@staix/agent-hub 0.19.0 → 0.21.0

package/src/memory/brief.ts

@@ -19,10 +19,14 @@ export function parseRows(markdown: string | undefined): BriefItem[] {
 }
 
 /** Index first, then the neighbourhood of the top hit: the retrieval both task briefs and `ahub ask` use. Deduplicated, in order. */
-export async function related(client: MemoryClient, project: string, query: string, around = 3): Promise<BriefItem[]> {
-  const hits = parseRows(await client.search(query.slice(0, 300), project, 10));
+export async function related(client: MemoryClient, project: string, query: string, around = 3, current?: () => boolean): Promise<BriefItem[]> {
+  const search = await client.search(query.slice(0, 300), project, 10);
+  if (current && !current()) throw new Error("brief context changed");
+  const hits = parseRows(search);
   if (!hits.length) return [];
-  const near = parseRows(await client.timeline(hits[0]!.id, project, around, around));
+  const timeline = await client.timeline(hits[0]!.id, project, around, around);
+  if (current && !current()) throw new Error("brief context changed");
+  const near = parseRows(timeline);
   const out: BriefItem[] = [];
   for (const item of [...hits, ...near]) if (!out.some((o) => o.id === item.id)) out.push(item);
   return out;
@@ -34,7 +38,14 @@ export type NativeBrief = (task: BriefTask) => NativeItem[] | Promise<NativeItem
 export interface IntentBriefContext { source: IntentBriefSource; options: IntentBriefOptions }
 /** Host-owned policy and store binding; the library owns relevance, ordering and text. */
 export type IntentBriefHost = (task: BriefTask) => IntentBriefContext | Promise<IntentBriefContext>;
-export interface BriefTask { id?: number; created?: number; title: string; refs: { paths?: string[] }; plan?: { paths?: string[]; symbols?: string[] } }
+export interface BriefTask { id?: number; created?: number; updated?: number; owner?: string | null; history?: readonly unknown[]; title: string; refs: { paths?: string[] }; plan?: { paths?: string[]; symbols?: string[] } }
+
+/** Host-authorized corpus reads. The port screens and sanitizes its returned public note lines. */
+export interface CorpusBriefPort {
+  allowed(task: BriefTask): boolean;
+  policyVersion(): string;
+  read(task: BriefTask): NativeItem[] | Promise<NativeItem[]>;
+}
 
 /**
  * Production task briefs use the library's intent retrieval and rendering with host policy and bindings.
@@ -55,23 +66,49 @@ export class Briefs {
     private readonly observe?: (peer: PeerId, task: number, counts: { native: number; fails: number; claudeMem: number }) => void,
     private readonly displayNative?: (items: readonly NativeItem[]) => string[],
     private readonly intent?: IntentBriefHost,
+    private readonly corpus?: CorpusBriefPort,
   ) {}
 
   async forTask(peer: PeerId, task: BriefTask, priority: readonly NativeItem[] = []): Promise<string | undefined> {
     // A brief snapshots its configured cap once, before either optional source is selected.
     const maximum = typeof this.maxItems === "function" ? this.maxItems() : this.maxItems;
+    let corpusRevision: string | undefined;
+    const allowed = (): boolean => {
+      if (!this.corpus) return true;
+      try { return this.corpus.allowed(task); } catch { return false; }
+    };
+    const current = (): boolean => {
+      if (!this.corpus) return true;
+      try { return allowed() && this.corpus.policyVersion() === corpusRevision; } catch { return false; }
+    };
+    if (this.corpus) {
+      if (!allowed()) return undefined;
+      try { corpusRevision = this.corpus.policyVersion(); } catch { return undefined; }
+      if (!current()) return undefined;
+    }
+    const corpusItems = async (room: number): Promise<NativeItem[] | undefined> => {
+      if (!this.corpus || room < 1) return [];
+      if (!current()) return undefined;
+      try {
+        const items = await this.corpus.read(task);
+        if (!current()) return undefined;
+        return items;
+      } catch { return current() ? [] : undefined; }
+    };
     if (this.intent) {
       // Serialize only this peer's library reads, so awaited policy cannot duplicate a delivered note.
       const previous = this.libraryRuns.get(peer);
       const run = (async () => {
         await previous?.catch(() => undefined);
+        if (!current()) return undefined;
         if (maximum < 1) return undefined;
         try {
           const context = await this.intent!(task);
+          if (!current()) return undefined;
           const seen = this.seen.get(peer) ?? new Set<string>();
-          this.seen.set(peer, seen);
           const revision = context.options.policyVersion();
           const result = await buildIntentBrief(context.source, context.options);
+          if (!current()) return undefined;
           if (result.state === "unknown" || context.options.allowed?.() === false || context.options.policyVersion() !== revision) return undefined;
           context.options.assertCurrent?.();
           const lines = result.text.split("\n");
@@ -84,28 +121,49 @@ export class Briefs {
             const id = `mem:${item.id}`;
             if (selected.length < maximum && !seen.has(id) && !selected.some(row => row.id === id)) selected.push({ id, line: rendered.get(id)!, kind: item.kind });
           }
+          const corpus = await corpusItems(maximum - selected.length);
+          if (corpus === undefined || !current()) return undefined;
+          for (const item of corpus) if (selected.length < maximum && !seen.has(item.id) && !selected.some(row => row.id === item.id)) selected.push(item);
           if (!selected.length) return undefined;
           // Preserve complete library rows (including graph neighbours after a seen direct bridge).
-          const text = [lines[0] || "Live fail notes for this plan (advice, not a block):", ...selected.map(item => item.line)].join("\n");
+          if (!current()) return undefined;
+          const header = selected.some(item => item.kind === "note") ? "Knowledge brief (advice, not a block):" : lines[0] || "Live fail notes for this plan (advice, not a block):";
+          const text = [header, ...selected.map(item => item.line)].join("\n");
+          if (!current()) return undefined;
+          this.seen.set(peer, seen);
           for (const item of selected) seen.add(item.id);
-          if (task.id !== undefined) try { this.observe?.(peer, task.id, { native: selected.length, fails: selected.filter(item => item.kind === "fail").length, claudeMem: 0 }); } catch { /* telemetry never fails a brief */ }
+          if (!current()) return undefined;
+          if (task.id !== undefined) try { this.observe?.(peer, task.id, { native: selected.filter(item => item.kind !== "note").length, fails: selected.filter(item => item.kind === "fail").length, claudeMem: 0 }); } catch { /* telemetry never fails a brief */ }
           return text;
         } catch { return undefined; }
       })();
       this.libraryRuns.set(peer, run);
       try { return await run; } finally { if (this.libraryRuns.get(peer) === run) this.libraryRuns.delete(peer); }
     }
+    if (!current()) return undefined;
     const seen = this.seen.get(peer) ?? new Set<string>();
+    // Publish an empty peer set before the first await so concurrent briefs share dedupe state.
+    // No ids enter it until the final policy guard, so an invalidated read cannot poison delivery.
     this.seen.set(peer, seen);
     let native: NativeItem[] = [];
-    try { native = await (this.native?.(task) ?? []); } catch { /* fail-open: the store and derived code context are optional */ }
+    try {
+      if (!current()) return undefined;
+      native = await (this.native?.(task) ?? []);
+      if (!current()) return undefined;
+    } catch { if (!current()) return undefined; /* fail-open: the store and derived code context are optional */ }
     const own: NativeItem[] = [];
     // A plan fail is task-specific guidance even when a previous task already carried it.
     const priorityIds = new Set(priority.map(item => item.id));
     for (const item of priority) if (own.length < maximum && !own.some(existing => existing.id === item.id)) own.push(item);
     // Native order is host-supplied (linked fails, then nearer/newer); preserve it for synchronous callers too.
     try { for (const item of native) if (!seen.has(item.id) && !own.some(existing => existing.id === item.id) && own.length < maximum) own.push(item); } catch { /* optional native iteration stays fail-open */ }
-    const found = this.client && own.length < maximum ? await related(this.client, this.project, [task.title, ...(task.refs.paths ?? [])].join(" ")) : [];
+    let found: BriefItem[] = [];
+    if (this.client && own.length < maximum) {
+      if (!current()) return undefined;
+      try { found = await related(this.client, this.project, [task.title, ...(task.refs.paths ?? [])].join(" "), 3, current); }
+      catch { if (!current()) return undefined; }
+      if (!current()) return undefined;
+    }
     // Another brief for this peer may finish while either optional source is awaited.
     const currentOwn = own.filter(item => priorityIds.has(item.id) || !seen.has(item.id)).slice(0, maximum);
     own.splice(0, own.length, ...currentOwn);
@@ -116,12 +174,26 @@ export class Briefs {
       items.push(item);
       if (own.length + items.length === maximum) break;
     }
+    const corpus = await corpusItems(maximum - own.length - items.length);
+    if (corpus === undefined || !current()) return undefined;
+    const corpusRows: NativeItem[] = [];
+    for (const item of corpus) {
+      if (own.length + items.length + corpusRows.length >= maximum) break;
+      if (seen.has(item.id) || own.some(row => row.id === item.id) || corpusRows.some(row => row.id === item.id)) continue;
+      corpusRows.push(item);
+    }
+    if (!current()) return undefined;
     const notice = this.client?.readNotice();
-    if (!own.length && !items.length && !notice) return undefined;
+    if (!own.length && !items.length && !corpusRows.length && !notice) return undefined;
+    if (!current()) return undefined;
     for (const item of own) seen.add(item.id);
     for (const item of items) seen.add(`#${item.id}`);
-    if (task.id !== undefined) try { this.observe?.(peer, task.id, { native: own.length, fails: own.filter((i) => i.kind === "fail").length, claudeMem: items.length }); } catch { /* telemetry never fails a brief */ }
-    const header = own.length ? "Memory brief (hub memory first, fails first: ahub memory show <mem id>; amem by mem:id):" : "Memory brief (amem curated notes; fetch details by mem:id):";
-    return [header, ...(notice ? [notice] : []), ...(this.displayNative?.(own) ?? own.map((i) => i.line)), ...items.map((i) => `${i.id.toString().startsWith("mem:") ? i.id : `#${i.id}`} ${i.time} ${i.type} ${i.title}`)].join("\n");
+    for (const item of corpusRows) seen.add(item.id);
+    if (!current()) return undefined;
+    if (task.id !== undefined) try { this.observe?.(peer, task.id, { native: own.filter(item => item.kind !== "note").length, fails: own.filter((i) => i.kind === "fail").length, claudeMem: items.length }); } catch { /* telemetry never fails a brief */ }
+    if (!current()) return undefined;
+    const nativeRows = own.filter(item => item.kind !== "note"), noteRows = [...own.filter(item => item.kind === "note"), ...corpusRows];
+    const header = noteRows.length ? "Knowledge brief (advice, not a block):" : own.length ? "Memory brief (hub memory first, fails first: ahub memory show <mem id>; amem by mem:id):" : "Memory brief (amem curated notes; fetch details by mem:id):";
+    return [header, ...(notice ? [notice] : []), ...(this.displayNative?.(nativeRows) ?? nativeRows.map((i) => i.line)), ...items.map((i) => `${i.id.toString().startsWith("mem:") ? i.id : `#${i.id}`} ${i.time} ${i.type} ${i.title}`), ...noteRows.map(item => item.line)].join("\n");
   }
 }

package/src/memory/capture.ts

@@ -38,7 +38,7 @@ export class Capture {
   }
 
   observe(call: { tool: string; args: string; output: string; id: string; paths: string[]; sourceId?: string }): void {
-    if (!this.sessionId || ((MEMORY_READ_TOOLS.has(call.tool.replace(/^mcp__[^ ]+__/, "")) || BOUNDED_TASK_TOOLS.has(call.tool.replace(/^mcp__[^ ]+__/, ""))) || call.tool.replace(/^mcp__[^ ]+__/, "") === "hub_memory_correct") || this.opts.skip?.includes(call.tool)) return;
+    if (!this.sessionId || ((MEMORY_READ_TOOLS.has(call.tool.replace(/^mcp__[^ ]+__/, "")) || BOUNDED_TASK_TOOLS.has(call.tool.replace(/^mcp__[^ ]+__/, ""))) || call.tool.replace(/^mcp__[^ ]+__/, "") === "hub_memory_correct") || call.tool.replace(/^mcp__[^ ]+__/, "") === "hub_source_read" || this.opts.skip?.includes(call.tool)) return;
     // Anything that names a denylisted path is kept out of memory entirely, input and output alike.
     if (call.paths.some((p) => isDenied(p, this.opts.deny) || p.split(/\s+/).some((word) => isDenied(word, this.opts.deny)))) return;
     // ponytail: legacy callers without a host sourceId dedupe native ids within a summary interval; all live LocalPeer calls supply invocation identity. Require that port for other hosts.

package/src/rooms/application.ts

@@ -0,0 +1,114 @@
+/** Encrypted X4 application payloads. Transport signatures/epochs remain in wire.ts. */
+import { MAX_HOP, type Priority } from "../hub/envelope.ts";
+import { decodeBase64url } from "./crypto.ts";
+import { canonicalBytes, ROOM_WIRE_LIMITS } from "./wire.ts";
+
+export const ROOM_APPLICATION_MAX_BYTES = ROOM_WIRE_LIMITS.plaintext;
+export interface RoomChatEnvelope {
+  id: string; trace: string; hop: number; from: string; to: string;
+  kind: "chat" | "status"; priority: Priority; body: string; ts: number;
+}
+export type RoomReceiptReason = "admitted" | "inbox_admitted" | "inbox_full" | "inbox_oversize" | "inbox_expired" | "inbox_age_unavailable" | "not_exposed" | "boundary_refused" | "invalid_message" | "rate_limited" | "hop" | "person_inbox_unsupported";
+export type RoomMessage =
+  | { v: 1; type: "chat"; envelope: RoomChatEnvelope }
+  | { v: 1; type: "receipt"; frame: string; application: string; peer: string; outcome: "completed" | "failed_safe"; reason: RoomReceiptReason };
+export class RoomApplicationError extends Error {
+  constructor(readonly code: "invalid_message" | "limit") { super(`Room application: ${code}`); this.name = "RoomApplicationError"; }
+}
+function fail(code: "invalid_message" | "limit" = "invalid_message"): never { throw new RoomApplicationError(code); }
+const LOCAL_ID = /^[a-z][a-z0-9-]{0,31}$/;
+const REMOTE_ID = /^([a-z][a-z0-9-]{0,31})@([a-z][a-z0-9-]{0,31})$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const REASON_TEXT: Readonly<Record<RoomReceiptReason, string>> = Object.freeze({
+  admitted: "admitted", inbox_admitted: "admitted to person inbox", inbox_full: "person inbox full",
+  inbox_oversize: "person inbox message too large", inbox_expired: "person inbox message expired",
+  inbox_age_unavailable: "person inbox admission age unavailable", not_exposed: "peer not exposed", boundary_refused: "room boundary refused",
+  invalid_message: "invalid room message", rate_limited: "room rate limit", hop: "hop limit",
+  person_inbox_unsupported: "person inbox not supported yet (X5)",
+});
+const REASONS: readonly RoomReceiptReason[] = ["admitted", "inbox_admitted", "inbox_full", "inbox_oversize", "inbox_expired", "inbox_age_unavailable", "not_exposed", "boundary_refused", "invalid_message", "rate_limited", "hop", "person_inbox_unsupported"];
+/** Fixed operator text only; a diagnostic or remote field can never become a rendered reason. */
+export function roomReceiptReasonText(reason: RoomReceiptReason): string {
+  return Object.hasOwn(REASON_TEXT, reason) ? REASON_TEXT[reason] : "room receipt unavailable";
+}
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const encoder = new TextEncoder();
+
+export function isRoomLocalPeerId(value: unknown): value is string {
+  return typeof value === "string" && LOCAL_ID.exec(value)?.[0] === value && value !== "hub" && value !== "digest";
+}
+/** Remote humans are user@label, never local console authority. Labels come from the signed private roster. */
+export function parseRemotePeerId(value: unknown): { peer: string; label: string } | undefined {
+  if (typeof value !== "string") return undefined;
+  const match = REMOTE_ID.exec(value);
+  if (!match || match[0] !== value || !isRoomLocalPeerId(match[1])) return undefined;
+  return { peer: match[1], label: match[2]! };
+}
+function object(value: unknown, fields: readonly string[]): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) fail();
+  const row = value as Record<string, unknown>;
+  if (Reflect.ownKeys(row).length !== fields.length || fields.some(key => !Object.hasOwn(row, key))) fail();
+  return row;
+}
+function uuid(value: unknown): string {
+  if (typeof value !== "string" || value.length !== 36 || !UUID.test(value)) fail();
+  return value;
+}
+function localPeer(value: unknown): string { if (!isRoomLocalPeerId(value)) fail(); return value; }
+function integer(value: unknown, min: number, max = Number.MAX_SAFE_INTEGER): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || Object.is(value, -0) || value < min || value > max) fail();
+  return value;
+}
+function text(value: unknown): string {
+  if (typeof value !== "string" || !value.isWellFormed()) fail();
+  if (encoder.encode(value).length > ROOM_APPLICATION_MAX_BYTES) fail("limit");
+  return value;
+}
+function parseEnvelope(value: unknown): RoomChatEnvelope {
+  const row = object(value, ["id", "trace", "hop", "from", "to", "kind", "priority", "body", "ts"]);
+  if (row.kind !== "chat" && row.kind !== "status") fail();
+  if (row.priority !== "important" && row.priority !== "status" && row.priority !== "fyi") fail();
+  return { id: uuid(row.id), trace: uuid(row.trace), hop: integer(row.hop, 0, MAX_HOP), from: localPeer(row.from), to: localPeer(row.to), kind: row.kind, priority: row.priority, body: text(row.body), ts: integer(row.ts, 0) };
+}
+function frameDigest(value: unknown): string {
+  if (typeof value !== "string" || value.length !== 43) fail();
+  try { decodeBase64url(value, 32); } catch { fail(); }
+  return value;
+}
+function parseMessage(value: unknown): RoomMessage {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail();
+  const type = (value as Record<string, unknown>).type;
+  if (type === "chat") {
+    const row = object(value, ["v", "type", "envelope"]);
+    if (row.v !== 1) fail();
+    return { v: 1, type, envelope: parseEnvelope(row.envelope) };
+  }
+  if (type === "receipt") {
+    const row = object(value, ["v", "type", "frame", "application", "peer", "outcome", "reason"]);
+    if (row.v !== 1 || row.outcome !== "completed" && row.outcome !== "failed_safe" || !REASONS.includes(row.reason as RoomReceiptReason)
+      || row.outcome === "completed" && row.reason !== "admitted" && row.reason !== "inbox_admitted"
+      || row.outcome === "failed_safe" && (row.reason === "admitted" || row.reason === "inbox_admitted")) fail();
+    return { v: 1, type, frame: frameDigest(row.frame), application: uuid(row.application), peer: localPeer(row.peer), outcome: row.outcome, reason: row.reason as RoomReceiptReason };
+  }
+  return fail();
+}
+function applicationError(error: unknown): never {
+  if (error instanceof RoomApplicationError) throw error;
+  return fail();
+}
+export function encodeRoomMessage(message: RoomMessage): Uint8Array {
+  try {
+    const wire = canonicalBytes(parseMessage(message));
+    if (wire.length > ROOM_APPLICATION_MAX_BYTES) fail("limit");
+    return wire;
+  } catch (error) { return applicationError(error); }
+}
+export function decodeRoomMessage(wire: Uint8Array): RoomMessage {
+  try {
+    if (!(wire instanceof Uint8Array) || wire.length === 0) fail();
+    if (wire.length > ROOM_APPLICATION_MAX_BYTES) fail("limit");
+    const bytes = Uint8Array.from(wire), message = parseMessage(JSON.parse(decoder.decode(bytes))), canonical = canonicalBytes(message);
+    if (canonical.length !== bytes.length || canonical.some((byte, index) => byte !== bytes[index])) fail();
+    return message;
+  } catch (error) { return applicationError(error); }
+}

package/src/rooms/boundary.ts

@@ -0,0 +1,103 @@
+/** The one X4 outbound view. A proof never carries refs, private task text or untrusted authority. */
+import { looksSecret } from "@staix/agent-mem";
+import { HUB, DIGEST, MAX_HOP, USER, sanitize, type Envelope } from "../hub/envelope.ts";
+import { mentionsPrivatePath } from "../hub/memory-policy.ts";
+import { detectSignals, type Routing } from "../hub/routing.ts";
+import type { PiiVerdict } from "../hub/inference.ts";
+import { encodeRoomMessage, isRoomLocalPeerId, parseRemotePeerId, type RoomChatEnvelope } from "./application.ts";
+
+export interface RoomBoundaryContext {
+  cwd: string; target: string; current: () => boolean;
+  senderExposed: (id: string) => boolean;
+  senderPrivate: (id: string) => boolean | undefined;
+  taskPrivate: (id: number) => boolean | undefined;
+  routing: () => Routing; piiPaths: () => readonly string[];
+  modelScreenOn: () => boolean;
+  /** The existing host-bound screenPii port owns device/campus admission, deadlines and fixed models. */
+  screen?: (text: string) => Promise<PiiVerdict>;
+}
+export type RoomBoundaryCode = "invalid_message" | "not_exposed" | "boundary_refused" | "hop";
+declare const proofBrand: unique symbol;
+export interface RoomOutboundProof { readonly [proofBrand]: true }
+export type RoomBoundaryResult = { status: "refused"; code: RoomBoundaryCode } | { status: "ready"; proof: RoomOutboundProof; withheld: boolean };
+const proofs = new WeakMap<RoomOutboundProof, { envelope: Readonly<RoomChatEnvelope>; current: () => boolean }>();
+const ENVELOPE_FIELDS = new Set(["id", "trace", "hop", "from", "to", "kind", "priority", "body", "refs", "private", "ts"]);
+const encoder = new TextEncoder();
+const refused = (code: RoomBoundaryCode): RoomBoundaryResult => ({ status: "refused", code });
+
+interface BodyPolicy { routing: Routing; paths: string[]; model: boolean; signature: string }
+function bodyPolicy(context: RoomBoundaryContext): BodyPolicy | undefined {
+  try {
+    const routing = context.routing(), paths = [...context.piiPaths()], model = context.modelScreenOn();
+    if (typeof model !== "boolean" || paths.some(path => typeof path !== "string") || !Array.isArray(routing.signals.pii_patterns) || routing.signals.pii_patterns.some(pattern => typeof pattern !== "string")) return undefined;
+    const patterns = [...routing.signals.pii_patterns];
+    return { routing: { ...routing, signals: { ...routing.signals, pii_patterns: patterns } }, paths, model, signature: JSON.stringify([patterns, paths, model]) };
+  } catch { return undefined; }
+}
+function clearBody(body: string, paths: readonly string[], context: RoomBoundaryContext, policy: BodyPolicy | undefined): boolean {
+  if (!policy) return false;
+  try {
+    return !looksSecret(body) && !mentionsPrivatePath(body, paths.map(path => `path:${path}`), policy.paths, context.cwd)
+      && !detectSignals({ title: "", detail: body, refs: {} }, policy.routing, context.cwd).includes("pii");
+  } catch { return false; }
+}
+/** Snapshot before any await; host ports remain captured, while their decisions are read fresh. */
+export async function roomBoundary(input: Envelope, ctx: RoomBoundaryContext): Promise<RoomBoundaryResult> {
+  try {
+    const env = structuredClone(input), context: RoomBoundaryContext = { ...ctx };
+    const target = parseRemotePeerId(context.target);
+    if (!target || !env || typeof env !== "object" || Array.isArray(env) || Object.keys(env).some(key => !ENVELOPE_FIELDS.has(key))) return refused("invalid_message");
+    if (env.from === HUB || env.from === DIGEST || !isRoomLocalPeerId(env.from)) return refused("boundary_refused");
+    if (env.kind !== "chat" && env.kind !== "status" || env.private === true) return refused("boundary_refused");
+    if (env.private !== undefined && typeof env.private !== "boolean") return refused("invalid_message");
+    if (!Array.isArray(env.to) || !env.to.includes(context.target)) return refused("boundary_refused");
+    if (env.to.length > 64 || env.to.some(id => !isRoomLocalPeerId(id) && !parseRemotePeerId(id))) return refused("invalid_message");
+    if (!Number.isSafeInteger(env.hop) || env.hop < 0 || env.hop > MAX_HOP) return refused("hop");
+    if (env.refs !== undefined && (!env.refs || typeof env.refs !== "object" || Array.isArray(env.refs))) return refused("invalid_message");
+    const paths = env.refs?.paths ?? [];
+    if (!Array.isArray(paths) || paths.length > 64 || paths.some(path => typeof path !== "string" || encoder.encode(path).length > 4096)) return refused("invalid_message");
+    const task = env.refs?.task;
+    if (task !== undefined && (typeof task !== "string" || !Number.isSafeInteger(Number(task)) || Number(task) < 1 || String(Number(task)) !== task)) return refused("invalid_message");
+    const taskId = task === undefined ? undefined : Number(task);
+    const authorized = (): RoomBoundaryCode | undefined => {
+      try {
+        if (context.current() !== true) return "boundary_refused";
+        if (env.from !== USER && context.senderExposed(env.from) !== true) return "not_exposed";
+        if (context.senderPrivate(env.from) !== false || taskId !== undefined && context.taskPrivate(taskId) !== false) return "boundary_refused";
+        return context.current() === true ? undefined : "boundary_refused";
+      } catch { return "boundary_refused"; }
+    };
+    const initial = authorized(); if (initial) return refused(initial);
+    const envelope: RoomChatEnvelope = { id: env.id, trace: env.trace, hop: env.hop, from: env.from, to: target.peer, kind: env.kind, priority: env.priority === "important" ? "status" : env.priority, body: env.body, ts: env.ts };
+    encodeRoomMessage({ v: 1, type: "chat", envelope }); // Validate metadata/body budget before any model sees it.
+    const policy = bodyPolicy(context);
+    let withheld = !clearBody(env.body, paths, context, policy);
+    if (!withheld && policy?.model) {
+      const before = authorized(); if (before) return refused(before);
+      let verdict: PiiVerdict | undefined;
+      try { verdict = await context.screen?.(env.body); } catch { /* unknown fails closed to the fixed stub */ }
+      const after = authorized(); if (after) return refused(after);
+      withheld = verdict?.label !== "clear";
+      const fresh = bodyPolicy(context);
+      if (!fresh || fresh.signature !== policy.signature) return refused("boundary_refused");
+      withheld ||= !clearBody(env.body, paths, context, fresh);
+    }
+    const final = authorized(); if (final) return refused(final);
+    const outgoing = Object.freeze({ ...envelope, body: withheld ? `[room message ${envelope.id} withheld]` : sanitize(envelope.body) });
+    encodeRoomMessage({ v: 1, type: "chat", envelope: outgoing });
+    const current = () => authorized() === undefined && (withheld || (() => {
+      const latest = bodyPolicy(context);
+      return latest !== undefined && latest.signature === policy?.signature && clearBody(env.body, paths, context, latest);
+    })());
+    const proof = Object.freeze({}) as RoomOutboundProof;
+    proofs.set(proof, { envelope: outgoing, current });
+    return { status: "ready", proof, withheld };
+  } catch { return refused("invalid_message"); }
+}
+export function readRoomOutbound(proof: RoomOutboundProof): RoomChatEnvelope | undefined {
+  if (!proof || typeof proof !== "object") return undefined;
+  const state = proofs.get(proof);
+  if (!state) return undefined;
+  try { return state.current() === true ? { ...state.envelope } : undefined; }
+  catch { return undefined; }
+}