@open-everywhere/provider-slack 0.7.0 → 0.8.0

package/agent/channels/slack-reply-blocks.ts

@@ -0,0 +1,180 @@
+// slack-reply-blocks — the Block Kit shape of an agent's ANSWER on Slack (OPE-2520): the answer's text,
+// its numbered source links, Slack's native thumbs up / down, and the suggested follow-ups (OPE-2516).
+//
+// A reply used to post `text` alone. An answer now also carries two blocks Slack draws natively:
+//   • a `context` block with the numbered source links — `[1] Launch checklist · [2] OPE-42 Fix login`,
+//     the link on each title. Only present when the reply choke point decided links may show (a 1:1 DM,
+//     the reach rule held — `reply-provenance.ts`).
+//   • a `context_actions` block holding one `feedback_buttons` element — Slack's own thumbs up / down
+//     for an AI app's message. A click arrives at the interactivity URL as a `block_actions` payload
+//     with the action id {@link SLACK_FEEDBACK_ACTION_ID}, and `slack-front.ts` records it.
+//
+//   • an `actions` block with up to three suggested FOLLOW-UPS (OPE-2516) — one button each, labelled
+//     with the whole text a press sends. A press arrives as a `block_actions` payload whose action id
+//     starts {@link SLACK_FOLLOW_UP_ACTION_PREFIX}, and `slack-follow-ups.ts` turns it into the
+//     person's next message. Only present when the choke point decided they may show (a 1:1 DM).
+//
+// 🔴 ONCE `blocks` IS PRESENT, SLACK SHOWS THE BLOCKS AND NOT `text`. `text` becomes the notification
+// fallback only. So the answer itself must ride the blocks too, as `section` blocks — and a section
+// holds at most 3000 characters, so a long answer is cut into several. A cut never splits a code fence
+// open: a chunk that ends inside a ``` fence closes it, and the next chunk opens it again.
+//
+// 🔴 A REFUSED BLOCK MUST NEVER COST THE ANSWER. The arm retries a post Slack refused for its blocks
+// (`invalid_blocks`) once without them, so a workspace that rejects a block shows the plain answer.
+
+import type { PostIntent, SourceLink } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** The action id of the native thumbs control. Exact, never a prefix: no other door uses it. */
+export const SLACK_FEEDBACK_ACTION_ID = "oe_feedback";
+
+/** The two button values, which ARE the rating a click records. */
+export const SLACK_FEEDBACK_VALUE_UP = "up";
+export const SLACK_FEEDBACK_VALUE_DOWN = "down";
+
+/** The action id prefix of a follow-up button: `oe_followup:<n>`. No other door uses it. */
+export const SLACK_FOLLOW_UP_ACTION_PREFIX = "oe_followup:";
+
+/** The block id of the follow-up row, so a press can find and remove it (`slack-follow-ups.ts`). */
+export const SLACK_FOLLOW_UP_BLOCK_ID = "oe_followups";
+
+/** A control (`Cc`) or format (`Cf`) character: it draws nothing on a button. The follow-up row and
+ *  the press parse (`slack-follow-ups.ts`) both refuse a text that holds one. */
+export const SLACK_INVISIBLE_CHARACTER = /[\p{Cc}\p{Cf}]/u;
+
+/** Slack's cap on a button label, which is also the core cap on a follow-up's length. */
+const BUTTON_TEXT_MAX = 75;
+
+/** Slack's cap on one section block's text. */
+const SECTION_TEXT_MAX = 3000;
+
+/** Slack's cap on blocks in one message. */
+const MAX_BLOCKS = 50;
+
+/** Escape the three characters Slack's mrkdwn reads as control characters, for a host-written label. */
+function escapeMrkdwn(text: string): string {
+  return text.replace(/&/gu, "&amp;").replace(/</gu, "&lt;").replace(/>/gu, "&gt;");
+}
+
+/**
+ * Cut mrkdwn into section-sized chunks at line ends. A line longer than a chunk is cut by code point.
+ * A chunk that ends inside a ``` fence closes it, and the next chunk reopens it, so each chunk renders
+ * on its own. Exported for the unit test.
+ */
+export function chunkSlackSectionText(text: string, max: number = SECTION_TEXT_MAX): string[] {
+  const fence = "```";
+  const reopen = `${fence}\n`;
+  // Room for the closing fence a chunk may need, and the opening fence the next chunk then carries.
+  const budget = max - 2 * reopen.length;
+  const chunks: string[] = [];
+  let cur = "";
+  // True while the text placed so far stands inside an open ``` fence.
+  let open = false;
+  const push = (): void => {
+    chunks.push(open ? `${cur}\n${fence}` : cur);
+    cur = open ? reopen : "";
+  };
+  for (const line of text.split("\n")) {
+    let rest = line;
+    for (;;) {
+      const sep = cur.length === 0 || cur === reopen ? "" : "\n";
+      if (cur.length + sep.length + rest.length <= budget) {
+        cur += sep + rest;
+        break;
+      }
+      if (sep.length > 0) {
+        push();
+        continue;
+      }
+      // The line alone does not fit an empty chunk: cut it by code point, never inside a character.
+      const cps = Array.from(rest);
+      const room = budget - cur.length;
+      cur += cps.slice(0, room).join("");
+      rest = cps.slice(room).join("");
+      push();
+    }
+    // An odd count of fences on the line opens or closes a fence.
+    if ((line.split(fence).length - 1) % 2 === 1) open = !open;
+  }
+  if (cur.length > 0 && cur !== reopen) chunks.push(cur);
+  return chunks;
+}
+
+/** The numbered source links as ONE line of mrkdwn: `*Sources:*  [1] <url|title> · [2] <url|title>`. */
+export function slackSourcesLine(sources: readonly SourceLink[]): string {
+  const items = sources.map((s, i) => `[${i + 1}] <${s.url}|${escapeMrkdwn(s.name)}>`);
+  return `*Sources:*  ${items.join("  ·  ")}`;
+}
+
+/** Slack's native thumbs up / down, as one `context_actions` block. */
+function slackFeedbackBlock(): Record<string, unknown> {
+  return {
+    type: "context_actions",
+    elements: [
+      {
+        type: "feedback_buttons",
+        action_id: SLACK_FEEDBACK_ACTION_ID,
+        positive_button: {
+          text: { type: "plain_text", text: "Good response" },
+          accessibility_label: "Mark this response as good",
+          value: SLACK_FEEDBACK_VALUE_UP,
+        },
+        negative_button: {
+          text: { type: "plain_text", text: "Bad response" },
+          accessibility_label: "Mark this response as bad",
+          value: SLACK_FEEDBACK_VALUE_DOWN,
+        },
+      },
+    ],
+  };
+}
+
+/**
+ * The suggested follow-ups as one `actions` block: one button per item, its label the whole text and
+ * its value the same text. An item over Slack's label cap, or holding an invisible character, is
+ * dropped here too: the friendly pass runs after core's check, and a resolved name can lengthen a label
+ * or bring a joiner back in an emoji. Over the cap, Slack would refuse the block and cost the thumbs as
+ * well. With an invisible character, the press parse would refuse the press, so the button would do
+ * nothing.
+ */
+function slackFollowUpsBlock(followUps: readonly string[]): Record<string, unknown> | undefined {
+  const fit = followUps.filter((f) => f.length > 0 && Array.from(f).length <= BUTTON_TEXT_MAX && !SLACK_INVISIBLE_CHARACTER.test(f));
+  if (fit.length === 0) return undefined;
+  return {
+    type: "actions",
+    block_id: SLACK_FOLLOW_UP_BLOCK_ID,
+    elements: fit.map((text, i) => ({
+      type: "button",
+      action_id: `${SLACK_FOLLOW_UP_ACTION_PREFIX}${i}`,
+      text: { type: "plain_text", text, emoji: true },
+      value: text,
+    })),
+  };
+}
+
+/**
+ * The blocks for one answer, or `undefined` when the intent asks for no links, no thumbs and no follow-ups — the
+ * post then sends `text` alone, as before OPE-2520. `mrkdwn` is the already-converted answer text.
+ */
+export function slackReplyBlocks(mrkdwn: string, intent: PostIntent | undefined): Record<string, unknown>[] | undefined {
+  const sources = intent?.sources ?? [];
+  const feedback = intent?.feedback === true;
+  const followUps = slackFollowUpsBlock(intent?.followUps ?? []);
+  if (sources.length === 0 && !feedback && followUps === undefined) return undefined;
+  const blocks: Record<string, unknown>[] = [];
+  for (const chunk of chunkSlackSectionText(mrkdwn)) {
+    if (chunk.trim().length === 0) continue;
+    blocks.push({ type: "section", text: { type: "mrkdwn", text: chunk } });
+  }
+  if (sources.length > 0) blocks.push({ type: "context", elements: [{ type: "mrkdwn", text: slackSourcesLine(sources) }] });
+  if (feedback) blocks.push(slackFeedbackBlock());
+  // The next steps sit last, under the answer and its thumbs.
+  if (followUps !== undefined) blocks.push(followUps);
+  // An answer too long for Slack's block cap posts as text alone: the answer matters more than the extras.
+  return blocks.length > MAX_BLOCKS ? undefined : blocks;
+}
+
+/** True when a Slack error names the blocks as the reason it refused the post. */
+export function isSlackBlocksRefusal(err: unknown): boolean {
+  const message = err instanceof Error ? err.message : String(err);
+  return /invalid_blocks|invalid_attachments|invalid_blocks_format|msg_blocks_too_long/u.test(message);
+}

package/agent/channels/slack-reply-feedback.ts

@@ -0,0 +1,75 @@
+// slack-reply-feedback — a click on Slack's native thumbs up / down under an agent answer (OPE-2520).
+//
+// The answer carries one `feedback_buttons` element (slack-reply-blocks.ts). Slack sends a click to the
+// app's interactivity URL as a signed `block_actions` payload whose action id is exactly
+// `oe_feedback` and whose value is `up` or `down`. The front route classifies it (`slack-front.ts`,
+// FrontDecision `feedback-click`), runs the tenant fence, acknowledges with an empty 200, and hands it
+// here. This module turns it into core's surface-neutral click and writes the `reply.feedback` row.
+//
+// 🔴 ONLY OUR OWN MESSAGES CARRY THE BUTTON. Slack sends a `block_actions` payload only for a block the
+// app itself posted, so a click always rates one of this app's messages: no bot-author check is needed,
+// unlike the reaction road, where a 👍 can land on anyone's message.
+
+import { recordReplyFeedback, resolvePartition, type ReplyFeedbackClick, type ReplyFeedbackRating } from "@open-everywhere/core/agent/adapter-api.js";
+import { bindableForSlackIds } from "./slack-events.js";
+import { SLACK_FEEDBACK_ACTION_ID, SLACK_FEEDBACK_VALUE_DOWN, SLACK_FEEDBACK_VALUE_UP } from "./slack-reply-blocks.js";
+
+/** One parsed click on the native thumbs control. IDS ONLY. */
+export interface ParsedSlackFeedbackClick {
+  readonly rating: ReplyFeedbackRating;
+  readonly userId: string;
+  readonly channelId: string;
+  readonly messageTs: string;
+  readonly teamId?: string;
+}
+
+const obj = (v: unknown): Record<string, unknown> | undefined => (typeof v === "object" && v !== null ? (v as Record<string, unknown>) : undefined);
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+
+/**
+ * Parse a decoded interactivity payload into a thumbs click, or `undefined` when it is not one: not a
+ * `block_actions`, no `oe_feedback` action, a value other than `up`/`down`, or a missing user, channel
+ * or message. Pure and total: it never throws.
+ */
+export function parseSlackFeedbackClick(payload: unknown): ParsedSlackFeedbackClick | undefined {
+  const p = obj(payload);
+  if (p?.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const action = (p.actions as unknown[]).map(obj).find((a) => a?.action_id === SLACK_FEEDBACK_ACTION_ID);
+  if (action === undefined) return undefined;
+  const value = str(action.value);
+  const rating: ReplyFeedbackRating | undefined = value === SLACK_FEEDBACK_VALUE_UP ? "up" : value === SLACK_FEEDBACK_VALUE_DOWN ? "down" : undefined;
+  if (rating === undefined) return undefined;
+  const userId = str(obj(p.user)?.id);
+  const channelId = str(obj(p.channel)?.id) ?? str(obj(p.container)?.channel_id);
+  const messageTs = str(obj(p.message)?.ts) ?? str(obj(p.container)?.message_ts);
+  if (userId === undefined || channelId === undefined || messageTs === undefined) return undefined;
+  const teamId = str(obj(p.team)?.id) ?? str(obj(p.user)?.team_id);
+  return { rating, userId, channelId, messageTs, ...(teamId === undefined ? {} : { teamId }) };
+}
+
+/** What {@link routeSlackFeedbackClick} writes through. The live default is core's audit writer. */
+export interface SlackFeedbackRouteDeps {
+  readonly record?: (click: ReplyFeedbackClick) => Promise<boolean>;
+}
+
+/** Record one thumbs click as a `reply.feedback` row, under the clicked conversation's partition.
+ *  Answers whether the row was written. Never throws. */
+export async function routeSlackFeedbackClick(click: ParsedSlackFeedbackClick, deps: SlackFeedbackRouteDeps = {}): Promise<boolean> {
+  try {
+    const p = resolvePartition(bindableForSlackIds({ teamId: click.teamId, channelId: click.channelId, userId: click.userId }));
+    const record = deps.record ?? ((c: ReplyFeedbackClick) => recordReplyFeedback(c));
+    return await record({
+      surface: "slack",
+      rating: click.rating,
+      raterId: click.userId,
+      channelId: click.channelId,
+      messageId: click.messageTs,
+      org: p.org,
+      platform: p.platform,
+      workspace: p.workspace,
+      surfaceKey: p.surfaceKey,
+    });
+  } catch {
+    return false;
+  }
+}

package/agent/channels/slack-shortcut.ts

@@ -255,7 +255,7 @@ export function globalShortcutText(sc: ParsedSlackShortcut): string {
  * instant's milliseconds; the last three digits are zero, because a millisecond clock cannot
  * honestly claim more precision than it has.
  */
-function slackTsFromMs(nowMs: number): string {
+export function slackTsFromMs(nowMs: number): string {
   const seconds = Math.floor(nowMs / 1000);
   const millis = nowMs % 1000;
   return `${seconds}.${String(millis).padStart(3, "0")}000`;

package/agent/channels/slack-voice-clips.ts

@@ -0,0 +1,82 @@
+// SLACK VOICE CLIPS (OPE-2524) — hear the voice clip on a Slack message the agent was ALREADY going to answer.
+//
+// The front door (slack-front.ts) calls {@link withSlackVoiceClips} on four roads, each one after the road decided to
+// wake the agent and inside the road's own serialized queue, so the 200 to Slack never waits on a transcription:
+//   • a DM or group DM (the DM window seat);
+//   • a group-DM @mention diverted to that seat;
+//   • an addressed seat wake: a diverted @mention, or a follow-up in a thread the seat is holding;
+//   • a follow-up in an engaged thread on an unseated deployment.
+// "Holding" means an engaged thread that was not stood down: the threads where a typed follow-up reaches the agent
+// (slack-front.ts `threadHearsClips`).
+//
+// 🔴 A CLIP IN A ROOM THAT DID NOT ADDRESS THE AGENT IS NEVER DOWNLOADED. A top-level channel message, an unengaged
+// thread and an ambient (unaddressed) seat wake all skip this. The name-drop judge reads typed words only, so a person
+// who wants the agent to hear a clip in a channel @mentions it or replies in its thread. That keeps a room's audio out
+// of a speech-to-text provider unless somebody pointed it at the agent.
+//
+// THE FETCH is the same bot-token, host-pinned, size-guarded read `read_file_upload` uses
+// (slack-attachments.ts `pullSlackAttachmentBytes`), over the EVENT's own `url_private`. The bytes go to the
+// transcriber and are dropped.
+//
+// 🔴 THE HEARD MESSAGE IS A PLAIN MESSAGE. Slack sends an upload as subtype `file_share`, and every thread gate drops a
+// subtype (`shouldDeliverReply`, `shouldSupervisorWake`). Once a clip is heard, the message is what the person said,
+// so the subtype is cleared. Only `file_share` is cleared. An edit (`message_changed`) is not heard again at all.
+
+import { hearVoiceClips, isVoiceClip, voiceClipBody, type VoiceClipOutcome } from "@open-everywhere/core/agent/adapter-api.js";
+import { bindableFor, type ParsedMessageEvent } from "./slack-events.js";
+import { pullSlackAttachmentBytes } from "./slack-attachments.js";
+import { slackTenantAdmission } from "./slack-tenant-fence.js";
+
+/** Slack records a voice clip as `audio/webm` or `audio/mp4`. A clip that names no type is sent as mp4. */
+const FALLBACK_MEDIA_TYPE = "audio/mp4";
+
+export interface SlackVoiceClipDeps {
+  readonly hear?: typeof hearVoiceClips;
+  readonly pull?: typeof pullSlackAttachmentBytes;
+}
+
+/** True when the message carries a voice clip, so a road can skip the whole step on the common message. */
+export function hasSlackVoiceClip(ev: ParsedMessageEvent): boolean {
+  return (ev.attachments ?? []).some(isVoiceClip);
+}
+
+/**
+ * The message with its voice clips heard: the transcript appended to `text` and `authoredText`, and a `file_share`
+ * subtype cleared. A message with no clip comes back unchanged (the same object). Total: any failure gives the message
+ * back unchanged, so a broken clip never costs the person their typed words.
+ */
+export async function withSlackVoiceClips(ev: ParsedMessageEvent, deps: SlackVoiceClipDeps = {}): Promise<ParsedMessageEvent> {
+  if (!hasSlackVoiceClip(ev)) return ev;
+  // An EDIT is not heard again: the clip was heard on first delivery, and a caption edit must not pay for the same audio
+  // twice. The edit's own text goes on as typed.
+  if (ev.subtype === "message_changed") return ev;
+  // 🔴 THE TENANT FENCE, ASKED AGAIN HERE. Every road refuses an undeclared workspace on its own, but the group-DM
+  // mention road reaches its fence (`scheduleDmWake`) only AFTER this step. So a foreign workspace's clip must not be
+  // downloaded or billed here. The question is pure: the refusal's audit row stays with the road's own fence.
+  if (slackTenantAdmission(ev.teamId, ev.enterpriseId) === "unadmitted") return ev;
+  const pull = deps.pull ?? pullSlackAttachmentBytes;
+  let outcomes: VoiceClipOutcome[];
+  try {
+    const bindable = bindableFor(ev);
+    outcomes = await (deps.hear ?? hearVoiceClips)({
+      attachments: ev.attachments,
+      bindable,
+      load: async (clip, maxBytes) => {
+        if (clip.url === undefined) throw new Error("the clip carries no download URL");
+        const audio = await pull(bindable, { urlPrivate: clip.url, ...(clip.id ? { id: clip.id } : {}) }, maxBytes);
+        return { audio, mediaType: clip.mimeType ?? FALLBACK_MEDIA_TYPE };
+      },
+    });
+  } catch (err) {
+    console.warn(`[open-everywhere:slack-voice-clips] ${ev.channelId}/${ev.ts}: voice clip step failed — the message goes on as typed: ${String(err)}`);
+    return ev;
+  }
+  if (outcomes.length === 0) return ev;
+  const { subtype, ...rest } = ev;
+  return {
+    ...rest,
+    ...(subtype === undefined || subtype === "file_share" ? {} : { subtype }),
+    text: voiceClipBody(ev.text, outcomes),
+    authoredText: voiceClipBody(ev.authoredText, outcomes),
+  };
+}

package/agent/channels/slack-wake-backscroll.ts

@@ -139,11 +139,6 @@ function liveWakeBotIdentity(): Promise<WakeBotIdentity> {
   return wakeBotIdentityPromise;
 }
 
-/** Reset the cached wake bot identity (tests only). */
-export function _resetWakeBotIdentity(): void {
-  wakeBotIdentityPromise = undefined;
-}
-
 const liveDeps: WakeBackscrollDeps = { request: liveRequest, identity: liveWakeBotIdentity };
 
 // --- the fetcher ------------------------------------------------------------

package/agent/channels/slack.ts

@@ -18,6 +18,7 @@
 // left eve reading `process.env` on a path OE no longer does. Capturing channel_type/is_private is a RAW-fact job; the
 // security-critical interpretation (fail-closed to private) lives in the binding.
 
+import { auditErrorDetail } from "@open-everywhere/core/agent/adapter-api.js";
 import { SLACK_EVE_CREDENTIALS } from "../setup/eve-credentials.js";
 import {
   slackChannel,
@@ -38,6 +39,7 @@ import {
 } from "./slack-identity.js";
 import {
   resolvePartition,
+  auditSurfaceModeFrom,
   getOperationalStore,
   postOnce,
   outboundKey,
@@ -89,6 +91,9 @@ import {
   dmTrustTtlMs,
   swallowRoomOp,
   domainRoster,
+  domainKeyOf,
+  resolveWakeTrust,
+  stampNonMemberChatAuth,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { TURN_FAILED_TEXT, withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
 import { loadConversationContext } from "./slack-context.js";
@@ -98,9 +103,10 @@ import { holdRouteWork } from "./slack-route-hold.js";
 import { frontSlackChannel, INTERNAL_SLACK_ROUTE } from "./slack-front.js";
 import { admitSlackInputResponse } from "./slack-input-response.js";
 import { taskCardConfidentiality } from "./slack-task-card.js";
-import { turnEffectsFor, botDisplayName, slackForm, isSupervisorReplyTurn, deliverSupervisorReply, dmWakeThreadOverride, replyThreadTsForState, type SupervisorReplyTarget } from "./slack-events.js";
+import { turnEffectsFor, botDisplayName, slackForm, isSupervisorReplyTurn, deliverSupervisorReply, dmWakeThreadOverride, replyThreadTsForState, slackAuthorIsMember, slackWakeAuthorFacts, type SlackMemberProbe, type SupervisorReplyTarget } from "./slack-events.js";
 import { markdownToSlackMrkdwn } from "./slack-mrkdwn.js";
 import { stepStatusFor, type StepAction } from "./slack-step-label.js";
+import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 // WARM_SILENT_LIMIT (the warm-thread shed threshold) now lives in channels/engagement.ts so
 // Slack and Discord share ONE constant instead of each defining their own (which could drift).
@@ -244,18 +250,20 @@ async function recordQuietFailure(
 ): Promise<void> {
   console.warn(`[open-everywhere:slack] ${event} on an uninvited turn — suppressed on-surface (${message})`);
   try {
-    const p = resolvePartition({
+    const bindable: Parameters<typeof resolvePartition>[0] = {
       channel: { kind: "slack" },
       session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-    });
+    };
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action: "surface.quiet_fail",
-      detail: { event, threadTs: state.threadTs ?? undefined, message: message.slice(0, 500) },
+      detail: { event, threadTs: state.threadTs ?? undefined, message: auditErrorDetail(message).error },
     });
   } catch (err) {
     console.warn(`[open-everywhere:slack] quiet-fail audit write failed: ${String(err)}`);
@@ -443,6 +451,7 @@ async function maybeOnboard(ctx: SlackContext, where: BindableContext): Promise<
           silo: target.silo,
           access: target.access,
           road: "pinned-instructions",
+          ...auditSurfaceModeFrom(where),
         });
         adopted = true;
       }
@@ -460,6 +469,7 @@ async function maybeOnboard(ctx: SlackContext, where: BindableContext): Promise<
       message: `onboarding ${p.surfaceKey}`,
       road: "onboarding-marker",
       kind: "operational",
+      ...auditSurfaceModeFrom(where),
     });
     try {
       // Introduce as the bot's actual workspace name (fail-soft → product-name fallback).
@@ -535,20 +545,22 @@ const DROP = null;
  * waits on. `holdRouteWork` additionally tracks it on the delivery's keepalive
  * (slack-route-hold.ts), which is what covers a writer no caller can await.
  */
-function auditWakeDropped(message: SlackMessage, reason: string, detail: Record<string, unknown> = {}): Promise<void> {
+function auditWakeDropped(message: SlackMessage, reason: string, detail: AuditDetail = {}): Promise<void> {
   return holdRouteWork(
     (async () => {
       try {
-        const p = resolvePartition({
+        const bindable: Parameters<typeof resolvePartition>[0] = {
           channel: { kind: "slack" },
           session: { auth: { current: { attributes: { team_id: message.teamId ?? "", channel_id: message.channelId }, principalId: "", principalType: "slack-user" } } },
-        });
+        };
+        const p = resolvePartition(bindable);
         await getOperationalStore().appendAudit({
           ts: new Date().toISOString(),
           org: p.org,
           platform: p.platform,
           workspace: p.workspace,
           surface: p.surface,
+          ...auditSurfaceModeFrom(bindable),
           action: "surface.wake_dropped",
           detail: { reason, channel: message.channelId, ts: message.ts, ...detail },
         });
@@ -729,7 +741,52 @@ async function onInbound(
     // its silent streak, and exempts it from warm auto-disengage).
     await markThreadEngaged(partitionForMessage(message, facts), message.threadTs, new Date().toISOString(), { participating: true });
   }
-  return { auth: authFromFacts(message, facts), context };
+  return { auth: await stampNativeAuthorLeg(message, facts, isDm, authFromFacts(message, facts)), context };
+}
+
+/**
+ * THE AUTHOR LEG ON THE NATIVE MENTION DOOR (OPE-2572). Every other Slack wake road probes who wrote
+ * the trigger and stamps `oe_chat_nonmember` on a positive refutation (slack-events.ts
+ * `slackWakeAuthorFacts`, the front's DM and group-DM legs). This door did neither, so a guest who
+ * @mentioned the agent in an internal channel woke an unmarked turn: no taint seed, no member-plane
+ * refusal, and a check-in that counted (hooks/routine-report-reply.ts). This runs the SAME probe and
+ * the SAME join (`stampNonMemberChatAuth`), so the native door and the windowed doors cannot disagree
+ * about one author.
+ *
+ * 🔴 IT STAMPS, IT DOES NOT DEMOTE THE ROOM. The auth keeps the room's verdict (`trust_checked` /
+ * `is_ext_shared`), the rule `slackWakeAuthorFacts` states for the channel routes: one guest's message
+ * must not demote the channel's memory tier. The stamp is what the consumers read.
+ *
+ * The room leg rides along exactly as on the channel routes: a channel the operator declared `public`
+ * marks the turn whoever wrote it. A DM or group DM contributes no room leg (`dm: true`).
+ *
+ * FAIL-OPEN, like every carriage leg: a probe that cannot answer refutes nobody. `probe` is injectable
+ * for the unit test only.
+ */
+export async function stampNativeAuthorLeg(
+  message: SlackMessage,
+  facts: ChannelFacts,
+  isDm: boolean,
+  auth: OpenEverywhereSlackAuth | null,
+  probe: SlackMemberProbe = slackAuthorIsMember,
+): Promise<OpenEverywhereSlackAuth | null> {
+  if (auth === null) return null;
+  const mode = slackMode(facts.channelType, message.channelId);
+  // The surface fact `resolveWakeTrust` takes: on a 1:1 the partner probe, elsewhere the room's own
+  // confirmed-internal verdict (the expression `channelInternalAndMeta` uses).
+  const surfaceInternal = isDm ? facts.dmPartnerTrust === "internal" : facts.trustChecked === true && facts.isExternal === false;
+  const authorFacts = await slackWakeAuthorFacts(surfaceInternal, message.author?.userId, message.teamId, probe);
+  const channelKey = domainKeyOf(partitionForMessage(message, facts));
+  const rawBotId = typeof (message.raw as { bot_id?: unknown })?.bot_id === "string" ? (message.raw as { bot_id: string }).bot_id : undefined;
+  const enterpriseId = forwardedSlackEnterpriseId(message);
+  const trust = resolveWakeTrust({
+    authorIsBot: Boolean(message.author?.isBot) && !isAllowedSlackDriver(message.teamId, rawBotId),
+    authorId: message.author?.userId,
+    surfaceInternal: authorFacts.surfaceInternal,
+    channelKey,
+    ...(enterpriseId === undefined ? {} : { enterpriseId }),
+  });
+  return stampNonMemberChatAuth(auth, [{ trust, refuted: authorFacts.refuted }], mode === "channel" ? { surfaceKey: channelKey } : { dm: true });
 }
 
 /**
@@ -1016,16 +1073,18 @@ const slackMentionChannel = slackChannel({
                   `(${channelId ?? "?"}/${threadTs ?? "?"}) — this usually means a judgment call went missing, not that one was made.`,
               );
               try {
-                const p = resolvePartition({
+                const bindable: Parameters<typeof resolvePartition>[0] = {
                   channel: { kind: "slack" },
                   session: { auth: { current: { attributes: { team_id: channel.state.teamId ?? "", channel_id: channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-                });
+                };
+                const p = resolvePartition(bindable);
                 await getOperationalStore().appendAudit({
                   ts: new Date().toISOString(),
                   org: p.org,
                   platform: p.platform,
                   workspace: p.workspace,
                   surface: p.surface,
+                  ...auditSurfaceModeFrom(bindable),
                   action: "turn.bare_stop",
                   detail: { threadTs, ...(sessionId ? { sessionId } : {}) },
                 });
@@ -1101,12 +1160,13 @@ const slackMentionChannel = slackChannel({
             // partition from the session state, independent of whether a reply target resolved.
             const channelId = channel.state.channelId ?? undefined;
             const teamId = channel.state.teamId;
-            const partition = channelId
-              ? resolvePartition({
+            const supervisorBindable: Parameters<typeof resolvePartition>[0] | undefined = channelId
+              ? {
                   channel: { kind: "slack" },
                   session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
-                })
+                }
               : undefined;
+            const partition = supervisorBindable ? resolvePartition(supervisorBindable) : undefined;
             // --- MESSAGE-TOOL-ONLY hard-silence gate (OpenClaw steal, slack-events.ts) -----------
             // A supervisor's terminal completion text is NOT a reply: a visible reply must come from
             // the `reply` tool (which posted mid-turn via reply-post.ts + marked repliedThisTurn).
@@ -1130,6 +1190,7 @@ const slackMentionChannel = slackChannel({
                     platform: partition.platform,
                     workspace: partition.workspace,
                     surface: partition.surface,
+                    ...(supervisorBindable ? auditSurfaceModeFrom(supervisorBindable) : {}),
                     action: "turn.supervisor_prose_dropped",
                     detail: { threadTs: target?.threadTs, chars: action.text.length, ...(sessionId ? { sessionId } : {}) },
                   });