pi-roundtable-webchat 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,24 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-09
+
+### Added
+
+- Personal background turns and delegated reports run privately as the router-checked principal, with replies pushed only to that principal's connections; the claim rejects other targets, principals, and unregistered or shared conversations.
+- A private inbox provider with offline `knows`, durable `webchat_notices` storage, additive `notice` frames, `GET <path>/notices` pagination, and idempotent `POST <path>/notices/<id>/read`. Inbox entries never become fake transcript turns.
+
+### Changed
+
+- The private conversation claim declares `takesSystemReports: false`.
+  Configuring `ops.conversation` on the webchat surface now fails at startup with core `ConfigError`, even though personal background turns are supported; use a shared conversation on another surface or `ops.agent` for system error reports.
+
+- Webchat resolves core `IDENTITY` at every token admission. Ownership, quotas, tickets, prompts and connection groups use `principalId`; `ready.speaker` adds it without changing `roundtable.webchat.v1`. A token switching principal closes with 4403, while linked identities of one principal can renew the same connection. Client frames recheck core admission and tier, so revoked admission or a relinked actor cannot keep acting on an old socket, and approvals do not use stale roles. Existing M1 conversations keep their OIDC principal ids unchanged.
+- Removed the plugin's `access` option and `WebAccessMap` / `webAccess` exports. Configure the host's top-level `access` with surface-prefixed roles and linked identities instead; passing the removed option fails with migration guidance. OIDC verification also reports `ActorFacts` for the core resolver.
+
+- A message the router drops after its claim admitted it (pi-roundtable 0.9's `Admission.dropped`, when the author's record finds them someone else) frees its place in the person's turn budget, as a message the claim drops does, and its person, told it was accepted, gets a `failed` frame for its conversation (`stopped: false`), as for a turn the host refused.
+- The surface's `prompts` take the core's `PromptScope` (pi-roundtable 0.9): a prompt goes to the scope's principal, by `principalId`, when the conversation is theirs, and an approval above their `tier` expires at once without being shown, whatever the scope escalates to, since the owners are not on the web chat. Who answers is unchanged: the conversation's person only, at the tier the call needs.
+
 ## [0.8.0] - 2026-10-07
 
 - First release. `webChat(options)` adds a WebSocket chat to a host's HTTP listener for people an OpenID Connect provider signs in: a `web:` chat surface, the claim that runs each message as a turn of its conversation's persona through `context.turns`, and a REST API (`POST tickets`, `GET`/`POST conversations`, `GET conversations/<id>/messages`) under one path. Every conversation is private to the person who opened it: the claim checks the host's conversation registry inside the conversation's queue before each turn.

package/README.md

@@ -8,11 +8,12 @@ Source lives in [`packages/webchat`][source] in the pi-roundtable repository and
 [roundtable]: https://www.npmjs.com/package/pi-roundtable
 [source]: https://github.com/wayne930242/pi-roundtable/tree/master/packages/webchat
 
-The plugin adds three things to a host:
+The plugin adds four things to a host:
 
 - a chat surface whose conversations have keys `web:<conversation>`;
 - the claim that runs each message as a turn of its conversation's persona, through `context.turns` and the host's runtime;
-- a REST API and a WebSocket under one path of the host's HTTP listener.
+- a REST API and a WebSocket under one path of the host's HTTP listener;
+- a durable private inbox for `notify`, with live `notice` frames and an authenticated REST inbox.
 
 It needs no Discord: a host whose `roundtable.config.ts` has no `discord` key and lists this plugin is a web-only assistant.
 `roundtable init --adapter web` creates such a project.
@@ -35,7 +36,11 @@ import type { RoundtableConfig } from "pi-roundtable";
 import { oidcJwtVerifier, webChat } from "pi-roundtable-webchat";
 
 export default {
-	owner: { id: "operator", name: "Ada" },
+	access: {
+		owners: [{ principal: "operator", name: "Ada" }],
+		admins: { roles: ["web:role:Helpdesk.Admin"] },
+		members: { roles: ["web:role:Helpdesk.User"] },
+	},
 	database: { url: process.env.DATABASE_URL ?? "" },
 	dataDir: "./data",
 	model: "anthropic/claude-sonnet-5-5",
@@ -47,10 +52,6 @@ export default {
 				issuers: ["https://login.example.com/"],
 				audiences: ["api://helpdesk"],
 			}),
-			access: {
-				admins: { roles: ["Helpdesk.Admin"] },
-				members: { roles: ["Helpdesk.User"] },
-			},
 			origins: ["https://chat.example.com"],
 			personas: [
 				{
@@ -71,7 +72,6 @@ Every mistake in these options throws when the configuration loads, so `roundtab
 | Option | What it sets |
 |---|---|
 | `verifier` | Checks each bearer token and names the person: `oidcJwtVerifier({ ... })`, or your own `TokenVerifier`. |
-| `access` | Who may chat, and at which tier: a `WebAccessMap`, or `webAccess(map)`. |
 | `personas` | The conversation kinds a person may open (`WebPersona`). |
 | `origins` | Required. The browser origins allowed to open the socket and call the API, each exactly `scheme://host[:port]`, such as `https://chat.example.com` or `chrome-extension://<id>`. `"any"` admits every origin, for clients that are not browsers; never use it where a browser holds the token. |
 | `listener` | The configured listener the route attaches to; default `public`, the one `http` names. |
@@ -85,16 +85,30 @@ A `WebPersona` is `{ kind, label?, prompt?, minTier?, selection? }`.
 `prompt()` is the system prompt of its conversations, contributed by this plugin; leave it out when another plugin contributes the persona of that kind.
 `minTier` (default `member`) is the lowest tier that may see and open it; a person whose tier falls below it later can no longer write in its conversations.
 `selection` (`{ tools, groups }`) names the tools its turns get; without it a turn gets the plugins' `agentSelection`, which grows with every plugin you add, so name the tools.
-Leave out `schedule_*` and `delegate_task` (see [what it does not do yet](#what-it-does-not-do-yet)), and `web_search` and `fetch_content` unless people may make the server fetch any address, internal ones included: they are member-tier tools, and a plugin that loads pi-web-access, such as one `roundtable add package pi-web-access` writes, adds them to `agentSelection`.
+Schedules and delegated reports can run in the person's private web conversation, even after reconnect or restart.
+Include their tools in `selection` only where intended: scheduling and delegation default to admin tier, and `notify` defaults to owner tier; top-level `toolTiers` can lower them deliberately.
+Leave out `web_search` and `fetch_content` unless people may make the server fetch any address, internal ones included: they are member-tier tools, and a plugin that loads pi-web-access adds them to `agentSelection`.
 The kinds `owner` and `agent` belong to the host and are refused.
 
 ### Access
 
-A `WebAccessMap` is `{ owners?, admins?, members? }`.
-`admins` and `members` name people by `users` (speaker ids), by `roles` (the names in the token's roles claim), or `everyone` the verifier accepts, guest accounts included; the highest tier a person qualifies for wins.
-`owners` is a list of speaker ids only: no claim a provider issues can make anyone the owner.
-A person the map gives no tier is not admitted: no ticket, no socket, no conversation, no turn.
-A map that admits no one throws.
+The core [Migrating to 0.9](../../docs/migration-0.9.md) guide covers the removed access option, backfill, memory isolation, prompt differences, and rollback.
+Use matching lockstep core and package releases; these principal contracts do not imply isolated per-person model credentials.
+
+Use the host's top-level `access`, not a `webChat` option.
+The removed `webChat({ access })` option fails at configuration load with migration guidance; `WebAccessMap` and `webAccess` are removed too.
+Token roles become `web:role:<role>` (or `<surface>:role:<role>` for a custom surface), and identities are written as `oidcSpeakerId(issuer, subject)`.
+Replace old `users` rules with `identities`, and old web owners with `access.owners: [{ name, principal?, identities: [oidcSpeakerId(...)] }]`.
+Replace the old webchat `everyone: true` with `everyone: ["<surface>"]`, substituting this chat's configured surface (default `"web"`).
+Core `everyone: true` opens every surface, including Discord, rather than only people this web verifier accepts.
+No IdP role can create an owner.
+A person the core policy gives no tier is not admitted: no ticket, no socket, no conversation, no turn.
+
+Each successful contact resolves through `IDENTITY`.
+An admitted new person gets an opaque `p_` principal; existing M1 users claim their backfilled OIDC principal and keep their private conversations without rewriting them.
+Ownership, limits, tickets, approvals and connection groups use `principalId`, not the external actor id.
+Link another identity with `roundtable principal link <principal> <identity>` to share memory across Discord and web; the CLI reports the host's cache delay.
+A fresh token may name another linked actor of the same principal, but a changed principal closes the socket with 4403.
 
 ### `oidcJwtVerifier`
 
@@ -116,7 +130,10 @@ A map that admits no one throws.
 It checks the signature, `iss`, `aud`, `exp` (required), and `nbf`, then a scope or roles and no app-only token, then the subject claim and `check`.
 A refused token throws `TokenRefused`, whose `reason` goes to the host's log and never to the client.
 The speaker id of a person is `oidc:<base64url(issuer)>:<subject>`: `oidcSpeakerId(issuer, subject)` makes it, and `parseOidcSpeakerId(id)` turns it back into the pair.
-Use it to name owners in the access map.
+Use it in the host's `access.owners[].identities` or with `roundtable principal link`.
+The verifier also reports `ActorFacts` with the canonical OIDC provider, subject, name, prefixed roles and legacy id.
+A custom verifier may supply `WebIdentity.actor` only with a provider beginning `oidc:` or equal to this chat's configured surface; `token`, `discord`, or another surface's provider is refused with `TokenRefused` before core identity resolution.
+Otherwise the chat derives these facts from its id.
 
 ### Provider settings
 
@@ -128,7 +145,7 @@ Microsoft Entra ID is the example below, and the same questions apply to any pro
 - **Accept access tokens only.** `requireScopeOrRoles` refuses a token with no scope or app roles, as an ID token is. An Entra ID token may still carry `roles` when you assign app roles, so also require the delegated scope in `check` (`typeof claims.scp === "string"`); where you can, register the API apart from the web page's sign-in app, so a page's ID token never has the API's audience.
 - **Refuse app-only tokens.** `rejectAppOnly` refuses `idtyp: "app"`. Entra writes `idtyp` only when the app asks for that optional claim; requiring `scp` refuses app-only tokens either way, since they carry roles and no scope.
 - **Merge issuers of one tenant only.** `speakerIssuer` makes one person's id the same whichever listed issuer signed the token, such as Entra's v1 `https://sts.windows.net/<tenant>/` and v2 `https://login.microsoftonline.com/<tenant>/v2.0`. Never list issuers of different tenants or providers together: their subjects are separate namespaces, and two people could get one id.
-- **Mind who `everyone` admits.** `everyone: true` admits every person the verifier accepts, guest accounts of your tenant included. Prefer roles assigned to the users and groups who should chat; with Entra, the optional `acct` claim (`0` for a member of the tenant, `1` for a guest) lets `check` refuse guests.
+- **Mind who `everyone` admits.** `everyone: ["<surface>"]` admits every person the verifier accepts on that surface, guest accounts of your tenant included; core `everyone: true` also admits people on every other surface. Prefer roles assigned to the users and groups who should chat; with Entra, the optional `acct` claim (`0` for a member of the tenant, `1` for a guest) lets `check` refuse guests.
 
 ```ts
 const tenant = process.env.ENTRA_TENANT_ID ?? "";
@@ -151,7 +168,7 @@ The token is never read from a URL.
 - **Another client**, such as a service, sends `Authorization: Bearer <token>` on the upgrade and offers `roundtable.webchat.v1`.
 
 The server echoes `roundtable.webchat.v1`.
-An upgrade from an origin not in `origins`, or without one, is refused with 403; without a valid ticket or token with 401; for a person the access map does not admit with 403; past the person's connection limit with 429.
+An upgrade from an origin not in `origins`, or without one, is refused with 403; without a valid ticket or token with 401; for a person the core policy does not admit with 403; past the person's connection limit with 429.
 
 ```js
 const { ticket } = await (
@@ -187,7 +204,7 @@ The TypeScript types are `ClientFrame` and `ServerFrame`.
 
 | Frame | Meaning |
 |---|---|
-| `{ type: "ready", protocol, speaker, personas, expiresAt }` | Sent first, and again after a fresh token: who you are (`{ id, name, tier }`), the personas you may open (`{ kind, label }`), and when the token expires. Open prompts follow it. |
+| `{ type: "ready", protocol, speaker, personas, expiresAt }` | Sent first, and again after a fresh token: who you are (`{ id, name, tier, principalId }`), the personas you may open (`{ kind, label }`), and when the token expires. Open prompts follow it. |
 | `{ type: "accepted", id, conversation }` | Your message `id` was taken into `conversation`, a new one when you named none. |
 | `{ type: "typing", conversation, on }` | The assistant is, or is no longer, working in the conversation. |
 | `{ type: "stoppable", conversation, on }` | A stop applies, or no longer applies. |
@@ -196,6 +213,7 @@ The TypeScript types are `ClientFrame` and `ServerFrame`.
 | `{ type: "failed", conversation, stopped }` | The turn ended without an answer: it failed, the host refused it before it ran (for example when its conversation could not be recorded), or it was stopped. The cause stays in the host's log. |
 | `{ type: "prompt", conversation, prompt }` | The turn asks you: `{ id, kind: "approval", title, message }`, or `{ id, kind: "ask", title, question, options, multi, allowOther }`. |
 | `{ type: "prompt_closed", conversation, prompt, outcome }` | The prompt closed: `approved`, `declined`, `answered`, `expired`, or `cancelled` (the turn stopped). |
+| `{ type: "notice", notice: { id, text, createdAt, readAt } }` | A durable private inbox entry; `readAt` is `null` until read. Fetch the REST inbox to recover entries missed while offline. |
 | `{ type: "reauth", expiresAt }` | Your token expires soon: send `auth` with a fresh one. |
 | `{ type: "error", code, ref? }` | A frame was refused. `ref` is the `send` id or prompt id it was about. |
 
@@ -206,7 +224,7 @@ The host's own limits close with `1008` (too many frames), `1009` (a frame too b
 
 ## REST API
 
-Every call sends `Authorization: Bearer <token>`; a missing or refused token gets 401 with `WWW-Authenticate: Bearer`, and a person the access map does not admit 403.
+Every call sends `Authorization: Bearer <token>`; a missing or refused token gets 401 with `WWW-Authenticate: Bearer`, and a person the core policy does not admit 403.
 A request from a browser origin not in `origins` gets 403; an allowed origin gets CORS headers and its preflight is answered.
 
 | Call | Answer |
@@ -215,23 +233,34 @@ A request from a browser origin not in `origins` gets 403; an allowed origin get
 | `GET <path>/conversations` | `{ conversations: [{ conversation, persona, title?, createdAt, lastActiveAt }] }`: your own, the most recently active first. |
 | `POST <path>/conversations` with `{ persona, title? }` | 201 `{ conversation, persona }`: a new conversation to write in. 429 `too_many_conversations` past either conversation limit. |
 | `GET <path>/conversations/<conversation>/messages?limit=50` | `{ messages: [{ role, text }] }`: its last messages, at most 500. Someone else's conversation is 403. |
+| `GET <path>/notices?limit=50&before=<id>` | `{ notices: [{ id, text, createdAt, readAt }] }`: only your principal's entries on this surface, newest first, at most 100. Omit `before` for the first page; use its last id to fetch the next. |
+| `POST <path>/notices/<id>/read` | `{ notice }` with `readAt` set. Idempotent; unknown ids or another principal's notice return 404. |
+
+Inbox text is truncated with `…` to at most 4096 UTF-16 units, or `messageChars` if smaller.
+The cap is reduced further for a small `maxBufferedBytes`, reserving 256 bytes for the notice frame and allowing six JSON bytes per text unit; configurations below 262 bytes are refused.
+Each principal retains only its newest 100 notices per surface, pruning oldest entries atomically with each insert (including concurrent deliveries).
+List, read acknowledgements, pagination cursors and retention are isolated by surface as well as principal.
+Offline inbox discovery requires a private conversation on this surface or a linked identity whose provider equals this surface; a generic `oidc:` link alone does not establish membership in every webchat inbox.
+A REST notice page therefore contains at most 100 bounded entries, less than 2.5 MiB at the default text cap.
 
 ## Security model
 
 - **Private conversations.** A conversation belongs to the person who opened it.
-  The host's conversation registry records its person at its first turn, and the claim checks that record inside the conversation's queue before every turn; only that person may list it, read it, write in it, stop it, or answer its prompts.
+  The host's conversation registry records its principal before runtime use, including transcript reads, and the claim checks that record inside the conversation's queue before every turn; only that person may list it, read it, write in it, stop it, or answer its prompts.
   Conversation ids are random UUIDs, and the claim runs only messages this plugin accepted from a verified socket.
   The owner can still read every conversation through the owner console, pi-roundtable-web, and the operator through the database and the data directory.
 - **Tokens.** Tokens are checked on every REST call, every upgrade, and every `auth` frame, and never read from a URL.
   By default only a person's access token passes: one without a scope or app roles, or an app-only one, is refused.
   A socket is closed when its token expires.
+  Every valid client frame rechecks the stored verified facts against core identity: revoked admission or a changed principal closes with 4403, and approvals use the current tier, subject to the core's identity-cache delay.
 - **Origins.** `origins` is required and checked on every upgrade and every browser request, so another site cannot open a socket or call the API with a browser's credentials.
 - **Limits.** Each person holds at most `connectionsPerPrincipal` sockets, and the route at most `maxConnections`; frames are limited in size and rate.
-  Each person has at most `turnsPerPrincipal` turns running or queued at once, however many conversations or sockets they use, and a conversation at most its running turn and one queued behind it, so one account cannot spend a shared model subscription on many turns at once; a message over either limit is refused with `busy` and never queued.
+  Each person has at most `turnsPerPrincipal` interactive turns running or queued at once, however many conversations or sockets they use, and a conversation at most its running interactive turn and one queued behind it; a browser message over either limit is refused with `busy` and never queued.
+  Personal schedules and delegated reports use the core runtime's conversation queue separately from this interactive admission budget, so a busy browser cannot discard them; runtime stop and shutdown still apply.
   Each person opens at most `newConversationsPerHour` conversations an hour, over the socket or the REST API alike.
 - **Approvals.** A held call's card goes to the conversation's person only, and needs the tier the call needs.
-  A card whose tier the person lacks is never shown, so the call stays held.
-- **Owner.** Nobody becomes the owner through a token's claims; list owners by speaker id.
+  A card whose tier the person lacks is never shown: its prompt resolves `expired`, without owner escalation.
+- **Owner.** Nobody becomes the owner through a token's claims; grant owner in core configuration or the principal CLI.
   Owner-tier tools stay out of web turns unless an owner is chatting.
 
 ## Limits
@@ -254,10 +283,10 @@ A request from a browser origin not in `origins` gets 403; an allowed origin get
 ## What it does not do yet
 
 - Attachments: messages carry text only.
-- Schedules and delegated reports: the claim takes no background turns, so a schedule or a report aimed at a web conversation is skipped. Leave the `schedule_*` and `delegate_task` tools out of a web persona's `selection`.
-- Error reports: `ops: { conversation: "web:<id>" }` stops the host at startup with a `config ops.conversation` error, since the surface posts only to a conversation a signed-in person opened and the claim takes no background turns. Report errors to another surface's conversation, or to an agent with Discord.
+- System error reports into a person's web conversation: the background claim accepts only `PERSONAL_TARGET` turns checked by core, whose author principal is the private conversation's principal.
+  The claim declares `takesSystemReports: false`: configuring `ops.conversation` on this surface (for example, `web:ops`) fails at startup with core `ConfigError`, rather than silently skipping every report.
+  Use a shared conversation on another surface, such as a Discord channel, or `ops.agent`.
 - Agent teams: the web chat has no agent rooms.
-- A person signed in on two providers, or on Discord and the web, has two speaker ids, and so two memories, until principals arrive in pi-roundtable 0.9.
 
 ## Testing
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-webchat",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"description": "A WebSocket chat adapter for pi-roundtable: private web conversations for people an OpenID Connect provider signs in, with live progress and approval cards",
 	"type": "module",
 	"license": "MIT",
@@ -36,14 +36,14 @@
 		"jose": "6.2.12"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.8.0 <0.9.0"
+		"pi-roundtable": ">=0.9.0 <0.10.0"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.15",
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.8.0",
+		"pi-roundtable": "0.9.0",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/chat.ts

@@ -7,7 +7,9 @@ import {
 	type ConversationRegistry,
 	type ConversationTurns,
 	channelKey,
+	type IdentityService,
 	type Logger,
+	PERSONAL_TARGET,
 	type RouteSocket,
 	type Speaker,
 	TIERS,
@@ -16,10 +18,14 @@ import {
 	type TranscriptEntry,
 	type TurnResult,
 } from "pi-roundtable";
-import type { WebAccess } from "./access.ts";
 import { RateWindow, TurnBudget } from "./budget.ts";
 import { type Connection, Connections } from "./connections.ts";
-import { TokenRefused, type TokenVerifier, type WebIdentity } from "./oidc.ts";
+import {
+	identityActor,
+	TokenRefused,
+	type TokenVerifier,
+	type WebIdentity,
+} from "./oidc.ts";
 import { PromptDesk } from "./prompts.ts";
 import {
 	CLOSE_CODES,
@@ -58,7 +64,7 @@ export interface WebChatLimits {
 	/** New conversations one person may open in any hour, written in or not; default 60. */
 	newConversationsPerHour: number;
 	/**
-	 * Turns one person may have running or queued at once, across their conversations; default 2.
+	 * Interactive turns one person may have running or queued at once, across their conversations; default 2.
 	 * A conversation also holds at most its running turn and one queued behind it.
 	 */
 	turnsPerPrincipal: number;
@@ -73,7 +79,7 @@ export interface WebChatLimits {
 export interface WebChatDeps {
 	surface: string;
 	verifier: TokenVerifier;
-	access: WebAccess;
+	identity(): IdentityService;
 	personas: readonly WebPersona[];
 	limits: WebChatLimits;
 	logger: Logger;
@@ -183,6 +189,8 @@ export class WebChat {
 	readonly #minted = new Map<string, Minted>();
 	/** Whose each conversation is, once its person wrote in it during this process. */
 	readonly #owners = new Map<string, string>();
+	/** Keys proved registered private before any direct runtime operation. */
+	readonly #registered = new Set<ChannelKey>();
 	/** Accepted messages waiting for the claim, by message id. */
 	readonly #pending = new Map<string, Pending>();
 	/** Each person's turns, running or queued. */
@@ -230,13 +238,12 @@ export class WebChat {
 		return this.admitIdentity(identity);
 	}
 
-	admitIdentity(identity: WebIdentity): Admitted {
-		const tier = this.#deps.access.tierOf(identity);
-		if (!tier) throw new Refusal("forbidden");
-		return {
-			identity,
-			speaker: { id: identity.id, name: identity.name, tier },
-		};
+	async admitIdentity(identity: WebIdentity): Promise<Admitted> {
+		const speaker = await this.#deps
+			.identity()
+			.resolve(identityActor(identity, this.#deps.surface));
+		if (!speaker) throw new Refusal("forbidden");
+		return { identity, speaker };
 	}
 
 	/** The personas a speaker may open. */
@@ -260,16 +267,16 @@ export class WebChat {
 	open(speaker: Speaker, kind: string, title?: string): string {
 		this.#persona(kind, speaker);
 		const unused = [...this.#minted.values()].filter(
-			(minted) => minted.principal === speaker.id,
+			(minted) => minted.principal === speaker.principalId,
 		).length;
 		if (unused >= this.#deps.limits.unusedConversationsPerPrincipal)
 			throw new Refusal("too_many_conversations");
-		if (!this.#opened.take(speaker.id))
+		if (!this.#opened.take(speaker.principalId))
 			throw new Refusal("too_many_conversations");
 		const id = crypto.randomUUID();
 		const cut = title === undefined ? undefined : titleOf(title);
 		this.#minted.set(id, {
-			principal: speaker.id,
+			principal: speaker.principalId,
 			persona: kind,
 			...(cut ? { title: cut } : {}),
 		});
@@ -292,24 +299,31 @@ export class WebChat {
 			.registry()
 			.get(channelKey(this.#deps.surface, conversation));
 		if (record) {
-			if (record.principalId !== speaker.id || record.visibility !== "private")
+			if (
+				record.principalId !== speaker.principalId ||
+				record.visibility !== "private"
+			)
 				throw new Refusal("forbidden");
 			const persona = this.#persona(record.kind, speaker);
-			this.#owners.set(conversation, speaker.id);
+			this.#owners.set(conversation, speaker.principalId);
+			this.#registered.add(record.key);
 			return { persona, record };
 		}
 		const minted = this.#minted.get(conversation);
 		if (!minted) throw new Refusal("unknown_conversation");
-		if (minted.principal !== speaker.id) throw new Refusal("forbidden");
+		if (minted.principal !== speaker.principalId)
+			throw new Refusal("forbidden");
 		const persona = this.#persona(minted.persona, speaker);
 		// The surface learns whose a conversation is from each check that proves it.
-		this.#owners.set(conversation, speaker.id);
+		this.#owners.set(conversation, speaker.principalId);
 		return { persona, minted };
 	}
 
 	/** The speaker's web conversations, the most recently active first. */
 	async list(speaker: Speaker): Promise<ConversationRecord[]> {
-		const records = await this.#deps.registry().list({ principal: speaker.id });
+		const records = await this.#deps
+			.registry()
+			.list({ principal: speaker.principalId });
 		return records.filter(
 			(record) =>
 				record.surface === this.#deps.surface &&
@@ -349,7 +363,7 @@ export class WebChat {
 			personas: this.personasFor(speaker),
 			expiresAt: identity.expiresAt.toISOString(),
 		});
-		for (const frame of this.desk.openFor(identity.id))
+		for (const frame of this.desk.openFor(speaker.principalId))
 			this.connections.send(connection, frame);
 		this.#watchToken(connection);
 	}
@@ -419,6 +433,23 @@ export class WebChat {
 	}
 
 	async #handle(connection: Connection, frame: ClientFrame): Promise<void> {
+		// Token facts remain verified until expiry, but linked principals and persistent roles can
+		// change while the socket is open. In particular, an approval must use the current tier.
+		if (frame.type !== "auth") {
+			let current: Speaker;
+			try {
+				current = (await this.admitIdentity(connection.identity)).speaker;
+			} catch (error) {
+				if (!(error instanceof Refusal)) throw error;
+				connection.socket?.close(CLOSE_CODES.notAdmitted, "not admitted");
+				return;
+			}
+			if (current.principalId !== connection.speaker.principalId) {
+				connection.socket?.close(CLOSE_CODES.notAdmitted, "another person");
+				return;
+			}
+			connection.speaker = current;
+		}
 		const { speaker } = connection;
 		switch (frame.type) {
 			case "auth":
@@ -472,7 +503,7 @@ export class WebChat {
 			throw error;
 		}
 		// A connection belongs to one person: a token for someone else ends it.
-		if (admitted.identity.id !== connection.identity.id) {
+		if (admitted.speaker.principalId !== connection.speaker.principalId) {
 			connection.socket?.close(CLOSE_CODES.notAdmitted, "another person");
 			return;
 		}
@@ -490,12 +521,12 @@ export class WebChat {
 		if (!text.trim() || text.length > this.#deps.limits.messageChars)
 			throw new Refusal("bad_frame");
 		// Checked before a conversation is opened for it, so a refused message opens none.
-		if (!this.#turns.allows(speaker.id, frame.conversation))
+		if (!this.#turns.allows(speaker.principalId, frame.conversation))
 			throw new Refusal("busy");
 		const conversation =
 			frame.conversation ?? this.open(speaker, frame.persona as string);
 		const { persona, record, minted } = await this.own(speaker, conversation);
-		const release = this.#turns.take(speaker.id, conversation);
+		const release = this.#turns.take(speaker.principalId, conversation);
 		if (!release) {
 			// Another message took the last place meanwhile.
 			if (!frame.conversation) this.#minted.delete(conversation);
@@ -518,6 +549,7 @@ export class WebChat {
 			this.surface.deliver({
 				channel: channelKey(this.#deps.surface, conversation),
 				messageId,
+				actor: identityActor(connection.identity, this.#deps.surface),
 				authorId: speaker.id,
 				authorName: speaker.name,
 				authorIsBot: false,
@@ -543,32 +575,122 @@ export class WebChat {
 		return {
 			name: `webchat:${surface}`,
 			priority: 10,
+			postsInPlace: true,
+			takesSystemReports: false,
 			owns: (channel) => channel.startsWith(`${surface}:`),
 			admit: (message) => {
 				const pending = this.#pending.get(message.messageId);
 				this.#pending.delete(message.messageId);
-				if (!pending || pending.speaker.id !== message.authorId) {
+				const speaker = message.speaker;
+				if (
+					!pending ||
+					pending.speaker.id !== message.authorId ||
+					!speaker ||
+					speaker.principalId !== pending.speaker.principalId
+				) {
 					pending?.release();
+					if (pending)
+						this.connections.sendTo(pending.speaker.principalId, {
+							type: "failed",
+							conversation: this.surface.conversationOf(message.channel),
+							stopped: false,
+						});
 					return undefined;
 				}
 				return {
 					kind: "turn",
 					run: async () => {
 						try {
-							await this.#turn(message.channel, message.text, pending);
+							await this.#turn(message.channel, message.text, {
+								...pending,
+								speaker,
+							});
 						} finally {
 							pending.release();
 						}
 					},
+					// Dropped by the router after all: the message never runs, so its place is free, and its
+					// person, told it was accepted, is told it failed, as for a turn the host refused.
+					dropped: () => {
+						pending.release();
+						this.connections.sendTo(pending.speaker.principalId, {
+							type: "failed",
+							conversation: this.surface.conversationOf(message.channel),
+							stopped: false,
+						});
+					},
 					failure: "a web chat turn failed",
 				};
 			},
+			background: async (turn) => {
+				if (turn.target !== PERSONAL_TARGET.name)
+					return {
+						status: "skipped",
+						reason: "webchat takes only personal background turns",
+					};
+				const { speaker } = turn;
+				if (!speaker || speaker.principalId !== turn.author.principalId)
+					return {
+						status: "skipped",
+						reason: "webchat needs the router's checked principal",
+					};
+				const conversation = this.surface.conversationOf(turn.channel);
+				const record = await this.#deps.registry().get(turn.channel);
+				if (
+					record?.visibility !== "private" ||
+					record.principalId !== turn.author.principalId
+				)
+					return {
+						status: "skipped",
+						reason:
+							"the background author does not own this private conversation",
+					};
+				let persona: WebPersona;
+				try {
+					persona = (await this.own(speaker, conversation)).persona;
+				} catch (error) {
+					if (!(error instanceof Refusal)) throw error;
+					return { status: "skipped", reason: error.code };
+				}
+				// Background work has already been admitted by core. Its runtime queue is
+				// separate from interactive admission: a busy browser must not discard
+				// a completed delegation or scheduled reminder. Runtime owns stop/shutdown.
+				const result = await this.#deps.turns().run({
+					channel: turn.channel,
+					kind: persona.kind,
+					text: turn.text,
+					speaker,
+					interactive: turn.report === true,
+					conversation: { visibility: "private" },
+					...(persona.selection
+						? {
+								selection: {
+									id: `webchat:${persona.kind}`,
+									...persona.selection,
+								},
+							}
+						: {}),
+					reply: async (result) =>
+						this.#reply(speaker.principalId, conversation, result),
+				});
+				return result.ok
+					? { status: "ran" }
+					: { status: "failed", error: "a webchat background turn failed" };
+			},
 			startFresh: async (channel) => {
 				const record = await this.#deps.registry().get(channel);
+				if (record?.visibility !== "private" || !record.principalId)
+					throw new Refusal("unknown_conversation");
+				this.#owners.set(
+					this.surface.conversationOf(channel),
+					record.principalId,
+				);
+				this.#registered.add(channel);
 				await this.#deps.runtime().startFresh(channel);
-				return record?.kind ?? "";
+				return record.kind;
 			},
-			stop: (channel) => this.#deps.runtime().stop(channel),
+			stop: (channel) =>
+				this.#registered.has(channel) && this.#deps.runtime().stop(channel),
 		};
 	}
 
@@ -580,15 +702,16 @@ export class WebChat {
 	): Promise<void> {
 		const { speaker, persona } = pending;
 		const conversation = this.surface.conversationOf(channel);
+		let registered = false;
 		try {
-			await this.own(speaker, conversation);
+			registered = (await this.own(speaker, conversation)).record !== undefined;
 		} catch (error) {
 			if (!(error instanceof Refusal)) throw error;
 			this.#deps.logger.warn(
 				{ channel, code: error.code },
 				"a web chat message was refused before its turn",
 			);
-			this.connections.sendTo(speaker.id, {
+			this.connections.sendTo(speaker.principalId, {
 				type: "error",
 				code: error.code,
 			});
@@ -596,6 +719,21 @@ export class WebChat {
 		}
 		let answered = false;
 		try {
+			if (!registered) {
+				const kept = await this.#deps.registry().register({
+					key: channel,
+					kind: persona.kind,
+					visibility: "private",
+					principalId: speaker.principalId,
+					...(pending.title ? { title: pending.title } : {}),
+				});
+				if (
+					kept.visibility !== "private" ||
+					kept.principalId !== speaker.principalId
+				)
+					throw new Refusal("forbidden");
+			}
+			this.#registered.add(channel);
 			await this.#deps.turns().run({
 				channel,
 				kind: persona.kind,
@@ -616,14 +754,14 @@ export class WebChat {
 				},
 				reply: async (result) => {
 					answered = true;
-					this.#reply(speaker.id, conversation, result);
+					this.#reply(speaker.principalId, conversation, result);
 				},
 			});
 		} catch (error) {
 			// A turn the host refused before it ran, such as one whose conversation could not be
 			// recorded, has no reply: the person is told it failed, and the router logs the cause.
 			if (!answered)
-				this.connections.sendTo(speaker.id, {
+				this.connections.sendTo(speaker.principalId, {
 					type: "failed",
 					conversation,
 					stopped: false,