@openrig/cli 0.4.8 → 0.5.1

package/daemon/dist/routes/provider.js

@@ -0,0 +1,124 @@
+import { Hono } from "hono";
+// Slice-04 (OPR.0.5.0.4) seam B — the `/api/provider` routes (packet 3ffa3c22 §3). Thin handlers
+// over ONE service read model (filtered projections cannot diverge). Edge validation -> 400; an
+// unsafe precheck is a 200 verdict; switch business outcomes are 200 payloads; an unwired service
+// is a loud 503 (never an empty/fabricated four-block). No collection or policy logic lives here.
+const VALID_PROVIDERS = new Set(["codex", "claude"]);
+export function providerRoutes() {
+    const router = new Hono();
+    const svcOf = (c) => c.get("providerService") ?? null;
+    const unavailable = 503;
+    const okProvider = (p) => p === undefined || VALID_PROVIDERS.has(p);
+    // When present, an account filter must be a non-empty, non-whitespace ref.
+    const okAccount = (a) => a === undefined || a.trim().length > 0;
+    // A malformed filter (bad provider enum or empty account) is a 400; returns the message or null.
+    const filterError = (provider, account) => {
+        if (!okProvider(provider))
+            return `invalid provider: ${provider}`;
+        if (!okAccount(account))
+            return "account must be a non-empty ref";
+        return null;
+    };
+    router.get("/status", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        return c.json(await svc.getReadModel(), 200);
+    });
+    // S-B (OPR.0.5.0.4-B) — the external status site's ENTIRE contract: GET /api/provider/usage
+    // SERVES the S-A host-level rollup rows (model.hostUsage) verbatim from the one read model. No
+    // derivation here — state/windows/resets_at/anomalies/provenance are built in S-A's rollupHostUsage
+    // (and the rows carry NO account identity by construction, only (host, provider) + topology seats).
+    // Absent block -> honest empty array (never a fabricated row); unwired service -> loud 503.
+    router.get("/usage", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        const model = await svc.getReadModel();
+        return c.json({ hostUsage: model.hostUsage ?? [] }, 200);
+    });
+    router.get("/accounts", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        const provider = c.req.query("provider");
+        const account = c.req.query("account");
+        const filterErr = filterError(provider, account);
+        if (filterErr)
+            return c.json({ error: filterErr }, 400);
+        const model = await svc.getReadModel();
+        const accounts = model.accounts.filter((a) => (provider === undefined || a.provider === provider) && (account === undefined || a.accountId === account));
+        return c.json({ accounts }, 200);
+    });
+    router.get("/bindings", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        const provider = c.req.query("provider");
+        const account = c.req.query("account");
+        const filterErr = filterError(provider, account);
+        if (filterErr)
+            return c.json({ error: filterErr }, 400);
+        const model = await svc.getReadModel();
+        const providerOf = new Map(model.accounts.map((a) => [a.accountId, a.provider]));
+        const bindings = model.bindings.filter((b) => (account === undefined || b.accountId === account) &&
+            (provider === undefined || (b.accountId !== null && providerOf.get(b.accountId) === provider)));
+        return c.json({ bindings }, 200);
+    });
+    router.get("/signals", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        const provider = c.req.query("provider");
+        const account = c.req.query("account");
+        const filterErr = filterError(provider, account);
+        if (filterErr)
+            return c.json({ error: filterErr }, 400);
+        const model = await svc.getReadModel();
+        const signals = model.signals.filter((s) => (provider === undefined || s.provider === provider) && (account === undefined || s.accountRef === account));
+        return c.json({ signals }, 200);
+    });
+    router.get("/precheck", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        const seat = c.req.query("seat");
+        const toAccount = c.req.query("toAccount");
+        // Trim for VALIDATION only — the opaque refs are passed through unrewritten.
+        if (!seat || !seat.trim() || !toAccount || !toAccount.trim()) {
+            return c.json({ error: "seat and toAccount are required" }, 400);
+        }
+        // An unsafe verdict is a valid 200 response, not an error.
+        return c.json(await svc.precheck({ seat, toAccount }), 200);
+    });
+    router.post("/switch", async (c) => {
+        const svc = svcOf(c);
+        if (!svc)
+            return c.json({ error: "provider_service_unavailable" }, unavailable);
+        let raw;
+        try {
+            raw = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "invalid JSON body" }, 400);
+        }
+        // JSON null/array/primitive is malformed (400), not a 500 from reading a field off null.
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            return c.json({ error: "body must be a JSON object" }, 400);
+        }
+        const body = raw;
+        const seat = body["seat"];
+        const toAccount = body["toAccount"];
+        const forceUnsafe = body["forceUnsafe"] ?? false;
+        if (typeof seat !== "string" || seat.trim() === "" || typeof toAccount !== "string" || toAccount.trim() === "") {
+            return c.json({ error: "seat and toAccount are required" }, 400);
+        }
+        if (typeof forceUnsafe !== "boolean") {
+            return c.json({ error: "forceUnsafe must be a boolean" }, 400);
+        }
+        // Business outcome (incl. failed_safely / rebind_in_progress) is an explicit 200 payload.
+        return c.json(await svc.switchAccount({ seat, toAccount, forceUnsafe }), 200);
+    });
+    return router;
+}
+//# sourceMappingURL=provider.js.map

package/daemon/dist/routes/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/routes/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAElG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,KAAK,GAAG,CAAC,CAAU,EAA0B,EAAE,CAClD,CAAC,CAAC,GAAG,CAAC,iBAA0B,CAAiC,IAAI,IAAI,CAAC;IAC7E,MAAM,WAAW,GAAG,GAAY,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,2EAA2E;IAC3E,MAAM,SAAS,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7F,iGAAiG;IACjG,MAAM,WAAW,GAAG,CAAC,QAA4B,EAAE,OAA2B,EAAiB,EAAE;QAC/F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,qBAAqB,QAAQ,EAAE,CAAC;QAClE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,iCAAiC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,+FAA+F;IAC/F,oGAAoG;IACpG,oGAAoG;IACpG,4FAA4F;IAC5F,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CACjH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC;YAClD,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CACjG,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAClH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,6EAA6E;QAC7E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,2DAA2D;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,yFAAyF;QACzF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,GAA8B,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;QACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,0FAA0F;QAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/daemon/dist/routes/queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/routes/queue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA8C5B,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKhF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAI1I;AAGD,wBAAgB,WAAW,IAAI,IAAI,CAk4BlC"}
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/routes/queue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA8C5B,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKhF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAS1I;AAGD,wBAAgB,WAAW,IAAI,IAAI,CAw8BlC"}

package/daemon/dist/routes/queue.js

@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
-import { QueueRepositoryError, newQitemId, deriveCrossHostSuccessorId } from "../domain/queue-repository.js";
-import { isHumanSeatSession } from "../domain/human-route-enforcer.js";
-import { parseSessionName } from "../domain/session-name.js";
+import { QueueRepositoryError, newQitemId, deriveCrossHostSuccessorId, stampSelfHostSuffix, classifyNudgeFailure } from "../domain/queue-repository.js";
+import { parseSessionName, isHumanSeatSessionRef } from "../domain/session-name.js";
+import { requireSenderIdentity, resolveRecordedProvenance } from "./require-sender-identity.js";
 import { hostname as osHostname } from "node:os";
 import { InboxHandlerError } from "../domain/inbox-handler.js";
 import { aggregateAttention } from "../domain/feed/attention-aggregator.js";
@@ -58,9 +58,14 @@ export function crossHostProvenanceTags(existing) {
 export function isAttentionItem(q) {
     if (q.tier === "human-gate")
         return true;
-    if (isHumanSeatSession(q.destinationSession))
+    // A2: consolidated onto the ONE contract predicate (isHumanSeatSessionRef) so
+    // virtual-domain refs (<local>@external) are human-CLASS and JOIN the attention
+    // union — behavior-identical for every non-@external ref (same pattern today).
+    // The enforcer's other consumers keep the narrow pattern this slice (a DOCUMENTED
+    // divergence, routed as a follow-on per dev-planner's ruling).
+    if (isHumanSeatSessionRef(q.destinationSession))
         return true;
-    return q.state === "blocked" && isHumanSeatSession(q.blockedOn ?? null);
+    return q.state === "blocked" && isHumanSeatSessionRef(q.blockedOn ?? "");
 }
 export function queueRoutes() {
     const app = new Hono();
@@ -130,11 +135,14 @@ export function queueRoutes() {
                                                     : err.code === "cross_host_close_conflict" ? 409
                                                         : err.code === "unknown_destination_rig" ? 400
                                                             : err.code === "human_route_fields_required" ? 400
-                                                                // OPR.0.4.6.WF3 FR-6: the frontier close-path guard — operator
-                                                                // misuse of a queue verb on a live workflow packet; structured
-                                                                // 400 with the what/why/fix message, never a 500.
-                                                                : err.code === "workflow_frontier_packet" ? 400
-                                                                    : 500;
+                                                                // OPR.0.5.1 slice-51-06 D2: summary/evidence_ref on a non-park transition — a client
+                                                                // input error surfaced as a structured 400 (the daemon rejects before any mutation).
+                                                                : err.code === "summary_evidence_not_persistable" ? 400
+                                                                    // OPR.0.4.6.WF3 FR-6: the frontier close-path guard — operator
+                                                                    // misuse of a queue verb on a live workflow packet; structured
+                                                                    // 400 with the what/why/fix message, never a 500.
+                                                                    : err.code === "workflow_frontier_packet" ? 400
+                                                                        : 500;
             return c.json({ error: err.code, message: err.message, ...(err.meta ?? {}) }, status);
         }
         if (err instanceof InboxHandlerError) {
@@ -263,7 +271,10 @@ export function queueRoutes() {
         const effectiveTags = body.tags ?? source.tags ?? undefined;
         const forwardBody = {
             qitemId: successorId,
-            sourceSession: body.fromSession,
+            // 51-09 incr 4a — stamp-at-FORWARD: this forwarding daemon IS the origin,
+            // so stamp its own self-id onto the sender identity before forwarding (the
+            // remote create()'s not-bare guard then leaves it — origin never forged).
+            sourceSession: stampSelfHostSuffix(body.fromSession),
             destinationSession: body.toSession,
             body: body.body ?? source.body,
             priority: body.priority ?? source.priority,
@@ -306,8 +317,14 @@ export function queueRoutes() {
     // POST /create
     app.post("/create", async (c) => {
         const body = await c.req.json().catch(() => ({}));
-        if (!body.sourceSession)
-            return c.json({ error: "sourceSession is required" }, 400);
+        // P21 I3 — the source is the transport-derived sender (X-OpenRig-Session), NEVER the body claim.
+        // P18 deliver-and-label: absent header + a body sourceSession → recorded as the claimed-era stamp
+        // claimed:v1; absent header + no body → 400 actor_required; a body sourceSession that DIFFERS from the
+        // header → the wire SUPERSEDES it (transport:v1), not a 409. `sourceSession` below is authoritative.
+        const identity = requireSenderIdentity(c, { verb: "queue create", bodyClaim: body.sourceSession });
+        if (!identity.ok)
+            return identity.response;
+        const sourceSession = identity.session;
         if (!body.destinationSession)
             return c.json({ error: "destinationSession is required" }, 400);
         if (!body.body)
@@ -327,7 +344,7 @@ export function queueRoutes() {
         // check cannot recover it. Local ordering is unchanged (the cross-host
         // branch is a no-op without hostId).
         if (body.targetRepo) {
-            const validation = validateTargetRepo(c, body.sourceSession, body.targetRepo);
+            const validation = validateTargetRepo(c, sourceSession, body.targetRepo);
             if (!validation.ok)
                 return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
         }
@@ -337,6 +354,10 @@ export function queueRoutes() {
             const forwardBody = {
                 ...rest,
                 qitemId: mintedId,
+                // 51-09 incr 4a — stamp-at-FORWARD: this forwarding daemon is the origin,
+                // so it stamps its OWN self-id (overriding the bare spread) before the
+                // remote create() runs — else the remote would forge member@rig@RECEIVER.
+                sourceSession: stampSelfHostSuffix(sourceSession),
                 tags: crossHostProvenanceTags(body.tags),
             };
             const fwd = await forwardQueueWrite(c, body.hostId, "/api/queue/create", forwardBody);
@@ -345,7 +366,7 @@ export function queueRoutes() {
         try {
             const item = await getRepo(c).create({
                 qitemId: body.qitemId,
-                sourceSession: body.sourceSession,
+                sourceSession,
                 destinationSession: body.destinationSession,
                 body: body.body,
                 priority: body.priority,
@@ -357,6 +378,7 @@ export function queueRoutes() {
                 summary: body.summary,
                 evidenceRef: body.evidenceRef,
                 nudge: body.nudge,
+                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
             });
             return c.json(item, 201);
         }
@@ -368,10 +390,13 @@ export function queueRoutes() {
     app.post("/:qitemId/claim", async (c) => {
         const qitemId = c.req.param("qitemId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
+        // P21 I3: the claimant is the transport-derived sender, never body.destinationSession.
+        const identity = requireSenderIdentity(c, { verb: "queue claim", bodyClaim: body.destinationSession });
+        if (!identity.ok)
+            return identity.response;
+        const destinationSession = identity.session;
         try {
-            const item = getRepo(c).claim({ qitemId, destinationSession: body.destinationSession });
+            const item = getRepo(c).claim({ qitemId, destinationSession, identityProvenance: resolveRecordedProvenance(c, identity) });
             return c.json(item);
         }
         catch (err) {
@@ -382,10 +407,13 @@ export function queueRoutes() {
     app.post("/:qitemId/unclaim", async (c) => {
         const qitemId = c.req.param("qitemId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
+        // P21 I3: the claimant is the transport-derived sender, never body.destinationSession.
+        const identity = requireSenderIdentity(c, { verb: "queue unclaim", bodyClaim: body.destinationSession });
+        if (!identity.ok)
+            return identity.response;
+        const destinationSession = identity.session;
         try {
-            const item = getRepo(c).unclaim(qitemId, body.destinationSession, body.reason ?? "manual");
+            const item = getRepo(c).unclaim(qitemId, destinationSession, body.reason ?? "manual", resolveRecordedProvenance(c, identity));
             return c.json(item);
         }
         catch (err) {
@@ -418,14 +446,20 @@ export function queueRoutes() {
     app.post("/:qitemId/update", async (c) => {
         const qitemId = c.req.param("qitemId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.actorSession)
-            return c.json({ error: "actorSession is required" }, 400);
+        // P21 I3 — the actor is the transport-derived sender (X-OpenRig-Session), NEVER a body claim.
+        // P18 deliver-and-label: absent header + a body actor → claimed:v1; absent + no body → 400
+        // actor_required; a differing body actorSession → the wire SUPERSEDES it (transport:v1), not a 409;
+        // an equal body claim is a no-op.
+        const identity = requireSenderIdentity(c, { verb: "queue update", bodyClaim: body.actorSession });
+        if (!identity.ok)
+            return identity.response;
+        const actorSession = identity.session;
         if (!body.state)
             return c.json({ error: "state is required" }, 400);
         try {
             const item = getRepo(c).update({
                 qitemId,
-                actorSession: body.actorSession,
+                actorSession,
                 state: body.state,
                 transitionNote: body.transitionNote,
                 closureReason: body.closureReason,
@@ -435,6 +469,7 @@ export function queueRoutes() {
                 blockedOn: body.blockedOn,
                 summary: body.summary,
                 evidenceRef: body.evidenceRef,
+                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
             });
             return c.json(item);
         }
@@ -448,8 +483,11 @@ export function queueRoutes() {
     app.post("/:qitemId/handoff", async (c) => {
         const qitemId = c.req.param("qitemId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.fromSession)
-            return c.json({ error: "fromSession is required" }, 400);
+        // P21 I3: the handoff actor is the transport header, never body.fromSession.
+        const identity = requireSenderIdentity(c, { verb: "queue handoff", bodyClaim: body.fromSession });
+        if (!identity.ok)
+            return identity.response;
+        const fromSession = identity.session;
         if (!body.toSession)
             return c.json({ error: "toSession is required" }, 400);
         // PL-007 — GUARD FIXBACK (Finding 1): an EXPLICIT targetRepo validates
@@ -457,13 +495,13 @@ export function queueRoutes() {
         // the create-route note). An inherited source.targetRepo (no override)
         // is NOT re-validated — it was already accepted on the source row.
         if (body.targetRepo) {
-            const validation = validateTargetRepo(c, body.fromSession, body.targetRepo);
+            const validation = validateTargetRepo(c, fromSession, body.targetRepo);
             if (!validation.ok)
                 return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
         }
         if (typeof body.hostId === "string" && body.hostId !== "" && body.hostId !== LOCAL_HOST_ID) {
             return crossHostHandoff(c, qitemId, body.hostId, "handed-off", {
-                fromSession: body.fromSession,
+                fromSession,
                 toSession: body.toSession,
                 body: body.body,
                 transitionNote: body.transitionNote,
@@ -479,7 +517,7 @@ export function queueRoutes() {
         try {
             const result = await getRepo(c).handoff({
                 qitemId,
-                fromSession: body.fromSession,
+                fromSession,
                 toSession: body.toSession,
                 body: body.body,
                 transitionNote: body.transitionNote,
@@ -490,6 +528,7 @@ export function queueRoutes() {
                 summary: body.summary,
                 evidenceRef: body.evidenceRef,
                 nudge: body.nudge,
+                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
             });
             return c.json(result, 201);
         }
@@ -504,20 +543,23 @@ export function queueRoutes() {
     app.post("/:qitemId/handoff-and-complete", async (c) => {
         const qitemId = c.req.param("qitemId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.fromSession)
-            return c.json({ error: "fromSession is required" }, 400);
+        // P21 I3: the handoff-and-complete actor is the transport header, never body.fromSession.
+        const identity = requireSenderIdentity(c, { verb: "queue handoff-and-complete", bodyClaim: body.fromSession });
+        if (!identity.ok)
+            return identity.response;
+        const fromSession = identity.session;
         if (!body.toSession)
             return c.json({ error: "toSession is required" }, 400);
         // PL-007 — GUARD FIXBACK (Finding 1): same source-host-authority ordering
         // as handoff — explicit targetRepo validates BEFORE the cross-host branch.
         if (body.targetRepo) {
-            const validation = validateTargetRepo(c, body.fromSession, body.targetRepo);
+            const validation = validateTargetRepo(c, fromSession, body.targetRepo);
             if (!validation.ok)
                 return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
         }
         if (typeof body.hostId === "string" && body.hostId !== "" && body.hostId !== LOCAL_HOST_ID) {
             return crossHostHandoff(c, qitemId, body.hostId, "done", {
-                fromSession: body.fromSession,
+                fromSession,
                 toSession: body.toSession,
                 body: body.body,
                 transitionNote: body.transitionNote,
@@ -533,7 +575,7 @@ export function queueRoutes() {
         try {
             const result = await getRepo(c).handoffAndComplete({
                 qitemId,
-                fromSession: body.fromSession,
+                fromSession,
                 toSession: body.toSession,
                 body: body.body,
                 transitionNote: body.transitionNote,
@@ -544,6 +586,7 @@ export function queueRoutes() {
                 summary: body.summary,
                 evidenceRef: body.evidenceRef,
                 nudge: body.nudge,
+                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
             });
             return c.json(result, 201);
         }
@@ -583,8 +626,9 @@ export function queueRoutes() {
     // source of truth for the UI Action-required + Approval lenses) so
     // those surfaces don't depend on the lossy ephemeral client event
     // FIFO. Class membership matches the mission-control read layer
-    // semantics: tier='human-gate' OR destination matches
-    // /^human(?:-[A-Za-z0-9._-]+)?@(kernel|host)$/. Open state defaults
+    // semantics: tier='human-gate' OR the ONE contract predicate
+    // isHumanSeatSessionRef (human-seat /^human…@(kernel|host)$/ OR the A2
+    // virtual-domain leg <local>@external). Open state defaults
     // to pending|in-progress|blocked (callers can still override via
     // `state=...`). Composable with destinationSession/sourceSession/
     // targetRepo/limit.
@@ -681,6 +725,22 @@ export function queueRoutes() {
         const items = getRepo(c).findOverdue({ rig, limit, compact });
         return c.json(items);
     });
+    // GET /undelivered — 0.5.1-54 DR-1: surfaces PENDING qitems whose create-path nudge FAILED
+    // (last_nudge_result LIKE 'failed:%'). Rig-scoped + bounded + compact-by-default, mirroring /overdue.
+    // MUST precede /:qitemId. READ-only (no retry — DR-2 is PM-gated on this surface's measurement).
+    app.get("/undelivered", (c) => {
+        const q = c.req.query();
+        const rig = q.rig || undefined;
+        const limitRaw = q.limit !== undefined ? Number.parseInt(q.limit, 10) : undefined;
+        const limit = limitRaw !== undefined && Number.isInteger(limitRaw) && limitRaw > 0 ? limitRaw : undefined;
+        const compact = q.compact === "1" || q.compact === "true";
+        const items = getRepo(c).findUndelivered({ rig, limit, compact });
+        // 0.5.1-54 classifier fold (PM ruling): LABEL each strand transient vs permanent-topology so the
+        // count is actionable — permanent-topology (destination unresolvable on this daemon) routes to the
+        // addressing family, not retry; transient is the only class a future DR-2 (held n=1) would touch.
+        const classified = items.map((it) => ({ ...it, deliveryFailureClass: classifyNudgeFailure(it.lastNudgeResult) }));
+        return c.json(classified);
+    });
     // ---- SSE watch over coordination events ----
     // MUST precede /:qitemId so the literal `watch` and `sse` paths win
     // over the bare-param route (otherwise GET /api/queue/sse resolves as
@@ -734,23 +794,35 @@ export function queueRoutes() {
     });
     // ---- Inbox routes (mailbox) ----
     app.post("/inbox/drop", async (c) => {
+        // P18 sender-provenance: the sender is DERIVED from the authenticated transport header (stamped
+        // once by the CLI from the seat env), NEVER from the request body. senderSession/authenticatedSender
+        // are intentionally NOT read from the body — a body-supplied identity is forgeable false history in
+        // the channel of record (inbox_entries.sender_session → absorb → the receiver's queue).
         const body = await c.req.json().catch(() => ({}));
+        // P18 SWEEP (actor-to-label test): the sender is DERIVED from the transport header, NEVER the body
+        // — a body-supplied identity is forgeable false history. No body claim is read, so with no header
+        // there is no actor at all to LABEL → 400 actor_required (parameter completeness, the queue.ts:215
+        // class), NOT the retired 401 refusal-of-an-uncertifiable-sender. Converges on the shape
+        // resolveActorWithDeferral already uses for nothing-to-record.
+        const identity = requireSenderIdentity(c, { verb: "inbox drop" });
+        if (!identity.ok)
+            return identity.response;
+        const senderSession = identity.session; // transport-derived, authoritative
         if (!body.destinationSession)
             return c.json({ error: "destinationSession is required" }, 400);
-        if (!body.senderSession)
-            return c.json({ error: "senderSession is required" }, 400);
         if (!body.body)
             return c.json({ error: "body is required" }, 400);
         try {
             const entry = getInbox(c).drop({
                 inboxId: body.inboxId,
                 destinationSession: body.destinationSession,
-                senderSession: body.senderSession,
+                senderSession, // transport-derived, authoritative
                 body: body.body,
                 tags: body.tags,
                 urgency: body.urgency,
                 auditPointer: body.auditPointer,
-            }, body.authenticatedSender);
+                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 (or relay:v1 on a relayed hop) — no body sender is read, so claimed:v1 cannot arise here
+            });
             return c.json(entry, 201);
         }
         catch (err) {
@@ -760,10 +832,12 @@ export function queueRoutes() {
     app.post("/inbox/:inboxId/absorb", async (c) => {
         const inboxId = c.req.param("inboxId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.receiverSession)
-            return c.json({ error: "receiverSession is required" }, 400);
+        // P21 I3: the receiver is the transport-derived sender, never body.receiverSession.
+        const identity = requireSenderIdentity(c, { verb: "inbox absorb", bodyClaim: body.receiverSession });
+        if (!identity.ok)
+            return identity.response;
         try {
-            const result = await getInbox(c).absorb(inboxId, body.receiverSession);
+            const result = await getInbox(c).absorb(inboxId, identity.session, resolveRecordedProvenance(c, identity));
             return c.json(result);
         }
         catch (err) {
@@ -773,12 +847,14 @@ export function queueRoutes() {
     app.post("/inbox/:inboxId/deny", async (c) => {
         const inboxId = c.req.param("inboxId");
         const body = await c.req.json().catch(() => ({}));
-        if (!body.receiverSession)
-            return c.json({ error: "receiverSession is required" }, 400);
+        // P21 I3: the receiver is the transport-derived sender, never body.receiverSession.
+        const identity = requireSenderIdentity(c, { verb: "inbox deny", bodyClaim: body.receiverSession });
+        if (!identity.ok)
+            return identity.response;
         if (!body.reason)
             return c.json({ error: "reason is required" }, 400);
         try {
-            const entry = getInbox(c).deny(inboxId, body.receiverSession, body.reason);
+            const entry = getInbox(c).deny(inboxId, identity.session, body.reason);
             return c.json(entry);
         }
         catch (err) {
@@ -801,20 +877,23 @@ export function queueRoutes() {
     // ---- Outbox routes ----
     app.post("/outbox/record", async (c) => {
         const body = await c.req.json().catch(() => ({}));
-        if (!body.senderSession)
-            return c.json({ error: "senderSession is required" }, 400);
+        // P21 I3: the outbox sender is the transport-derived identity, never body.senderSession.
+        const identity = requireSenderIdentity(c, { verb: "outbox record", bodyClaim: body.senderSession });
+        if (!identity.ok)
+            return identity.response;
         if (!body.destinationSession)
             return c.json({ error: "destinationSession is required" }, 400);
         if (!body.body)
             return c.json({ error: "body is required" }, 400);
         const entry = getOutbox(c).record({
             outboxId: body.outboxId,
-            senderSession: body.senderSession,
+            senderSession: identity.session,
             destinationSession: body.destinationSession,
             body: body.body,
             tags: body.tags,
             urgency: body.urgency,
             auditPointer: body.auditPointer,
+            identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
         });
         return c.json(entry, 201);
     });