@open-everywhere/provider-slack 0.4.0 → 0.6.0

package/agent/app-manifest.ts

@@ -6,10 +6,12 @@
 // scope array below against the runbook's documented scopes. It used to live in the setup CLI, where
 // the ops server could not reach it at all.
 //
-// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The setup CLI depends on the bundle for this
-// document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
-// eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
-// only the vendor's own knowledge.
+// 🔴 THIS MODULE IMPORTS NOTHING BUT ANOTHER LEAF, DELIBERATELY. The setup CLI depends on the bundle
+// for this document alone, so a leaf module costs it no transitive weight — not the adapter-api
+// barrel, not eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file
+// holds only the vendor's own knowledge. `./slack-as-you.ts` is a leaf too (it imports only types).
+
+import { SLACK_MCP_BOT_SCOPE, slackAsYouUserScopes } from "./slack-as-you.js";
 
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
  *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
@@ -53,8 +55,38 @@ export interface SlackAppManifestOptions {
   /** The slash command's name without the slash — the `identity.commandName` setting. Absent ⇒
    *  {@link SLACK_DEFAULT_COMMAND_NAME}. */
   readonly commandName?: string;
+  /**
+   * The app declares "search Slack as you" (`slackAsYou` in `agent/access/mcp-servers.ts`, OPE-2421). Adds
+   * the `mcp:connect` bot scope, the user scopes a person consents to, and the redirect URL their sign-in
+   * returns to. Absent ⇒ none of them: an app that does not use Slack's MCP server asks for no user scope.
+   * The MCP toggle itself (the app config's Agents section) has no manifest field, so it stays a click.
+   */
+  readonly personalMcp?: boolean;
+  /**
+   * The side panel's suggested prompts (OPE-2457) — the `slack.suggestedPrompts` setting, which the
+   * caller reads (this module imports nothing). Absent or empty ⇒ the manifest offers none. The setup
+   * CLI passes none: it runs before the app's settings resolve, and the post-deploy re-paste from the
+   * ops tool or `/setup` carries them.
+   */
+  readonly suggestedPrompts?: readonly { readonly title: string; readonly message: string }[];
+}
+
+/** Slack's limit on `features.agent_view.agent_description` (the manifest reference: 300). */
+export const SLACK_AGENT_DESCRIPTION_MAX = 300;
+
+/** The side panel's one-line description. Names the configured agent, never the brand on its own. */
+function slackAgentDescription(appName: string): string {
+  return `Ask ${appName} beside anything you are reading in Slack. It is your own direct-message conversation, with the same rules as a DM.`.slice(
+    0,
+    SLACK_AGENT_DESCRIPTION_MAX,
+  );
 }
 
+/** The path the person's OAuth sign-in returns to — core's `OE_OAUTH_CALLBACK_PATH`
+ *  (connections/oe-oauth-callback.ts). Spelled here because this module imports nothing from core;
+ *  `scripts/slack-as-you-test.ts` fails if the two drift. */
+export const SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH = "/oauth/v1/callback";
+
 /** The app name a manifest carries: the explicit name, else the configured name, else the default.
  *  A configured name past Slack's limit is cut to fit, because Slack refuses the whole paste. */
 export function slackManifestAppName(opts: SlackAppManifestOptions = {}): string {
@@ -76,6 +108,7 @@ function shortcutName(prefix: string, appName: string, neutral: string): string
 export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): string {
   const appName = slackManifestAppName(opts);
   const commandName = opts.commandName?.trim() || SLACK_DEFAULT_COMMAND_NAME;
+  const personalMcp = opts.personalMcp === true;
   return JSON.stringify(
     {
       display_information: { name: appName },
@@ -83,8 +116,25 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // THE MESSAGES TAB (OPE-2222). With no `app_home` block, Slack creates the app with the
         // Messages tab OFF, and a person who opens a DM with the bot sees "Sending messages to this
         // app has been turned off". DMs are the primary wake (`message.im` below), so the tab is
-        // on and writable. The product has no Home tab (`app_home_opened` is not routed).
-        app_home: { home_tab_enabled: false, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
+        // on and writable.
+        // THE HOME TAB (OPE-2451) is on too: it is the person's private page — what the agent
+        // remembers about them, with Edit, Forget and Export, and what their domains know. Opening
+        // it delivers `app_home_opened` (below), and the front route publishes the page
+        // (channels/slack-home.ts).
+        app_home: { home_tab_enabled: true, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
+        // THE SIDE PANEL (OPE-2457) — Slack's agent experience. With `agent_view` on, a person can
+        // open the app's Messages tab beside any channel, and what they send there is an ordinary
+        // `message.im` to their own DM seat (channels/slack-side-panel.ts). `agent_view`, not the
+        // older `assistant_view`: Slack's manifest reference says a NEW app can only use `agent_view`.
+        // 🔴 FOR AN EXISTING APP THE SWITCH IS ONE-WAY: Slack cannot move an app from `assistant_view`
+        // back, and its people need a hard refresh. An app that never had `assistant_view` (every
+        // install of this manifest before OPE-2457) has nothing to switch from.
+        agent_view: {
+          agent_description: slackAgentDescription(appName),
+          ...(opts.suggestedPrompts && opts.suggestedPrompts.length > 0
+            ? { suggested_prompts: opts.suggestedPrompts.map((p) => ({ title: p.title, message: p.message })) }
+            : {}),
+        },
         bot_user: { display_name: appName, always_online: true },
         // The "/oe" ZERO-INFERENCE control command (agent/commands/core.ts). Declared here rather
         // than left to a manual setup step because one of its subcommands is `/oe stop` (OPE-418),
@@ -100,7 +150,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             description: `${appName} control-plane commands (stop, status, budget) — no model turn.`,
             // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
             // scripts/slack-app-manifest-test.ts fails if one is missing here.
-            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | help",
+            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | help",
             should_escape: false,
           },
         ],
@@ -135,7 +185,11 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // line in the manifest, not just in the code that handles the callback. It is harmless on the
         // hand-paste path: an app created from this manifest and installed from the Slack console
         // never visits the URL.
-        redirect_urls: [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`],
+        redirect_urls: [
+          `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`,
+          // "SEARCH SLACK AS YOU" (OPE-2421): a person's own sign-in returns here, to core's OAuth callback.
+          ...(personalMcp ? [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}${SLACK_PERSONAL_SIGN_IN_CALLBACK_PATH}`] : []),
+        ],
         scopes: {
           bot: [
             "app_mentions:read",
@@ -184,7 +238,22 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // users.info — the DM-partner trust check. Without this, EVERY DM binds `external`
             // (fail-closed) on a fresh install, silently (OPE-175).
             "users:read",
+            // conversations.canvases.create + canvases.edit — the domain memory canvas (OPE-2451,
+            // channels/slack-memory-canvas.ts): a domain's internal channels show what the domain
+            // knows. Without it the canvas refresh fails with `missing_scope`, logged and audited
+            // per channel, and memory itself is unaffected.
+            "canvases:write",
+            // The side panel (OPE-2457): Slack requires it for `app_context_changed`, the event whose
+            // subscription makes Slack attach the viewed room to each side-panel `message.im`.
+            "assistant:write",
+            // Slack requires this bot scope on an app whose people connect to Slack's MCP server
+            // (OPE-2421). Declared only when the app declares "search Slack as you".
+            ...(personalMcp ? [SLACK_MCP_BOT_SCOPE] : []),
           ],
+          // The USER scopes a person consents to for "search Slack as you" (OPE-2421). The install
+          // asks for none of them: `/setup` requests bot scopes only, and each person grants these for
+          // themselves, in the moment, through Slack's user-only consent.
+          ...(personalMcp ? { user: [...slackAsYouUserScopes()] } : {}),
         },
       },
       settings: {
@@ -198,6 +267,10 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           //   message.mpim → mpim:history (group DMs; without it only an @mention there is heard)
           //   member_joined_channel → channels:read, groups:read, mpim:read (the channel-join intro)
           //   reaction_added, reaction_removed → reactions:read (reaction feedback)
+          //   app_home_opened → no scope (the Home tab page, OPE-2451)
+          //   channel_shared → channels:read, groups:read (re-run the memory canvas gate, OPE-2451)
+          //   user_change → users:read (automatic offboarding on a deactivated member, OPE-2423)
+          //   app_context_changed → assistant:write (the side panel's viewed room, OPE-2457)
           // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
           // this list drops one (OPE-2223).
           bot_events: [
@@ -209,6 +282,10 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "member_joined_channel",
             "reaction_added",
             "reaction_removed",
+            "app_home_opened",
+            "channel_shared",
+            "user_change",
+            "app_context_changed",
           ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every

package/agent/channels/slack-events.ts

@@ -17,6 +17,7 @@
 // envelope reaches `routeMessageEvent`. Until then this is unit-tested but unmounted.
 
 import { slackContinuationToken } from "eve/channels/slack";
+import { parseSlackAppContext, type SlackAppContextRoom } from "./slack-side-panel.js";
 import { callSlackWebApi } from "./slack-web-api.js";
 import { slackBotToken } from "../setup/credentials.js";
 import { RateLimitExhaustedError } from "@open-everywhere/core/agent/adapter-api.js";
@@ -265,6 +266,10 @@ export interface ParsedMessageEvent {
    *  the wake envelope so the agent knows an image exists and can `describe_image` it. Empty/
    *  absent when the message carries no files. Never the bytes — just id/name/mimetype/url. */
   readonly attachments?: readonly WakeAttachment[];
+  /** The room the person was viewing in the side panel (OPE-2457), from the event's `app_context`.
+   *  UNVERIFIED — slack-side-panel.ts `sidePanelViewedRoom` gates it before any use. Absent on every
+   *  event that carries no channel entity, which is every non-panel message. */
+  readonly appContext?: SlackAppContextRoom;
 }
 
 /** Parse Slack's `files[]` (on a message event's inner message) into attachment references.
@@ -710,6 +715,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   const teamId = envelope.team_id ?? (typeof e.team === "string" ? e.team : undefined);
   const enterpriseId = slackEnterpriseIdFromEnvelope(envelope);
   const attachments = parseSlackFiles(inner.files);
+  const appContext = parseSlackAppContext(e);
   // TRUSTED PROVENANCE: record each IMAGE attachment's url_private under its Slack file id so
   // describe_image's `attachmentId` path (via the attachment plane's Slack resolver) can resolve the
   // model-named id → this event's url_private and fetch it with the bot token
@@ -738,6 +744,8 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
     // Image/file attachments (docs Part B) — read off the same inner message the text came
     // from (so an edit's post-edit files win). Absent for the common no-file message.
     attachments,
+    // The side panel's viewed room (OPE-2457) rides the OUTER event, never an edit's inner message.
+    ...(appContext === undefined ? {} : { appContext }),
   };
 }
 
@@ -1058,6 +1066,10 @@ export interface SlackWakeOpts {
    *  (channels/seat-catch-up.ts `catchUpUnavailableReason`). Rendered as a trusted `<system-note>`;
    *  unset ⇒ no note, which is every Slack wake, because Slack registers a fetch. */
   readonly catchUpUnavailable?: string;
+  /** OE's own trusted note for this wake (`<system-note>`): fixed words around host-checked ids only.
+   *  Set by the DM door alone — the side panel's viewed room and the person's opt-out
+   *  (slack-side-panel.ts `slackDmSystemNote`). Unset ⇒ no note, byte-identical to before. */
+  readonly systemNote?: string;
   /**
    * THE NAME-DROP HYDRATION, ON THE SEAT ROAD (OPE-1725). The surrounding conversation
    * {@link routeNameDropEvent} fetches for a name-drop, as RAW {@link ContextLine}s — renderWake
@@ -1142,6 +1154,7 @@ function slackJudgedWake(
     ...(addressing === "name-drop" ? { nameDrop: { followUp: "follows-on-reply" as const } } : {}),
     // The catch-up bound, stated on the wake that could not take one ({@link SlackWakeOpts.catchUpUnavailable}).
     ...(opts.catchUpUnavailable !== undefined ? { catchUpUnavailable: opts.catchUpUnavailable } : {}),
+    ...(opts.systemNote !== undefined ? { systemNote: opts.systemNote } : {}),
     // The name-drop hydration's side-channel slot ({@link SlackWakeOpts.contextLines}). Spread
     // conditionally so a wake that states none carries no key at all — the shape every
     // characterization golden was taken against.
@@ -2762,6 +2775,18 @@ export async function confirmChannelInternal(channelId: string): Promise<boolean
   return (await channelInternalAndMeta(channelId)).internal;
 }
 
+/**
+ * {@link confirmChannelInternal} read FRESH: the cached verdict is dropped first, so the answer is
+ * today's `conversations.info`, and the cache is refilled with it. For the one consumer that must not
+ * act on a verdict up to a TTL old — the domain memory canvas (slack-memory-canvas.ts, OPE-2451),
+ * which decides whether every line of a domain's memory stays on screen in this channel. A wake keeps
+ * the cached read; the canvas is written rarely enough to pay for one call.
+ */
+export async function confirmChannelInternalFresh(channelId: string): Promise<boolean> {
+  channelTrustCache.delete(channelId);
+  return (await channelInternalAndMeta(channelId)).internal;
+}
+
 /**
  * Positively confirm a channel is internal (fail-closed, same TTL-cached
  * conversations.info as {@link confirmChannelInternal}) AND surface its member count —

package/agent/channels/slack-front.ts

@@ -39,6 +39,8 @@
 //      commands) still forwards exactly as before.
 //   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
 
+import { parseSlackUserDeactivation, routeSlackUserDeactivation, type SlackUserDeactivation } from "./slack-offboarding.js";
+import type { OffboardOutcome } from "@open-everywhere/core/agent/adapter-api.js";
 import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
 import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
 import { slackSigningSecret } from "../setup/credentials.js";
@@ -118,7 +120,13 @@ import {
   tailAuthorGrain,
   dmWindowRegistryKey,
   stampSurfaceEventVerified,
+  readPersonOptOut,
+  auditPersonOptOutRefusal,
+  PERSON_OPT_OUT_SHORTCUT_NOTICE,
+  PERSON_OPT_OUT_UNREADABLE_NOTICE,
+  type PersonOptOutState,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { sidePanelViewedRoom, slackDmSystemNote } from "./slack-side-panel.js";
 import {
   renderWakeMessage,
   slackChannelFactsFor,
@@ -129,10 +137,24 @@ import {
   applySlackExternalPolicy,
   stripUnfencedSlackAttachments,
   slackEnterpriseIdFromEnvelope,
+  slackForm,
   _resetAuthorMemberCache,
 } from "./slack-events.js";
 import { buildSlackAuth, withForwardedSlackEnvelope, type ForwardedSlackEnvelope } from "./slack-identity.js";
 import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { liveMemoryCanvasDeps, recheckChannelCanvas } from "./slack-memory-canvas.js";
+import {
+  handleHomeClick,
+  handleHomeOpened,
+  handleHomeSubmission,
+  liveSlackHomeDeps,
+  parseHomeClick,
+  parseHomeOpened,
+  parseHomeSubmission,
+  type ParsedHomeClick,
+  type ParsedHomeOpen,
+  type ParsedHomeSubmission,
+} from "./slack-home.js";
 import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
 import {
   parseSlackShortcutPayload,
@@ -158,6 +180,9 @@ export type FrontDecision =
   | { readonly kind: "forward"; readonly reason: string }
   | { readonly kind: "wake"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "join"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** OPE-2423 — a `user_change` event. Ours: a `deleted` user is a deactivation report for core's
+   *  offboarding lever (slack-offboarding.ts); every other profile edit is acked with no work. */
+  | { readonly kind: "user-change"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "reaction"; readonly reason: string; readonly env: SlackEventEnvelope }
   | { readonly kind: "approval-click"; readonly reason: string; readonly payload: unknown }
   /** A "Set API key" button click (credentials/intake.ts) — ours: verify the clicker is the intake's
@@ -191,7 +216,19 @@ export type FrontDecision =
    *  a forward is a guaranteed no-op, and eve's shortcut context carries no session to wake from
    *  anyway. The decoded shortcut rides along so the handler needn't re-parse it — same pattern as
    *  the click branches, which carry a raw `payload` because their handlers own the decode. */
-  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut };
+  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut }
+  /** A `channel_shared` (the channel became Slack Connect shared) — ours: re-run the memory canvas gate
+   *  on that channel, which clears the app's canvas when the channel no longer passes (OPE-2451). */
+  | { readonly kind: "channel-shared"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** An `app_home_opened` for the HOME tab (OPE-2451) — ours: publish the person's own page. */
+  | { readonly kind: "home-open"; readonly reason: string; readonly open: ParsedHomeOpen }
+  /** An `oe_home:` click on the Home tab (OPE-2451) — ours: run a button, or open an item's modal. */
+  | { readonly kind: "home-click"; readonly reason: string; readonly click: ParsedHomeClick }
+  /** A submission of the Home tab's own modal (OPE-2451) — ours: run the action, republish the page. */
+  | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission }
+  /** An `app_context_changed` (OPE-2457) — ours, and nothing to do. The subscription exists only so
+   *  Slack attaches the viewed room to each side-panel `message.im`; the change itself wakes nothing. */
+  | { readonly kind: "context-change"; readonly reason: string };
 
 /**
  * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
@@ -365,6 +402,17 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     if (grantClick !== undefined) {
       return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
     }
+    // THE HOME TAB (OPE-2451). Its clicks carry an `oe_home:` action id and its one modal a callback
+    // id of its own, so neither can be mistaken for another door's payload, nor for eve's.
+    const homePayload = decodeInteractivityPayload(rawBody);
+    const homeClick = parseHomeClick(homePayload);
+    if (homeClick !== undefined) {
+      return { kind: "home-click", reason: `block_actions oe_home: ${homeClick.action} — ours, never forwarded`, click: homeClick };
+    }
+    const homeSubmission = parseHomeSubmission(homePayload);
+    if (homeSubmission !== undefined) {
+      return { kind: "home-submit", reason: `view_submission for the Home tab modal (${homeSubmission.action}) — ours, never forwarded`, submission: homeSubmission };
+    }
     // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
     // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
     // matched LAST among the urlencoded branches and cannot race any of them: every branch above
@@ -397,6 +445,27 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
   if (eventType === "member_joined_channel") {
     return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
   }
+  if (eventType === "channel_shared") {
+    return { kind: "channel-shared", reason: "channel_shared — recheck the domain memory canvas", env };
+  }
+  if (eventType === "app_home_opened") {
+    // Only the HOME tab is ours (OPE-2451). The same event fires for the Messages tab, which has no
+    // page to publish, so that one forwards — eve acknowledges an event it has no handler for.
+    const open = parseHomeOpened(env);
+    if (open) return { kind: "home-open", reason: "app_home_opened (home tab) — publish the person's page", open };
+    return { kind: "forward", reason: "app_home_opened for a tab other than home — nothing to publish" };
+  }
+  if (eventType === "app_context_changed") {
+    // THE SIDE PANEL (OPE-2457). Slack fires this each time the person moves the panel to another
+    // room. The room that matters arrives on the `message.im` they then send (`app_context`), so a
+    // change alone wakes nothing — but it is acknowledged HERE rather than forwarded, because a
+    // forward costs eve a parse and a re-verify for every click the person makes in Slack.
+    return { kind: "context-change", reason: "app_context_changed — the room rides the next side-panel message; nothing to wake" };
+  }
+  if (eventType === "user_change") {
+    // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
+    return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
+  }
   if (eventType === "reaction_added" || eventType === "reaction_removed") {
     // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
     // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
@@ -553,10 +622,21 @@ export interface FrontOptions {
    *  re-verifies standing host-side, then mints an ephemeral OAuth URL / opens the api-key intake.
    *  Injectable for tests. */
   readonly handleConnectClick?: (payload: unknown) => Promise<boolean>;
+  /** OPE-2423 — hand one deactivation report to core's offboarding lever. Defaults to
+   *  {@link routeSlackUserDeactivation} with a live `users.info` re-read. Injectable for tests. */
+  readonly routeUserDeactivation?: (d: SlackUserDeactivation) => Promise<OffboardOutcome>;
   /** Injected in tests; the live default is core's `handleGrantCardClick`. The signed grant-click
    *  branch schedules it through the route's `waitUntil`, so this handler may outlive the empty
    *  Slack acknowledgement. */
   readonly handleGrantCardClick?: (payload: unknown) => Promise<boolean>;
+  /** The three Home-tab handlers (OPE-2451). Injected in tests; the live defaults are slack-home.ts's,
+   *  over the live Slack deps. Each runs after the empty acknowledgement, through `waitUntil`. */
+  readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
+  readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
+  readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+  /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
+   *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
+  readonly recheckChannelCanvas?: (input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => Promise<unknown>;
   /** SINGLE-WINDOW mention policy for one (channel, surface) — should the unified window own an
    *  @mention here (suppress the native forward + keep the sibling as an addressed wake)?
    *  Defaults to the live {@link slackSingleWindowMentionPolicy} (grain + fail-closed
@@ -603,6 +683,13 @@ export interface FrontOptions {
    *  governance DM-delivery arm. Defaults to the live call; FAIL-CLOSED: undefined ⇒ the shortcut
    *  wakes nothing and says so, never a wake in a guessed room. Injectable for tests. */
   readonly openDirectMessageChannel?: (userId: string) => Promise<string | undefined>;
+  /** The person opt-out read (OPE-2436): may the agent act on this person's content? Defaults to
+   *  core's `readPersonOptOut`, which is fail-CLOSED (an unreadable store reads as opted out).
+   *  Injectable for tests. */
+  readonly personOptOutFor?: (org: string, principalId: string) => Promise<PersonOptOutState>;
+  /** Tell one person, privately in their own DM, why a shortcut they pressed did nothing (OPE-2436).
+   *  Best-effort. Defaults to `conversations.open` + `chat.postMessage`. Injectable for tests. */
+  readonly postPrivateNotice?: (userId: string, text: string) => Promise<void>;
   /** The trigger author's two membership facts, from ONE `users.info` probe — the exact pair every
    *  wake route in slack-events.ts resolves. Two readers: the native `app_mention` forward's
    *  external-policy gate, which calls it only when that policy is not inert (so a deployment on the
@@ -991,11 +1078,24 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
   const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
   const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+  const routeUserDeactivation =
+    opts.routeUserDeactivation ?? ((d: SlackUserDeactivation) => routeSlackUserDeactivation(d, { usersInfo: (userId) => slackForm("users.info", `user=${encodeURIComponent(userId)}`) }));
   const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+  const homeOpened = opts.handleHomeOpened ?? ((open: ParsedHomeOpen) => handleHomeOpened(open, liveSlackHomeDeps()));
+  const homeClicked = opts.handleHomeClick ?? ((click: ParsedHomeClick) => handleHomeClick(click, liveSlackHomeDeps()));
+  const recheckCanvas = opts.recheckChannelCanvas ?? ((input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
+  const homeSubmitted = opts.handleHomeSubmission ?? ((submission: ParsedHomeSubmission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
   const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
   const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
   const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
   const openDirectMessageChannel = opts.openDirectMessageChannel ?? liveOpenDirectMessageChannel;
+  const personOptOutFor = opts.personOptOutFor ?? readPersonOptOut;
+  const postPrivateNotice =
+    opts.postPrivateNotice ??
+    (async (userId: string, text: string) => {
+      const dm = await openDirectMessageChannel(userId);
+      if (dm) await slackForm("chat.postMessage", new URLSearchParams({ channel: dm, text }).toString());
+    });
   const resolveDmSeat = opts.resolveDmSeat ?? ((org, dm, atIso) => liveGetOrCreateDmSeat(org, dm, atIso));
   const touchDmSeatFn = opts.touchDmSeatFn ?? liveTouchDmSeat;
   const dmPartnerTrustFor = opts.dmPartnerTrustFor ?? liveDmPartnerTrust;
@@ -1502,9 +1602,25 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // by design (the seat is one long-lived session over the whole DM, so replaying history a live
       // session already holds would duplicate it) — the tail is exactly the case that reasoning does
       // not cover, because a rotation is when the session stops holding it.
+      // THE SIDE PANEL (OPE-2457) AND THE PERSON OPT-OUT (OPE-2436) — two host facts for a 1:1 DM, in
+      // one trusted note. The viewed room passes every strictest-default gate first
+      // (slack-side-panel.ts); the opt-out tells the seat not to promise memory the write road will
+      // refuse anyway. A group DM states neither: it has no single person, and no panel.
+      const systemNote = isGroup
+        ? undefined
+        : slackDmSystemNote({
+            viewedRoom: await sidePanelViewedRoom({
+              room: ev.appContext,
+              teamId: ev.teamId,
+              partnerTrust,
+              channelInternal: async (id) => (await channelFactsFor(id)).internal === true,
+            }),
+            personOptOut: ev.userId ? await personOptOutFor(p.org, ev.userId) : undefined,
+          });
       const message = renderWakeMessage(ev, () => atIso, {
         dm: true,
         trust: wakeTrust,
+        ...(systemNote === undefined ? {} : { systemNote }),
         // The FENCE BACKSTOP for the whole DM family (OPE-1486) — the SAME refutation the taint stamp
         // and the policy gate read, so the three cannot disagree about one author. On a 1:1 it is a
         // no-op in practice (a refuted partner is already `unauth`, and `unauth` is already fenced);
@@ -1842,6 +1958,32 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // Keyed on the click, not the message — a person may invoke the same shortcut on the same
       // message twice on purpose, and only Slack's redelivery of ONE click is a duplicate.
       if (!(await notYetSeenKey(shortcutWakeKey(sc), sev))) return new Response(null, { status: 200 });
+      // 🔴 THE PERSON OPT-OUT (OPE-2436). A message shortcut hands the agent somebody's message to act
+      // on — summarise it, answer it, file it. When the message's AUTHOR opted out of agent actions on
+      // their content and somebody ELSE pressed the button, nothing wakes: one refusal row, and a
+      // private line to the person who pressed it. The author's own shortcut on their own message is
+      // their own request, so it wakes as before. The read is fail-closed (core `readPersonOptOut`).
+      const shortcutAuthor = sc.kind === "message" ? sc.message?.userId : undefined;
+      if (shortcutAuthor && shortcutAuthor !== sc.userId) {
+        const p = resolvePartition(bindableFor(sev));
+        const authorOptOut = await personOptOutFor(p.org, shortcutAuthor);
+        if (authorOptOut.optedOut) {
+          console.log(`[open-everywhere:slack-front] message shortcut "${sc.callbackId}" in ${shortcutChannelId}: refused — the message's author opted out`);
+          args.waitUntil(
+            Promise.allSettled([
+              auditPersonOptOutRefusal(
+                { org: p.org, platform: p.platform, workspace: p.workspace, surface: p.surface, principalKey: shortcutAuthor },
+                "message-shortcut",
+                { requestedBy: sc.userId, storeReadable: authorOptOut.readable },
+              ),
+              // An unreadable store is the fail-closed GUESS, never the author's decision, so the presser
+              // is not told the author asked for anything.
+              postPrivateNotice(sc.userId, authorOptOut.readable ? PERSON_OPT_OUT_SHORTCUT_NOTICE : PERSON_OPT_OUT_UNREADABLE_NOTICE),
+            ]),
+          );
+          return new Response(null, { status: 200 });
+        }
+      }
       // BOTH halves of the attachment registry, seeded ONLY on a click that reaches a DISPATCHER —
       // the in-memory one for this process's seat, the durable one for a delegated worker in
       // another. (A dispatcher can still refuse further down, as `routeSupervisorEvent`'s own
@@ -2098,6 +2240,35 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return new Response(null, { status: 200 });
     }
 
+    if (decision.kind === "home-open" || decision.kind === "home-click" || decision.kind === "home-submit") {
+      // THE HOME TAB (OPE-2451). THE TENANT FENCE FIRST (OPE-1680), for the reason the approval branch
+      // states: the page reads and changes a person's memory, keyed to a bare per-workspace member id,
+      // so an unadmitted workspace reaching it is a foreign tenant reading our store.
+      const ids = decision.kind === "home-open" ? decision.open : decision.kind === "home-click" ? decision.click : decision.submission;
+      const fenceIds = {
+        ...(ids.teamId === undefined ? {} : { teamId: ids.teamId }),
+        ...(ids.enterpriseId === undefined ? {} : { enterpriseId: ids.enterpriseId }),
+        userId: ids.userId,
+      };
+      if (slackInteractivityTenantFenceDeclined(fenceIds, decision.kind, decision.kind === "home-open" ? "front-home-event-branch" : "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // ACK FIRST, WORK AFTER. Building the page reads memory and asks Slack who the person is and
+      // which channels they sit in, which can cross Slack's three-second budget. An empty 200 also
+      // CLOSES a submitted modal, which is what the person expects after Save or Forget; the page
+      // they return to is republished with a one-line notice saying what happened.
+      const run =
+        decision.kind === "home-open" ? homeOpened(decision.open) : decision.kind === "home-click" ? homeClicked(decision.click) : homeSubmitted(decision.submission);
+      args.waitUntil(
+        run
+          .then((handled) => {
+            if (!handled) console.log(`[open-everywhere:slack-front] ${decision.kind} for ${ids.userId} did not complete`);
+          })
+          .catch(() => console.warn(`[open-everywhere:slack-front] ${decision.kind} failed after acknowledgement`)),
+      );
+      return new Response(null, { status: 200 });
+    }
+
     if (decision.kind === "setkey-submit") {
       // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
       // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
@@ -2120,6 +2291,43 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return forwardNative();
     }
 
+    if (decision.kind === "channel-shared") {
+      // THE CHANNEL WAS SHARED (OPE-2451): re-run the memory canvas gate at once, which clears the app's
+      // own canvas there. The canvas reads the room verdict fresh, so the wake path's cached "internal"
+      // cannot carry a pre-share answer into this decision.
+      const ev = decision.env.event as Record<string, unknown> | undefined;
+      const channelId = typeof ev?.channel === "string" ? ev.channel : undefined;
+      const teamId = typeof decision.env.team_id === "string" ? decision.env.team_id : undefined;
+      if (!channelId || !teamId) return OK();
+      const sharedEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+      if (
+        slackInteractivityTenantFenceDeclined(
+          { teamId, ...(sharedEnterpriseId === undefined ? {} : { enterpriseId: sharedEnterpriseId }), channelId },
+          "channel-shared",
+          "front-channel-shared-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      let sharedOrg: string | undefined;
+      try {
+        sharedOrg = resolvePartition({
+          channel: { kind: "slack" },
+          session: { auth: { current: { attributes: { team_id: teamId, channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+        } as Parameters<typeof resolvePartition>[0]).org;
+      } catch {
+        sharedOrg = undefined;
+      }
+      if (sharedOrg !== undefined) {
+        args.waitUntil(
+          recheckCanvas({ org: sharedOrg, teamId, channelId, trigger: "channel-shared" }).catch(() =>
+            console.warn("[open-everywhere:slack-front] memory canvas recheck after a share failed"),
+          ),
+        );
+      }
+      return OK();
+    }
+
     if (decision.kind === "join") {
       // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
       // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
@@ -2129,7 +2337,38 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       const jev = parseChannelJoinEvent(decision.env);
       if (!jev) return OK();
       const { userId: joinBotUserId } = await getBotIdentity();
-      if (!joinBotUserId || jev.userId !== joinBotUserId) return OK();
+      if (!joinBotUserId || jev.userId !== joinBotUserId) {
+        // A PERSON JOINED (OPE-2451). No intro, but the domain memory canvas re-runs its gate: the
+        // newcomer may be a guest, and a canvas written before they joined would show them every line
+        // of the domain's memory. The recheck can only CLEAR the app's own canvas, never write memory,
+        // so an unresolved bot identity rechecks too. Fenced like every other door: a foreign tenant
+        // never reaches this deployment's Slack calls.
+        if (jev.teamId === undefined) return OK();
+        if (
+          slackInteractivityTenantFenceDeclined(
+            { teamId: jev.teamId, ...(jev.enterpriseId === undefined ? {} : { enterpriseId: jev.enterpriseId }), channelId: jev.channelId, userId: jev.userId },
+            "member-joined",
+            "front-join-branch",
+          )
+        ) {
+          return fencedAck(OK());
+        }
+        let joinOrg: string | undefined;
+        try {
+          joinOrg = resolvePartition(bindableForJoin(jev)).org;
+        } catch {
+          joinOrg = undefined;
+        }
+        if (joinOrg !== undefined) {
+          const teamId = jev.teamId;
+          args.waitUntil(
+            recheckCanvas({ org: joinOrg, teamId, channelId: jev.channelId, trigger: "member-joined", joinedUserId: jev.userId }).catch(() =>
+              console.warn("[open-everywhere:slack-front] memory canvas recheck after a join failed"),
+            ),
+          );
+        }
+        return OK();
+      }
 
       // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
       // double intro is exactly the annoyance the durable half exists to prevent.
@@ -2152,6 +2391,40 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return OK();
     }
 
+    if (decision.kind === "context-change") return OK();
+
+    if (decision.kind === "user-change") {
+      // AUTOMATIC OFFBOARDING (OPE-2423). The signature above has authenticated the envelope, so its
+      // `team_id` is the workspace that delivered this report. Every other decision — the
+      // same-workspace gate, the tenant fence, the live users.info re-read, the terminal revoke and
+      // its audit row — runs in core's offboardDeactivatedAccount, AFTER the ack: Slack wants a quick
+      // 200, and a revoke is idempotent, so a Slack retry that races it changes nothing.
+      const deactivation = parseSlackUserDeactivation(decision.env);
+      if (!deactivation) return OK();
+      // THE TENANT FENCE (OPE-1680), the same front-door refusal every other deciding branch takes.
+      // Core's gate 2 ALSO requires a positive admission, because this fence is inert when config
+      // declares no tenant — and a terminal revoke must not run on an inert answer.
+      if (
+        slackInteractivityTenantFenceDeclined(
+          {
+            teamId: deactivation.deliveringTeamId,
+            ...(deactivation.enterpriseId === undefined ? {} : { enterpriseId: deactivation.enterpriseId }),
+            userId: deactivation.userId,
+          },
+          "user-change",
+          "front-user-change-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      args.waitUntil(
+        routeUserDeactivation(deactivation).then((outcome) =>
+          console.log(`[open-everywhere:slack-front] user_change ${deactivation.userId}: offboarding ${outcome.kind}${outcome.kind === "refused" ? ` (${outcome.reason})` : ""}`),
+        ),
+      );
+      return OK();
+    }
+
     if (decision.kind === "reaction") {
       // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
       const rev = parseSlackReactionEvent(decision.env);