+  /**
+   * The Enterprise Grid organisation the invocation's workspace sits in (`E…`), when the payload
+   * named one (OPE-1559). A shortcut never arrives as an event envelope, so there is no
+   * `enterprise_id` envelope field to read; the interactivity route names the Grid on the payload
+   * itself, in THREE spellings, and all three are read ({@link parseSlackShortcutPayload}).
+   *
+   * 🔴 IT IS THE ROOM'S GRID, NEVER THE INVOKER'S. Both spellings sit on the payload's own
+   * `enterprise` / `team` object, which describes WHERE the invocation happened. The invoker's
+   * `user.enterprise_user.enterprise_id` describes where THEY belong, and reading it would let a
+   * Slack Connect stranger's own Grid declaration vouch our room. So the author leg keeps its own
+   * source (`users.info`, slack-identity.ts) and this one never touches it.
+   */
+  readonly enterpriseId?: string;
+  /** Present on a `message` shortcut only — the conversation the message lives in. */
+  readonly channelId?: string;
+  /** Present on a `message` shortcut only. */
+  readonly message?: {
+    /** The target message's text, verbatim. UNTRUSTED — it is somebody's Slack message. */
+    readonly text: string;
+    readonly ts: string;
+    /** The thread the target message sits in, when it sits in one. */
+    readonly threadTs?: string;
+    /** The target message's AUTHOR — never the wake's principal (see the file header). */
+    readonly userId?: string;
+    /** Image/file REFERENCES off the target message's `files[]`, parsed by the SAME
+     *  {@link parseSlackFiles} the Events API path uses. A shortcut on a message carrying a
+     *  screenshot must surface that screenshot, exactly as reading the message in the channel
+     *  would — otherwise the same message means less through this door than through that one.
+     *  A REFERENCE ONLY: it reaches a wake, and the bot token, solely through
+     *  {@link shortcutMessageEvent}'s `admitAttachments` gate. */
+    readonly attachments?: readonly WakeAttachment[];
+  };
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+function obj(v: unknown): Record<string, unknown> | undefined {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? (v as Record<string, unknown>) : undefined;
+}
+
+/**
+ * Decode an already-JSON-parsed interactivity payload into a {@link ParsedSlackShortcut}, or
+ * `null` for anything that is not a shortcut. TOTAL AND PURE: it never throws and it writes
+ * nothing.
+ *
+ * 🔴 PURITY IS A SECURITY PROPERTY HERE, NOT A STYLE CHOICE (OPE-1442). This runs inside
+ * `classifyEnvelope`, which decides what a request IS — long before the dedupe, the readability
+ * gate and the ambient-off drop decide whether it wakes anything. An earlier revision registered
+ * the target message's attachments right here, so every click seeded the process-global registry
+ * (a 1000-entry LRU) even when the shortcut went on to wake NOTHING: repeated clicks on a domain
+ * with the unified window off evicted the records real uploads depend on, and `describe_image`
+ * then failed closed on a genuine image. The registry is now seeded by the front door's shortcut
+ * branch, after the gates it must sit behind.
+ *
+ * A payload is REFUSED (null) when it cannot produce a wake:
+ *   • the outer `type` is neither `message_action` nor `shortcut`;
+ *   • `callback_id`, `trigger_id` or `user.id` is missing — the first two are the trigger's name
+ *     and its idempotency key, and the third is the principal, so a wake without any of them
+ *     would have to be invented rather than derived;
+ *   • a `message_action` that carries no `channel.id` or no `message.ts` — a message shortcut
+ *     whose target cannot be addressed is not a message shortcut.
+ * Refusing is FAIL-CLOSED: the front route acks Slack and wakes nothing.
+ *
+ * `message.text` is allowed to be EMPTY and still parses. Slack sends an empty `text` for a message
+ * whose content lives entirely in blocks or files, and dropping a click a person made is the worse
+ * answer. The wake then renders an empty body — it says nothing ABOUT the emptiness. Files on that
+ * message ride through as attachments only where the front door admits them
+ * ({@link shortcutMessageEvent}'s `admitAttachments`), so a shortcut on a screenshot in a room the
+ * app cannot read wakes with an empty body and no file.
+ */
+export function parseSlackShortcutPayload(raw: unknown): ParsedSlackShortcut | null {
+  const p = obj(raw);
+  if (!p) return null;
+  const type = str(p.type);
+  if (type !== "message_action" && type !== "shortcut") return null;
+  const callbackId = str(p.callback_id);
+  const triggerId = str(p.trigger_id);
+  const userId = str(obj(p.user)?.id);
+  if (!callbackId || !triggerId || !userId) return null;
+  // THE WORKSPACE AND THE GRID RUNG (OPE-1559), read by the ONE reader every interactivity ingress
+  // spends — `slackInteractivityTenantIds` (slack-tenant-fence.ts), which also states which three
+  // spellings of the Grid id it unions and why `context_enterprise_id` is excluded. A shortcut is
+  // one interactivity payload among six click families (OPE-1680), and a second copy of the reading
+  // rule here is the drift that leaf module exists to prevent.
+  const { teamId, enterpriseId } = slackInteractivityTenantIds(p);
+  if (type === "shortcut") {
+    return { kind: "global", callbackId, triggerId, userId, ...(teamId ? { teamId } : {}), ...(enterpriseId ? { enterpriseId } : {}) };
+  }
+  const channelId = str(obj(p.channel)?.id);
+  const message = obj(p.message);
+  const ts = str(message?.ts);
+  if (!channelId || !message || !ts) return null;
+  const threadTs = str(message.thread_ts);
+  const authorId = str(message.user);
+  // File REFERENCES only. Parsing is all this function does with them: registering an id is what
+  // makes it fetchable with the bot token, and that decision belongs to the front door, which knows
+  // whether this shortcut wakes anything and whether the app may read the room at all. See
+  // {@link shortcutMessageEvent}'s `admitAttachments`.
+  const attachments = parseSlackFiles(message.files);
+  return {
+    kind: "message",
+    callbackId,
+    triggerId,
+    userId,
+    ...(teamId ? { teamId } : {}),
+    ...(enterpriseId ? { enterpriseId } : {}),
+    channelId,
+    message: {
+      text: typeof message.text === "string" ? message.text : "",
+      ts,
+      ...(threadTs ? { threadTs } : {}),
+      ...(authorId ? { userId: authorId } : {}),
+      ...(attachments.length > 0 ? { attachments } : {}),
+    },
+  };
+}
+
+/**
+ * The idempotency key for one shortcut invocation.
+ *
+ * Keyed on `trigger_id`, NOT on the target message. What that buys is certain: a person stays free
+ * to invoke the same shortcut on the same message twice on purpose, which keying on `channel:ts`
+ * (the shape an Events API wake falls back to) would have swallowed for ten minutes.
+ *
+ * What it de-dupes rests on an UNMEASURED assumption — that a Slack redelivery of one click carries
+ * the same trigger id (see {@link ParsedSlackShortcut.triggerId}). Wrong ⇒ a double wake, never a
+ * missed one, which is the direction the whole dedupe layer already fails in.
+ *
+ * It carries no bot-identity prefix, unlike `slack-front.ts`'s `wakeKey`. A trigger id is minted by
+ * Slack per app, so two apps in one workspace cannot collide on one; the `oe-shortcut:` prefix
+ * keeps it out of the Events API key space.
+ */
+export function shortcutWakeKey(sc: ParsedSlackShortcut): string {
+  return `oe-shortcut:${sc.triggerId}`;
+}
+
+/**
+ * Fence the target message's body, and declare the ingestion route this door opens.
+ *
+ * The declaration is the kind-binding entry for the route (access/ingestion-binding-manifest.ts). A
+ * message shortcut carries a Slack message body in through the INTERACTIVITY door, which no Events
+ * API route uses, so the route says what it ingests: `chat-message`.
+ *
+ * 🔴 WHY IT FENCES, AND WHAT THE FENCE STANDS IN FOR. The wake envelope attributes every message to
+ * ONE author and grades it with ONE trust tier, and on this path both are the INVOKER'S:
+ * `triggerMessage` (slack-events.ts) renders `author`/`author-id` from `ev.userId` and `trust` from
+ * the tier the front door resolved for the person who pressed the button. So the target message's
+ * OWN author is never graded here — this route resolves no author facts for them and makes no
+ * `users.info` probe on them, which means the OPE-466 non-member taint join that the channel door
+ * applies does not see them either.
+ *
+ * The consequence, stated plainly: read through the channel door, a guest's or a Connect stranger's
+ * message is graded `unauth` and the envelope fences it. Handed over by a `principal` invoker's
+ * shortcut, the SAME bytes would render under that invoker's tier — and
+ * `authorTrustAdmitsUnfencedBody` (channels/wake-envelope.ts) lets a `peer`/`principal` human body
+ * through UNFENCED. This fence is what closes that gap: the body carries its own wrapper because it
+ * cannot carry its own tier.
+ *
+ * That is deliberately MORE conservative than the ruled Slack-forward precedent (slack-events.ts's
+ * note on quoted attachment content, which inherits the forwarder's tier unfenced). The difference
+ * is who chose: a forward is text a person retyped into their own message, while a shortcut hands
+ * over somebody else's message untouched, so there is no editorial act to inherit a tier from.
+ *
+ * `taintMarkLands()` reports the RUNTIME effect rather than asserting one, for the reason that
+ * function's header states: this runs in the INGRESS process, outside any turn, so the taint half
+ * of `ingestUntrusted` no-ops here and the declaration says so honestly.
+ */
+function fenceAndDeclareShortcutIngestion(text: string): string {
+  noteIngestionVerdict({ kind: "chat-message", label: "slack:shortcut" }, taintMarkLands());
+  return ingestUntrusted(text, { source: "slack message shortcut" });
+}
+
+/**
+ * The body a GLOBAL shortcut wakes with. It has no message, so the trigger's own name is the whole
+ * content — which is the honest thing to hand the model: somebody pressed a named button.
+ *
+ * The callback id is operator-authored configuration, not somebody's Slack message, so it is NOT
+ * fenced as untrusted content — the same reasoning that leaves a slash-command name unfenced.
+ */
+export function globalShortcutText(sc: ParsedSlackShortcut): string {
+  return `Shortcut "${sc.callbackId}" invoked.`;
+}
+
+/**
+ * A Slack-shaped `ts` for the one wake that has no message behind it: a global shortcut.
+ *
+ * Slack's format is `<seconds>.<microseconds>`, and the wake envelope reads it back with
+ * `Number.parseFloat` to render `sent-at`. Minting from the clock therefore makes `sent-at` say
+ * exactly what is true — when the person pressed the button. The microsecond field carries this
+ * instant's milliseconds; the last three digits are zero, because a millisecond clock cannot
+ * honestly claim more precision than it has.
+ */
+function slackTsFromMs(nowMs: number): string {
+  const seconds = Math.floor(nowMs / 1000);
+  const millis = nowMs % 1000;
+  return `${seconds}.${String(millis).padStart(3, "0")}000`;
+}
+
+/**
+ * Map a shortcut onto the shared {@link ParsedMessageEvent} shape, so the front door's existing
+ * wake spine (partition → seat → window → dedupe → gates → divert) runs over it unchanged.
+ *
+ * 🔴 `userId` IS THE INVOKER on both kinds. See the file header: the target message's author never
+ * becomes the wake's principal.
+ *
+ * THE TWO TEXT FIELDS CARRY THE MESSAGE-SHORTCUT SPLIT EXACTLY AS THEY ALREADY MEAN IT. A message
+ * shortcut is a FORWARD with no covering note — the invoker typed nothing and pointed at somebody
+ * else's message — and {@link ParsedMessageEvent} already draws that line: `text` is "own text
+ * plus any quoted message", `authoredText` is "the author's OWN typed text". So `text` carries the
+ * target message and `authoredText` is empty. Any rule that asks "what did this person SAY?" then
+ * correctly answers "nothing", which is true, and the model still receives the message as the
+ * wake's content.
+ *
+ * `ts` differs by kind, and deliberately:
+ *   • a MESSAGE shortcut takes the target message's real ts, so the reply anchors under the
+ *     message the shortcut was invoked on (`routeSupervisorEvent` reads `threadTs ?? ts`);
+ *   • a GLOBAL shortcut has no message, so it MINTS one from `nowMs` in Slack's own
+ *     `seconds.microseconds` shape. 🔴 It must be ts-SHAPED, not merely unique: the envelope
+ *     renders `sent-at` by running `Number.parseFloat` over this field (`slackTsToIso`), so a
+ *     non-numeric id silently becomes a nonsense date — the trigger id `13345224609.7384…` parses
+ *     to the year 2392. Minting from the clock makes `sent-at` the truth: the moment the person
+ *     pressed the button. Uniqueness is not this field's job — the wake's idempotency key is
+ *     {@link shortcutWakeKey}, which does key on the trigger id.
+ *
+ * `isAppMention` is false on both. It reports whether the TEXT contains `<@bot>`, and neither body
+ * does; the "was the agent addressed?" question is answered by the caller passing `directMention`,
+ * which is the same seam the single-window mention divert uses.
+ *
+ * 🔴 `admitAttachments` GATES THE TARGET MESSAGE'S FILES, AND IT DEFAULTS TO FALSE (OPE-1442).
+ * Slack delivers a `message_action` for a room the app is not in, and the payload carries that
+ * message's `files[].url_private` — bytes the app's own channel reads refuse. So the files ride
+ * through only when the caller has POSITIVELY established that the app can read the room
+ * (`slackChannelFactsFor`'s `appCanRead`). The default is closed because the cost of the two
+ * mistakes is not symmetric: a withheld file is a wake that says less, an admitted one is the bot
+ * token downloading somebody's private upload from a room the agent cannot open.
+ *
+ * WITHHOLDING DROPS THE REFERENCE TOO, rather than passing an id that resolves to nothing. The
+ * envelope renders an attachment as an id and `describe_image` fails closed on an id the registry
+ * never saw, so an advertised-but-unresolvable file tells the model an image exists and then
+ * cannot show it — worse than not mentioning it.
+ */
+export function shortcutMessageEvent(
+  sc: ParsedSlackShortcut,
+  channelId: string,
+  channelType?: string,
+  nowMs: number = Date.now(),
+  opts: { readonly admitAttachments?: boolean } = {},
+): ParsedMessageEvent {
+  const attachments = opts.admitAttachments === true ? sc.message?.attachments : undefined;
+  const text = sc.kind === "message" && sc.message ? fenceAndDeclareShortcutIngestion(sc.message.text) : globalShortcutText(sc);
+  return {
+    channelId,
+    ts: sc.kind === "message" && sc.message ? sc.message.ts : slackTsFromMs(nowMs),
+    ...(sc.kind === "message" && sc.message?.threadTs ? { threadTs: sc.message.threadTs } : {}),
+    ...(sc.teamId ? { teamId: sc.teamId } : {}),
+    // The Grid rung the payload named (OPE-1559), spread conditionally exactly as the wake routes
+    // spread it: it reaches `buildSlackAuth` through `authForEvent` and `scheduleDmWake`, so a
+    // shortcut in a Grid workspace declared only at the enterprise key now resolves that line, and a
+    // non-Grid shortcut stamps nothing.
+    ...(sc.enterpriseId ? { enterpriseId: sc.enterpriseId } : {}),
+    userId: sc.userId,
+    ...(channelType ? { channelType } : {}),
+    text,
+    ...(attachments && attachments.length > 0 ? { attachments } : {}),
+    // A global shortcut's body IS what the invoker did — they pressed that named button and typed
+    // nothing else, so the trigger line is their own "text". A message shortcut's body is somebody
+    // else's message, so the invoker authored nothing.
+    authoredText: sc.kind === "global" ? text : "",
+    isAppMention: false,
+  };
+}

package/agent/channels/slack-signature.ts

@@ -0,0 +1,53 @@
+// SLACK'S `v0=` SIGNATURE SCHEME, as a leaf primitive — the ONE implementation of Slack's digest in
+// this tree, extracted (OPE-197) so the two callers that need it cannot drift into two schemes:
+//
+//   • channels/slack-front.ts `verifySlackSignature` — the SURFACE front door (events, interactivity,
+//     `/oe` slash commands), which reads its secret from `SLACK_SIGNING_SECRET` and answers a Slack
+//     Request URL.
+//   • channels/slack-webhook-verifier.ts — the WEBHOOK VERIFIER REGISTRY entry, which reads its keys
+//     from a hook's `secretRef` list and answers the generic ingress.
+//
+// Those two resolve their key differently and discriminate failures differently; what they must
+// share to the byte is the BASESTRING and the DIGEST, because a difference there is a signature that
+// verifies on one route and 401s on the other with nothing saying why. So exactly that much lives
+// here and nothing else — no header reading, no skew window, no key resolution.
+//
+// THE SCHEME (https://api.slack.com/authentication/verifying-requests-from-slack):
+//   X-Slack-Request-Timestamp: <unix seconds>
+//   X-Slack-Signature:         v0=<hex>   HMAC-SHA256 of `v0:<timestamp>:<raw body>`, keyed by the
+//                                         app's Signing Secret.
+// The timestamp is INSIDE the signed basestring, which is what makes a skew check meaningful here
+// (contrast GitHub, which signs the body alone) — but enforcing that window is the caller's, since
+// the two callers bound it differently on purpose.
+//
+// Pinned by Slack's OWN PUBLISHED TEST VECTOR in scripts/slack-webhook-verifier-test.ts — the only
+// assertion that proves we implement THEIR scheme rather than a self-consistent idea of it.
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/** The header carrying the signature. Exported so no caller re-types the string. */
+export const SLACK_SIGNATURE_HEADER = "x-slack-signature";
+/** The header carrying the signed unix-seconds timestamp. */
+export const SLACK_TIMESTAMP_HEADER = "x-slack-request-timestamp";
+/** The version tag that both prefixes the signature and opens the basestring. */
+export const SLACK_SIGNATURE_VERSION = "v0";
+
+/**
+ * The signature Slack would send for this `(secret, timestamp, rawBody)` — `v0=<hex>` over
+ * `v0:<timestamp>:<rawBody>`.
+ *
+ * `timestamp` is taken as the STRING off the header, never a number, because it is signed
+ * character-for-character: re-formatting it (leading zeros, a float round-trip) changes the
+ * basestring and breaks a signature that is perfectly good.
+ */
+export function slackSignature(secret: string, timestamp: string, rawBody: string): string {
+  return `${SLACK_SIGNATURE_VERSION}=${createHmac("sha256", secret).update(`${SLACK_SIGNATURE_VERSION}:${timestamp}:${rawBody}`).digest("hex")}`;
+}
+
+/** Length-prechecked constant-time compare of a presented signature against the expected one —
+ *  the shape every verifier in this tree uses. */
+export function slackSignatureMatches(secret: string, timestamp: string, rawBody: string, presented: string): boolean {
+  const a = Buffer.from(slackSignature(secret, timestamp, rawBody));
+  const b = Buffer.from(presented);
+  return a.length === b.length && timingSafeEqual(a, b);
+}

package/agent/channels/slack-spend-gate.ts

@@ -0,0 +1,62 @@
+// The Slack ingress SPEND GATE — a THIN BINDING over the shared core gate
+// (@open-everywhere/core/agent/spend/ingress-gate.ts), called at BOTH doors a Slack wake can arrive
+// through (OPE-33).
+//
+// WHY THE GATE IS NOT INLINE IN `slack.ts` (live-diagnosed 2026-07-25). It used to be, inside
+// `onInbound` — eve's `onAppMention`/`onDirectMessage` handler. That covers the MENTION door only.
+// Since eve 0.27.5 the compiled `slackChannel` drops any message it considers self-authored BEFORE
+// the mention hooks run:
+//
+//   isSelfAuthoredSlackMessage(e,t){ return e.botUserId!==void 0 && t.author?.userId===e.botUserId
+//     ? !0 : e.appId!==void 0 && t.raw.app_id===e.appId }
+//
+// …applied to the `app_mention`/`direct_message` leg AND to eve's own `onMessage` leg — but NOT to
+// the `onEvent` leg. Slack stamps `app_id` on ANY message an app posts through the Web API
+// (including with a user token), so every driver-app-authored mention now bypasses `onInbound`
+// entirely and re-enters through our engagement front route (slack-front.ts → slack-events.ts),
+// which had no spend gate at all. Net effect: a capped surface silently kept spending.
+//
+// WHY THE IMPLEMENTATION NOW LIVES IN CORE. The fix was always structural, not version-specific: the
+// gate is a WAKE-ADMISSION decision, so it belongs at every point a wake is about to dispatch a
+// model turn — and the same defect then recurred on five other surfaces AND on the cross-surface
+// window's own divert. The decision logic, the refusal copy, the admin-bypass semantics and the
+// audit row therefore exist exactly once, in core, and every door — Slack's two, each other
+// surface's native leg, and `divertToUnifiedWindow` — calls that one function. This module keeps
+// only what is genuinely Slack-shaped: the mrkdwn shortcode badges (`:no_entry:` / `:warning:`,
+// which no other surface renders) and the Slack-named type aliases its call sites use.
+
+import { ingressSpendGate, SLACK_SPEND_BADGES, spendRefusalCopy as coreSpendRefusalCopy, spendBypassWarnCopy as coreSpendBypassWarnCopy, type IngressSpendGateInput, type SpendGateDecision, type SpendRefusalCopyInput } from "@open-everywhere/core/agent/adapter-api.js";
+
+export type { SpendGateDoor, SpendGateDecision, SpendGateAuditRow } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** Slack's shape of the shared gate input: `teamId` is the Slack team id (the shared gate's generic
+ *  `workspaceRef`, emitted as `team` on the audit row), and `mode` stays REQUIRED here because both
+ *  Slack doors resolve dm/mpim/channel themselves before the gate is reached. */
+export interface SlackSpendGateInput extends Omit<IngressSpendGateInput, "workspaceRef" | "badges" | "mode"> {
+  readonly mode: NonNullable<IngressSpendGateInput["mode"]>;
+  /** Slack team id, for the audit row only (`null` when the event carried none). */
+  readonly teamId?: string | null;
+}
+
+/** The refusal copy with Slack's mrkdwn shortcode badge — same sentences as every other surface
+ *  (they live in core), only the leading emoji differs. The caller passes core's own input, so a
+ *  Slack refusal names the breached layer and its key exactly as every other surface does
+ *  (OPE-1860); nothing about the copy is decided here. */
+export function spendRefusalCopy(input: Omit<SpendRefusalCopyInput, "badge">): string {
+  return coreSpendRefusalCopy({ ...input, badge: SLACK_SPEND_BADGES.refusal });
+}
+
+/** The admin-bypass warning with Slack's mrkdwn shortcode badge. */
+export function spendBypassWarnCopy(reason: string | undefined): string {
+  return coreSpendBypassWarnCopy(reason, SLACK_SPEND_BADGES.warning);
+}
+
+/** Decide whether a Slack wake may spend — the shared decision table, bound to Slack's badges.
+ *  See the core module for the full posture (check fails OPEN, a definite OVER fails CLOSED, an
+ *  admin proceeds as audited sudo). */
+export function slackSpendGate(input: SlackSpendGateInput): Promise<SpendGateDecision> {
+  const { teamId, ...rest } = input;
+  // `?? null` (never omitted): Slack's row has always carried a `team` key, present-but-null when
+  // the event carried no team id, and a live probe reads it that way.
+  return ingressSpendGate({ ...rest, workspaceRef: teamId ?? null, badges: SLACK_SPEND_BADGES });
+}

package/agent/channels/slack-tenant-fence.ts

@@ -0,0 +1,99 @@
+// SLACK'S TENANT FENCE WIRING (OPE-309 phase 0c) — one helper, every wake door.
+//
+// The decision itself is core's (access/tenant-admission.ts): pure, unit-tested, platform-neutral.
+// This module is only the Slack-shaped call — "read the admitted set from config, classify this
+// delivery's ids" — named ONCE so the mention door, the four engagement routes, the join door, the
+// `/oe` slash door, the shortcut ingress and the DM window cannot drift apart on what "a tenant we
+// admit" means. Exactly the shape `slackWakeSpendGate` uses for the spend question.
+//
+// WHY SLACK IS THE PLATFORM THAT NEEDS IT. Slack's Events API verifies an APP-LEVEL signing
+// secret, which every workspace that installs the app shares — so `slack-front.ts` cannot tell a
+// second workspace from the first, and there is no team allowlist anywhere else in the tree. The
+// only thing bounding the deployment to one workspace is Slack's own app-distribution setting: a
+// boundary we do not own. Slack is also the one platform in TENANT_SCOPED_PLATFORMS, i.e. the one
+// whose person ids are issued per tenant, so a second workspace is precisely where two humans
+// start sharing one `slack/<id>` principal key.
+//
+// This module lives OUTSIDE slack-events.ts on purpose: slack.ts's mention door needs it too, and
+// a leaf module is how both get it without an import cycle.
+
+import { classifyTenantAdmission, admittedTenantsFromConfig, type TenantAdmissionDecision } from "@open-everywhere/core/agent/adapter-api.js";
+
+/**
+ * Is this delivery's Slack tenant admitted on this deployment? `proceed` also covers every
+ * deliberate inert case (nothing declared, operator opted in, no ids on the event at all) — see
+ * access/tenant-admission.ts's classifyTenantAdmission for why each one is a choice rather than a
+ * gap. `unadmitted` means: drop the wake, write the audit row, run no model turn.
+ *
+ * 🔴 PASS THE ENTERPRISE ID WHERE THE DOOR CAN READ ONE (OPE-1645). An ORG-WIDE Enterprise Grid
+ * install delivers an interactivity payload that names the Grid (`E…`) and NO workspace, so a call
+ * that hands over the workspace alone asks the fence to judge a delivery on the one field it is
+ * missing — and the classifier's "a delivery naming no tenant proceeds" path then ADMITS a foreign
+ * Grid. A door with no enterprise id to read omits the argument and gets the workspace-only
+ * decision it had before.
+ */
+export function slackTenantAdmission(teamId: string | undefined | null, enterpriseId?: string | undefined | null): TenantAdmissionDecision {
+  return classifyTenantAdmission({ platform: "slack", tenant: teamId, enterprise: enterpriseId, admitted: admittedTenantsFromConfig("slack") });
+}
+
+/** The workspace and Grid one INTERACTIVITY payload names. Either field is absent where the payload
+ *  named none — see {@link slackInteractivityTenantIds} for which install shape omits which. */
+export interface SlackInteractivityTenantIds {
+  readonly teamId?: string;
+  readonly enterpriseId?: string;
+}
+
+/**
+ * Read the tenant ids off an already-JSON-parsed INTERACTIVITY payload — a `block_actions` click, a
+ * `view_submission`, a shortcut. TOTAL AND PURE: any shape that names neither id yields `{}`, which
+ * {@link slackTenantAdmission} judges as "names no tenant".
+ *
+ * 🔴 THE GRID RUNG, IN ALL THREE SPELLINGS AN INTERACTIVITY PAYLOAD USES (OPE-1559). Which one
+ * arrives depends on how the app was installed, so reading fewer than three loses the rung on some
+ * installs — silently, and in the direction that ADMITS:
+ *   • a top-level `enterprise` OBJECT (an org-wide install; `team` may then be null);
+ *   • a top-level `enterprise_id` STRING;
+ *   • `team: { id, enterprise_id }` — what a PER-WORKSPACE install on a Grid sends.
+ * Order is widest-first; the top-level object wins where more than one is present.
+ *
+ * 🔴 NO SINGLE PLACE IN eve READS ALL THREE, so this union is OURS and cannot be delegated.
+ * Re-measured against eve 0.54.3: `parseShortcutPayload` (public/channels/slack/interactions.js) reads
+ * NO enterprise at all; `extractInstallationFromInteractive`
+ * (compiled/@chat-adapter/slack/index.js) reads `enterprise?.id || enterprise_id`; and the adapter's
+ * event path reads the top-level `enterprise_id` alone. Three readers, three different subsets — and
+ * none of them reads the `team.enterprise_id` arm, which is why the union stays ours.
+ * ⚠️ NOT RE-READ AT 0.54.3: the `enterprise.id || team.enterprise_id` shape this block used to
+ * attribute to the block_actions / view_submission parsers. It is not findable in the 0.54.3 bytes, so
+ * it is not restated as a measurement. The claim above does not rest on it.
+ *
+ * 🔴 `context_enterprise_id` IS DELIBERATELY NOT READ, though eve falls back to it. On a Slack
+ * Connect payload that field can name ANOTHER organisation, so trusting it would let a foreign Grid
+ * declaration vouch our room. `slackEnterpriseIdFromEnvelope` (slack-events.ts) makes the same
+ * exclusion on the event side. Every field below names the delivery's OWN workspace or Grid.
+ *
+ * 🔴 `user.team_id` IS NOT READ EITHER, and that omission is the point. It names the CLICKER's home
+ * workspace, which on a Grid is not the workspace the click happened in — so a fence built on it
+ * would judge the wrong tenant, in both directions. The question this fence asks is "which tenant
+ * DELIVERED this", and `team` / `enterprise` are the only fields that answer it.
+ *
+ * 🔴 IT LIVES HERE RATHER THAN AT A DOOR because the shortcut ingress and the six CLICK branches
+ * (OPE-1680) both need it, and a second copy of the reading rule at a second door is exactly the
+ * drift this module exists to prevent — the same argument that keeps {@link slackTenantAdmission}
+ * out of `slack-events.ts`.
+ */
+export function slackInteractivityTenantIds(raw: unknown): SlackInteractivityTenantIds {
+  const p = asObject(raw);
+  if (p === undefined) return {};
+  const teamId = asNonEmptyString(asObject(p.team)?.id);
+  const enterpriseId =
+    asNonEmptyString(asObject(p.enterprise)?.id) ?? asNonEmptyString(p.enterprise_id) ?? asNonEmptyString(asObject(p.team)?.enterprise_id);
+  return { ...(teamId === undefined ? {} : { teamId }), ...(enterpriseId === undefined ? {} : { enterpriseId }) };
+}
+
+function asObject(v: unknown): Record<string, unknown> | undefined {
+  return typeof v === "object" && v !== null ? (v as Record<string, unknown>) : undefined;
+}
+
+function asNonEmptyString(v: unknown): string | undefined {
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}