@open-everywhere/provider-slack 0.3.0 → 0.5.0

package/agent/app-manifest.ts

@@ -6,10 +6,12 @@
 // scope array below against the runbook's documented scopes. It used to live in the setup CLI, where
 // the ops server could not reach it at all.
 //
-// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The setup CLI depends on the bundle for this
-// document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
-// eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
-// only the vendor's own knowledge.
+// 🔴 THIS MODULE IMPORTS NOTHING BUT ANOTHER LEAF, DELIBERATELY. The setup CLI depends on the bundle
+// for this document alone, so a leaf module costs it no transitive weight — not the adapter-api
+// barrel, not eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file
+// holds only the vendor's own knowledge. `./slack-as-you.ts` is a leaf too (it imports only types).
+
+import { SLACK_MCP_BOT_SCOPE, slackAsYouUserScopes } from "./slack-as-you.js";
 
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
  *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
@@ -53,8 +55,20 @@ export interface SlackAppManifestOptions {
   /** The slash command's name without the slash — the `identity.commandName` setting. Absent ⇒
    *  {@link SLACK_DEFAULT_COMMAND_NAME}. */
   readonly commandName?: string;
+  /**
+   * The app declares "search Slack as you" (`slackAsYou` in `agent/access/mcp-servers.ts`, OPE-2421). Adds
+   * the `mcp:connect` bot scope, the user scopes a person consents to, and the redirect URL their sign-in
+   * returns to. Absent ⇒ none of them: an app that does not use Slack's MCP server asks for no user scope.
+   * The MCP toggle itself (the app config's Agents section) has no manifest field, so it stays a click.
+   */
+  readonly personalMcp?: boolean;
 }
 
+/** The path the person's OAuth sign-in returns to — core's `OE_OAUTH_CALLBACK_PATH`
+ *  (connections/oe-oauth-callback.ts). Spelled here because this module imports nothing from core;
+ *  `scripts/slack-as-you-test.ts` fails if the two drift. */
+export const SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH = "/oauth/v1/callback";
+
 /** The app name a manifest carries: the explicit name, else the configured name, else the default.
  *  A configured name past Slack's limit is cut to fit, because Slack refuses the whole paste. */
 export function slackManifestAppName(opts: SlackAppManifestOptions = {}): string {
@@ -76,6 +90,7 @@ function shortcutName(prefix: string, appName: string, neutral: string): string
 export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): string {
   const appName = slackManifestAppName(opts);
   const commandName = opts.commandName?.trim() || SLACK_DEFAULT_COMMAND_NAME;
+  const personalMcp = opts.personalMcp === true;
   return JSON.stringify(
     {
       display_information: { name: appName },
@@ -83,8 +98,12 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // THE MESSAGES TAB (OPE-2222). With no `app_home` block, Slack creates the app with the
         // Messages tab OFF, and a person who opens a DM with the bot sees "Sending messages to this
         // app has been turned off". DMs are the primary wake (`message.im` below), so the tab is
-        // on and writable. The product has no Home tab (`app_home_opened` is not routed).
-        app_home: { home_tab_enabled: false, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
+        // on and writable.
+        // THE HOME TAB (OPE-2451) is on too: it is the person's private page — what the agent
+        // remembers about them, with Edit, Forget and Export, and what their domains know. Opening
+        // it delivers `app_home_opened` (below), and the front route publishes the page
+        // (channels/slack-home.ts).
+        app_home: { home_tab_enabled: true, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
         bot_user: { display_name: appName, always_online: true },
         // The "/oe" ZERO-INFERENCE control command (agent/commands/core.ts). Declared here rather
         // than left to a manual setup step because one of its subcommands is `/oe stop` (OPE-418),
@@ -135,7 +154,11 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // line in the manifest, not just in the code that handles the callback. It is harmless on the
         // hand-paste path: an app created from this manifest and installed from the Slack console
         // never visits the URL.
-        redirect_urls: [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`],
+        redirect_urls: [
+          `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`,
+          // "SEARCH SLACK AS YOU" (OPE-2421): a person's own sign-in returns here, to core's OAuth callback.
+          ...(personalMcp ? [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}${SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH}`] : []),
+        ],
         scopes: {
           bot: [
             "app_mentions:read",
@@ -184,7 +207,19 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // users.info — the DM-partner trust check. Without this, EVERY DM binds `external`
             // (fail-closed) on a fresh install, silently (OPE-175).
             "users:read",
+            // conversations.canvases.create + canvases.edit — the domain memory canvas (OPE-2451,
+            // channels/slack-memory-canvas.ts): a domain's internal channels show what the domain
+            // knows. Without it the canvas refresh fails with `missing_scope`, logged and audited
+            // per channel, and memory itself is unaffected.
+            "canvases:write",
+            // Slack requires this bot scope on an app whose people connect to Slack's MCP server
+            // (OPE-2421). Declared only when the app declares "search Slack as you".
+            ...(personalMcp ? [SLACK_MCP_BOT_SCOPE] : []),
           ],
+          // The USER scopes a person consents to for "search Slack as you" (OPE-2421). The install
+          // asks for none of them: `/setup` requests bot scopes only, and each person grants these for
+          // themselves, in the moment, through Slack's user-only consent.
+          ...(personalMcp ? { user: [...slackAsYouUserScopes()] } : {}),
         },
       },
       settings: {
@@ -198,6 +233,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           //   message.mpim → mpim:history (group DMs; without it only an @mention there is heard)
           //   member_joined_channel → channels:read, groups:read, mpim:read (the channel-join intro)
           //   reaction_added, reaction_removed → reactions:read (reaction feedback)
+          //   app_home_opened → no scope (the Home tab page, OPE-2451)
+          //   channel_shared → channels:read, groups:read (re-run the memory canvas gate, OPE-2451)
+          //   user_change → users:read (automatic offboarding on a deactivated member, OPE-2423)
           // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
           // this list drops one (OPE-2223).
           bot_events: [
@@ -209,6 +247,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "member_joined_channel",
             "reaction_added",
             "reaction_removed",
+            "app_home_opened",
+            "channel_shared",
+            "user_change",
           ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every
@@ -240,6 +281,7 @@ export const SLACK_APP_MANIFEST_STEPS: readonly string[] = [
   "Pick the workspace, choose JSON, and paste the manifest below.",
   "Next → Create.",
   "Install to Workspace, and approve the scopes Slack lists.",
+  "Unless you set identity.name and chose your own icon, give the app the project mark: Basic Information → Display Information → App icon, and upload https://raw.githubusercontent.com/open-everywhere/open-everywhere/main/brand/png/mark-square-1024.png. Slack's manifest has no icon field, so this step stays by hand.",
   "Before the first deploy, Slack cannot verify the Event Subscriptions URL: it answers only once a deploy that holds SLACK_SIGNING_SECRET is up. After the deploy, paste the manifest again with the real host (App Manifest → Save Changes), then retry the verification under Event Subscriptions.",
 ];
 

package/agent/channels/slack-events.ts

@@ -1433,8 +1433,8 @@ export async function routeMessageEvent(ev: ParsedMessageEvent, deps: MessageRou
     ...(ev.enterpriseId === undefined ? {} : { enterpriseId: ev.enterpriseId }),
   });
   // ── THE EXTERNAL-PARTICIPANT POLICY (OPE-507 / OPE-504) ────────────────────────────────────────
-  // Inert on the shipped grains (`taint` / `engage`), so a deployment that has not opted in is
-  // byte-identical. It sits here because this is where the author evidence first exists — see the
+  // Inert only on the `taint` / `engage` opt-out, where it is byte-identical to before it
+  // existed; the shipped grains suppress here. It sits here because this is where the author evidence first exists — see the
   // block comment on `slackExternalVerdict` for why that is lower than Discord's gate.
   {
     const verdict = await applySlackExternalPolicy(ev, p, { trust: wakeTrust, refuted: authorFacts.refuted }, "routeMessageEvent");
@@ -1862,7 +1862,7 @@ export async function auditDmBotAuthorDrop(
     dmKind,
     botId: ev.botId,
     team: ev.teamId ?? null,
-    // TRUE ⇒ the `OE_TEST_DRIVER_IDS` allowlist vouches for this bot at the engagement and mention
+    // TRUE ⇒ the `wake.driverAllowlist` setting vouches for this bot at the engagement and mention
     // doors, and the DM door dropped it anyway. That is not a defect: the DM door reads its OWN,
     // narrower lever (`wake.e2eDrivers`, {@link dmDoorAdmitsDriver}), so a bot on the channel
     // allowlist has no DM standing. The row carries the distinction as data.
@@ -1884,7 +1884,7 @@ export async function auditDmBotAuthorDrop(
  * DM leg in the pack exercised a synthetic envelope and a regression in Slack's own DM delivery to
  * us was invisible. This carve-out lets the driver in through the real front door.
  *
- * WHY IT IS NOT THE `OE_TEST_DRIVER_IDS` ALLOWLIST, which already lifts the same bot at the
+ * WHY IT IS NOT THE `wake.driverAllowlist` SETTING, which already lifts the same bot at the
  * engagement and mention doors. A DM seat holds a window token, delegation and memory, so admitting
  * a bot into a DM is a strictly larger grant than admitting one into a watched channel. Reusing the
  * channel allowlist would have widened the DM door for every deployment that already sets it, on
@@ -2268,7 +2268,7 @@ export interface NameDropRouteDeps {
   readonly backscroll?: (input: { channelId: string; ts: string; threadTs?: string; threadAdmissionSlice?: boolean }) => Promise<WakeBackscrollLines | null>;
   /** The per-author membership probe the hydrated-context withhold uses (OPE-525,
    *  {@link withholdNameDropContext}). Defaults to the live {@link slackAuthorIsMember}; injectable
-   *  so the withhold is testable without Slack. Never called on the shipped `taint` grain. */
+   *  so the withhold is testable without Slack. Never called on the `taint` opt-out grain. */
   readonly authorIsMember?: SlackMemberProbe;
   /** Start the judged turn in a thread rooted at the triggering message. `context` (when present)
    *  is the backscroll — ADDITIONAL history the channel appends before the delivery turn. */
@@ -2482,7 +2482,7 @@ export async function routeNameDropEvent(ev: ParsedMessageEvent, deps: NameDropR
     // reference-only and marks the taint join too — not just the trigger's own author. Fail-soft:
     // a regrade failure keeps the fetched (ungraded) lines, exactly like every other backscroll leg.
     // 🔴 THE REGRADE KEEPS THE LIVE PROBE, and `deps.authorIsMember` must NOT be threaded here. That
-    // dep is the WITHHOLD's probe and its contract is "never called on the shipped `taint` grain"
+    // dep is the WITHHOLD's probe and its contract is "never called on the `taint` opt-out grain"
     // (OPE-525); this regrade runs on every hydration, whatever the grain, so sharing the dep would
     // break that contract and make a grain-gated lookup look grain-blind. The two share the
     // TTL-cached probe underneath, which is where the call is actually saved.
@@ -2605,7 +2605,7 @@ export async function routeNameDropEvent(ev: ParsedMessageEvent, deps: NameDropR
   });
   // ── THE EXTERNAL-PARTICIPANT POLICY (OPE-507 / OPE-504) ────────────────────────────────────────
   // A name-drop is AMBIENT by construction (the gate above disqualifies an @mention), so an excluded
-  // author's name-drop is owed nothing and is suppressed in silence. Inert on the shipped grains.
+  // author's name-drop is owed nothing and is suppressed in silence. Inert only on the opt-out grains.
   {
     const verdict = await applySlackExternalPolicy(ev, p, { trust: wakeTrust, refuted: authorFacts.refuted }, "routeNameDropEvent");
     if (verdict !== "proceed") return { deliver: false, reason: externalPolicyDropReason(verdict), woke: false };
@@ -2622,7 +2622,7 @@ export async function routeNameDropEvent(ev: ParsedMessageEvent, deps: NameDropR
   // about the people quoted in that hydration: a member name-drops the bot in a channel where a
   // refuted guest has been talking, and without this the guest's bytes reach the model verbatim.
   // `withholdNameDropContext` runs the shared transform and returns the wake BY REFERENCE on the
-  // shipped `taint` grain, so nothing moves for a deployment that has not opted in.
+  // `taint` opt-out grain, so nothing moves for a deployment that opted out.
   const rendered = renderWake(
     await withholdNameDropContext(
       slackNameDropWake(ev, name!, {
@@ -2762,6 +2762,18 @@ export async function confirmChannelInternal(channelId: string): Promise<boolean
   return (await channelInternalAndMeta(channelId)).internal;
 }
 
+/**
+ * {@link confirmChannelInternal} read FRESH: the cached verdict is dropped first, so the answer is
+ * today's `conversations.info`, and the cache is refilled with it. For the one consumer that must not
+ * act on a verdict up to a TTL old — the domain memory canvas (slack-memory-canvas.ts, OPE-2451),
+ * which decides whether every line of a domain's memory stays on screen in this channel. A wake keeps
+ * the cached read; the canvas is written rarely enough to pay for one call.
+ */
+export async function confirmChannelInternalFresh(channelId: string): Promise<boolean> {
+  channelTrustCache.delete(channelId);
+  return (await channelInternalAndMeta(channelId)).internal;
+}
+
 /**
  * Positively confirm a channel is internal (fail-closed, same TTL-cached
  * conversations.info as {@link confirmChannelInternal}) AND surface its member count —
@@ -3205,7 +3217,7 @@ function externalPolicyDropReason(verdict: SlackExternalVerdict): string {
  * other in the plane. A `bot` line carries a bot id, and a machine author is never excluded, so only
  * `senderType: "user"` lines are asked about.
  *
- * COSTS NOTHING ON THE SHIPPED GRAIN: `taint` returns the wake by reference before any probe runs.
+ * COSTS NOTHING ON THE OPT-OUT GRAIN: `taint` returns the wake by reference before any probe runs.
  * On `withhold` it costs one TTL-cached `users.info` per DISTINCT hydrated author, resolved in
  * parallel, and the render budget caps the hydration at ten lines.
  */
@@ -3824,8 +3836,8 @@ export function liveNameDropDeps(send: WakeSend): NameDropRouteDeps {
 
 // --- channel-supervisor delivery (Slack Claude-Tag parity, T1.3) ---------------
 //
-// The "always-on teammate" leg. When a channel's domain opts into ambientSupervisor
-// (memory/domain.ts, fail-closed off) AND the channel is POSITIVELY confirmed internal,
+// The "always-on teammate" leg. When a channel's domain has ambientSupervisor on
+// (memory/domain.ts, default ON since OPE-2409) AND the channel is POSITIVELY confirmed internal,
 // an unowned message (top-level, or in-thread but not engaged) is delivered to a single
 // long-lived CHANNEL-SUPERVISOR session instead of the name-drop-only path. The supervisor
 // is one durable eve session per channel, addressed by a RESERVED continuation token
@@ -4003,7 +4015,7 @@ export interface SupervisorRouteDeps {
    *  {@link withholdNameDropContext}) — the same dep, spelled the same way, as the native route it
    *  replaces ({@link NameDropRouteDeps.authorIsMember}). Defaults to the live
    *  {@link slackAuthorIsMember}; injectable so the withhold is testable without Slack. Never called
-   *  on the shipped `taint` grain, and never on a wake that carries no hydrated lines. */
+   *  on the `taint` opt-out grain, and never on a wake that carries no hydrated lines. */
   readonly authorIsMember?: SlackMemberProbe;
   /**
    * Start/continue the supervisor session under its reserved token. `window` is present ONLY on
@@ -4070,7 +4082,7 @@ export interface SupervisorRouteDeps {
  * Route one unowned message to the channel supervisor: pure disqualifiers, then the
  * fail-closed internal-channel confirmation (which also surfaces the member count for the
  * envelope), then create-or-fetch the supervisor session and deliver the judged wake. The
- * caller (slack-front) only reaches here once the domain has opted into ambientSupervisor.
+ * caller (slack-front) only reaches here once the domain has ambientSupervisor on (the default).
  *
  * `opts.directMention` (SINGLE-WINDOW @mention routing — the GitHub reference's
  * `treatMentionAsDirect`/`directMention` shape): the trigger is the `message.channels` SIBLING of
@@ -4223,7 +4235,7 @@ export async function routeSupervisorEvent(
   });
   // ── THE EXTERNAL-PARTICIPANT POLICY (OPE-507 / OPE-504) ────────────────────────────────────────
   // ABOVE THE SESSION MINT, deliberately: a suppressed wake must not rotate a generation or claim a
-  // fresh generation's first-wake backscroll. Inert on the shipped grains (`taint` / `engage`).
+  // fresh generation's first-wake backscroll. Inert only on the `taint` / `engage` opt-out.
   const externalPolicy = slackExternalPolicyForRoom(domainKeyOf(p));
   {
     const verdict = await applySlackExternalPolicy(ev, p, { trust: wakeTrust, refuted: authorFacts.refuted }, "routeSupervisorEvent");
@@ -4358,8 +4370,8 @@ export async function routeSupervisorEvent(
   // BEHAVIOUR 3 (OPE-507) — the ARRIVED-MARKER over the first-wake backscroll. The trigger author
   // cleared the gate above, so this wake fires; a SIBLING the probe refuted has not, and under
   // `withhold` their bytes must not enter. The transform replaces the body, the pre-edit body and the
-  // attachments, and it returns the SAME ARRAY by reference on the shipped `taint` grain, so no
-  // golden moves on a deployment that has not opted in.
+  // attachments, and it returns the SAME ARRAY by reference on the `taint` opt-out grain, so no
+  // golden moves on a deployment that opted out.
   const backscroll = priorContext.map((m) => (withholdsBody(m, externalPolicy) ? withheldWakeMessage(m) : m));
 
   // POSITIVELY confirmed internal → stamp the trust verdict into the wake auth, exactly like the
@@ -4374,7 +4386,7 @@ export async function routeSupervisorEvent(
   //
   // 🔴 A WITHHELD SIBLING NEVER KEYS TAINT. `ingestedAfterWithholding` REMOVES the entries the
   // transform above stripped, because their bytes did not enter — a join over a message that did not
-  // ingest would claim an exposure that did not happen. On the shipped `taint` grain it returns the
+  // ingest would claim an exposure that did not happen. On the `taint` opt-out grain it returns the
   // SAME ARRAY by reference, so the auth bag is byte-identical.
   //
   // 🔴 THE HYDRATED NAME-DROP LINES JOIN TOO (OPE-475/OPE-525, carried onto the seat road by
@@ -4479,8 +4491,8 @@ export async function routeSupervisorEvent(
     // and without this the guest's bytes reach the model verbatim. It is the SAME function the
     // native route calls, over the WHOLE wake — so the envelope backscroll's own withholding (the
     // `priorContext` map above) and the hydrated lines are decided by one transform, and it returns
-    // the wake BY REFERENCE on the shipped `taint` grain, so nothing moves for a deployment that has
-    // not opted in. Run only on the name-drop tier, which is the only tier that carries the slot.
+    // the wake BY REFERENCE on the `taint` opt-out grain, so nothing moves for a deployment that
+    // opted out. Run only on the name-drop tier, which is the only tier that carries the slot.
     const wake = slackChannelWatchWake(ev, {
       mode: "supervisor",
       trust: wakeTrust,

package/agent/channels/slack-front.ts

@@ -39,6 +39,8 @@
 //      commands) still forwards exactly as before.
 //   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
 
+import { parseSlackUserDeactivation, routeSlackUserDeactivation, type SlackUserDeactivation } from "./slack-offboarding.js";
+import type { OffboardOutcome } from "@open-everywhere/core/agent/adapter-api.js";
 import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
 import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
 import { slackSigningSecret } from "../setup/credentials.js";
@@ -129,10 +131,24 @@ import {
   applySlackExternalPolicy,
   stripUnfencedSlackAttachments,
   slackEnterpriseIdFromEnvelope,
+  slackForm,
   _resetAuthorMemberCache,
 } from "./slack-events.js";
 import { buildSlackAuth, withForwardedSlackEnvelope, type ForwardedSlackEnvelope } from "./slack-identity.js";
 import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { liveMemoryCanvasDeps, recheckChannelCanvas } from "./slack-memory-canvas.js";
+import {
+  handleHomeClick,
+  handleHomeOpened,
+  handleHomeSubmission,
+  liveSlackHomeDeps,
+  parseHomeClick,
+  parseHomeOpened,
+  parseHomeSubmission,
+  type ParsedHomeClick,
+  type ParsedHomeOpen,
+  type ParsedHomeSubmission,
+} from "./slack-home.js";
 import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
 import {
   parseSlackShortcutPayload,
@@ -158,6 +174,9 @@ export type FrontDecision =
   | { readonly kind: "forward"; readonly reason: string }
   | { readonly kind: "wake"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "join"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** OPE-2423 — a `user_change` event. Ours: a `deleted` user is a deactivation report for core's
+   *  offboarding lever (slack-offboarding.ts); every other profile edit is acked with no work. */
+  | { readonly kind: "user-change"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "reaction"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "approval-click"; readonly reason: string; readonly payload: unknown }
   /** A "Set API key" button click (credentials/intake.ts) — ours: verify the clicker is the intake's
@@ -191,7 +210,16 @@ export type FrontDecision =
    *  a forward is a guaranteed no-op, and eve's shortcut context carries no session to wake from
    *  anyway. The decoded shortcut rides along so the handler needn't re-parse it — same pattern as
    *  the click branches, which carry a raw `payload` because their handlers own the decode. */
-  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut };
+  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut }
+  /** A `channel_shared` (the channel became Slack Connect shared) — ours: re-run the memory canvas gate
+   *  on that channel, which clears the app's canvas when the channel no longer passes (OPE-2451). */
+  | { readonly kind: "channel-shared"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** An `app_home_opened` for the HOME tab (OPE-2451) — ours: publish the person's own page. */
+  | { readonly kind: "home-open"; readonly reason: string; readonly open: ParsedHomeOpen }
+  /** An `oe_home:` click on the Home tab (OPE-2451) — ours: run a button, or open an item's modal. */
+  | { readonly kind: "home-click"; readonly reason: string; readonly click: ParsedHomeClick }
+  /** A submission of the Home tab's own modal (OPE-2451) — ours: run the action, republish the page. */
+  | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission };
 
 /**
  * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
@@ -365,6 +393,17 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     if (grantClick !== undefined) {
       return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
     }
+    // THE HOME TAB (OPE-2451). Its clicks carry an `oe_home:` action id and its one modal a callback
+    // id of its own, so neither can be mistaken for another door's payload, nor for eve's.
+    const homePayload = decodeInteractivityPayload(rawBody);
+    const homeClick = parseHomeClick(homePayload);
+    if (homeClick !== undefined) {
+      return { kind: "home-click", reason: `block_actions oe_home: ${homeClick.action} — ours, never forwarded`, click: homeClick };
+    }
+    const homeSubmission = parseHomeSubmission(homePayload);
+    if (homeSubmission !== undefined) {
+      return { kind: "home-submit", reason: `view_submission for the Home tab modal (${homeSubmission.action}) — ours, never forwarded`, submission: homeSubmission };
+    }
     // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
     // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
     // matched LAST among the urlencoded branches and cannot race any of them: every branch above
@@ -397,6 +436,20 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
   if (eventType === "member_joined_channel") {
     return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
   }
+  if (eventType === "channel_shared") {
+    return { kind: "channel-shared", reason: "channel_shared — recheck the domain memory canvas", env };
+  }
+  if (eventType === "app_home_opened") {
+    // Only the HOME tab is ours (OPE-2451). The same event fires for the Messages tab, which has no
+    // page to publish, so that one forwards — eve acknowledges an event it has no handler for.
+    const open = parseHomeOpened(env);
+    if (open) return { kind: "home-open", reason: "app_home_opened (home tab) — publish the person's page", open };
+    return { kind: "forward", reason: "app_home_opened for a tab other than home — nothing to publish" };
+  }
+  if (eventType === "user_change") {
+    // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
+    return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
+  }
   if (eventType === "reaction_added" || eventType === "reaction_removed") {
     // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
     // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
@@ -553,10 +606,21 @@ export interface FrontOptions {
    *  re-verifies standing host-side, then mints an ephemeral OAuth URL / opens the api-key intake.
    *  Injectable for tests. */
   readonly handleConnectClick?: (payload: unknown) => Promise<boolean>;
+  /** OPE-2423 — hand one deactivation report to core's offboarding lever. Defaults to
+   *  {@link routeSlackUserDeactivation} with a live `users.info` re-read. Injectable for tests. */
+  readonly routeUserDeactivation?: (d: SlackUserDeactivation) => Promise<OffboardOutcome>;
   /** Injected in tests; the live default is core's `handleGrantCardClick`. The signed grant-click
    *  branch schedules it through the route's `waitUntil`, so this handler may outlive the empty
    *  Slack acknowledgement. */
   readonly handleGrantCardClick?: (payload: unknown) => Promise<boolean>;
+  /** The three Home-tab handlers (OPE-2451). Injected in tests; the live defaults are slack-home.ts's,
+   *  over the live Slack deps. Each runs after the empty acknowledgement, through `waitUntil`. */
+  readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
+  readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
+  readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+  /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
+   *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
+  readonly recheckChannelCanvas?: (input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => Promise<unknown>;
   /** SINGLE-WINDOW mention policy for one (channel, surface) — should the unified window own an
    *  @mention here (suppress the native forward + keep the sibling as an addressed wake)?
    *  Defaults to the live {@link slackSingleWindowMentionPolicy} (grain + fail-closed
@@ -991,7 +1055,13 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
   const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
   const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+  const routeUserDeactivation =
+    opts.routeUserDeactivation ?? ((d: SlackUserDeactivation) => routeSlackUserDeactivation(d, { usersInfo: (userId) => slackForm("users.info", `user=${encodeURIComponent(userId)}`) }));
   const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+  const homeOpened = opts.handleHomeOpened ?? ((open: ParsedHomeOpen) => handleHomeOpened(open, liveSlackHomeDeps()));
+  const homeClicked = opts.handleHomeClick ?? ((click: ParsedHomeClick) => handleHomeClick(click, liveSlackHomeDeps()));
+  const recheckCanvas = opts.recheckChannelCanvas ?? ((input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
+  const homeSubmitted = opts.handleHomeSubmission ?? ((submission: ParsedHomeSubmission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
   const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
   const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
   const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
@@ -1156,16 +1226,16 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     const notYetSeen = (env: SlackEventEnvelope, ev: ParsedMessageEvent): Promise<boolean> =>
       notYetSeenKey(wakeKey(env, ev.channelId, ev.ts), ev);
 
-    // UNOWNED message dispatch (top-level, or in-thread but not engaged): today's default is the
-    // name-drop path (per-domain opt-in, fail-closed). When the channel's domain opts into
-    // ambientSupervisor, the SAME unowned traffic routes to the channel-supervisor session instead
+    // UNOWNED message dispatch (top-level, or in-thread but not engaged): the fallback is the
+    // name-drop path (per-domain opt-in, fail-closed). When the channel's domain has
+    // ambientSupervisor on (the default since OPE-2409), the SAME unowned traffic routes to the channel-supervisor session instead
     // (slack-events.ts routeSupervisorEvent) — the "always-on teammate" leg. `directMention` is the
     // SINGLE-WINDOW addressed-mention divert (an app_mention event routed here from the mention
     // branch): it forces the supervisor path (the only road into the unified window) and renders an
     // addressed `direct-mention` wake. The supervisor wake serializes on its OWN FIFO key (the
     // supervisor token), never shared with a thread FIFO. Fail-closed: any partition/config error,
     // or the flag off, falls through to the UNCHANGED name-drop dispatch — so ambientSupervisor-off
-    // is byte-identical to today. Parametrised on `ev` so both the app_mention divert and a plain
+    // is byte-identical to the pre-ambient path. Parametrised on `ev` so both the app_mention divert and a plain
     // message.channels wake feed one dispatcher.
     // `onWake` runs SYNCHRONOUSLY, once, immediately before a wake is scheduled — and never on the
     // addressed-drop path below. The shortcut route (OPE-1442) uses it to seed the attachment
@@ -1424,10 +1494,9 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // 🔴 A GROUP DM IS SUPPRESSIBLE ON THE AUTHOR GRAIN TOO (OPE-1486). It was not before, because
       // an mpim resolved no refutation at all — the limit the old note here recorded. The author leg
       // above now resolves one from the same probe a channel uses, so an operator who set
-      // `externalPolicy.authorGrain: "withhold"` gets that rule in a group DM as well. Nothing moves
-      // on the SUPPRESSION PATH for a default deployment: `withholdsBody` is inert under the shipped
-      // `taint` grain, so only a deployment that explicitly excluded refuted authors is suppressed
-      // here — which is the rule it asked for. That is a claim about SUPPRESSION alone: on `taint`
+      // `externalPolicy.authorGrain: "withhold"` (shipped since 2026-10-10) gets that rule in a group
+      // DM as well. `withholdsBody` is inert only under the `taint` opt-out, so a deployment that opted
+      // out is never suppressed here. That is a claim about SUPPRESSION alone: on `taint`
       // the same refutation still newly stamps `oe_chat_nonmember` and still newly fences the body,
       // which is the fix. The room leg stays off for the whole DM family by the note above: on a DM
       // the trust plane asks about the PARTNER, not about the room.
@@ -1967,7 +2036,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       //
       // 🔴 IT COSTS A PROBE, SO IT IS SKIPPED WHEN IT CANNOT MATTER. Unlike the three routes, this
       // leg resolves no author facts of its own, so gating it means one `users.info` call. The inert
-      // check runs first: on the shipped `taint` / `engage` pair no evidence is resolved at all and
+      // check runs first: on the `taint` / `engage` opt-out pair no evidence is resolved at all and
       // this whole block is a single config read. The probe is TTL-cached per author on top of that.
       //
       // FAIL-OPEN on anything unreadable — an unparseable event, an unresolvable partition, a probe
@@ -2099,6 +2168,35 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return new Response(null, { status: 200 });
     }
 
+    if (decision.kind === "home-open" || decision.kind === "home-click" || decision.kind === "home-submit") {
+      // THE HOME TAB (OPE-2451). THE TENANT FENCE FIRST (OPE-1680), for the reason the approval branch
+      // states: the page reads and changes a person's memory, keyed to a bare per-workspace member id,
+      // so an unadmitted workspace reaching it is a foreign tenant reading our store.
+      const ids = decision.kind === "home-open" ? decision.open : decision.kind === "home-click" ? decision.click : decision.submission;
+      const fenceIds = {
+        ...(ids.teamId === undefined ? {} : { teamId: ids.teamId }),
+        ...(ids.enterpriseId === undefined ? {} : { enterpriseId: ids.enterpriseId }),
+        userId: ids.userId,
+      };
+      if (slackInteractivityTenantFenceDeclined(fenceIds, decision.kind, decision.kind === "home-open" ? "front-home-event-branch" : "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // ACK FIRST, WORK AFTER. Building the page reads memory and asks Slack who the person is and
+      // which channels they sit in, which can cross Slack's three-second budget. An empty 200 also
+      // CLOSES a submitted modal, which is what the person expects after Save or Forget; the page
+      // they return to is republished with a one-line notice saying what happened.
+      const run =
+        decision.kind === "home-open" ? homeOpened(decision.open) : decision.kind === "home-click" ? homeClicked(decision.click) : homeSubmitted(decision.submission);
+      args.waitUntil(
+        run
+          .then((handled) => {
+            if (!handled) console.log(`[open-everywhere:slack-front] ${decision.kind} for ${ids.userId} did not complete`);
+          })
+          .catch(() => console.warn(`[open-everywhere:slack-front] ${decision.kind} failed after acknowledgement`)),
+      );
+      return new Response(null, { status: 200 });
+    }
+
     if (decision.kind === "setkey-submit") {
       // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
       // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
@@ -2121,6 +2219,43 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return forwardNative();
     }
 
+    if (decision.kind === "channel-shared") {
+      // THE CHANNEL WAS SHARED (OPE-2451): re-run the memory canvas gate at once, which clears the app's
+      // own canvas there. The canvas reads the room verdict fresh, so the wake path's cached "internal"
+      // cannot carry a pre-share answer into this decision.
+      const ev = decision.env.event as Record<string, unknown> | undefined;
+      const channelId = typeof ev?.channel === "string" ? ev.channel : undefined;
+      const teamId = typeof decision.env.team_id === "string" ? decision.env.team_id : undefined;
+      if (!channelId || !teamId) return OK();
+      const sharedEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+      if (
+        slackInteractivityTenantFenceDeclined(
+          { teamId, ...(sharedEnterpriseId === undefined ? {} : { enterpriseId: sharedEnterpriseId }), channelId },
+          "channel-shared",
+          "front-channel-shared-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      let sharedOrg: string | undefined;
+      try {
+        sharedOrg = resolvePartition({
+          channel: { kind: "slack" },
+          session: { auth: { current: { attributes: { team_id: teamId, channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+        } as Parameters<typeof resolvePartition>[0]).org;
+      } catch {
+        sharedOrg = undefined;
+      }
+      if (sharedOrg !== undefined) {
+        args.waitUntil(
+          recheckCanvas({ org: sharedOrg, teamId, channelId, trigger: "channel-shared" }).catch(() =>
+            console.warn("[open-everywhere:slack-front] memory canvas recheck after a share failed"),
+          ),
+        );
+      }
+      return OK();
+    }
+
     if (decision.kind === "join") {
       // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
       // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
@@ -2130,7 +2265,38 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       const jev = parseChannelJoinEvent(decision.env);
       if (!jev) return OK();
       const { userId: joinBotUserId } = await getBotIdentity();
-      if (!joinBotUserId || jev.userId !== joinBotUserId) return OK();
+      if (!joinBotUserId || jev.userId !== joinBotUserId) {
+        // A PERSON JOINED (OPE-2451). No intro, but the domain memory canvas re-runs its gate: the
+        // newcomer may be a guest, and a canvas written before they joined would show them every line
+        // of the domain's memory. The recheck can only CLEAR the app's own canvas, never write memory,
+        // so an unresolved bot identity rechecks too. Fenced like every other door: a foreign tenant
+        // never reaches this deployment's Slack calls.
+        if (jev.teamId === undefined) return OK();
+        if (
+          slackInteractivityTenantFenceDeclined(
+            { teamId: jev.teamId, ...(jev.enterpriseId === undefined ? {} : { enterpriseId: jev.enterpriseId }), channelId: jev.channelId, userId: jev.userId },
+            "member-joined",
+            "front-join-branch",
+          )
+        ) {
+          return fencedAck(OK());
+        }
+        let joinOrg: string | undefined;
+        try {
+          joinOrg = resolvePartition(bindableForJoin(jev)).org;
+        } catch {
+          joinOrg = undefined;
+        }
+        if (joinOrg !== undefined) {
+          const teamId = jev.teamId;
+          args.waitUntil(
+            recheckCanvas({ org: joinOrg, teamId, channelId: jev.channelId, trigger: "member-joined", joinedUserId: jev.userId }).catch(() =>
+              console.warn("[open-everywhere:slack-front] memory canvas recheck after a join failed"),
+            ),
+          );
+        }
+        return OK();
+      }
 
       // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
       // double intro is exactly the annoyance the durable half exists to prevent.
@@ -2153,6 +2319,38 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return OK();
     }
 
+    if (decision.kind === "user-change") {
+      // AUTOMATIC OFFBOARDING (OPE-2423). The signature above has authenticated the envelope, so its
+      // `team_id` is the workspace that delivered this report. Every other decision — the
+      // same-workspace gate, the tenant fence, the live users.info re-read, the terminal revoke and
+      // its audit row — runs in core's offboardDeactivatedAccount, AFTER the ack: Slack wants a quick
+      // 200, and a revoke is idempotent, so a Slack retry that races it changes nothing.
+      const deactivation = parseSlackUserDeactivation(decision.env);
+      if (!deactivation) return OK();
+      // THE TENANT FENCE (OPE-1680), the same front-door refusal every other deciding branch takes.
+      // Core's gate 2 ALSO requires a positive admission, because this fence is inert when config
+      // declares no tenant — and a terminal revoke must not run on an inert answer.
+      if (
+        slackInteractivityTenantFenceDeclined(
+          {
+            teamId: deactivation.deliveringTeamId,
+            ...(deactivation.enterpriseId === undefined ? {} : { enterpriseId: deactivation.enterpriseId }),
+            userId: deactivation.userId,
+          },
+          "user-change",
+          "front-user-change-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      args.waitUntil(
+        routeUserDeactivation(deactivation).then((outcome) =>
+          console.log(`[open-everywhere:slack-front] user_change ${deactivation.userId}: offboarding ${outcome.kind}${outcome.kind === "refused" ? ` (${outcome.reason})` : ""}`),
+        ),
+      );
+      return OK();
+    }
+
     if (decision.kind === "reaction") {
       // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
       const rev = parseSlackReactionEvent(decision.env);