instar 1.3.732 → 1.3.733

package/dist/core/conversationBindToken.d.ts

@@ -0,0 +1,36 @@
+export interface BindTokenPayload {
+    sessionName: string;
+    bootstrapConversationIds: number[];
+    mintedAt: string;
+}
+/** §7 R7-minor-2: the token-less positive-id straggler backstop window. */
+export declare const TOKENLESS_BIND_GRACE_DAYS = 14;
+/** Read-or-create the 32-byte bind-token secret (first-boot generation). */
+export declare function ensureBindTokenSecret(stateDir: string): Buffer;
+export declare function mintBindToken(secret: Buffer, payload: BindTokenPayload): string;
+/**
+ * Verify a token. Returns the CLAMPED payload on a valid MAC, null otherwise
+ * (missing/tampered/undecodable — the caller maps null to the typed
+ * `conversation-bind-not-authorized` refusal, fail-closed on minted-id binds).
+ */
+export declare function verifyBindToken(secret: Buffer, token: string): BindTokenPayload | null;
+/**
+ * Write the per-feature deploy stamp on first boot (idempotent — the house
+ * per-feature deploy-stamp shape, R8-low-3). The stamp anchors the
+ * `tokenlessBindGraceDays` clock for the R7-minor-2 straggler backstop.
+ */
+export declare function ensureBindDeployStamp(stateDir: string, version: string): void;
+/** Age of the deploy stamp in whole days, or null when unstamped/unreadable. */
+export declare function bindDeployStampAgeDays(stateDir: string, now?: () => number): number | null;
+/** The ctx surface the routes-layer bind gate consumes (wired at bootstrap;
+ *  AgentServer default-constructs it so the gate is alive on every init path).
+ *  `mint` is the SessionManager spawn-env side (INSTAR_BIND_TOKEN); `verify` +
+ *  `deployStampAgeDays` are the POST /commitments gate side — one shared
+ *  secret backs both. */
+export interface ConversationBindAuth {
+    mint: (sessionName: string, bootstrapConversationIds: number[]) => string;
+    verify: (token: string) => BindTokenPayload | null;
+    deployStampAgeDays: () => number | null;
+}
+export declare function createConversationBindAuth(stateDir: string): ConversationBindAuth;
+//# sourceMappingURL=conversationBindToken.d.ts.map

package/dist/core/conversationBindToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationBindToken.d.ts","sourceRoot":"","sources":["../../src/core/conversationBindToken.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY9D;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAqCtF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAW7E;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,MAAM,GAAG,IAAI,CAYpG;AAED;;;;yBAIyB;AACzB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACnD,kBAAkB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,CAQjF"}

package/dist/core/conversationBindToken.js

@@ -0,0 +1,144 @@
+/**
+ * conversationBindToken — the §7 bind-time authority primitive (B7 / R3-M5 /
+ * R4-M3, docs/specs/durable-conversation-identity.md).
+ *
+ * A durable-state BIND (`POST /commitments`, working-set carry) on a minted
+ * conversation id must be scoped to the session's OWN authenticated bootstrap
+ * context. The enforcement primitive is a per-session bind token minted at
+ * session spawn and delivered ONLY through the spawned session's environment
+ * (`INSTAR_BIND_TOKEN` in the tmux -e block) — never over a route.
+ *
+ * The token is SELF-AUTHENTICATING and validation is STATELESS (R4-M3):
+ * sessions are tmux processes that OUTLIVE the server process, and the server
+ * restarts on every auto-update — so the server stores nothing per-session.
+ * It verifies the HMAC and reads the bootstrap set FROM the token; a live
+ * session's token remains valid across any number of server restarts.
+ *
+ * Shape: `base64url(payload) + "." + base64url(HMAC-SHA256(secret, payload))`
+ * where payload = { sessionName, bootstrapConversationIds, mintedAt }.
+ *
+ * The secret is a random 32-byte value generated once at first boot and
+ * persisted in the stateDir (same at-rest posture as authToken — plaintext
+ * machine-local; it authorizes only bind-scoping, never delivery or message
+ * content). It is deliberately EXCLUDED from the backup manifest (R5-minor-4):
+ * a disaster restore regenerates it, so all outstanding tokens invalidate —
+ * live sessions then hit the loud typed refusal until respawned, never a
+ * silent failure. Rotating it (delete the file, restart) is the revocation
+ * story — a LOUD deliberate trade.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+/** §7 R7-minor-2: the token-less positive-id straggler backstop window. */
+export const TOKENLESS_BIND_GRACE_DAYS = 14;
+const SECRET_RELATIVE_PATH = path.join('state', 'conversation-bind-token.secret');
+const DEPLOY_STAMP_RELATIVE_PATH = path.join('state', 'conversation-registry-deploy.json');
+/** Read-or-create the 32-byte bind-token secret (first-boot generation). */
+export function ensureBindTokenSecret(stateDir) {
+    const p = path.join(stateDir, SECRET_RELATIVE_PATH);
+    try {
+        const existing = fs.readFileSync(p);
+        if (existing.length >= 32)
+            return existing;
+    }
+    catch {
+        /* falls through to generation */
+    }
+    const secret = crypto.randomBytes(32);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, secret, { mode: 0o600 });
+    return secret;
+}
+export function mintBindToken(secret, payload) {
+    const body = Buffer.from(JSON.stringify(payload), 'utf-8').toString('base64url');
+    const mac = crypto.createHmac('sha256', secret).update(body).digest('base64url');
+    return `${body}.${mac}`;
+}
+/**
+ * Verify a token. Returns the CLAMPED payload on a valid MAC, null otherwise
+ * (missing/tampered/undecodable — the caller maps null to the typed
+ * `conversation-bind-not-authorized` refusal, fail-closed on minted-id binds).
+ */
+export function verifyBindToken(secret, token) {
+    if (typeof token !== 'string' || token.length > 4096)
+        return null;
+    const idx = token.indexOf('.');
+    if (idx <= 0 || idx === token.length - 1)
+        return null;
+    const body = token.slice(0, idx);
+    const givenMac = token.slice(idx + 1);
+    const expected = crypto.createHmac('sha256', secret).update(body).digest();
+    let given;
+    try {
+        given = Buffer.from(givenMac, 'base64url');
+    }
+    catch {
+        // @silent-fallback-ok — a non-decodable MAC is an INVALID token; returning
+        // null is the fail-CLOSED security contract (the caller refuses the bind),
+        // not a degraded-service fallback.
+        return null;
+    }
+    if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf-8'));
+        if (!parsed ||
+            typeof parsed.sessionName !== 'string' ||
+            !Array.isArray(parsed.bootstrapConversationIds) ||
+            typeof parsed.mintedAt !== 'string') {
+            return null;
+        }
+        return {
+            sessionName: parsed.sessionName.slice(0, 128),
+            bootstrapConversationIds: parsed.bootstrapConversationIds.filter((n) => typeof n === 'number' && Number.isSafeInteger(n)),
+            mintedAt: parsed.mintedAt.slice(0, 64),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write the per-feature deploy stamp on first boot (idempotent — the house
+ * per-feature deploy-stamp shape, R8-low-3). The stamp anchors the
+ * `tokenlessBindGraceDays` clock for the R7-minor-2 straggler backstop.
+ */
+export function ensureBindDeployStamp(stateDir, version) {
+    const p = path.join(stateDir, DEPLOY_STAMP_RELATIVE_PATH);
+    if (fs.existsSync(p))
+        return;
+    try {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify({ firstBootVersion: version, at: new Date().toISOString() }, null, 2));
+    }
+    catch {
+        /* @silent-fallback-ok — the stamp only arms the fail-OPEN straggler
+           attention backstop; a missed write means the backstop stays unarmed
+           (today's behavior), never a refused bind. */
+    }
+}
+/** Age of the deploy stamp in whole days, or null when unstamped/unreadable. */
+export function bindDeployStampAgeDays(stateDir, now = Date.now) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(stateDir, DEPLOY_STAMP_RELATIVE_PATH), 'utf-8'));
+        const at = raw?.at ? Date.parse(raw.at) : NaN;
+        if (!Number.isFinite(at))
+            return null;
+        return Math.floor((now() - at) / 86400000);
+    }
+    catch {
+        // @silent-fallback-ok — an unreadable/absent deploy stamp reads as "no age"
+        // (null), so the R7-minor-2 straggler backstop simply stays UNARMED (today's
+        // fail-open behavior) — never a refused bind, never a degraded service path.
+        return null;
+    }
+}
+export function createConversationBindAuth(stateDir) {
+    const secret = ensureBindTokenSecret(stateDir);
+    return {
+        mint: (sessionName, bootstrapConversationIds) => mintBindToken(secret, { sessionName, bootstrapConversationIds, mintedAt: new Date().toISOString() }),
+        verify: (token) => verifyBindToken(secret, token),
+        deployStampAgeDays: () => bindDeployStampAgeDays(stateDir),
+    };
+}
+//# sourceMappingURL=conversationBindToken.js.map

package/dist/core/conversationBindToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationBindToken.js","sourceRoot":"","sources":["../../src/core/conversationBindToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;AAClF,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;AAE3F,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;QAC3E,mCAAmC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB,CAAC;QAChG,IACE,CAAC,MAAM;YACP,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAC/C,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC7C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAC9D,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CACrE;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP;;uDAE+C;IACjD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAAoB,IAAI,CAAC,GAAG;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,EAAE,OAAO,CAAC,CAAoB,CAAC;QACrH,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,EAAE,CAC9C,aAAa,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtG,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;QACjD,kBAAkB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/dist/core/conversationIdentity.d.ts

@@ -86,6 +86,20 @@ export declare function parseCanonicalKey(key: string): {
     tuple: ConversationTuple;
     workspaceId: string;
 } | null;
+/**
+ * The SHARED id↔tuple coherence predicate (§3.5 ingest check ≡ §3.5.2 R5-M2
+ * delivery-time check — ONE implementation, never a second copy; a second
+ * implementation is a CI failure per §10). An id is coherent with a tuple iff
+ * it is the tuple's recomputed candidate or a within-`MAX_PROBE_DISTANCE`
+ * displacement offset of it (probe direction DOWN):
+ *
+ *   cand(routingKey(tuple)) − MAX_PROBE_DISTANCE ≤ id ≤ cand(routingKey(tuple))
+ *
+ * Used at delivery time to validate a binding's stored `topicId` against its
+ * record-carried `boundTuple` (increment 2); the §6.1-step-9 replication
+ * ingest check MUST reuse this export.
+ */
+export declare function idWithinCoherenceBound(id: number, tuple: ConversationTuple): boolean;
 /** Result of a displacement walk (§3.3 probe / §3.5.1 step 2). */
 export type DisplacementResult = {
     ok: true;

package/dist/core/conversationIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conversationIdentity.d.ts","sourceRoot":"","sources":["../../src/core/conversationIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;kFAEkF;AAClF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,uFAAuF;AACvF,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AACtD,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AACpD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAO/E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAIjG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQvG;AAED,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,kBAAkB,CASzG"}
+{"version":3,"file":"conversationIdentity.d.ts","sourceRoot":"","sources":["../../src/core/conversationIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;kFAEkF;AAClF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,uFAAuF;AACvF,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AACtD,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AACpD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAO/E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAIjG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQvG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAIpF;AAED,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,kBAAkB,CASzG"}

package/dist/core/conversationIdentity.js

@@ -114,6 +114,25 @@ export function parseCanonicalKey(key) {
         return null;
     return { tuple: { platform: 'slack', channelId, threadTs: threadTs ?? null }, workspaceId };
 }
+/**
+ * The SHARED id↔tuple coherence predicate (§3.5 ingest check ≡ §3.5.2 R5-M2
+ * delivery-time check — ONE implementation, never a second copy; a second
+ * implementation is a CI failure per §10). An id is coherent with a tuple iff
+ * it is the tuple's recomputed candidate or a within-`MAX_PROBE_DISTANCE`
+ * displacement offset of it (probe direction DOWN):
+ *
+ *   cand(routingKey(tuple)) − MAX_PROBE_DISTANCE ≤ id ≤ cand(routingKey(tuple))
+ *
+ * Used at delivery time to validate a binding's stored `topicId` against its
+ * record-carried `boundTuple` (increment 2); the §6.1-step-9 replication
+ * ingest check MUST reuse this export.
+ */
+export function idWithinCoherenceBound(id, tuple) {
+    if (!Number.isSafeInteger(id) || id >= 0)
+        return false;
+    const cand = candidateIdForRoutingKey(routingKeyForTuple(tuple));
+    return id <= cand && id >= cand - MAX_PROBE_DISTANCE;
+}
 /**
  * The ONE shared displacement implementation (§3.3 = §3.5.1 step 2 — pinned by
  * the §10 shared-implementation equivalence test; R2-adversarial-2). Walks the

package/dist/core/conversationIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"conversationIdentity.js","sourceRoot":"","sources":["../../src/core/conversationIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;kFAEkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC;AAClC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,uBAAuB;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,wFAAwF;AAElI,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AASzC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB;IAClD,OAAO,GAAG,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,WAA+B;IACvF,MAAM,IAAI,GAAG,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC1G,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;IAC5D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IACnD,IAAI,WAAW,KAAK,qBAAqB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;AAC9F,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,QAAiC;IACnF,IAAI,EAAE,GAAG,SAAS,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACpB,EAAE,IAAI,eAAe,CAAC;QACtB,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,kBAAkB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"conversationIdentity.js","sourceRoot":"","sources":["../../src/core/conversationIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;kFAEkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC;AAClC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,uBAAuB;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,wFAAwF;AAElI,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AASzC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB;IAClD,OAAO,GAAG,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,WAA+B;IACvF,MAAM,IAAI,GAAG,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC1G,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;IAC5D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IACnD,IAAI,WAAW,KAAK,qBAAqB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU,EAAE,KAAwB;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,IAAI,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,kBAAkB,CAAC;AACvD,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,QAAiC;IACnF,IAAI,EAAE,GAAG,SAAS,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACpB,EAAE,IAAI,eAAe,CAAC;QACtB,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,kBAAkB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/core/deliverToConversation.d.ts

@@ -1,27 +1,3 @@
-/**
- * deliverToConversation — the outbound funnel SKELETON
- * (docs/specs/durable-conversation-identity.md §5; §6.1 increment 1).
- *
- * A single delivery helper every follow-through consumer MIGRATES onto in the
- * later §6.1 increments. In increment 1 it ships with ZERO consumers and the
- * `id<0` arm dark-gated behind `conversationIdentity.followThrough` (§9:
- * `enabled` OMITTED → the developmentAgent gate resolves it — live-on-dev,
- * dark-fleet; `dryRun: true` FIRST because delivery is externally visible).
- *
- * §5.1 failure/dryRun contract: a funnel non-delivery is a TYPED,
- * NON-EXCEPTIONAL return the caller inspects — never a thrown exception, and
- * NEVER success-shaped. dryRun (and fleet-dark) return the SAME
- * `not-delivered` typed result the unresolvable path uses, plus a
- * `would-deliver` audit line — caller-visible as a non-delivery so beacon
- * retry / attention escalation keep engaging (A Refusal Stays a Refusal / P18).
- *
- * NOT in this skeleton (they land WITH their §6.1 increments, before any
- * consumer migrates onto the funnel): the §5.0(a) E1 ambiguous-outcome
- * idempotency guard + durable send-intent ops (increment 2, the proof
- * consumer), the §5 `deterministicKind` gate-exempt arm (increment 3), the
- * §5.2 P17 budgets (increment 5's attention migration), and the §5.1
- * permanent-error classification (increment 2).
- */
 import type { ConversationRegistry } from './ConversationRegistry.js';
 export interface DeliverOpts {
     isProxy?: boolean;
@@ -29,16 +5,78 @@ export interface DeliverOpts {
     tier?: string;
     allowDuplicate?: boolean;
     messageKind?: string;
+    /**
+     * §5.0(a) STABLE logical send identity (`<commitmentId>:<sendSeq>` for
+     * beacon sends — the §3.4 pinned encoding). A caller supplying its own
+     * logicalSendId MUST also define its retirement events (R8-low-2); a caller
+     * that cannot name them belongs on the content-hash window lane (omit this).
+     */
+    logicalSendId?: string;
+    /**
+     * §3.5.2 property 5: the binding record's denormalized bind-time tuple.
+     * Delivery targets `resolve(boundTuple)` when present AND coherent with the
+     * binding's stored id — the uniform every-machine delivery rule.
+     */
+    boundTuple?: {
+        platform: string;
+        channelId: string;
+        threadTs: string | null;
+    };
 }
 export type DeliveryOutcome = {
     delivered: true;
     outcome: 'delivered';
+}
+/** §5.0(a): DELIVERED-EQUIVALENT for sequencing (R7-M1) — the caller treats
+ *  it as delivered (no re-escalation, seq advances) so suppression can never
+ *  mute the beacon. */
+ | {
+    delivered: false;
+    outcome: 'already-delivered-recently';
 } | {
     delivered: false;
     outcome: 'not-delivered';
-    reason: 'follow-through-dark' | 'follow-through-dry-run' | 'unresolvable' | 'replicated-only-origin' | 'system-channel-suppressed' | 'no-slack-adapter' | 'send-failed' | 'telegram-send-failed';
+    reason: 'follow-through-dark' | 'follow-through-dry-run' | 'unresolvable' | 'replicated-only-origin' | 'system-channel-suppressed' | 'no-slack-adapter' | 'send-failed' | 'telegram-send-failed' | 'conversation-unreachable' | 'conversation-binding-incoherent' | 'binding-target-unresolved';
     detail?: string;
+    /** §5.1: true ONLY for the pinned permanent error set — the beacon
+     *  treats it as TERMINAL (dead-letter), never an infinite retry. */
+    permanent?: boolean;
+    /** §5/I1 dead-letter scoping: a by-design non-owning/unresolvable
+     *  refusal — the beacon STANDS DOWN (bounded ownership recheck), and this
+     *  NEVER increments the dead-letter counter. */
+    standDown?: boolean;
 };
+/** §5.1 pinned PERMANENT `chat.postMessage` error codes — the code is
+ *  `is_archived`, NOT `channel_archived` (adversarial-A2/codex-X4). DISTINCT
+ *  from the adapter's token-scoped `SlackApiError.permanent` set. */
+export declare const CONVERSATION_UNREACHABLE_ERRORS: Set<string>;
+/** Content-hash lane length gate — mirrors the Telegram exact-duplicate
+ *  dedup's `minLength` (brief acks are never suppressed). */
+export declare const CONTENT_HASH_MIN_LENGTH = 40;
+/** §5.1 R2-lessons-2/P17 pinned emitter coalescing window (mass-unreachable). */
+export declare const UNREACHABLE_COALESCING_WINDOW_MS = 60000;
+export type SlackSendErrorClass = {
+    kind: 'permanent';
+    code: string;
+} | {
+    kind: 'permanent-shaped-unknown';
+    code: string;
+} | {
+    kind: 'clean-transient';
+    detail: string;
+} | {
+    kind: 'ambiguous';
+    detail: string;
+};
+/**
+ * Classify a Slack-arm send failure (§5.1 + §5.0(a) R2-security-NEW-3).
+ * A `SlackApiError` means Slack ANSWERED `ok:false` — positive evidence the
+ * message did NOT post (clean), further split permanent/canary/transient.
+ * A pre-accept network refusal is clean. Everything else (timeout, reset,
+ * unknown) is AMBIGUOUS — the message may actually have posted, so the E1
+ * suppressor IS recorded (only a CLEAN failure forbids recording).
+ */
+export declare function classifySlackSendError(err: unknown): SlackSendErrorClass;
 export interface ConversationDeliveryDeps {
     registry: ConversationRegistry;
     /** §9 followThrough gate state, resolved through resolveDevAgentGate at wiring. */
@@ -55,7 +93,12 @@ export interface ConversationDeliveryDeps {
     isSystemChannel?: (channelId: string) => boolean;
     /** `would-deliver` audit sink for dark/dry non-deliveries (§5.1). */
     auditWouldDeliver?: (line: string) => void;
+    /** ONE deduped attention item per episode (incoherent binding, pin redirect,
+     *  drift canary, mass-unreachable summary, non-owning heal paths). */
+    onAttention?: (dedupeKey: string, title: string, body: string) => void;
     log?: (line: string) => void;
+    /** Test override for the mass-unreachable coalescing window. */
+    coalescingWindowMs?: number;
 }
 export type DeliverToConversation = (id: number, text: string, opts?: DeliverOpts) => Promise<DeliveryOutcome>;
 export declare function createConversationDelivery(deps: ConversationDeliveryDeps): DeliverToConversation;

package/dist/core/deliverToConversation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deliverToConversation.d.ts","sourceRoot":"","sources":["../../src/core/deliverToConversation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACzC;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EACF,qBAAqB,GACrB,wBAAwB,GACxB,cAAc,GACd,wBAAwB,GACxB,2BAA2B,GAC3B,kBAAkB,GAClB,aAAa,GACb,sBAAsB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mFAAmF;IACnF,aAAa,EAAE,MAAM;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,8EAA8E;IAC9E,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG;2EACuE;IACvE,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAE/G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAwFhG"}
+{"version":3,"file":"deliverToConversation.d.ts","sourceRoot":"","sources":["../../src/core/deliverToConversation.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAStE,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/E;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE;AAC3C;;uBAEuB;GACrB;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,4BAA4B,CAAA;CAAE,GAC3D;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EACF,qBAAqB,GACrB,wBAAwB,GACxB,cAAc,GACd,wBAAwB,GACxB,2BAA2B,GAC3B,kBAAkB,GAClB,aAAa,GACb,sBAAsB,GACtB,0BAA0B,GAC1B,iCAAiC,GACjC,2BAA2B,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;wEACoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;oDAEgD;IAChD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN;;qEAEqE;AACrE,eAAO,MAAM,+BAA+B,aAAkE,CAAC;AAU/G;6DAC6D;AAC7D,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,iFAAiF;AACjF,eAAO,MAAM,gCAAgC,QAAQ,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,CAWxE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mFAAmF;IACnF,aAAa,EAAE,MAAM;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,8EAA8E;IAC9E,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG;2EACuE;IACvE,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;0EACsE;IACtE,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAY/G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAmUhG"}