@open-everywhere/provider-slack 0.4.0 → 0.5.0

package/agent/app-manifest.ts

@@ -6,10 +6,12 @@
 // scope array below against the runbook's documented scopes. It used to live in the setup CLI, where
 // the ops server could not reach it at all.
 //
-// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The setup CLI depends on the bundle for this
-// document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
-// eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
-// only the vendor's own knowledge.
+// 🔴 THIS MODULE IMPORTS NOTHING BUT ANOTHER LEAF, DELIBERATELY. The setup CLI depends on the bundle
+// for this document alone, so a leaf module costs it no transitive weight — not the adapter-api
+// barrel, not eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file
+// holds only the vendor's own knowledge. `./slack-as-you.ts` is a leaf too (it imports only types).
+
+import { SLACK_MCP_BOT_SCOPE, slackAsYouUserScopes } from "./slack-as-you.js";
 
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
  *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
@@ -53,8 +55,20 @@ export interface SlackAppManifestOptions {
   /** The slash command's name without the slash — the `identity.commandName` setting. Absent ⇒
    *  {@link SLACK_DEFAULT_COMMAND_NAME}. */
   readonly commandName?: string;
+  /**
+   * The app declares "search Slack as you" (`slackAsYou` in `agent/access/mcp-servers.ts`, OPE-2421). Adds
+   * the `mcp:connect` bot scope, the user scopes a person consents to, and the redirect URL their sign-in
+   * returns to. Absent ⇒ none of them: an app that does not use Slack's MCP server asks for no user scope.
+   * The MCP toggle itself (the app config's Agents section) has no manifest field, so it stays a click.
+   */
+  readonly personalMcp?: boolean;
 }
 
+/** The path the person's OAuth sign-in returns to — core's `OE_OAUTH_CALLBACK_PATH`
+ *  (connections/oe-oauth-callback.ts). Spelled here because this module imports nothing from core;
+ *  `scripts/slack-as-you-test.ts` fails if the two drift. */
+export const SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH = "/oauth/v1/callback";
+
 /** The app name a manifest carries: the explicit name, else the configured name, else the default.
  *  A configured name past Slack's limit is cut to fit, because Slack refuses the whole paste. */
 export function slackManifestAppName(opts: SlackAppManifestOptions = {}): string {
@@ -76,6 +90,7 @@ function shortcutName(prefix: string, appName: string, neutral: string): string
 export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): string {
   const appName = slackManifestAppName(opts);
   const commandName = opts.commandName?.trim() || SLACK_DEFAULT_COMMAND_NAME;
+  const personalMcp = opts.personalMcp === true;
   return JSON.stringify(
     {
       display_information: { name: appName },
@@ -83,8 +98,12 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // THE MESSAGES TAB (OPE-2222). With no `app_home` block, Slack creates the app with the
         // Messages tab OFF, and a person who opens a DM with the bot sees "Sending messages to this
         // app has been turned off". DMs are the primary wake (`message.im` below), so the tab is
-        // on and writable. The product has no Home tab (`app_home_opened` is not routed).
-        app_home: { home_tab_enabled: false, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
+        // on and writable.
+        // THE HOME TAB (OPE-2451) is on too: it is the person's private page — what the agent
+        // remembers about them, with Edit, Forget and Export, and what their domains know. Opening
+        // it delivers `app_home_opened` (below), and the front route publishes the page
+        // (channels/slack-home.ts).
+        app_home: { home_tab_enabled: true, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
         bot_user: { display_name: appName, always_online: true },
         // The "/oe" ZERO-INFERENCE control command (agent/commands/core.ts). Declared here rather
         // than left to a manual setup step because one of its subcommands is `/oe stop` (OPE-418),
@@ -135,7 +154,11 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // line in the manifest, not just in the code that handles the callback. It is harmless on the
         // hand-paste path: an app created from this manifest and installed from the Slack console
         // never visits the URL.
-        redirect_urls: [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`],
+        redirect_urls: [
+          `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`,
+          // "SEARCH SLACK AS YOU" (OPE-2421): a person's own sign-in returns here, to core's OAuth callback.
+          ...(personalMcp ? [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}${SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH}`] : []),
+        ],
         scopes: {
           bot: [
             "app_mentions:read",
@@ -184,7 +207,19 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // users.info — the DM-partner trust check. Without this, EVERY DM binds `external`
             // (fail-closed) on a fresh install, silently (OPE-175).
             "users:read",
+            // conversations.canvases.create + canvases.edit — the domain memory canvas (OPE-2451,
+            // channels/slack-memory-canvas.ts): a domain's internal channels show what the domain
+            // knows. Without it the canvas refresh fails with `missing_scope`, logged and audited
+            // per channel, and memory itself is unaffected.
+            "canvases:write",
+            // Slack requires this bot scope on an app whose people connect to Slack's MCP server
+            // (OPE-2421). Declared only when the app declares "search Slack as you".
+            ...(personalMcp ? [SLACK_MCP_BOT_SCOPE] : []),
           ],
+          // The USER scopes a person consents to for "search Slack as you" (OPE-2421). The install
+          // asks for none of them: `/setup` requests bot scopes only, and each person grants these for
+          // themselves, in the moment, through Slack's user-only consent.
+          ...(personalMcp ? { user: [...slackAsYouUserScopes()] } : {}),
         },
       },
       settings: {
@@ -198,6 +233,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           //   message.mpim → mpim:history (group DMs; without it only an @mention there is heard)
           //   member_joined_channel → channels:read, groups:read, mpim:read (the channel-join intro)
           //   reaction_added, reaction_removed → reactions:read (reaction feedback)
+          //   app_home_opened → no scope (the Home tab page, OPE-2451)
+          //   channel_shared → channels:read, groups:read (re-run the memory canvas gate, OPE-2451)
+          //   user_change → users:read (automatic offboarding on a deactivated member, OPE-2423)
           // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
           // this list drops one (OPE-2223).
           bot_events: [
@@ -209,6 +247,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "member_joined_channel",
             "reaction_added",
             "reaction_removed",
+            "app_home_opened",
+            "channel_shared",
+            "user_change",
           ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every

package/agent/channels/slack-events.ts

@@ -2762,6 +2762,18 @@ export async function confirmChannelInternal(channelId: string): Promise<boolean
   return (await channelInternalAndMeta(channelId)).internal;
 }
 
+/**
+ * {@link confirmChannelInternal} read FRESH: the cached verdict is dropped first, so the answer is
+ * today's `conversations.info`, and the cache is refilled with it. For the one consumer that must not
+ * act on a verdict up to a TTL old — the domain memory canvas (slack-memory-canvas.ts, OPE-2451),
+ * which decides whether every line of a domain's memory stays on screen in this channel. A wake keeps
+ * the cached read; the canvas is written rarely enough to pay for one call.
+ */
+export async function confirmChannelInternalFresh(channelId: string): Promise<boolean> {
+  channelTrustCache.delete(channelId);
+  return (await channelInternalAndMeta(channelId)).internal;
+}
+
 /**
  * Positively confirm a channel is internal (fail-closed, same TTL-cached
  * conversations.info as {@link confirmChannelInternal}) AND surface its member count —

package/agent/channels/slack-front.ts

@@ -39,6 +39,8 @@
 //      commands) still forwards exactly as before.
 //   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
 
+import { parseSlackUserDeactivation, routeSlackUserDeactivation, type SlackUserDeactivation } from "./slack-offboarding.js";
+import type { OffboardOutcome } from "@open-everywhere/core/agent/adapter-api.js";
 import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
 import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
 import { slackSigningSecret } from "../setup/credentials.js";
@@ -129,10 +131,24 @@ import {
   applySlackExternalPolicy,
   stripUnfencedSlackAttachments,
   slackEnterpriseIdFromEnvelope,
+  slackForm,
   _resetAuthorMemberCache,
 } from "./slack-events.js";
 import { buildSlackAuth, withForwardedSlackEnvelope, type ForwardedSlackEnvelope } from "./slack-identity.js";
 import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { liveMemoryCanvasDeps, recheckChannelCanvas } from "./slack-memory-canvas.js";
+import {
+  handleHomeClick,
+  handleHomeOpened,
+  handleHomeSubmission,
+  liveSlackHomeDeps,
+  parseHomeClick,
+  parseHomeOpened,
+  parseHomeSubmission,
+  type ParsedHomeClick,
+  type ParsedHomeOpen,
+  type ParsedHomeSubmission,
+} from "./slack-home.js";
 import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
 import {
   parseSlackShortcutPayload,
@@ -158,6 +174,9 @@ export type FrontDecision =
   | { readonly kind: "forward"; readonly reason: string }
   | { readonly kind: "wake"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "join"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** OPE-2423 — a `user_change` event. Ours: a `deleted` user is a deactivation report for core's
+   *  offboarding lever (slack-offboarding.ts); every other profile edit is acked with no work. */
+  | { readonly kind: "user-change"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "reaction"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "approval-click"; readonly reason: string; readonly payload: unknown }
   /** A "Set API key" button click (credentials/intake.ts) — ours: verify the clicker is the intake's
@@ -191,7 +210,16 @@ export type FrontDecision =
    *  a forward is a guaranteed no-op, and eve's shortcut context carries no session to wake from
    *  anyway. The decoded shortcut rides along so the handler needn't re-parse it — same pattern as
    *  the click branches, which carry a raw `payload` because their handlers own the decode. */
-  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut };
+  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut }
+  /** A `channel_shared` (the channel became Slack Connect shared) — ours: re-run the memory canvas gate
+   *  on that channel, which clears the app's canvas when the channel no longer passes (OPE-2451). */
+  | { readonly kind: "channel-shared"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** An `app_home_opened` for the HOME tab (OPE-2451) — ours: publish the person's own page. */
+  | { readonly kind: "home-open"; readonly reason: string; readonly open: ParsedHomeOpen }
+  /** An `oe_home:` click on the Home tab (OPE-2451) — ours: run a button, or open an item's modal. */
+  | { readonly kind: "home-click"; readonly reason: string; readonly click: ParsedHomeClick }
+  /** A submission of the Home tab's own modal (OPE-2451) — ours: run the action, republish the page. */
+  | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission };
 
 /**
  * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
@@ -365,6 +393,17 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     if (grantClick !== undefined) {
       return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
     }
+    // THE HOME TAB (OPE-2451). Its clicks carry an `oe_home:` action id and its one modal a callback
+    // id of its own, so neither can be mistaken for another door's payload, nor for eve's.
+    const homePayload = decodeInteractivityPayload(rawBody);
+    const homeClick = parseHomeClick(homePayload);
+    if (homeClick !== undefined) {
+      return { kind: "home-click", reason: `block_actions oe_home: ${homeClick.action} — ours, never forwarded`, click: homeClick };
+    }
+    const homeSubmission = parseHomeSubmission(homePayload);
+    if (homeSubmission !== undefined) {
+      return { kind: "home-submit", reason: `view_submission for the Home tab modal (${homeSubmission.action}) — ours, never forwarded`, submission: homeSubmission };
+    }
     // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
     // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
     // matched LAST among the urlencoded branches and cannot race any of them: every branch above
@@ -397,6 +436,20 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
   if (eventType === "member_joined_channel") {
     return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
   }
+  if (eventType === "channel_shared") {
+    return { kind: "channel-shared", reason: "channel_shared — recheck the domain memory canvas", env };
+  }
+  if (eventType === "app_home_opened") {
+    // Only the HOME tab is ours (OPE-2451). The same event fires for the Messages tab, which has no
+    // page to publish, so that one forwards — eve acknowledges an event it has no handler for.
+    const open = parseHomeOpened(env);
+    if (open) return { kind: "home-open", reason: "app_home_opened (home tab) — publish the person's page", open };
+    return { kind: "forward", reason: "app_home_opened for a tab other than home — nothing to publish" };
+  }
+  if (eventType === "user_change") {
+    // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
+    return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
+  }
   if (eventType === "reaction_added" || eventType === "reaction_removed") {
     // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
     // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
@@ -553,10 +606,21 @@ export interface FrontOptions {
    *  re-verifies standing host-side, then mints an ephemeral OAuth URL / opens the api-key intake.
    *  Injectable for tests. */
   readonly handleConnectClick?: (payload: unknown) => Promise<boolean>;
+  /** OPE-2423 — hand one deactivation report to core's offboarding lever. Defaults to
+   *  {@link routeSlackUserDeactivation} with a live `users.info` re-read. Injectable for tests. */
+  readonly routeUserDeactivation?: (d: SlackUserDeactivation) => Promise<OffboardOutcome>;
   /** Injected in tests; the live default is core's `handleGrantCardClick`. The signed grant-click
    *  branch schedules it through the route's `waitUntil`, so this handler may outlive the empty
    *  Slack acknowledgement. */
   readonly handleGrantCardClick?: (payload: unknown) => Promise<boolean>;
+  /** The three Home-tab handlers (OPE-2451). Injected in tests; the live defaults are slack-home.ts's,
+   *  over the live Slack deps. Each runs after the empty acknowledgement, through `waitUntil`. */
+  readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
+  readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
+  readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+  /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
+   *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
+  readonly recheckChannelCanvas?: (input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => Promise<unknown>;
   /** SINGLE-WINDOW mention policy for one (channel, surface) — should the unified window own an
    *  @mention here (suppress the native forward + keep the sibling as an addressed wake)?
    *  Defaults to the live {@link slackSingleWindowMentionPolicy} (grain + fail-closed
@@ -991,7 +1055,13 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
   const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
   const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+  const routeUserDeactivation =
+    opts.routeUserDeactivation ?? ((d: SlackUserDeactivation) => routeSlackUserDeactivation(d, { usersInfo: (userId) => slackForm("users.info", `user=${encodeURIComponent(userId)}`) }));
   const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+  const homeOpened = opts.handleHomeOpened ?? ((open: ParsedHomeOpen) => handleHomeOpened(open, liveSlackHomeDeps()));
+  const homeClicked = opts.handleHomeClick ?? ((click: ParsedHomeClick) => handleHomeClick(click, liveSlackHomeDeps()));
+  const recheckCanvas = opts.recheckChannelCanvas ?? ((input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
+  const homeSubmitted = opts.handleHomeSubmission ?? ((submission: ParsedHomeSubmission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
   const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
   const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
   const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
@@ -2098,6 +2168,35 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return new Response(null, { status: 200 });
     }
 
+    if (decision.kind === "home-open" || decision.kind === "home-click" || decision.kind === "home-submit") {
+      // THE HOME TAB (OPE-2451). THE TENANT FENCE FIRST (OPE-1680), for the reason the approval branch
+      // states: the page reads and changes a person's memory, keyed to a bare per-workspace member id,
+      // so an unadmitted workspace reaching it is a foreign tenant reading our store.
+      const ids = decision.kind === "home-open" ? decision.open : decision.kind === "home-click" ? decision.click : decision.submission;
+      const fenceIds = {
+        ...(ids.teamId === undefined ? {} : { teamId: ids.teamId }),
+        ...(ids.enterpriseId === undefined ? {} : { enterpriseId: ids.enterpriseId }),
+        userId: ids.userId,
+      };
+      if (slackInteractivityTenantFenceDeclined(fenceIds, decision.kind, decision.kind === "home-open" ? "front-home-event-branch" : "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // ACK FIRST, WORK AFTER. Building the page reads memory and asks Slack who the person is and
+      // which channels they sit in, which can cross Slack's three-second budget. An empty 200 also
+      // CLOSES a submitted modal, which is what the person expects after Save or Forget; the page
+      // they return to is republished with a one-line notice saying what happened.
+      const run =
+        decision.kind === "home-open" ? homeOpened(decision.open) : decision.kind === "home-click" ? homeClicked(decision.click) : homeSubmitted(decision.submission);
+      args.waitUntil(
+        run
+          .then((handled) => {
+            if (!handled) console.log(`[open-everywhere:slack-front] ${decision.kind} for ${ids.userId} did not complete`);
+          })
+          .catch(() => console.warn(`[open-everywhere:slack-front] ${decision.kind} failed after acknowledgement`)),
+      );
+      return new Response(null, { status: 200 });
+    }
+
     if (decision.kind === "setkey-submit") {
       // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
       // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
@@ -2120,6 +2219,43 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return forwardNative();
     }
 
+    if (decision.kind === "channel-shared") {
+      // THE CHANNEL WAS SHARED (OPE-2451): re-run the memory canvas gate at once, which clears the app's
+      // own canvas there. The canvas reads the room verdict fresh, so the wake path's cached "internal"
+      // cannot carry a pre-share answer into this decision.
+      const ev = decision.env.event as Record<string, unknown> | undefined;
+      const channelId = typeof ev?.channel === "string" ? ev.channel : undefined;
+      const teamId = typeof decision.env.team_id === "string" ? decision.env.team_id : undefined;
+      if (!channelId || !teamId) return OK();
+      const sharedEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+      if (
+        slackInteractivityTenantFenceDeclined(
+          { teamId, ...(sharedEnterpriseId === undefined ? {} : { enterpriseId: sharedEnterpriseId }), channelId },
+          "channel-shared",
+          "front-channel-shared-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      let sharedOrg: string | undefined;
+      try {
+        sharedOrg = resolvePartition({
+          channel: { kind: "slack" },
+          session: { auth: { current: { attributes: { team_id: teamId, channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+        } as Parameters<typeof resolvePartition>[0]).org;
+      } catch {
+        sharedOrg = undefined;
+      }
+      if (sharedOrg !== undefined) {
+        args.waitUntil(
+          recheckCanvas({ org: sharedOrg, teamId, channelId, trigger: "channel-shared" }).catch(() =>
+            console.warn("[open-everywhere:slack-front] memory canvas recheck after a share failed"),
+          ),
+        );
+      }
+      return OK();
+    }
+
     if (decision.kind === "join") {
       // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
       // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
@@ -2129,7 +2265,38 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       const jev = parseChannelJoinEvent(decision.env);
       if (!jev) return OK();
       const { userId: joinBotUserId } = await getBotIdentity();
-      if (!joinBotUserId || jev.userId !== joinBotUserId) return OK();
+      if (!joinBotUserId || jev.userId !== joinBotUserId) {
+        // A PERSON JOINED (OPE-2451). No intro, but the domain memory canvas re-runs its gate: the
+        // newcomer may be a guest, and a canvas written before they joined would show them every line
+        // of the domain's memory. The recheck can only CLEAR the app's own canvas, never write memory,
+        // so an unresolved bot identity rechecks too. Fenced like every other door: a foreign tenant
+        // never reaches this deployment's Slack calls.
+        if (jev.teamId === undefined) return OK();
+        if (
+          slackInteractivityTenantFenceDeclined(
+            { teamId: jev.teamId, ...(jev.enterpriseId === undefined ? {} : { enterpriseId: jev.enterpriseId }), channelId: jev.channelId, userId: jev.userId },
+            "member-joined",
+            "front-join-branch",
+          )
+        ) {
+          return fencedAck(OK());
+        }
+        let joinOrg: string | undefined;
+        try {
+          joinOrg = resolvePartition(bindableForJoin(jev)).org;
+        } catch {
+          joinOrg = undefined;
+        }
+        if (joinOrg !== undefined) {
+          const teamId = jev.teamId;
+          args.waitUntil(
+            recheckCanvas({ org: joinOrg, teamId, channelId: jev.channelId, trigger: "member-joined", joinedUserId: jev.userId }).catch(() =>
+              console.warn("[open-everywhere:slack-front] memory canvas recheck after a join failed"),
+            ),
+          );
+        }
+        return OK();
+      }
 
       // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
       // double intro is exactly the annoyance the durable half exists to prevent.
@@ -2152,6 +2319,38 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return OK();
     }
 
+    if (decision.kind === "user-change") {
+      // AUTOMATIC OFFBOARDING (OPE-2423). The signature above has authenticated the envelope, so its
+      // `team_id` is the workspace that delivered this report. Every other decision — the
+      // same-workspace gate, the tenant fence, the live users.info re-read, the terminal revoke and
+      // its audit row — runs in core's offboardDeactivatedAccount, AFTER the ack: Slack wants a quick
+      // 200, and a revoke is idempotent, so a Slack retry that races it changes nothing.
+      const deactivation = parseSlackUserDeactivation(decision.env);
+      if (!deactivation) return OK();
+      // THE TENANT FENCE (OPE-1680), the same front-door refusal every other deciding branch takes.
+      // Core's gate 2 ALSO requires a positive admission, because this fence is inert when config
+      // declares no tenant — and a terminal revoke must not run on an inert answer.
+      if (
+        slackInteractivityTenantFenceDeclined(
+          {
+            teamId: deactivation.deliveringTeamId,
+            ...(deactivation.enterpriseId === undefined ? {} : { enterpriseId: deactivation.enterpriseId }),
+            userId: deactivation.userId,
+          },
+          "user-change",
+          "front-user-change-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      args.waitUntil(
+        routeUserDeactivation(deactivation).then((outcome) =>
+          console.log(`[open-everywhere:slack-front] user_change ${deactivation.userId}: offboarding ${outcome.kind}${outcome.kind === "refused" ? ` (${outcome.reason})` : ""}`),
+        ),
+      );
+      return OK();
+    }
+
     if (decision.kind === "reaction") {
       // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
       const rev = parseSlackReactionEvent(decision.env);