Organization orchestration
One organization has one logical orchestrator identity. Its durable admission ledger preserves the authenticated source actor, addressed private stream, receipt and reconciliation lease. Existing unit owners retain execution authority.
The server composes these contracts through authenticated adapter mappings and configured retention and admission limits. The server does not infer an organization or person from message text, repository, email or attached context. The server wires browser, Slack, HTTP and MCP intake, account verification routes and canonical owner effects. Unavailable source proof holds work; it never selects a replacement owner.
- Code:
src/core/dispatch/admission.ts,src/core/dispatch/textTurns.ts,src/core/dispatch/operator.ts,src/core/dispatcher.ts,src/core/dispatch/handoff.ts,src/core/dispatch/handoffValidation.ts,src/core/dispatch/sessionIdentity.ts,src/core/dispatch/relaunch.ts,src/core/dispatch/runLoop.ts,src/core/dispatch/provision.ts,src/core/dispatch/run.ts,src/core/dispatch/record.ts,src/core/dispatch/ship.ts,src/core/runRecord.ts,src/core/runRegistry/projections.ts,src/core/runRegistry/state.ts,src/core/runsService.ts,src/tools/session.ts,src/core/runLedger/ingress.ts,src/core/runLedger/unreadIngress.ts,src/core/runLedger/ledger.ts,src/core/runLedger/inMemory.ts,src/core/runLedger/inboxSegment.ts,src/core/runLedger/writeThrough.ts,src/core/runLedger/types.ts,src/core/runLedger/inboxMessage.ts,src/core/runLedger/decisions.ts,src/core/runLedgerWorker.ts,src/core/dispatch/originalOrganizationInput.ts,src/core/dispatch/privateDestination.ts,src/core/dispatch/privateConversation.ts,src/core/types.ts,src/core/coordinator/questionAnswer.ts,src/core/coordinator/humanGate.ts,src/core/coordinator/requesterAuthority.ts,src/core/coordinator/instanceStore.ts,src/core/coordinator/contract.ts,src/core/ship/coordinator.ts,deploy/cloudflare-memory/worker.ts,src/core/organization/accessCatalogue.ts,src/core/organization/contract.ts,src/core/organization/engine.ts,src/core/organization/memory.ts,src/core/organization/sqlite.ts,src/core/organization/service.ts,src/core/organization/worker.ts,src/core/organization/directoryTransport.ts,deploy/cloudflare-memory/organization.ts,src/channels/organizationAuthentication.ts,src/channels/organizationNativeSources.ts,src/core/organization/runtime.ts,src/core/organization/ownerFailure.ts,src/channels/slack.ts,src/channels/browserHomeWiring.ts,src/index.ts. - Tests:
src/core/dispatch/operator.test.ts,src/core/dispatch/ship.test.ts,src/core/dispatcher.test.ts,src/core/dispatch/handoffValidation.test.ts,src/core/dispatch/relaunch.test.ts,src/core/dispatch/sessionIdentity.test.ts,src/tools/session.test.ts,src/core/runLedger/ingress.test.ts,src/core/runLedger/inboxMessage.test.ts,src/core/coordinator/questionAnswer.test.ts,src/core/coordinator/humanGate.test.ts,deploy/cloudflare-memory/runLedger.test.ts,src/core/organization/contract.test.ts,src/core/organization/service.test.ts,deploy/cloudflare-memory/organization.test.ts,src/channels/organizationAuthentication.test.ts,src/channels/organizationNativeSources.test.ts,src/core/organization/runtime.test.ts,src/channels/slack.test.ts,src/channels/browserHomeWiring.test.ts.
Behavior
- Authenticated organization first. Exact authenticated source, issuer and tenant map to one organization. CLI, HTTP and MCP also require an explicit caller organization grant. Absent and ambiguous mappings fail closed. GitHub admits only a proved human's local answer to an observed unit question.
- Private projection preserves identity. A proved person binding joins only future admitted conversation. Every reply inherits its original request's admission boundary; a late reply cannot expose a pre-link request. A legacy entry with no admission boundary is readable only through its own current source. Historical actors and authorization receipts remain unchanged. Unlinked human sources have separate streams. Services retain separate principals; a verified delegation preserves its source identity while projecting to the addressed person's stream. Before a proved person binding, that delegation uses only the credential's own source stream; it does not infer a Person ID or join peer history. An unlink tombstone supplies the current source-only revision and fences older queued owners. Local thread messages never copy into the broad stream.
- One durable admission transaction. Organization, source identity and key scope a receipt. Equivalent validated fields return the original disposition regardless of object property order. Array order and raw input content remain part of the payload; binding projection changes do not change its digest. A changed payload under that key conflicts. New keys are distinct acts. Browser keys are minted by the server, expire before first use and bind the current actor revision. An existing receipt remains replayable after key expiry.
- Reservations do not own unit state. The ledger records an observed canonical target version and reserves it for one admitted receipt. It never increments the canonical version on admission. Rejection, deletion, retention or revoked authority release that exact reservation. Accepted reservations remain until the canonical owner reports a newer version. The canonical unit owner must independently authorize and compare its full question state before accepting an answer.
- Fenced reconciliation. A replacement process acquires the same logical identity with a new lease generation. Selection excludes later admissions outside the claimed snapshot. Bounded batches rotate source and actor lanes with a durable cursor; ordinary requests cannot use reserved reconciliation capacity. Completion refuses while eligible work in that snapshot remains pending. The runtime releases that finished batch through the fenced yield command, without marking the remaining snapshot reconciled or waiting for its launched model runs. Pending caps bound queued submissions; the original execution engine retains its separate live-run and compute ownership.
- Effect keys do not prove an external effect once. Pending selection is repeatable after process replacement. The existing execution owner must atomically consume the preserved effect key before dispatch or resume. The ledger alone cannot prevent a repeated network effect after a crash between effect and settlement. Admission and settlement are separate facts.
- Current authority at every read and act. Admission, stream reads, selection and settlement check the binding in the same authoritative database as the identity directory. A caller revoked between service authorization and a stream transaction receives a fenced result. Source-access revocation stops admission, queued effects and source transcript disclosure. Effect authorization rechecks the preserved actor, source access, content lifetime, canonical target version, receipt and current lease before the owner consumes its key.
- Content lifecycle and safe updates. Secrets are redacted before durable input and reply storage. Every constructed pending, stream and receipt row must pass its stored schema. If sanitized instructions, replies or receipt reasons exceed that schema, the request fails before state changes; instructions are never silently truncated. Content deletion removes transcript and queued model input while its non-content receipt still blocks replay. Expired queued content is ineligible even beyond a cleanup batch. Transcript reads use an indexed bounded cursor. Deletes, source revocations, receipt settlement and cleanup advance the projection revision. Consumers must also fence frames by the current actor binding revision.
- One persistence algorithm. The in-memory and SQLite implementations run the same contract tests. The Worker stores the directory and ledger in one installation Durable Object, uses the existing bearer and request-size gates, validates both requests and responses, and refuses unknown stored schema versions without replacing their rows.
Validation criteria
| Criterion | Evidence |
|---|---|
| Process replacement preserves logical identity and fences an old owner | [unit] src/core/organization/contract.test.ts::organization store contract::keeps one durable logical orchestrator and fences replacement owners |
| Retry returns one original receipt and changed payload conflicts | [unit] src/core/organization/contract.test.ts::organization store contract::returns a durable retry receipt and rejects changed payload under its key |
| Flooded actor cannot block another actor or a reconciliation wake | [unit] src/core/organization/contract.test.ts::organization store contract::contains an actor flood while another actor and reconciliation proceed |
| Rejected reservation leaves canonical question version available | [unit] src/core/organization/contract.test.ts::organization store contract::releases a rejected reservation without changing the canonical question revision |
| Revoked reader is fenced and its queued reservation releases | [unit] src/core/organization/contract.test.ts::organization store contract::fences a revoked reader and releases that actor's queued question reservation |
| Actor lanes rotate and newer admissions remain outside the lease snapshot | [unit] src/core/organization/contract.test.ts::organization store contract::rotates actor lanes across bounded batches and fences the lease snapshot |
| Expired content beyond one cleanup batch never reaches selection | [unit] src/core/organization/contract.test.ts::organization store contract::never exposes expired queued content beyond a cleanup batch |
| Delegated service attribution remains visible and replies redact secrets | [unit] src/core/organization/contract.test.ts::organization store contract::preserves service attribution in a verified person's stream and redacts replies |
| Server key binds actor and organization; retry survives issuance expiry | [unit] src/core/organization/contract.test.ts::organization store contract::requires a fresh actor-bound browser key once and preserves retry receipts after its expiry |
| Busy reconciliation persists the projection version after removing revoked content | [unit] src/core/organization/contract.test.ts::organization store contract::advances the projection clock when a busy reconciliation rejects revoked content |
| Current lease and canonical target version fence the owner effect | [unit] src/core/organization/contract.test.ts::organization store contract::checks the current lease and canonical question before its original owner starts an effect |
| Private stream cursors continue past inaccessible source rows | [unit] src/core/organization/contract.test.ts::organization store contract::continues private stream pages past currently inaccessible source content |
| Source resolution uses authenticated scope and explicit caller organization grants | [unit] src/core/organization/service.test.ts::organization authenticated service::resolves every supported source from authenticated scope and requires caller organization grants |
| Public submissions cannot consume the internal reserved reconciliation lane | [unit] src/core/organization/service.test.ts::organization authenticated service::does not let caller payloads consume the reserved reconciliation lane |
| Only proved identities join private streams; unrelated actors remain private | [unit] src/core/organization/service.test.ts::organization authenticated service::joins only proved identities and preserves historical source attribution |
| Revocation between authorization and read is refused inside the transaction | [unit] src/core/organization/service.test.ts::organization authenticated service::fences a caller revoked after authorization and before its transcript transaction |
| Actor is revalidated after pending selection and before effect authorization | [unit] src/core/organization/service.test.ts::organization authenticated service::revalidates a preserved actor after pending selection and before its effect |
| Source revocation after selection refuses the effect | [unit] src/core/organization/service.test.ts::organization authenticated service::refuses source revocation after selection before an effect |
| Real Worker client replacement retains proved identity and conversation, then refuses revocation | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::keeps proved identities and private content across client replacement and fences revocation |
| Real Worker refuses unknown schemas without overwriting their rows | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::refuses unknown stored schema versions without overwriting rows |
| Oversized sanitized instructions refuse atomically across human, service, ordinary, reconciliation, broad and local lanes; expiry and deletion remain readable | [unit] src/core/organization/contract.test.ts::organization store contract::refuses redaction-expanded instructions atomically in every admission lane |
| Oversized sanitized replies and reasons leave the prior receipt and projection intact, including delegated service replies | [unit] src/core/organization/contract.test.ts::organization store contract::refuses expanded settlement text without changing the receipt or private projection |
| Service admission validates sanitized input before calling storage | [unit] src/core/organization/service.test.ts::organization authenticated service::rejects expanded sanitized input before an unavailable store can affect admission |
| Logical field order is stable while raw content, context array order and original attribution remain significant | [unit] src/core/organization/service.test.ts::organization authenticated service::replays equivalent validated payloads regardless of property order while preserving array order |
| Real Worker refuses expanded content and still admits, settles, deletes and reads valid work | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::rejects redaction growth without poisoning durable admission or settlement |
| Real Worker retries reorder-equivalent content but conflicts on raw or context order changes | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::replays reordered logical payloads through the real Worker while preserving raw differences |
| Staging browser-to-original-owner execution, cross-adapter account verification and live feed frame fencing | [gap] Requires an exact deployed candidate and bounded live acceptance; isolated adapter and owner tests do not establish deployment. |
| Message and action requests share one actor quota; changing workload cannot throttle a different actor or consume the reserved reconciliation lane | [unit] src/core/organization/contract.test.ts::organization store contract::shares one actor quota across message and act workloads while preserving another actor and reconciliation | | Accepted original owners deliver addressed replies without holding the organization lease; deletion and revocation refuse late output | [unit] src/core/organization/contract.test.ts::organization store contract::delivers an original owner's addressed reply once after lease completion and blocks deletion or revocation | | Initial private history opens the current bounded page and carries independent older and forward cursors | [unit] src/core/organization/contract.test.ts::organization store contract::opens the latest private page with bounded older cursors and follows new replies | | Real SQLite serves the latest bounded private page and refuses late original-owner output after deletion | [unit] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::reads the latest private page and persists original-owner replies after the lease ends | | Body fields cannot become authenticated source lookup facts | [unit] src/core/organization/service.test.ts::organization authenticated service::takes replay identity lookup facts only from authentication and ignores forged body facts | | Exact browser retry keeps the original saved question and observed revision | [unit] src/core/organization/service.test.ts::organization authenticated service::replays the original saved question and observed browser revision after the current question changes | | New proved identities join only future cross-source history at an atomic sequence cutoff | [unit] src/core/organization/contract.test.ts::organization store contract::links only future cross-source private activity at an atomic sequence cutoff even in the same millisecond | | Source-access changes have a separate epoch; ordinary messages leave it unchanged | [unit] src/core/organization/contract.test.ts::organization store contract::uses a separate access epoch for policy changes without clearing drafts on messages | | Retained private entries use exact original source proof; unknown policy holds the read | [unit] src/core/organization/contract.test.ts::organization store contract::filters private history through the exact original source proof and holds unknown policy | | A shorter-lived settlement or owner reply cannot expire source proof before the retained original message | [unit] src/core/organization/contract.test.ts::organization store contract::retains original source proof when a shorter-lived … reply expires | | Joining a private person stream does not grant another source's deletion authority | [unit] src/core/organization/contract.test.ts::organization store contract::limits private content deletion to the exact authenticated source even in a joined person stream | | Linking preserves bounded own-source history and deletion without revealing old other-source activity | [unit] src/core/organization/contract.test.ts::organization store contract::preserves bounded own-source history and deletion after linking without inheriting another source's old history | | Late settlement and owner replies inherit the original admission boundary on every private history path | [unit] src/core/organization/contract.test.ts::organization store contract::keeps late … replies behind their original admission's linking cutoff | | Native SQLite preserves late-reply sharing eligibility across client replacement | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::keeps pre-link requests and their late replies private through native SQLite client replacement | | A missing original-source verifier holds stream, tail and explicit-identity history without returning private content | [unit] src/core/organization/service.test.ts::organization authenticated service::holds every private history path when original-source verification is absent | | Original ingress retains request and run identity and refuses replay before any run exists | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::retains the original request and identity and refuses a retry before any run exists | | Fresh machine history reads only its captured dispatching owner; rehosting remains uncertain-only, and stale or foreign input is refused | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::routes the exported smoke answer through native HTTP to its original General owner; ::keeps fresh machine history bound to its original source: %s; ::rehosts an uncertain service input with its original owner and only proved source-owned machine history | | Original ingress clears expired private content but retains its replay refusal | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::clears expired request content while preserving the original refusal tombstone | | Deleting original ingress content preserves ownership and fences a racing later admission | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::deletes original content and fences a later admission when deletion wins the race | | SQLite keeps original ingress ownership across client replacement and clears expired content | [unit] deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::preserves original request and run identity across clients and refuses replay without a run | | New human questions accept only the original owner's assignment; replay preserves known or unknown assignment | [unit] src/core/coordinator/humanGate.test.ts::original human question assignment::assigns only a new question from the trusted owner and preserves known or unknown assignments on replay | | Original source lookup remains after private input deletion and fails closed at its own expiry | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::retains indexed original source proof after content deletion and fences it at origin expiry | | An original live receiver can hand back only its exact durable unread input under the current generation fence; consumed items cannot continue, released items cannot return to the receiver's inbox, and one continuation claim retains the same consumed owner across client replacement | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::holds only the original unread inbox item, then claims its continuation once across replacement; src/core/runLedger/ingress.test.ts::original ingress owner::never returns already consumed, deleted, or expired input to a provider; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::returns an exact unread item durably and claims the same original input once across clients | | Bounded unread repair scans rotate past unavailable owners and omit erased or expired content without discarding the original owner tombstone | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::rotates bounded unread repairs past unavailable owners and omits deleted and expired input; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::returns an exact unread item durably and claims the same original input once across clients | | Positive original-owner completion always fences unread handoff or continuation, including a canonical effect that created no physical model run | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::never continues a positively completed owner…; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::returns an exact unread item durably and claims the same original input once across clients | | Canonical answer admission matches the complete saved question and original sender; exact saved retries retain their event sequence after the question changes, and recovered human holds do not reopen execution | [unit] src/core/coordinator/questionAnswer.test.ts::Original question answer admission::*, deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit events (record 0051's reply-as-event rule)::admits only the captured question and returns an exact saved answer after the question changes | | Durable inbox reconstruction retains only the original input pointer, never a private capability or saved Actor grants | [unit] src/core/runLedger/inboxMessage.test.ts::durable inbox continuity::preserves the original owned input pointer across JSON without restoring private proof or Actor grants | | A terminal receiver's unread proof comes from its exact archived closure, generation, cursor and deferred set; consumed, missing, malformed and foreign closures fence while explicit deferred input remains eligible | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::uses the exact terminal receiver closure for unread eligibility…; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::validates archived terminal unread proof through SQLite and a replacement client… | | Positive original completion cannot be demoted by later uncertainty or refusal repair; concurrent cleanup acknowledges only current fields and cannot restore deleted input or replace completed ownership | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::never demotes positive completion with a late uncertainty or refusal repair; ::concurrent cleanup and refusal acknowledgement cannot restore deleted input or replace a completed owner; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::keeps completion and content deletion final through late settlement and concurrent cleanup | | The first guarded answer reserves its complete canonical question at the original unit owner across source races; consumed or cleared questions retain that reservation, exact retries keep their original sequence, and a new complete question admits a new answer | [unit] src/core/coordinator/questionAnswer.test.ts::Original question answer admission::admits one answer across concurrent browser and GitHub sources; ::retains a consumed question winner through clearing ending and a new question; deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit events (record 0051's reply-as-event rule)::retains one canonical question winner across concurrent sources consumption and process replacement | | Only guarded append derives the durable question digest; an unguarded caller cannot mint a reservation, and event capping retains the accepted stamp | [unit] src/core/coordinator/questionAnswer.test.ts::Original question answer admission::ignores unguarded caller question claims and retains the guarded claim under the event cap; deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit events (record 0051's reply-as-event rule)::ignores caller question claims and retains a capped guarded claim in SQLite | | An exact committed unread handback replays after a step-free terminal closure or a lost acknowledgement without resetting its continuation claim; changed proof and deleted input remain fenced | [unit] src/core/runLedger/ingress.test.ts::original ingress owner::replays a committed unread handback after its live receiver closes without a step; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::reconciles a lost unread handback acknowledgement after a step-free terminal closure |
| A legacy event without an admitted question digest cannot replay as a guarded answer or reserve a question retroactively; the first new guarded answer reserves the complete current question and excludes another source | [unit] src/core/coordinator/questionAnswer.test.ts::Original question answer admission::refuses to turn an unguarded legacy event into a reserved question answer; deploy/cloudflare-memory/runLedger.test.ts::run ledger — the coordinator's unit events (record 0051's reply-as-event rule)::refuses an unguarded legacy reply as a reserved question answer through the native store | | New run registration uses the identity held by its original ingress owner | [unit] src/core/dispatch/provision.test.ts::registerRun — the run's row on every surface before the attach::publishes a newly admitted run under its original ingress owner's identity | | A trusted full actor survives internal message copies while JSON cannot supply authority | [unit] src/core/authz/actor.test.ts::resolveChatActor — a chat message's namespaced user id chooses the surface::preserves a fresh server actor across message copies but never accepts a JSON actor snapshot | | Broad private turns use the current retained projection without saved tail, notes, memory or artifact fallback | [unit] src/core/dispatcher.test.ts::dispatch::uses only authoritative retained history with the operator… | | Missing authoritative private history refuses before any stored fallback | [unit] src/core/dispatcher.test.ts::dispatch::refuses an authoritative private turn without a verified seed instead of reading stored history | | A private operator question does not derive a shared stored conversation row | [unit] src/core/dispatcher.test.ts::dispatch::keeps private operator questions out of the shared stored conversation | | Plain organization conversation selects the existing orchestrator while an explicit agent keeps its route | [unit] src/core/dispatcher.test.ts::dispatch::keeps plain organization conversation on the orchestrator while honoring an explicit agent | | Hosted Ship preserves the consumed owner identity in registry and recovery ledger | [unit] src/core/dispatch/ship.test.ts::runShipBranch — the host key and the hosted marker (record 0060)::keeps the consumed original ingress identity on the hosted registry and recovery ledger | | Private saved confirmation uses current actor policy and retained history only | [unit] src/core/dispatcher.test.ts::dispatch::confirms a saved private proposal with the current full actor and retained history only | | A target answer compares its saved question at the original unit owner and cannot fall through to a new model | [unit] src/core/dispatcher.test.ts::a unit-owned thread (record 0051's reply-as-event and gone-instance rules)::keeps a target-bound answer on its original unit and refuses a question changed at append | | Authoritative private tools and child captures read only fresh verified projection, without old notes, assets or durable recall ranges; independent original inputs have separate model session lanes | [unit] src/tools/session.test.ts::sessionCapabilityFor…::uses only fresh authoritative projection for tools and child capture without stored notes assets or recall ranges; src/core/dispatch/sessionIdentity.test.ts::run session identity comes from the admitted unit::keeps authoritative history in its original run lane without a shared or legacy fallback | | Private handoffs rebuild from current verified source projection; missing source or cumulative permissions holds them without reading stored transcript, notes or files | [unit] src/core/dispatch/handoffValidation.test.ts::canonical child handoff validation::rebuilds private handoffs from current verified projection and never frozen history notes or assets | | Model session tools use the current private projection, and persisted private provider restart holds the original run without fallback | [unit] src/core/dispatcher.test.ts::dispatch::keeps authoritative session tools and saved provider recovery behind the current private projection | | In-process private provider replacement holds the same run without reattaching, rotating or rebuilding cached model state; ordinary native relaunch remains available | [unit] src/core/dispatch/relaunch.test.ts::prepareRelaunch — the relaunch decided and prepared::holds authoritative private provider state without reattaching rotating or rebuilding its original run |
Current private routing evidence
Authoritative private routing does not load or write actor-keyed target checkpoints or inherit a finished run's target. Only current typed input, fresh verified source projection and independently authorized canonical owner facts can ground work. Ship thread evidence uses the same projected author-stamped history; unavailable evidence starts no worker. Ordinary native checkpoint routing remains unchanged.
| Criterion | Proof |
|---|---|
| Private operator prompts exclude deleted requester checkpoints, finished-run repositories, saved notes and memory, while ordinary native routing retains its checkpoints | [unit] src/core/dispatch/operator.test.ts::requester-authored repository inheritance for a plain fix::keeps authoritative routing free of deleted requester checkpoints and finished-run targets |
| Authoritative Ship work and work_from_thread handoffs use only fresh projected evidence; missing evidence refuses without a worker | [unit] src/core/dispatch/ship.test.ts::runShipBranch — the agent:ship fork hands every admitted request to the plan runner::uses only fresh authoritative evidence for a thread-sourced… |
| The actual dispatcher propagates the private routing boundary with the operator on and off | [unit] src/core/dispatcher.test.ts::dispatch::uses only authoritative retained history with the operator… |
| Authoritative full and early-review target resolution exclude finished independent-run PRs; exact current and canonical owner targets remain available | [unit] src/core/dispatcher.test.ts::dispatch::does not recover an excluded finished PR during authoritative … target resolution |
| The verified private projection retains adapter-proved user authorship for target admission; foreign, assistant and unstamped turns cannot acquire requester authority | [unit] src/core/dispatcher.test.ts::dispatch::preserves only proved requester authorship in the authoritative operator tail … |
| An original input queued before receiver reservation freshly rehosts under its existing ingress ID; unavailable proof preserves the original durable input and reports it held, without claiming invented inbox custody or starting replacement work. An uncertain inbox write after reservation stays held | [unit] src/core/dispatcher.test.ts::dispatch::keeps original inputs queued during setup … |
| Authoritative private follow-ups retain sticky owner identity but never republish excluded finished-run routing prose on cards or records; ordinary native routing prose remains available | [unit] src/core/dispatcher.test.ts::dispatch::does not republish excluded routing prose in authoritative … cards or records; ::keeps ordinary native sticky routing prose available without crossing the private projection |
Current source authorization
The additive host authentication seam reconstructs the full actor from current native proof and the exact original credential digest. It keeps unavailable proof separate from a proved refusal. Directory correlation cannot supply grants or email ownership aliases. A credited question answer is scoped to canonical original unit provenance and both current action and repository policies. The original owner pointer restores source facts after restart, without restoring historical grants. The server installs this seam for native intake; source configuration and current proof remain mandatory.
| Criterion | Evidence |
|---|---|
| Exact credentials and native proof govern intake and original-owner restoration, without email aliases or same-subject key substitution | [unit] src/channels/organizationAuthentication.test.ts::current organization authentication::* |
| Browser proof is verified on use; restart needs a fresh credential and an expired proof cannot restore the saved subject | [unit] src/channels/organizationNativeSources.test.ts::organization native sources::requires a fresh verified browser credential after restart and refuses the same saved subject after expiry |
| Slack proof checks the current installation, user membership and original unshared private reply address | [unit] src/channels/organizationNativeSources.test.ts::organization native sources::rechecks Slack installation, user membership and the original private reply address |
| Verified unlinked service delegation admits and replays its own receipt without changing the actual service actor; private reads expose only its source partition, not the human's or another device's history. An un-delegated service has no private stream, and a current unlink tombstone fences the old revision while preserving owned source history and deletion | [unit] src/core/organization/contract.test.ts::organization store contract::admits an unlinked delegated service into only its own source stream and fences its old revision after unlink |
| Source-only delegation still uses current send/read authorization over the actual service actor and exact native source verification; denied source reads omit bytes and unavailable source proof holds the read | [unit] src/core/organization/service.test.ts::organization authenticated service::keeps unlinked delegation source-only and applies current authorization and native source proof |
| Native client replacement preserves owned history after unlink and fences the old joined actor; former peer history is excluded from the fresh source-only read | [integration] deploy/cloudflare-memory/organization.test.ts::OrganizationDO routes::keeps proved identities and private content across client replacement and fences revocation |
| Fresh delegated source-only reads after unlink retain only that credential's own joined history and deletion; former person peers stay hidden. Both the stale joined actor and the new source actor refuse rehosting the original mixed owner's execution | [unit] src/core/organization/contract.test.ts::organization store contract::retains only a delegated service's joined history after unlink without rehosting its original owner |
| An active protected personal device approval survives browser-session expiry only under the same installation issuer, application, organization and subject; missing pins, changed realms, exact device revocation or current credential rights refuse, and current human rights still bound execution | [unit] src/channels/organizationAuthentication.test.ts::current organization authentication::uses an active pinned personal delegation after browser proof expires and fences changed realms and revoked rights |
Original-owner lifecycle runtime
The additive runtime preserves authenticated source facts and the original durable ingress owner. Host-supplied callbacks perform current authorization and effects; this slice registers no production adapter. Missing current proof holds admission or an original unread input. A scheduled uncertain owner is reconciled only from that original owner’s evidence.
| Criterion | Proof |
|---|---|
| Explicit content deletion fences private owners with already copied history before each later model-proxy call; original-owner cleanup remains durable while the owner store is unavailable | [unit] src/channels/homeHost.test.ts::Home authenticated host::fences a live owner's copied plain-text history after deletion: %s; ::fences deletion during private history context loading: %s; src/channels/browserHomeInstallation.test.ts::browser installation::guards the next original bearer model request after plain-text deletion: %s; src/core/organization/runtime.test.ts::organization runtime::persists deleted original-owner cleanup across an unavailable store and process replacement |
| Runtime admission preserves credential and credited person and consumes ingress before scheduling | [unit] src/core/organization/runtime.test.ts::organization runtime::consumes the original ingress before scheduling and preserves credential and credited person |
| Queued execution rechecks current authority after owner admission | [unit] src/core/organization/runtime.test.ts::organization runtime::refuses revoked or replaced credentials after admission without dispatching a rival owner |
| Queued execution rechecks organization permission even when source identities remain valid | [unit] src/core/organization/runtime.test.ts::organization runtime::refuses organization permission revoked after scheduling even when credential identity remains valid |
| Scheduling uncertainty is reconciled only from the original run's evidence | [unit] src/core/organization/runtime.test.ts::organization runtime::retains scheduling uncertainty and reconciles only evidence about the original run |
| Saved confirmation continuations preserve their id and never become message text | [unit] src/core/organization/runtime.test.ts::organization runtime::passes saved confirmation ids to the original consumer without making them message text |
| Missing current proof holds the same pending key without consuming a new owner | [unit] src/core/organization/runtime.test.ts::organization runtime::holds a pending request across missing proof and admits the same key once after fresh proof |
| Confirmed no-effect refusal repairs its original reservation after an outage while uncertain effects stay held | [unit] src/core/organization/runtime.test.ts::organization runtime::repairs a known refused answer after a store outage and keeps uncertain reservations |
| Known no-effect refusal can release its exact reservation after private content expires | [unit] src/core/organization/runtime.test.ts::organization runtime::releases a known refusal after private content expiry without needing the old reply address |
| Missing current proof holds a proved unread input durably; fresh proof permits one continuation, while a crash after the claim stays uncertain and cannot reissue the claim | [unit] src/core/organization/runtime.test.ts::organization runtime::repairs a proved unread input after restart and fresh proof under the same consumed owner once; deploy/cloudflare-memory/runLedger.test.ts::original ingress SQLite owner::returns an exact unread item durably and claims the same original input once across clients |
Original owner failure diagnostics
A caught owner-task exception reports the original ingress run, receipt and request digest, the selected dispatch/answer/confirm branch, the last operation stage and a closed error classification. Private-history refusals attach allowlisted codes without changing their messages or guards. Unknown exceptions supply no message, stack, name, actor, source key, body or epoch. An execution result and its later settlement have distinct stages; a failed uncertain settlement retains the first failure metadata. Synchronous, asynchronous and trace-sink reporting failures cannot change authority, the saved outcome or no-replay behavior.
| Criterion | Proof |
|---|---|
| Owner-task and scheduling failures retain exact original identity and closed metadata, distinguish execution from settlement, omit exception prose and arbitrary codes, preserve the first failure and never authorize replay | [unit] src/core/organization/runtime.test.ts::organization runtime::owner failure diagnostics::* |
Temporary verification loss
An unavailable authority or execution read is not a confirmed denial. Before owner consumption it retains the pending receipt and reservation. After consumption it retains the same owner with uncertainty and no refusal repair marker. Only explicit denial, deletion or expiry proves refusal. Durable unread continuation remains unclaimed until fresh proof; completed evidence is read only for the original owner.
| Criterion | Proof |
|---|---|
| Message, answer and saved-choice admission stays pending through unavailable directory effect checks and executes once when current proof returns | [unit] src/core/organization/runtime.test.ts::organization runtime::keeps %s pending across unavailable directory effect checks and executes once after fresh proof |
| Unavailable launch-time directory, execution and snapshot reads retain accepted target reservation and the original uncertain owner; recovery reads only that owner | [unit] src/core/organization/runtime.test.ts::organization runtime::retains accepted target ownership and uncertainty after unavailable %s at launch |
| An unavailable effect store, ingress store, actor proof or policy proof keeps the same admission pending; recovery admits the original key exactly once. | [unit] src/core/organization/runtime.test.ts::organization runtime::keeps admission pending after unavailable %s and admits the original key once on recovery | | Temporary directory, execution or snapshot loss before an unread claim preserves the unclaimed original-owner obligation; fresh proof resumes that owner once. | [unit] src/core/organization/runtime.test.ts::organization runtime::repairs a proved unread input after restart and fresh proof under the same consumed owner once | | Temporary recipient proof loss publishes no addressed reply; the same owner and reply key write once after current proof returns. | [unit] src/core/organization/runtime.test.ts::organization runtime::holds an addressed reply through temporary proof loss and writes once after current proof returns |
| Protected native form-consent connection metadata survives organization admission and stored submission reads; an unknown mode is refused before any admission mutation. | [unit] src/core/organization/contract.test.ts::organization store contract::retains protected MCP form-connection metadata and refuses an unknown consent mode atomically |
| Bounded intake batches release only their owned lease without waiting for model completion, so another source can start its next batch at the same clock under a new generation; accepted queue capacity is distinct from original-engine live compute capacity | [unit] src/core/organization/runtime.test.ts::organization runtime::lets another source reconcile the next bounded batch while the first original model remains unfinished |
| A batch whose lease generation was replaced cannot release or reuse its successor lease | [unit] src/core/organization/runtime.test.ts::organization runtime::cannot release a replacement process lease after a finished batch loses its generation |
Verified native source deletion
The internal source-address deletion command is a lifecycle fact, not a caller-selected act. The Slack adapter verifies its authenticated Socket Mode workspace against the configured bot before matching the retained source issuer, workspace, channel and immutable message timestamp. It never derives deletion authority from previous_message.user or text. Source deletion removes copied private entries and original queued snapshots, while canonical work, original owners and non-content receipts remain unchanged. A source tombstone rejects later admission at that same address and fences reads and effects while bounded physical cleanup remains pending. Its cursor survives replacement; the existing reconciliation loop repairs remaining copies and owner clears. Each batch scans at most the existing reconciliation bound plus one lookahead and removes at most that bound of stream entries. Completed tombstones expire after the configured content/receipt horizon or a later retained source deadline. Incomplete cleanup remains fenced until cleanup completes; it cannot expire into restored content.
Bolt normally acknowledges events before message listeners. The existing receiver-to-app seam intercepts only source deletion so successful acknowledgment follows durable copied-content cleanup and a bounded, exact-source check proving no matching snapshot clear remains. An unrelated older clear cannot consume that proof or certify the target. Unknown proof or erasure receives no success acknowledgment. Ordinary events keep the existing app handler. Deleting a native delivery projection that is not a retained ingress source does not rewrite canonical unit conversations or execution history.
| Criterion | Proof |
|---|---|
| Exact native source deletion removes copied input/replies and blocks late replay while keeping the accepted original receipt, attribution and owner; foreign native addresses cannot erase another source | [unit] src/core/organization/contract.test.ts::organization store contract::erases only a verified native source message and keeps its original receipt and owner |
| Bounded deletion continues across source-only and joined partitions, hides unprocessed copies immediately, and retains a durable repair cursor | [unit] src/core/organization/contract.test.ts::organization store contract::keeps source deletion bounded and durable across joined partitions without exposing unprocessed copies |
| Verified native delivery erases the copied source and queued snapshot before acknowledgment; foreign proof and provider outage cannot erase, failed snapshot cleanup stays unacknowledged, and retry keeps the original owner while another source still executes | [unit] src/channels/slack.test.ts::Slack source deletion::erases the verified native copy and queued snapshot before acknowledging, without replacing its original owner |
| Production callback uses the fixed organization and configured native realm; copied private data and source input become unavailable without dispatching a replacement | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::erases the verified native Slack source through the production callback without rehosting its copied input |
| Actual signed deletion delivery, websocket retry and restart in staging | [gap] Requires the final deployed candidate and an authorized disposable native source. Synthetic receiver/store proofs establish no provider delivery or missed-offline-event recovery. |