@securecoms/agent-bridge 0.39.0 → 0.40.0

package/README.md

@@ -973,6 +973,22 @@ copied after the owner's next typed message.
 
 ---
 
+## Release notes: 0.40.0
+
+<!-- [COPY, approved by Eric 2026-11-12 ("Notes OK")] -->
+
+#### What's new
+- **Scheduled messages reach you.** Reminders, scheduled jobs and check-ins from your OpenClaw or Hermes agent now arrive in your direct messages with the agent. Before this release, OpenClaw showed "SecureComs Owner" as a place to send to, but sending there always failed.
+- **Only to you.** A scheduled message goes to your direct messages only after your agent has your signed owner settings. Without them, nothing is sent.
+- **Text only.** A scheduled message carries text only. If a scheduled job tries to send a file, the file is not sent.
+
+#### Upgrade
+Upgrade the bridge. Copy the new plugin files from the bridge's `connectors` folder. Then restart your agent.
+
+For Hermes, run `agent-bridge wire --harness hermes` again. If you use a Hermes profile, add this line to that profile's `.env` file: `SECURECOMS_HOME_CHANNEL=owner`.
+
+If you go back to 0.39.0, scheduled messages to "owner" fail again.
+
 ## Release notes: 0.39.0
 
 <!-- [COPY, approved by Eric 2026-11-12 ("notes OK")] -->

package/connectors/hermes/adapter.py

@@ -278,6 +278,56 @@ def _new_client_session():
     return aiohttp.ClientSession()
 
 
+# Item A (R4): cron / proactive delivery to the owner DM. `agent-bridge wire
+# --harness hermes` sets the cron home channel (CRON_HOME_CHANNEL_ENV, the
+# platform's cron_deliver_env_var) to the literal OWNER_TARGET. Both Hermes
+# cron lanes (the live adapter.send and the out-of-process
+# _standalone_send) resolve it through the bridge's bearer-gated
+# GET /v1/owner-dm, which answers only from the owner-signed manifest in
+# force (OQ-A1). There is no fallback: no manifest means no send. A proactive
+# send carries no in_reply_to and no idempotency_key (OQ-A2: Hermes passes no
+# run id, and job_id is stable across runs, so a job_id key would suppress
+# every later run of the job).
+CRON_HOME_CHANNEL_ENV = "SECURECOMS_HOME_CHANNEL"
+OWNER_TARGET = "owner"
+# Answers that name a target rather than a channel are never a channel id.
+_OWNER_DM_NON_CHANNEL_ANSWERS = ("owner", "default")
+# Fixed failure texts: no channel id, no message text. Wording approved by Eric
+# 2026-11-12 (E-4); OWNER_DM_UNKNOWN_ERROR is byte-equal to the OpenClaw
+# connector's.
+OWNER_DM_UNKNOWN_ERROR = (
+    "SecureComs could not find the owner's direct message. "
+    "The agent needs its signed owner settings first."
+)
+PROACTIVE_MEDIA_ERROR = "SecureComs can send only text in a scheduled message. The file was not sent."
+PROACTIVE_UNAVAILABLE_ERROR = "SecureComs could not reach the agent bridge for a scheduled message."
+_OWNER_DM_TIMEOUT_S = 5.0
+
+
+async def _owner_dm_channel_id(session, bridge_url: str, token: str) -> Optional[str]:
+    """The owner DM channel id from GET /v1/owner-dm, or None on ANY failure
+    (non-200, network error, malformed body, an empty or non-string id, or an
+    answer that is itself a target name). Never raises."""
+
+    async def _get() -> Any:
+        async with session.get(
+            f"{bridge_url}/v1/owner-dm", headers={"Authorization": f"Bearer {token}"}
+        ) as r:
+            if r.status != 200:
+                return None
+            return await r.json()
+
+    try:
+        body = await asyncio.wait_for(_get(), timeout=_OWNER_DM_TIMEOUT_S)
+    except Exception as e:
+        logger.debug("SecureComs: owner DM lookup failed (error_class=%s)", _error_class(e))
+        return None
+    cid = body.get("channel_id") if isinstance(body, dict) else None
+    if not isinstance(cid, str) or not cid or cid in _OWNER_DM_NON_CHANNEL_ANSWERS:
+        return None
+    return cid
+
+
 class SecureComsAdapter(BasePlatformAdapter):
     """Hermes platform adapter fronting the local SecureComs daemon."""
 
@@ -1205,6 +1255,15 @@ class SecureComsAdapter(BasePlatformAdapter):
     ) -> SendResult:
         if not self._session or self._session.closed:
             return SendResult(success=False, error="not connected")
+        if chat_id == OWNER_TARGET:
+            # Cron live lane (Item A): the home channel literal resolves only
+            # from the manifest in force; a proactive send answers no turn, so
+            # it carries no in_reply_to and no idempotency_key.
+            resolved = await _owner_dm_channel_id(self._session, self.bridge_url, self._token)
+            if resolved is None:
+                return SendResult(success=False, error=OWNER_DM_UNKNOWN_ERROR)
+            chat_id = resolved
+            reply_to = None
         block = self._block_key(reply_to, content) if reply_to else None
         try:
             async with self._session.post(
@@ -1236,11 +1295,39 @@ class SecureComsAdapter(BasePlatformAdapter):
         await self._status.on_typing(chat_id)
 
     async def send_image(self, chat_id: str, image_url: str, caption: str = "", **kwargs) -> SendResult:
+        if chat_id == OWNER_TARGET:
+            # A proactive send never carries a file (Item A, live lane).
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
         # The daemon's text send is the only modality wired today; degrade to
         # sending the URL + caption as text rather than failing the turn.
         text = f"{caption}\n{image_url}".strip() if caption else image_url
         return await self.send(chat_id, text)
 
+    # Item A, live lane. Hermes routes a cron run's media through the adapter's
+    # media methods, whose base stubs degrade to a notice posted through
+    # emit_warning / emit_media_warning (-> self.send, which resolves OWNER_TARGET).
+    # We refuse the owner literal at those two chokepoints, so a proactive send
+    # never carries a file or a path. DO NOT override the base send_document /
+    # send_voice / send_video / send_animation / send_image_file here: Hermes's
+    # _send_live_adapter_media treats "type(adapter).<m> is BasePlatformAdapter.<m>"
+    # as "not implemented natively", and an override makes a normal channel
+    # delegate to the base stub, which posts a fallback notice and reports a
+    # false success. send_image above is the one pre-existing override.
+    async def emit_warning(self, *args, **kwargs):
+        return await self._owner_refused_warning("emit_warning", args, kwargs)
+
+    async def emit_media_warning(self, *args, **kwargs):
+        return await self._owner_refused_warning("emit_media_warning", args, kwargs)
+
+    async def _owner_refused_warning(self, method_name, args, kwargs):
+        target = kwargs["chat_id"] if "chat_id" in kwargs else (args[0] if args else None)
+        if target == OWNER_TARGET:
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
+        base = getattr(super(), method_name, None)
+        if base is None:
+            return SendResult(success=False, error=PROACTIVE_MEDIA_ERROR)
+        return await base(*args, **kwargs)
+
     async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         meta = self._channels.get(chat_id)
         if not meta:
@@ -1270,6 +1357,71 @@ def check_requirements() -> bool:
     return os.path.isfile(os.getenv("SECURECOMS_CONNECTION_FILE") or _BINDING_PATH)
 
 
+async def _standalone_send(
+    pconfig,
+    chat_id: str,
+    message: str,
+    *,
+    thread_id: Optional[str] = None,
+    media_files: Optional[list] = None,
+    force_document: bool = False,
+    **_ignored,
+) -> Dict[str, Any]:
+    """Hermes PlatformEntry.standalone_sender_fn: a cron run delivered with no
+    live adapter in this process (tools/send_message_tool.py:575-591). Returns
+    {"success": True, "message_id": ...} or {"error": <fixed text>}.
+
+    The daemon's address and bearer come the way connect() gets them: the
+    binding resolves the identity, then probe_and_gate_bound reads the
+    connection and token files and runs the two-anchor gate. `pconfig` holds
+    nothing for SecureComs. OWNER_TARGET resolves via GET /v1/owner-dm (a
+    failure is an error, never a guess); any other chat id passes through.
+    No in_reply_to, no idempotency_key (OQ-A2). A non-empty media_files is
+    refused before anything is read or posted (no turn, no grant: item B).
+    thread_id and force_document are ignored.
+    """
+    del pconfig, thread_id, force_document, _ignored
+    if media_files:
+        return {"error": PROACTIVE_MEDIA_ERROR}
+    bound_identity = resolve_bound_identity(os.environ, _read_file_text, _BINDING_PATH)
+    if not bound_identity:
+        return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+    session = _new_client_session()
+    try:
+        target, _reason = await securecoms_transport.probe_and_gate_bound(
+            session, bound_identity, _read_file_text, _CONNECTIONS_DIR
+        )
+        if target is None:
+            return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+        channel_id = chat_id
+        if chat_id == OWNER_TARGET:
+            channel_id = await _owner_dm_channel_id(session, target.bridge_url, target.token)
+            if channel_id is None:
+                return {"error": OWNER_DM_UNKNOWN_ERROR}
+        async with session.post(
+            f"{target.bridge_url}/v1/send",
+            headers={"Authorization": f"Bearer {target.token}"},
+            json={"channel_id": channel_id, "text": message},
+        ) as r:
+            if 200 <= r.status < 300:
+                # Posted: a body we cannot parse never turns that into an error.
+                try:
+                    j = await r.json()
+                except Exception:
+                    j = None
+                mid = j.get("message_id") if isinstance(j, dict) else None
+                return {"success": True, "message_id": str(mid) if isinstance(mid, (str, int)) and mid != "" else None}
+            return {"error": f"SecureComs scheduled send failed (HTTP {int(r.status)})."}
+    except Exception as e:
+        logger.debug("SecureComs: scheduled send failed (error_class=%s)", _error_class(e))
+        return {"error": PROACTIVE_UNAVAILABLE_ERROR}
+    finally:
+        try:
+            await session.close()
+        except Exception:
+            pass
+
+
 def _securecoms_pre_tool_call(**_kwargs):
     """Hermes pre_tool_call hook: block every tool call in a SecureComs turn
     that the daemon did not grant tools, and any call whose turn identity is
@@ -1358,6 +1510,9 @@ def _install_tool_veto(ctx) -> bool:
         return False
 
 
+_CRON_REGISTER_KWARGS = ("cron_deliver_env_var", "standalone_sender_fn")
+
+
 def register(ctx):
     """Plugin entry point: called by the Hermes plugin system."""
     global _TOOL_VETO_ACTIVE
@@ -1366,7 +1521,7 @@ def register(ctx):
         logger.warning(
             "SecureComs: tool veto inactive; turns without a tool grant will be refused"
         )
-    ctx.register_platform(
+    platform_kwargs = dict(
         name="securecoms",
         label="SecureComs",
         adapter_factory=lambda cfg: SecureComsAdapter(cfg),
@@ -1384,3 +1539,21 @@ def register(ctx):
             "never sees plaintext. Respond normally and conversationally."
         ),
     )
+    # Item A: cron delivery. The env var holds the cron home channel (`wire`
+    # sets OWNER_TARGET); the standalone sender delivers a cron run when no
+    # live adapter is in this process.
+    cron_kwargs = dict(
+        cron_deliver_env_var=CRON_HOME_CHANNEL_ENV,
+        standalone_sender_fn=_standalone_send,
+    )
+    try:
+        ctx.register_platform(**platform_kwargs, **cron_kwargs)
+    except TypeError as e:
+        # A Hermes older than PlatformEntry.cron_deliver_env_var /
+        # standalone_sender_fn rejects them as unexpected keywords. Register
+        # without them so chat keeps working; only cron delivery is missing.
+        # Any other TypeError (or any other exception) propagates unchanged.
+        if not any(name in str(e) for name in _CRON_REGISTER_KWARGS):
+            raise
+        logger.warning("SecureComs: this Hermes has no cron delivery hooks; scheduled messages are off")
+        ctx.register_platform(**platform_kwargs)

package/connectors/hermes/tests/test_adapter_wiring.py

@@ -2241,3 +2241,432 @@ class TestDeliveryLedger:
     def test_defaults(self):
         assert adapter._DEDUP_MAX_ENTRIES == 2048
         assert adapter._DEDUP_TTL_S == 600.0
+
+
+# ---------------------------------------------------------------------------
+# Item A (R4): cron / proactive delivery to the owner DM.
+#
+# Hermes v2026.9.24 (Mini, read-only) delivers a cron run two ways:
+#   - live lane: adapter.send(chat_id=<home channel>, content, metadata={"job_id": ...})
+#     (cron/scheduler_delivery.py:1447, :1611);
+#   - out of process: PlatformEntry.standalone_sender_fn(pconfig, chat_id, message, *,
+#     thread_id=None, media_files=None, force_document=False) -> dict with "success" or
+#     "error" (tools/send_message_tool.py:575-591).
+# The home channel comes from the env var named by cron_deliver_env_var. `agent-bridge
+# wire --harness hermes` sets it to the literal "owner", which both lanes resolve through
+# the bridge's GET /v1/owner-dm (the signed manifest in force) and never send verbatim.
+# ---------------------------------------------------------------------------
+
+
+class _RoutedResp:
+    def __init__(self, status, body):
+        self.status = status
+        self._body = body
+
+    async def json(self):
+        if isinstance(self._body, Exception):
+            raise self._body
+        return self._body
+
+    async def text(self):
+        return self._body if isinstance(self._body, str) else json.dumps(self._body)
+
+
+class _RoutedCall:
+    """Awaitable (securecoms_transport's probe does `await session.get`) and an
+    async context manager (`async with session.get(...)`)."""
+
+    def __init__(self, resp):
+        self._resp = resp
+
+    def __await__(self):
+        async def _r():
+            if isinstance(self._resp, Exception):
+                raise self._resp
+            return self._resp
+
+        return _r().__await__()
+
+    async def __aenter__(self):
+        if isinstance(self._resp, Exception):
+            raise self._resp
+        return self._resp
+
+    async def __aexit__(self, *exc):
+        return False
+
+
+class RoutedSession:
+    """Routes by path. owner_dm / send are (status, body) or an Exception."""
+
+    def __init__(self, owner_dm=(200, {"channel_id": "dm-1"}), send=(200, {"message_id": "m-9"}),
+                 healthz=None):
+        self._owner_dm = owner_dm
+        self._send = send
+        self._healthz = healthz if healthz is not None else {"identity_id": "A"}
+        self.closed = False
+        self.get_calls = []  # (url, headers)
+        self.post_calls = []  # (url, headers, json)
+
+    @staticmethod
+    def _resp(spec):
+        if isinstance(spec, Exception):
+            return spec
+        return _RoutedResp(*spec)
+
+    def get(self, url, headers=None):
+        self.get_calls.append((url, headers))
+        if url.endswith("/v1/owner-dm"):
+            return _RoutedCall(self._resp(self._owner_dm))
+        if url.endswith("/healthz"):
+            return _RoutedCall(_RoutedResp(200, self._healthz))
+        return _RoutedCall(ConnectionError("unrouted"))
+
+    def post(self, url, headers=None, json=None):
+        self.post_calls.append((url, headers, json))
+        if url.endswith("/v1/send"):
+            return _RoutedCall(self._resp(self._send))
+        return _RoutedCall(ConnectionError("unrouted"))
+
+    def sends(self):
+        return [c for c in self.post_calls if c[0].endswith("/v1/send")]
+
+    async def close(self):
+        self.closed = True
+
+
+BRIDGE = "http://127.0.0.1:9001"
+BEARER = {"Authorization": "Bearer tok-A"}
+
+
+def _connected_adapter(monkeypatch, session):
+    a, _ = make_adapter(monkeypatch)
+    a._session = session
+    a.bridge_url = BRIDGE
+    a._token = "tok-A"
+    return a
+
+
+def _wired_fs(monkeypatch, session):
+    """A wired host as the standalone sender sees it: binding, connection
+    file and token file on disk, a fresh session per send."""
+    files = {
+        BINDING_PATH: binding("A"),
+        os.path.join(CONNECTIONS_DIR, "A.json"): conn_file(),
+        "/tok/A": "tok-A\n",
+    }
+    monkeypatch.setattr(adapter, "_read_file_text", make_fs(files))
+    monkeypatch.setattr(adapter, "_BINDING_PATH", BINDING_PATH)
+    monkeypatch.setattr(adapter, "_CONNECTIONS_DIR", CONNECTIONS_DIR)
+    monkeypatch.delenv("SECURECOMS_CONNECTION_FILE", raising=False)
+    monkeypatch.setattr(adapter, "_new_client_session", lambda: session)
+
+
+class TestCronRegistration:
+    """A.3: register(ctx) hands Hermes the out-of-process cron seams."""
+
+    def test_register_platform_carries_cron_env_var_and_standalone_sender(self, monkeypatch, fresh_gate):
+        _install_hermes_modules(monkeypatch)
+        ctx = _FakeCtx()
+        adapter.register(ctx)
+        assert len(ctx.platforms) == 1
+        kw = ctx.platforms[0]
+        assert kw["cron_deliver_env_var"] == "SECURECOMS_HOME_CHANNEL"
+        assert callable(kw["standalone_sender_fn"])
+        assert kw["standalone_sender_fn"] is adapter._standalone_send
+
+
+class TestCronLiveLane:
+    """A.6 live lane: adapter.send(chat_id="owner") resolves via GET /v1/owner-dm."""
+
+    @pytest.mark.asyncio
+    async def test_owner_resolves_to_the_manifest_dm_and_never_posts_owner(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        r = await a.send(chat_id="owner", content="x", metadata={"job_id": "j1"})
+        assert r.success is True
+        assert s.get_calls == [(f"{BRIDGE}/v1/owner-dm", BEARER)]
+        assert s.sends() == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": "dm-1", "text": "x"})]
+
+    @pytest.mark.asyncio
+    async def test_job_id_never_becomes_an_idempotency_key(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        await a.send(chat_id="owner", content="x", metadata={"job_id": "j1"})
+        await a.send(chat_id="owner", content="x", metadata={"job_id": "j1"})
+        bodies = [c[2] for c in s.sends()]
+        assert len(bodies) == 2
+        for b in bodies:
+            assert "idempotency_key" not in b
+            assert "in_reply_to" not in b
+            assert all("j1" not in str(v) for v in b.values())
+
+    @pytest.mark.asyncio
+    async def test_owner_with_reply_to_still_posts_no_reply_receipt(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        await a.send(chat_id="owner", content="x", reply_to="m-1")
+        assert s.sends() == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": "dm-1", "text": "x"})]
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("owner_dm", [
+        (404, {"error": "owner_dm_unknown"}),
+        (500, "boom"),
+        (200, {"channel_id": "owner"}),
+        (200, {"channel_id": "default"}),
+        (200, {"channel_id": ""}),
+        (200, {"channel_id": 7}),
+        (200, ["dm-1"]),
+        (200, ValueError("not json")),
+        ConnectionError("refused"),
+    ], ids=["404", "500", "answer-owner", "answer-default", "empty", "non-string", "list-body",
+            "bad-json", "network"])
+    async def test_unresolved_owner_posts_nothing_and_fails_with_the_fixed_error(self, monkeypatch, owner_dm):
+        s = RoutedSession(owner_dm=owner_dm)
+        a = _connected_adapter(monkeypatch, s)
+        r = await a.send(chat_id="owner", content="secret text", metadata={"job_id": "j1"})
+        assert r.success is False
+        assert r.error == adapter.OWNER_DM_UNKNOWN_ERROR
+        assert s.post_calls == []
+
+    @pytest.mark.asyncio
+    async def test_an_explicit_channel_id_is_unchanged(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        cid = "5b7f3a2e-0000-4000-8000-000000000001"
+        r = await a.send(chat_id=cid, content="x", metadata={"job_id": "j1"})
+        assert r.success is True
+        assert s.get_calls == []
+        assert s.sends() == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": cid, "text": "x"})]
+
+
+class TestCronStandaloneSender:
+    """A.6 standalone lane: _standalone_send, out of process, no live adapter."""
+
+    @pytest.mark.asyncio
+    async def test_one_post_with_bearer_and_resolved_channel(self, monkeypatch):
+        s = RoutedSession()
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "x", thread_id="t-1", force_document=True)
+        assert r == {"success": True, "message_id": "m-9"}
+        assert (f"{BRIDGE}/v1/owner-dm", BEARER) in s.get_calls
+        assert s.post_calls == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": "dm-1", "text": "x"})]
+        assert s.closed is True
+
+    @pytest.mark.asyncio
+    async def test_explicit_channel_passes_through_without_a_lookup(self, monkeypatch):
+        s = RoutedSession()
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "chan-7", "x")
+        assert r["success"] is True
+        assert all(not u.endswith("/v1/owner-dm") for u, _ in s.get_calls)
+        assert s.post_calls == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": "chan-7", "text": "x"})]
+
+    @pytest.mark.asyncio
+    async def test_owner_dm_404_posts_nothing_and_returns_the_error_dict(self, monkeypatch):
+        s = RoutedSession(owner_dm=(404, {"error": "owner_dm_unknown"}))
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "secret text")
+        assert r == {"error": adapter.OWNER_DM_UNKNOWN_ERROR}
+        assert s.post_calls == []
+        assert s.closed is True
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("send", [(500, "internal detail"), (403, {"error": "not_member"}),
+                                      ConnectionError("refused")], ids=["500", "403", "network"])
+    async def test_a_failed_send_returns_the_error_dict_not_success(self, monkeypatch, send):
+        s = RoutedSession(send=send)
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "secret text")
+        assert set(r) == {"error"}
+        assert isinstance(r["error"], str) and r["error"]
+        assert "secret text" not in r["error"] and "dm-1" not in r["error"]
+        assert "internal detail" not in r["error"]
+
+    @pytest.mark.asyncio
+    async def test_the_body_never_carries_in_reply_to_or_an_idempotency_key(self, monkeypatch):
+        s = RoutedSession()
+        _wired_fs(monkeypatch, s)
+        await adapter._standalone_send(None, "owner", "x")
+        await adapter._standalone_send(None, "chan-7", "x")
+        for _, _, body in s.post_calls:
+            assert set(body) == {"channel_id", "text"}
+
+    @pytest.mark.asyncio
+    async def test_media_files_post_nothing_and_return_the_fixed_error(self, monkeypatch):
+        s = RoutedSession()
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "x", media_files=["/x.png"])
+        assert r == {"error": adapter.PROACTIVE_MEDIA_ERROR}
+        assert s.post_calls == []
+        assert s.get_calls == []
+
+    @pytest.mark.asyncio
+    async def test_unwired_host_posts_nothing(self, monkeypatch):
+        s = RoutedSession()
+        _wired_fs(monkeypatch, s)
+        monkeypatch.setattr(adapter, "_read_file_text", make_fs({}))
+        r = await adapter._standalone_send(None, "owner", "x")
+        assert set(r) == {"error"}
+        assert s.post_calls == []
+
+    @pytest.mark.asyncio
+    async def test_a_gate_mismatch_posts_nothing(self, monkeypatch):
+        # The daemon at the connection file's address answers as another
+        # identity: the two-anchor gate refuses, exactly as for connect().
+        s = RoutedSession(healthz={"identity_id": "B"})
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "x")
+        assert set(r) == {"error"}
+        assert s.post_calls == []
+        assert s.closed is True
+
+    def test_the_fixed_errors_carry_no_channel_id_or_text(self):
+        for e in (adapter.OWNER_DM_UNKNOWN_ERROR, adapter.PROACTIVE_MEDIA_ERROR, adapter.PROACTIVE_UNAVAILABLE_ERROR):
+            assert isinstance(e, str) and e
+            assert "{" not in e and "%" not in e
+
+
+class _OldHermesCtx(_FakeCtx):
+    """register_platform as a Hermes whose PlatformEntry predates the cron
+    fields: an unknown keyword raises TypeError, like a dataclass __init__."""
+
+    def __init__(self, error=None):
+        super().__init__()
+        self.calls = []
+        self._error = error
+
+    def register_platform(self, **kw):
+        self.calls.append(kw)
+        if self._error is not None:
+            raise self._error
+        for name in ("cron_deliver_env_var", "standalone_sender_fn"):
+            if name in kw:
+                raise TypeError(f"PlatformEntry.__init__() got an unexpected keyword argument '{name}'")
+        self.platforms.append(kw)
+
+
+class TestCronRegistrationFallback:
+    """An older Hermes still loads the plugin (chat works); only cron is off."""
+
+    def test_old_hermes_registers_via_the_fallback(self, monkeypatch, fresh_gate, caplog):
+        _install_hermes_modules(monkeypatch)
+        ctx = _OldHermesCtx()
+        with caplog.at_level("WARNING", logger=adapter.logger.name):
+            adapter.register(ctx)
+        assert len(ctx.calls) == 2
+        assert len(ctx.platforms) == 1
+        kw = ctx.platforms[0]
+        assert kw["name"] == "securecoms"
+        assert callable(kw["adapter_factory"])
+        assert kw["check_fn"] is adapter.check_requirements
+        assert "cron_deliver_env_var" not in kw and "standalone_sender_fn" not in kw
+        assert any("no cron delivery hooks" in r.getMessage() for r in caplog.records)
+
+    def test_current_hermes_registers_once_with_the_cron_kwargs(self, monkeypatch, fresh_gate, caplog):
+        _install_hermes_modules(monkeypatch)
+        ctx = _FakeCtx()
+        with caplog.at_level("WARNING", logger=adapter.logger.name):
+            adapter.register(ctx)
+        assert len(ctx.platforms) == 1
+        assert ctx.platforms[0]["standalone_sender_fn"] is adapter._standalone_send
+        assert not any("no cron delivery hooks" in r.getMessage() for r in caplog.records)
+
+    @pytest.mark.parametrize("error", [TypeError("adapter_factory must be callable"), ValueError("standalone_sender_fn must be a coroutine function")],
+                             ids=["unrelated-TypeError", "ValueError-naming-a-cron-kwarg"])
+    def test_any_other_error_propagates_without_a_retry(self, monkeypatch, fresh_gate, error):
+        _install_hermes_modules(monkeypatch)
+        ctx = _OldHermesCtx(error=error)
+        with pytest.raises(type(error)):
+            adapter.register(ctx)
+        assert len(ctx.calls) == 1
+
+
+class TestCronStandaloneSuccessShapes:
+    """Review r1 #2/#3: a 2xx is a sent message, whatever its body."""
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("send", [(200, ValueError("not json")), (200, {}), (200, "ok"), (201, {"message_id": "m-2"})],
+                             ids=["200-bad-json", "200-no-id", "200-non-dict", "201"])
+    async def test_a_2xx_is_success_and_never_the_string_none(self, monkeypatch, send):
+        s = RoutedSession(send=send)
+        _wired_fs(monkeypatch, s)
+        r = await adapter._standalone_send(None, "owner", "x")
+        assert r.get("success") is True
+        assert "error" not in r
+        assert r.get("message_id") != "None"
+        assert len(s.post_calls) == 1
+
+
+# Review r1 #1: "a proactive send never carries a file, in any lane". On the
+# live lane Hermes degrades media through the base emit_warning /
+# emit_media_warning, so those two refuse the "owner" literal. The base
+# send_* media methods must NOT be overridden (Hermes identity check).
+_BASE_MEDIA_METHODS = ("send_image_file", "send_document", "send_voice", "send_video", "send_animation")
+
+
+@pytest.fixture
+def base_warnings(monkeypatch):
+    """Give the stub base emit_warning / emit_media_warning, recording calls."""
+    base = adapter.BasePlatformAdapter
+    calls = []
+
+    async def emit_warning(self, chat_id, content, *, reply_to=None, metadata=None, logical_platform=None):
+        calls.append(("emit_warning", chat_id, content, reply_to, metadata))
+        return await self.send(chat_id, content)
+
+    async def emit_media_warning(self, chat_id, content, *, caption=None, reply_to=None, metadata=None, shown_metadata=None):
+        calls.append(("emit_media_warning", chat_id, content, caption, shown_metadata))
+        return await self.send(chat_id, content)
+
+    monkeypatch.setattr(base, "emit_warning", emit_warning, raising=False)
+    monkeypatch.setattr(base, "emit_media_warning", emit_media_warning, raising=False)
+    return calls
+
+
+class TestLiveLaneMediaToOwner:
+    @pytest.mark.asyncio
+    async def test_send_image_to_owner_posts_nothing(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        r = await a.send_image("owner", "https://x/y.png", caption="c")
+        assert r.success is False
+        assert r.error == adapter.PROACTIVE_MEDIA_ERROR
+        assert s.post_calls == [] and s.get_calls == []
+
+    @pytest.mark.asyncio
+    async def test_send_image_to_a_channel_is_unchanged(self, monkeypatch):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        r = await a.send_image("chan-7", "https://x/y.png")
+        assert r.success is True
+        assert s.sends() == [(f"{BRIDGE}/v1/send", BEARER, {"channel_id": "chan-7", "text": "https://x/y.png"})]
+
+    @pytest.mark.parametrize("name", _BASE_MEDIA_METHODS)
+    def test_base_media_methods_are_not_overridden(self, name):
+        # Hermes _send_live_adapter_media: an override defeats the
+        # "not implemented natively" check and yields a false success.
+        assert getattr(adapter.SecureComsAdapter, name, None) is getattr(adapter.BasePlatformAdapter, name, None)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("name", ["emit_warning", "emit_media_warning"])
+    @pytest.mark.parametrize("as_keyword", [False, True], ids=["positional", "keyword"])
+    async def test_warning_to_owner_posts_nothing(self, monkeypatch, base_warnings, name, as_keyword):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        method = getattr(a, name)
+        r = await (method(chat_id="owner", content="couldn't send /secret/r.pdf") if as_keyword
+                   else method("owner", "couldn't send /secret/r.pdf"))
+        assert r.success is False and r.error == adapter.PROACTIVE_MEDIA_ERROR
+        assert s.post_calls == [] and s.get_calls == []
+        assert base_warnings == []
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("name", ["emit_warning", "emit_media_warning"])
+    async def test_warning_to_a_channel_delegates_unchanged(self, monkeypatch, base_warnings, name):
+        s = RoutedSession()
+        a = _connected_adapter(monkeypatch, s)
+        r = await getattr(a, name)("chan-7", "notice", reply_to="m1", metadata={"k": 1})
+        assert r.success is True
+        assert [c[:3] for c in base_warnings] == [(name, "chan-7", "notice")]
+        assert [c[2]["channel_id"] for c in s.sends()] == ["chan-7"]

package/connectors/openclaw/openclaw-entry.js

@@ -86,6 +86,13 @@ const _channels = new Map();
 
 export const MAX_INBOUND_ATTEMPTS = 3;
 
+// Outbound target ids the plugin advertises. They are NOT channel ids: both
+// resolve to the owner DM through the bridge. Failure text wording approved by Eric 2026-11-12;
+// keep it a single constant. It must never carry a channel id or text.
+export const OUTBOUND_TARGET_IDS = ["owner", "default"];
+export const OWNER_DM_UNKNOWN_ERROR =
+  "SecureComs could not find the owner's direct message. The agent needs its signed owner settings first.";
+
 /**
  * Voice calls (owner report 2026-10-02): prefixes the daemon's compiled-in
  * spoken-reply guidance on a live voice turn, so a turn the voice front desk
@@ -971,6 +978,28 @@ export class LoopbackChannel {
     return r.json();
   }
 
+  /**
+   * Resolve the owner DM channel id through the bridge (GET /v1/owner-dm), which
+   * reads it from the owner-signed manifest in force and nowhere else. Returns
+   * the id, or null on ANY failure (404, non-2xx, network error, malformed
+   * body, empty id, or an id that is itself an advertised target name). The
+   * caller must not send when this returns null: no fallback, no guess.
+   */
+  async ownerDmChannelId() {
+    try {
+      const r = await fetch(`${this.bridgeUrl}/v1/owner-dm`, {
+        headers: { authorization: `Bearer ${this.token}` },
+      });
+      if (!r.ok) return null;
+      const body = await r.json();
+      const id = body?.channel_id;
+      if (typeof id !== "string" || id === "" || OUTBOUND_TARGET_IDS.includes(id)) return null;
+      return id;
+    } catch {
+      return null;
+    }
+  }
+
   // Report agent operational status to the daemon (POST /v1/status). Drives the
   // web "… is thinking…" strip (J1, #910). A port of the runtime's reporter
   // (packages/connect-agent-runtime/src/status-reporter.ts, #911):
@@ -1347,14 +1376,22 @@ const secureComsPlugin = {
       { id: "owner", label: "SecureComs Owner", accountId: "default" },
       { id: "default", label: "SecureComs Owner (default)", accountId: "default" },
     ],
-    // Proactive send (cron / cross-channel). Requires an explicit target channel
-    // id in `to`; without channel context we can't guess which SecureComs
-    // conversation to use, so this errors rather than mis-routing.
+    // Proactive send (cron / cross-channel). "owner" and "default" are the
+    // advertised targets: they resolve to the owner DM through the bridge's
+    // GET /v1/owner-dm (owner-signed manifest in force) and fail closed, never
+    // posting the literal name as a channel id. Any other `to` is an explicit
+    // channel id, as before.
     sendText: async ({ text, to, accountId }) => {
       const ch = _channels.get(accountId ?? "default");
       if (!ch) return { ok: false, error: "SecureComs channel is not connected" };
       if (!to) return { ok: false, error: "SecureComs proactive send requires a target channel_id in `to`" };
       try {
+        if (OUTBOUND_TARGET_IDS.includes(to)) {
+          const resolved = await ch.ownerDmChannelId();
+          if (!resolved) return { ok: false, error: OWNER_DM_UNKNOWN_ERROR };
+          await ch.send(resolved, text);
+          return { ok: true };
+        }
         await ch.send(to, text);
         return { ok: true };
       } catch (err) {

package/connectors/openclaw/openclaw-entry.outbound.test.ts

@@ -0,0 +1,217 @@
+// packages/connect-agent-bridge/connectors/openclaw/openclaw-entry.outbound.test.ts
+//
+// Item A (proactive delivery): the OpenClaw connector advertises the outbound
+// targets "owner" and "default". They are not channel ids. They resolve through
+// the bridge's bearer-gated GET /v1/owner-dm (the owner DM from the signed
+// manifest in force), and fail closed: a 404, any non-2xx, a network error or a
+// malformed body posts NOTHING and returns {ok:false, error: OWNER_DM_UNKNOWN_ERROR}.
+// Any other `to` keeps the explicit-channel behaviour.
+//
+// Drives the REAL plugin.gateway.startAccount path with a fake loopback
+// WebSocket and a fake fetch (same harness shape as openclaw-entry.inbound.test.ts).
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildConnectionFile, writeConnectionFile } from "../../src/service/connection-file.js";
+
+const BOUND_ID = "agent-identity";
+const PORT = 7097;
+const TOKEN_VALUE = "outbound-test-token";
+const ORIGINAL_CONN_FILE_ENV = process.env.SECURECOMS_CONNECTION_FILE;
+
+function waitFor(predicate: () => boolean, timeout = 3000): Promise<void> {
+  const start = Date.now();
+  return new Promise((resolve, reject) => {
+    const check = () => {
+      if (predicate()) return resolve();
+      if (Date.now() - start > timeout) return reject(new Error("waitFor: condition never became true"));
+      setTimeout(check, 5);
+    };
+    check();
+  });
+}
+
+function makeFakeWebSocket() {
+  const instances: any[] = [];
+  class FakeWebSocket {
+    listeners: Record<string, Array<(ev?: unknown) => void>> = {};
+    constructor(public url: string) { instances.push(this); }
+    addEventListener(type: string, cb: (ev?: unknown) => void) { (this.listeners[type] ??= []).push(cb); }
+    send() {}
+    close() { this._emit("close"); }
+    _emit(type: string, ev?: unknown) { for (const cb of this.listeners[type] ?? []) cb(ev ?? {}); }
+  }
+  return { FakeWebSocket, instances };
+}
+
+type OwnerDm =
+  | { kind: "ok"; body: unknown }
+  | { kind: "status"; status: number; body?: unknown }
+  | { kind: "network" }
+  | { kind: "badjson" };
+
+describe("openclaw-entry: outbound owner/default targets resolve through /v1/owner-dm", () => {
+  let home: string;
+  let controller: AbortController;
+  let sends: Array<Record<string, unknown>>;
+  let ownerDmCalls: Array<{ auth: string | null }>;
+  let ownerDm: OwnerDm;
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "sc-outbound-"));
+    const tokenFile = join(home, "bridge-token");
+    writeFileSync(tokenFile, TOKEN_VALUE, { mode: 0o600 });
+    writeConnectionFile(home, buildConnectionFile({
+      identityId: BOUND_ID, port: PORT, tokenFile, slug: "outbound-test", label: "Outbound Test",
+      instanceId: "outbound-test-instance", now: new Date().toISOString(),
+    }));
+    process.env.SECURECOMS_CONNECTION_FILE = join(home, ".securecoms", "connections", `${BOUND_ID}.json`);
+    sends = [];
+    ownerDmCalls = [];
+    ownerDm = { kind: "ok", body: { channel_id: "dm-1" } };
+    vi.stubGlobal("fetch", vi.fn(async (url: string, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/healthz")) return { ok: true, json: async () => ({ identity_id: BOUND_ID, joined_channels: 1 }) };
+      if (u.endsWith("/v1/owner-dm")) {
+        const h = (init?.headers ?? {}) as Record<string, string>;
+        ownerDmCalls.push({ auth: h.authorization ?? null });
+        if (ownerDm.kind === "network") throw new Error("ECONNREFUSED");
+        if (ownerDm.kind === "badjson") {
+          return { ok: true, status: 200, json: async () => { throw new SyntaxError("bad json"); }, text: async () => "<html>" };
+        }
+        if (ownerDm.kind === "status") {
+          return { ok: false, status: ownerDm.status, json: async () => ownerDm.kind === "status" ? ownerDm.body ?? {} : {}, text: async () => "" };
+        }
+        return { ok: true, status: 200, json: async () => ownerDm.body };
+      }
+      if (u.endsWith("/v1/send")) {
+        sends.push(JSON.parse(String(init?.body)));
+        return { ok: true, json: async () => ({ message_id: "m-1" }) };
+      }
+      if (u.endsWith("/v1/status")) return { ok: true, json: async () => ({ ok: true }) };
+      throw new Error(`unexpected fetch: ${u}`);
+    }));
+    controller = new AbortController();
+  });
+
+  afterEach(async () => {
+    controller.abort();
+    vi.unstubAllGlobals();
+    vi.unmock("node:os");
+    if (ORIGINAL_CONN_FILE_ENV === undefined) delete process.env.SECURECOMS_CONNECTION_FILE;
+    else process.env.SECURECOMS_CONNECTION_FILE = ORIGINAL_CONN_FILE_ENV;
+    vi.resetModules();
+  });
+
+  async function start() {
+    vi.resetModules();
+    vi.doMock("node:os", async (importOriginal) => {
+      const actual = await importOriginal<typeof import("node:os")>();
+      return { ...actual, homedir: () => home };
+    });
+    const mod = await import("./openclaw-entry.js");
+    let plugin: any;
+    mod.default.register({
+      runtime: { channel: {}, error: () => {} },
+      on: () => {},
+      registerTrustedToolPolicy: () => {},
+      registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; },
+    });
+    const { FakeWebSocket, instances } = makeFakeWebSocket();
+    vi.stubGlobal("WebSocket", FakeWebSocket);
+    const account = plugin.config.resolveAccount({}, "default");
+    plugin.gateway.startAccount({ account, cfg: {}, log: () => {}, abortSignal: controller.signal }).catch(() => {});
+    await waitFor(() => instances.length >= 1);
+    instances[0]._emit("open");
+    return { plugin, mod };
+  }
+
+  const advertised = ["owner", "default"] as const;
+
+  it("keeps the advertised target labels unchanged", async () => {
+    const { plugin } = await start();
+    expect(plugin.outbound.targets).toEqual([
+      { id: "owner", label: "SecureComs Owner", accountId: "default" },
+      { id: "default", label: "SecureComs Owner (default)", accountId: "default" },
+    ]);
+  });
+
+  for (const to of advertised) {
+    it(`(a) to="${to}": resolves via /v1/owner-dm with the bearer and sends once to the resolved channel`, async () => {
+      const { plugin } = await start();
+      const res = await plugin.outbound.sendText({ text: "x", to, accountId: "default" });
+      expect(res).toEqual({ ok: true });
+      expect(ownerDmCalls).toEqual([{ auth: `Bearer ${TOKEN_VALUE}` }]);
+      expect(sends).toHaveLength(1);
+      expect(sends[0]).toEqual({ channel_id: "dm-1", text: "x" }); // no in_reply_to, no idempotency_key
+    });
+
+    it(`(b) to="${to}": a 404 posts nothing and returns the fixed error`, async () => {
+      const { plugin, mod } = await start();
+      ownerDm = { kind: "status", status: 404, body: { error: "owner_dm_unknown" } };
+      const res = await plugin.outbound.sendText({ text: "secret body", to, accountId: "default" });
+      expect(sends).toHaveLength(0);
+      expect(res.ok).toBe(false);
+      expect(res.error).toBe(mod.OWNER_DM_UNKNOWN_ERROR);
+      expect(res.error.length).toBeGreaterThan(0);
+      expect(res.error).not.toContain("secret body");
+    });
+  }
+
+  const failures: Array<[string, OwnerDm]> = [
+    ["a 500", { kind: "status", status: 500 }],
+    ["a 401", { kind: "status", status: 401 }],
+    ["a network error", { kind: "network" }],
+    ["a non-JSON 200 body", { kind: "badjson" }],
+    ["a 200 with no channel_id", { kind: "ok", body: {} }],
+    ["a 200 with an empty channel_id", { kind: "ok", body: { channel_id: "" } }],
+    ["a 200 with a non-string channel_id", { kind: "ok", body: { channel_id: 7 } }],
+    ["a 200 that resolves to the literal 'owner'", { kind: "ok", body: { channel_id: "owner" } }],
+    ["a 200 that resolves to the literal 'default'", { kind: "ok", body: { channel_id: "default" } }],
+  ];
+  for (const [name, mode] of failures) {
+    it(`(b) ${name} fails closed: no send, fixed error`, async () => {
+      const { plugin, mod } = await start();
+      ownerDm = mode;
+      const res = await plugin.outbound.sendText({ text: "x", to: "owner", accountId: "default" });
+      expect(sends).toHaveLength(0);
+      expect(res).toEqual({ ok: false, error: mod.OWNER_DM_UNKNOWN_ERROR });
+    });
+  }
+
+  it("(c) in no case does a send carry channel_id 'owner' or 'default'", async () => {
+    const { plugin } = await start();
+    const modes: OwnerDm[] = [
+      { kind: "ok", body: { channel_id: "dm-1" } },
+      { kind: "status", status: 404, body: { error: "owner_dm_unknown" } },
+      { kind: "status", status: 500 },
+      { kind: "network" },
+      { kind: "badjson" },
+      { kind: "ok", body: {} },
+    ];
+    for (const m of modes) {
+      ownerDm = m;
+      for (const to of advertised) await plugin.outbound.sendText({ text: "x", to, accountId: "default" });
+    }
+    expect(sends.length).toBeGreaterThan(0); // vacuity control: the ok mode did send
+    expect(sends.some((s) => s.channel_id === "owner" || s.channel_id === "default")).toBe(false);
+  });
+
+  it("any other `to` keeps the explicit-channel behaviour and never calls /v1/owner-dm", async () => {
+    const { plugin } = await start();
+    const res = await plugin.outbound.sendText({ text: "x", to: "chan-uuid-1", accountId: "default" });
+    expect(res).toEqual({ ok: true });
+    expect(ownerDmCalls).toHaveLength(0);
+    expect(sends).toEqual([{ channel_id: "chan-uuid-1", text: "x" }]);
+  });
+
+  it("no `to` still errors without a send or a lookup", async () => {
+    const { plugin } = await start();
+    const res = await plugin.outbound.sendText({ text: "x", accountId: "default" });
+    expect(res.ok).toBe(false);
+    expect(sends).toHaveLength(0);
+    expect(ownerDmCalls).toHaveLength(0);
+  });
+});

package/dist/bin.d.ts

@@ -29,6 +29,8 @@ export declare function slugFromCredentialPath(credentialPath: string): string;
 export declare function chooseInstallExecPath(runningExecPath: string, override: string | undefined, deps: ResolveNodeDeps): string;
 export declare function realGetHealth(port: number): DaemonHealth | null;
 export declare function realCopyConnector(srcDir: string, dstDir: string, harness: Harness): void;
+export declare function realReadHermesEnv(p: string): string | null;
+export declare function realAppendHermesEnv(p: string, text: string): void;
 /** The stderr line (with newline) a failed service verb prints. */
 export declare function formatServiceError(verb: string, e: unknown): string;
 /**

package/dist/bin.js

@@ -44763,6 +44763,16 @@ var BridgeAgent = class _BridgeAgent {
   async consumeUploaded(read) {
     if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog("warn", "vault_outbox.consume_failed");
   }
+  /**
+   * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+   * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+   */
+  ownerDmChannelId() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const inForce = pin !== null ? this.toolGrantManifest : null;
+    const id = inForce?.owner_dm_channel_id;
+    return typeof id === "string" && id !== "" ? id : null;
+  }
   /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
   vaultOutboxPath() {
     return this.outboxPin?.dir ?? null;
@@ -50172,7 +50182,9 @@ function capabilities(opts) {
     // version this daemon parses into BridgeMessage.vault_refs (never fetched
     // on receipt) and opens with the R4 pins on /v1/vault-read. A daemon
     // without this field skips and acks a link, so the agent never sees it.
-    vault_ref: 1
+    vault_ref: 1,
+    // Item A: GET /v1/owner-dm resolves the literal `owner`/`default` cron target from the signed manifest in force.
+    owner_dm_route: 1
   };
 }
 var SEND_CAP = 64 * 1024;
@@ -50356,6 +50368,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/vault-outbox") {
         return json(res, 200, { path: agent.vaultOutboxPath() });
       }
+      if (method === "GET" && path === "/v1/owner-dm") {
+        const channelId = agent.ownerDmChannelId();
+        return channelId === null ? json(res, 404, { error: "owner_dm_unknown" }) : json(res, 200, { channel_id: channelId });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
@@ -51138,7 +51154,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
 var LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 // src/bin.ts
-import { readFileSync as readFileSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync4, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync7 } from "node:fs";
+import { readFileSync as readFileSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5, appendFileSync, rmSync as rmSync8, existsSync as existsSync7, realpathSync as realpathSync4, readdirSync as readdirSync4, statSync as statSync8, chmodSync as chmodSync7 } from "node:fs";
 import { join as join27, dirname as dirname14, isAbsolute as isAbsolute3, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5, userInfo } from "node:os";
@@ -51587,6 +51603,36 @@ function enableHermesConfig(home, deps) {
     message: `enabled ${HERMES_PLUGIN_NAME} in ${path} (the original was backed up alongside it as config.yaml.bak-wire-<ts>-<pid>).`
   };
 }
+var HERMES_HOME_CHANNEL_KEY = "SECURECOMS_HOME_CHANNEL";
+var HERMES_HOME_CHANNEL_LINE = `${HERMES_HOME_CHANNEL_KEY}=owner`;
+function hermesEnvPath(home) {
+  return `${home}/.hermes/.env`;
+}
+var HOME_CHANNEL_ASSIGNMENT = new RegExp(`^\\s*(?:export\\s+)?${HERMES_HOME_CHANNEL_KEY}\\s*=`, "m");
+function homeChannelEnvAppendix(text) {
+  const current = text ?? "";
+  if (HOME_CHANNEL_ASSIGNMENT.test(current)) return null;
+  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
+  return `${sep}${HERMES_HOME_CHANNEL_LINE}
+`;
+}
+function ensureHermesHomeChannel(home, deps) {
+  const path = hermesEnvPath(home);
+  try {
+    const appendix = homeChannelEnvAppendix(deps.readHermesEnv(path));
+    if (appendix === null) {
+      deps.log(`[securecoms] ${HERMES_HOME_CHANNEL_KEY} is already set in ${path}; kept as is.`);
+      return;
+    }
+    deps.appendHermesEnv(path, appendix);
+    deps.log(`[securecoms] set ${HERMES_HOME_CHANNEL_LINE} in ${path} (scheduled messages go to the owner's DM).`);
+  } catch {
+    deps.log(
+      `wire: could not update ${path}; scheduled messages need it. Add this line manually:
+  ${HERMES_HOME_CHANNEL_LINE}`
+    );
+  }
+}
 function parseArg(argv, flag) {
   const i = argv.indexOf(flag);
   return i >= 0 ? argv[i + 1] : void 0;
@@ -51635,6 +51681,7 @@ function runWire(deps) {
       );
       return 1;
     }
+    ensureHermesHomeChannel(deps.home, deps);
   }
   if (typeof entry.port === "number") {
     const h = deps.getHealth(entry.port);
@@ -52883,6 +52930,17 @@ function realBackupHermesConfig(p, originalText) {
 function realWriteHermesConfig(p, newText) {
   writeFileSync5(p, newText, "utf8");
 }
+function realReadHermesEnv(p) {
+  try {
+    return readFileSync17(p, "utf8");
+  } catch (e) {
+    if (e?.code === "ENOENT") return null;
+    throw e;
+  }
+}
+function realAppendHermesEnv(p, text) {
+  appendFileSync(p, text, { encoding: "utf8", mode: 384 });
+}
 function realWireArgv() {
   if (process.argv.includes("--harness")) return process.argv;
   const detected = detectHarness(homedir5(), realStatDir);
@@ -52906,7 +52964,9 @@ function realWireDeps() {
     connectorsSrcDir: (h) => connectorsSrcDir(import.meta.url, h),
     readHermesConfig: realReadHermesConfig,
     backupHermesConfig: realBackupHermesConfig,
-    writeHermesConfig: realWriteHermesConfig
+    writeHermesConfig: realWriteHermesConfig,
+    readHermesEnv: realReadHermesEnv,
+    appendHermesEnv: realAppendHermesEnv
   };
 }
 function runWireVerb(verb) {
@@ -53365,8 +53425,10 @@ export {
   formatServiceError,
   nodeMajorOk,
   parseVerb,
+  realAppendHermesEnv,
   realCopyConnector,
   realGetHealth,
+  realReadHermesEnv,
   runMode,
   slugFromCredentialPath,
   startThenServe,

package/dist/bridge-agent.d.ts

@@ -2539,6 +2539,11 @@ export declare class BridgeAgent {
     }>;
     /** Audit 2026-10-30 MED 5: an uploaded file leaves the outbox (no plaintext lingers). Content-free log. */
     private consumeUploaded;
+    /**
+     * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+     * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+     */
+    ownerDmChannelId(): string | null;
     /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
     vaultOutboxPath(): string | null;
     /** Download + verify + decrypt a vault file node. Returns the plaintext

package/dist/http-server.d.ts

@@ -58,6 +58,7 @@ export declare function capabilities(opts: {
     send_types: string[];
     webhook_push: boolean;
     vault_ref: number;
+    owner_dm_route: number;
 };
 export declare const memoryRecordSchema: z.ZodObject<{
     conversation_id: z.ZodString;

package/dist/index.js

@@ -44477,6 +44477,16 @@ var BridgeAgent = class _BridgeAgent {
   async consumeUploaded(read) {
     if (!this.outboxPin || !await consumeOutboxFile(this.outboxPin, read)) writeServiceLog2("warn", "vault_outbox.consume_failed");
   }
+  /**
+   * Item A (OQ-A1): the owner DM channel id of the signed manifest in force, else null. In force means the owner pin is
+   * set (same guard as applyManifest). No channelOwner, no listChannels heuristic, no fallback.
+   */
+  ownerDmChannelId() {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    const inForce = pin !== null ? this.toolGrantManifest : null;
+    const id = inForce?.owner_dm_channel_id;
+    return typeof id === "string" && id !== "" ? id : null;
+  }
   /** Audit 2026-10-30 MED 3: the pinned outbox path, served only on the authenticated GET /v1/vault-outbox. */
   vaultOutboxPath() {
     return this.outboxPin?.dir ?? null;
@@ -50032,7 +50042,9 @@ function capabilities(opts) {
     // version this daemon parses into BridgeMessage.vault_refs (never fetched
     // on receipt) and opens with the R4 pins on /v1/vault-read. A daemon
     // without this field skips and acks a link, so the agent never sees it.
-    vault_ref: 1
+    vault_ref: 1,
+    // Item A: GET /v1/owner-dm resolves the literal `owner`/`default` cron target from the signed manifest in force.
+    owner_dm_route: 1
   };
 }
 var SEND_CAP = 64 * 1024;
@@ -50216,6 +50228,10 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/vault-outbox") {
         return json(res, 200, { path: agent.vaultOutboxPath() });
       }
+      if (method === "GET" && path === "/v1/owner-dm") {
+        const channelId = agent.ownerDmChannelId();
+        return channelId === null ? json(res, 404, { error: "owner_dm_unknown" }) : json(res, 200, { channel_id: channelId });
+      }
       if (method === "POST" && path === "/v1/send-attachment") {
         const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
         if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);

package/dist/service/wire.d.ts

@@ -60,6 +60,14 @@ export interface WireDeps extends HermesConfigIoDeps {
      * tests and never inspects the path for its own sake).
      */
     connectorsSrcDir: (harness: Harness) => string;
+    /** The Hermes profile env file's text; null when the file does not exist.
+     *  Throws on any other read failure, so an unreadable file is never
+     *  mistaken for an absent key (see ensureHermesHomeChannel). */
+    readHermesEnv: (path: string) => string | null;
+    /** Appends `text` to the env file (creating it 0600 when missing). An
+     *  append never rewrites another line and never changes an existing
+     *  file's mode. */
+    appendHermesEnv: (path: string, text: string) => void;
 }
 /**
  * Detects an installed harness by probing well-known home-relative dirs.
@@ -136,6 +144,22 @@ export declare function enableHermesConfig(home: string, deps: HermesConfigIoDep
     ok: boolean;
     message: string;
 };
+/** The Hermes cron home-channel env var (the connector registers it as
+ *  `cron_deliver_env_var`) and the value `wire` sets: the literal `owner`,
+ *  which the connector resolves only through GET /v1/owner-dm (Item A). */
+export declare const HERMES_HOME_CHANNEL_KEY = "SECURECOMS_HOME_CHANNEL";
+export declare const HERMES_HOME_CHANNEL_LINE = "SECURECOMS_HOME_CHANNEL=owner";
+/** The env file Hermes loads for the profile `wire` targets: `<HERMES_HOME>/.env`,
+ *  with HERMES_HOME the default `~/.hermes` (the same profile scope as
+ *  `hermesConfigPath`). */
+export declare function hermesEnvPath(home: string): string;
+/** The text to append so the env file sets the home channel, or null when the
+ *  key is already assigned (any value, including an owner-set channel id or an
+ *  empty one: `wire` never overwrites it). Pure. */
+export declare function homeChannelEnvAppendix(text: string | null): string | null;
+/** Sets the Hermes cron home channel when absent. Never fatal to `wire`: the
+ *  connector is wired without it, and a failure prints the manual line. */
+export declare function ensureHermesHomeChannel(home: string, deps: Pick<WireDeps, "readHermesEnv" | "appendHermesEnv" | "log">): void;
 /**
  * Installs the reference connector into the harness's plugin dir and drops
  * an explicit securecoms.binding.json naming the resolved agent's identity.

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.39.0";
+export declare const BRIDGE_VERSION = "0.40.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "type": "module",
   "engines": {
     "node": ">=24"