refactor(chat): route browser chat through one runtime (P3 Slice-Zero Task 5) (#1172)

Co-authored-by: shaggy <[email protected]>
2026-08-12 20:11:12 +00:00
parent 6a8ce66702
commit 216cd72226
33 changed files with 7209 additions and 672 deletions
@@ -12,6 +12,10 @@ import { RuntimeProviderService } from '../agent/runtime-provider-registry.servi
 import { ChatGateway } from '../chat/chat.gateway.js';
 import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { validateDiscordServiceToken } from '../chat/chat.gateway-auth.js';
+import { ChatRuntimeRouter } from '../chat/chat-runtime-router.js';
+import { EmbeddedChatRuntime } from '../chat/embedded-chat.runtime.js';
+import { HarnessChatRuntime } from '../chat/harness-chat.runtime.js';
+import { HarnessRegistry } from '../harness/harness.registry.js';
 import { DiscordReplayProtector } from './discord-replay-protector.js';

 const SERVICE_TOKEN = 'test-service-token';
@@ -25,6 +29,7 @@ const ENV_KEYS = [
  'DISCORD_ALLOWED_USER_IDS',
  'MOSAIC_AGENT_NAME',
  'MOSAIC_AGENT_CONFIG_ID',
+  'CHAT_HARNESS_RUNTIME',
 ] as const;
 const savedEnv = new Map<string, string | undefined>();

@@ -150,6 +155,57 @@ function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordI
  };
 }

+/**
+ * Task 5 fence (C): the Discord SEND path runs through the exclusive {@link ChatRuntimeRouter},
+ * constructed here in `pi-rpc` mode with a fully-resolved runtime (`active` = harness). A verified
+ * Discord *service* turn must nonetheless execute on the {@link EmbeddedChatRuntime} — never the
+ * harness, never the routing engine — per the Q1/Q2 adjudication: the router owns a dedicated
+ * verified-ingress dispatch that delegates to embedded regardless of mode, with zero harness
+ * fallback. The gateway is given the router in the former direct-`AgentService` constructor slot.
+ *
+ * RED today: production still reads that slot as a bare `AgentService`, so `this.agentService`
+ * resolves to the router, `getSession(...)` is not a function, the send path throws and is caught
+ * (an `error` is emitted and the handler returns) BEFORE it ever reaches the embedded runtime. The
+ * failure is behavioural wiring — collection, DI, and `onModuleInit` all succeed. GREEN re-routes
+ * the verified Discord dispatch through the router into the embedded runtime, satisfying the
+ * preserved create/prompt assertions without weakening any control. `harnessConversations.append`
+ * proves the harness path is never touched even though the pi-rpc router resolved it as `active`.
+ *
+ * Correction #4 is proved behaviourally, not by naming an accessor: the verified-ingress dispatch
+ * is reachable only from the fully-verified `discordService` branch (the create/prompt tests below)
+ * and never from a browser-emittable socket event (the browser-forgery refusal test).
+ */
+function readyPiRpcRegistry(): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  // A registered 'pi' adapter + an available (non-sentinel) conversation service let the pi-rpc
+  // router resolve `active` = harness instead of failing closed at init, so these tests model the
+  // real hostile condition — the harness runtime IS live — rather than a degraded router.
+  registry.register({ id: 'pi' } as never);
+  return registry;
+}
+
+function piRpcRouterFronting(
+  agentService: unknown,
+  harnessConversations: { append: ReturnType<typeof vi.fn> },
+): ChatRuntimeRouter {
+  const routerConversationServiceTripwire = {
+    append: () => {
+      throw new Error('router conversation service must not be resolved on the Discord path');
+    },
+  };
+  const embedded = new EmbeddedChatRuntime(agentService as never);
+  const harness = new HarnessChatRuntime(harnessConversations as never);
+  const router = new ChatRuntimeRouter(
+    readyPiRpcRegistry(),
+    routerConversationServiceTripwire as never,
+    embedded,
+    harness,
+    'pi-rpc',
+  );
+  router.onModuleInit();
+  return router;
+}
+
 describe('Discord ingress security', () => {
  it('keeps legacy role-only bindings valid while withholding privileged actor identity', () => {
    const [binding] = parseDiscordInteractionBindings(
@@ -433,6 +489,7 @@ describe('Discord ingress security', () => {

  it("selects each binding's trusted logical-agent config when creating Discord sessions", async () => {
    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001,channel-002';
    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
      {
@@ -489,8 +546,9 @@ describe('Discord ingress security', () => {
      },
    };
    const routingEngine = { resolve: vi.fn() };
+    const harnessConversations = { append: vi.fn() };
    const gateway = new ChatGateway(
-      agentService as never,
+      piRpcRouterFronting(agentService, harnessConversations) as never,
      {} as never,
      brain as never,
      {} as never,
@@ -531,6 +589,575 @@ describe('Discord ingress security', () => {
      expect.objectContaining({ agentConfigId: 'agent-config-orion' }),
    );
    expect(routingEngine.resolve).not.toHaveBeenCalled();
+    // Even though the pi-rpc router resolved the harness as `active`, verified Discord ingress must
+    // never touch it — the create path stays on the embedded runtime.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('dispatches a verified Discord SEND once and drops a byte-identical replay with zero additional dispatch/persist/ack (Task 5 G4)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-replay',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    // One fully-valid signed envelope; the replay reuses the SAME object (same messageId).
+    const envelope = ingressEnvelope('verified once', 'discord-replay-001', {
+      conversationId: 'Nova:discord:channel-001',
+    });
+
+    // First delivery: the verified-Discord SEND runs the full embedded dispatch exactly once.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // Byte-identical replay: the messageId is already claimed, so resolveDiscordIngress returns
+    // null and the SEND handler bails before dispatch/persist/ack. Every effect stays at exactly one.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    // The harness runtime is never touched on either delivery.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND that fails the configured service identity consumes no replay claim, so a corrected byte-identical retry dispatches/persists/acks exactly once and a later duplicate stays fail-closed (Task 5 item 4 — claim ordering)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-claim-ordering',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    // A single fully-valid signed envelope, reused byte-for-byte across all three deliveries.
+    const envelope = ingressEnvelope('verified once with late identity', 'discord-order-001', {
+      conversationId: 'Nova:discord:channel-001',
+    });
+
+    // (1) Configured service identity is MISSING. The envelope is validly signed and passes the
+    //     binding + route checks, but the SEND must refuse at the identity gate BEFORE any claim
+    //     or effect. If the claim fires ahead of that gate, this delivery silently burns the
+    //     replay claim for `discord-order-001` even though nothing dispatched.
+    delete process.env['DISCORD_SERVICE_USER_ID'];
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) Identity is now configured; the operator resends the SAME envelope byte-for-byte. Because
+    //     step (1) consumed no claim, this corrected retry claims once and runs the full embedded
+    //     dispatch exactly once. (Under the pre-fix ordering the claim was already spent in step (1),
+    //     so this retry is dropped as a replay and never dispatches — the RED this test drives.)
+    process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after a committed turn stays fail-closed: the claim taken in step (2)
+    //     blocks it, so every effect remains at exactly one.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND whose configured agent record fails reconciliation consumes no replay claim, so a corrected byte-identical retry dispatches/persists/acks exactly once (Task 5 finding 3)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    // The durable agent record does not reconcile on the first delivery (its name no longer matches
+    // the verified binding's instance id), then reconciles cleanly on the corrected retry.
+    const findAgent = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'agent-config-nova', name: 'Renamed-Away' })
+      .mockResolvedValue({ id: 'agent-config-nova', name: 'Nova' });
+    const brain = {
+      agents: { findById: findAgent },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-reconcile',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    const envelope = ingressEnvelope(
+      'verified once with stale agent record',
+      'discord-reconcile-001',
+      {
+        conversationId: 'Nova:discord:channel-001',
+      },
+    );
+
+    // (1) The configured-agent reconcile runs BEFORE the replay claim. A mismatch refuses the turn
+    //     and, crucially, consumes no claim for discord-reconcile-001 — nothing dispatches.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) The record now reconciles; because step (1) took no claim, this byte-identical retry claims
+    //     once and runs the full embedded dispatch exactly once. (Pre-fix, the claim was spent ahead
+    //     of the reconcile in step (1), so this retry was dropped as a replay — the RED this drives.)
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after the committed turn stays fail-closed.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND refuses to reuse a same-scope embedded session minted under a different configured identity, with zero prompt/persist/ack (Task 5 finding 3)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    // A live session already exists for this conversation/scope, but it was minted under a DIFFERENT
+    // configured agent (Orion). The verified binding reconciles to Nova, so reusing this session would
+    // execute one agent's turn under another agent's verified label — the reuse guard must refuse it.
+    const foreignIdentitySession = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-orion',
+      agentName: 'Orion',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const createSession = vi.fn().mockResolvedValue(foreignIdentitySession);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(foreignIdentitySession),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-identity-swap',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('reuse under a different identity', 'discord-identity-swap-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    // Refused at the embedded reuse guard: no prompt, no persist, no ack — only a typed refusal.
+    expect(prompt).not.toHaveBeenCalled();
+    expect(addMessage).not.toHaveBeenCalled();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(client.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: 'Nova:discord:channel-001' }),
+    );
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND whose configured agent record resolves under a different id fails reconciliation, consumes no replay claim, and a corrected byte-identical retry dispatches/persists/acks exactly once (Task 5 finding 3 — id axis)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    // The name matches the verified binding, but the record's own id is a DIFFERENT agent config —
+    // an aliased/substituted lookup. Exact-id reconciliation must refuse it on the first delivery,
+    // then admit the corrected record whose id matches the binding.
+    const findAgent = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'agent-config-elsewhere', name: 'Nova' })
+      .mockResolvedValue({ id: 'agent-config-nova', name: 'Nova' });
+    const brain = {
+      agents: { findById: findAgent },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-reconcile-id',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    const envelope = ingressEnvelope(
+      'verified once with aliased agent id',
+      'discord-reconcile-id-001',
+      {
+        conversationId: 'Nova:discord:channel-001',
+      },
+    );
+
+    // (1) The record's id differs from the binding's agentConfigId. Exact-id reconcile refuses the
+    //     turn BEFORE the replay claim, so nothing dispatches and the claim stays available.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) The record now reconciles on both id and name; because step (1) took no claim, this
+    //     byte-identical retry claims once and runs the full embedded dispatch exactly once.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after the committed turn stays fail-closed.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND refuses a freshly minted same-scope session whose identity differs from the reconciled configured agent, with zero prompt/persist/ack (Task 5 finding 3 — post-create)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    // No live session exists for this scope, so the runtime MINTS one — but createSession returns a
+    // session carrying a DIFFERENT configured identity (Orion) than the reconciled binding (Nova).
+    // The post-create identity recheck must refuse it rather than dispatch one agent's turn under
+    // another agent's verified label. (The existing reuse test covers the getSession path; this
+    // covers the createSession path scrappy flagged as unvalidated.)
+    const mintedForeignSession = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-orion',
+      agentName: 'Orion',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const createSession = vi.fn().mockResolvedValue(mintedForeignSession);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-postcreate-mismatch',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('mint under a different identity', 'discord-postcreate-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    // The freshly minted session failed the post-create identity recheck: refused with a typed
+    // error, no prompt, no persist, no ack.
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).not.toHaveBeenCalled();
+    expect(addMessage).not.toHaveBeenCalled();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(client.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: 'Nova:discord:channel-001' }),
+    );
+    expect(harnessConversations.append).not.toHaveBeenCalled();
  });

  it('retains validated persisted attachments in resumed conversation history', async () => {
@@ -593,11 +1220,16 @@ describe('Discord ingress security', () => {

  it('preserves authenticated attachment metadata through persistence and agent dispatch', async () => {
    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
    const prompt = vi.fn().mockResolvedValue(undefined);
-    const addMessage = vi.fn().mockResolvedValue(undefined);
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
    const session = {
      provider: 'test-provider',
      modelId: 'test-model',
+      // The reused embedded session carries the SAME reconciled identity as the verified binding,
+      // so the finding-3 session-reuse guard admits it rather than refusing an identity swap.
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
      piSession: {
        thinkingLevel: 'medium',
        getAvailableThinkingLevels: (): string[] => ['medium'],
@@ -611,6 +1243,7 @@ describe('Discord ingress security', () => {
      prompt,
    };
    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
      conversations: {
        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
        create: vi.fn().mockResolvedValue(undefined),
@@ -618,8 +1251,9 @@ describe('Discord ingress security', () => {
        addMessage,
      },
    };
+    const harnessConversations = { append: vi.fn() };
    const gateway = new ChatGateway(
-      agentService as never,
+      piRpcRouterFronting(agentService, harnessConversations) as never,
      {} as never,
      brain as never,
      {} as never,
@@ -667,6 +1301,66 @@ describe('Discord ingress security', () => {
      }),
      'discord-service',
    );
+    // The verified Discord prompt dispatch stays on the embedded runtime; the pi-rpc harness that
+    // the router resolved as `active` is never reached.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('refuses a browser-forged Discord ingress envelope in pi-rpc with a fixed typed refusal and zero dispatch', async () => {
+    // Correction #2 + #4 (behavioural). A browser socket is never `discordService` (that flag is
+    // set only on a valid service-token handshake), so it cannot forge the trusted Discord path by
+    // emitting an envelope-shaped payload. In pi-rpc it must receive a FIXED TYPED refusal
+    // (`runtime_unsupported`, the same typed code the sibling harness-fence uses) and reach neither
+    // the forced Discord service scope, the verified Discord operation, the embedded runtime, nor
+    // the harness. There is no dedicated socket event for verified ingress — the only ingress
+    // surface is the generic `message` handler, and a non-service client is refused there.
+    //
+    // RED today: a non-service client emitting an envelope-shaped payload falls to the browser
+    // branch, fails the chat-message shape check, and is dropped SILENTLY (a warn + return) with no
+    // typed refusal emitted — so the refusal assertion fails. Collection and construction succeed;
+    // the gap is behavioural. GREEN emits the fixed typed refusal before any dispatch.
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession: vi.fn(),
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      prompt: vi.fn().mockResolvedValue(undefined),
+    };
+    const harnessConversations = { append: vi.fn() };
+    const routingEngine = { resolve: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      { conversations: { addMessage: vi.fn().mockResolvedValue(undefined) } } as never,
+      {} as never,
+      {} as never,
+      routingEngine as never,
+    );
+    const client = {
+      id: 'browser-forging-discord',
+      data: { discordService: false },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('forged from a browser', 'browser-forgery-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    const refusal = client.emit.mock.calls.find(
+      ([, payload]) => (payload as { code?: string } | undefined)?.code === 'runtime_unsupported',
+    );
+    expect(refusal).toBeDefined();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(agentService.createSession).not.toHaveBeenCalled();
+    expect(agentService.prompt).not.toHaveBeenCalled();
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+    expect(routingEngine.resolve).not.toHaveBeenCalled();
  });

  it('accepts a thread message through its allowed bound parent channel', () => {