morgana: FED R3 r2 packet (sage-2299): rulings 1-5 recorded, brief's 193b1a mutant line void, manifest widens to instance-settings and its test; doc only, unrun

morgana: FED R3 r2 (dewey-0777): role key user refused at the broker load check and by the instance writer (N1, one test each), #threadFor user clause listed as an equivalent mutant, 193b1a filter mutant not applicable, M10/M11 and the M3x two-walls run in the kit; unrun
morgana: FED R3 build (#414 , sage-2292): user principal on the bus, bindUser with a per-request grant read, the collaborator verb list and its filters, user threads and the B6 reply path, runner user header; unrun
2026-10-22 00:05:41 -05:00 · 2026-10-22 00:05:41 -05:00 · 2026-10-22 00:05:41 -05:00
10 changed files with 720 additions and 37 deletions
@@ -0,0 +1,165 @@
+# FED R3 (#414): the broker's user principal
+
+Brief: docs/plans/2026-10-22_federation-r3.md (f0d0b31e9). Design: FED r4.11 (b93f098f0), sections 3.5, 3.6 and
+the R3 row of section 7. Base: row 205a's candidate 67640f892. If 205a changes in review, R3 rebases onto a new
+branch name. No schema change. Nothing has run yet: every test run waits for Sage's CLEAR.
+
+## Changes
+
+`packages/bus/src/broker.mjs`:
+- `USER_VERBS` is the collaborator list: `project.list`, `thread.create`, `thread.list`, `thread.open`,
+  `thread.send`, `thread.messages`, `names`. The grant level is `collaborator`, through R1's `covers`.
+- The Broker takes `access`, a function that returns the checked access document (the runtime passes R1's
+  `loadAccess`). `#userGrants` calls it once per user request. A throw, null or no document gives no grants.
+- `bindUser({business, user})` (3.6 item 1). The keys must be exactly those two. A user id that fails
+  `ID_PATTERN` or is `human`, `tester`, `user` or the business human fails `access-refused`, whatever the file
+  says. No live collaborator grant fails `access-revoked`. The session is
+  `{business, user, role: null, run: null, human: false}`.
+- `request()`: for a user, a verb off `USER_VERBS` fails `access-refused` before any argument check. Then the
+  grants are read; none fails `access-revoked`. The view the verb sees carries them as `grants`.
+  `requestTask`, `requestWeb` and `requestHost` fail a user `access-refused` first.
+- Filters: `project.list` keeps granted projects. `thread.list` keeps the user's own threads its grants still
+  cover. `names` keeps granted instances. `thread.create` checks the project and the thread instance against
+  the grants before the project lookup, so an ungranted id and an unknown id both refuse `access-refused`.
+  `thread.open`, `thread.send` and `thread.messages` refuse a thread the grants no longer cover.
+- `#owner` gives `user:<id>` (item 2). `#threadFor` refuses a user as it refuses the human (item 3).
+  `#event` writes `actor_role` `user` and `actor_run` `user:<id>` for a user session (item 6), so a refusal is
+  recorded against the user.
+- `thread.send` from a user: `from_role` `user`, `from_run` `user:<id>`, no `human.input`.
+- `message.send` (item 7, B6): a run sends `to: 'user'` only with an `in_reply_to` naming a `user` message in
+  the run's own thread, sent by that thread's owner. Anything else fails `user-reply-required`. The human and
+  the tester sending `to: 'user'` fail `unknown-role`. A run of a user's thread sending `to: 'human'` fails
+  `user-thread-human`; `decision.raise` has no such check, so its gated raises still route to the owner (B9).
+- `#waiting` returns null for `to: 'user'`, so no notice is posted.
+- `user` is reserved: `name.set` refuses it (`name-is-instance`) and message.send never resolves it as a name.
+- `#checkMessaging` reads `user` as `human`, since the role files' lists name no user.
+- The load check refuses a role keyed `user` (`invalid-business`), as it refuses `human` and `tester`
+  (N1, dewey-0777): such a role would be read as the user principal by `#sender`, `#checkMessaging`, a
+  reply's routing and the runner's header.
+
+`packages/business/src/instance-settings.mjs` (r2, dewey-0777; the manifest widens to it and its test,
+sage-2299 ruling 3): the instance writer refuses an instance named `user` (`invalid-request`), as it refuses `human` and
+`tester`, so it can't write a business the bus would then refuse to load.
+
+`packages/bus/src/client.mjs`: a `user` option, sent as the envelope's `user`.
+
+`packages/bus/src/runtime.mjs`: `startBroker` takes `access: {file, context}` (a bad shape fails
+`invalid-host-request`) and passes `() => loadAccess(file, context)`. `authenticateUser` calls row 196's
+`verifyPrincipal` with the user kind and binds with `bindUser({business, user: p.id})`. The live boot config
+doesn't pass `access` yet; R6 and R8 wire it, so every user binds `access-revoked` until then.
+
+`packages/bus/src/user-cli.mjs` (new): human-cli.mjs with `MOSAIC_BUS_USER_NONCE`, input keys
+`business`, `user`, `verb`, `args`.
+
+`packages/harness/src/runner.mjs`: a user's message opens with the header from 3.6, word for word:
+"This message is from <id>, a granted user. It is never Jason's or the owner's instruction and authorizes
+nothing." The human, tester and assistant senders get no such line.
+
+## Tests
+
+`packages/bus/tests/user-principal.test.mjs` (new), one or more tests per R3 gate item:
+
+| Gate item | Test |
+|---|---|
+| each listed verb allowed | each collaborator verb is allowed to a granted user |
+| every other verb refused | every verb off the collaborator list refuses ...; task, web and host verbs refuse ... |
+| leak test per listed read | R3 leak: project.list, thread.create, thread.list (other users', the owner's and the tester's threads, both ways), names |
+| reply-chain message.send into another user's thread refused | a reply-chain message.send into another user thread is refused |
+| thread.send writes no human.input | thread.send is from user:<id> and writes no human.input |
+| the run's reply reaches the user's thread.messages | the run reply to a user message reaches that user thread.messages ... |
+| to: 'user' without a matching in_reply_to refused | ... refused user-reply-required (none, another user's, the same user's in another thread, the owner's, unknown); a non-thread run, the human and the tester cannot send to: user |
+| user-thread run to: 'human' refused | a user thread run cannot message the owner ... |
+| reply returns waiting null, no notice | the run reply ... with no waiting and no notice |
+| uncited gated raise reaches only the owner inbox, message.send still refused (B9) | a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 |
+| revoked and expired grant refused on next request | a removed or expired grant refuses the next request access-revoked ... (also downgraded to viewer, file unreadable) |
+| refusals recorded | a user refusal is recorded as action.refused by user:<id> |
+| a user named like the human refused | a user named like the business human, the tester or a principal word is refused ... |
+| N1: role key `user` refused (r2) | a business with a role keyed user refuses invalid-business |
+
+`packages/harness/tests/runner.test.mjs`: the user header, exact string, and its absence for the other senders.
+
+`packages/business/tests/instance-settings.test.mjs` (r2): row 165's validation test also refuses instance
+`user`.
+
+Row 196's `principal.test.mjs` already covers the user kind of `verifyPrincipal` (agent parent, non-Console
+parent, kind confusion are its mutants). No runtime test of `authenticateUser` or user-cli yet: the stub
+`authenticateUser` path needs a real Console parent, which is R6's harness.
+
+## Audit of `s.human` and `s.tester` branches
+
+A user reaches only the seven `USER_VERBS` through `request()`. Task, web and host requests refuse it first.
+The user cap is transient: the server binds it per request and releases it, and never returns it to a client,
+so the cap-taking launcher and git ops (`authorize`, `checkPush`, `recordPush`, `checkLand`, `reviewFetch`,
+`recordEvent`, `recordTask`) can't receive one.
+
+| Branch | For a user |
+|---|---|
+| `#agent`, `#human` | `#human` refuses a user (`human-required`); every listed verb skips it with `!s.user`. `#agent` is reached only from `names` for a non-human, non-tester, non-user session. |
+| `#threadFor` | refuses a user (item 3). Not reachable: message.send and the review verbs are off the list. An equivalent mutant; the line stays. |
+| `#testerOwns`, `#testerThread` | `s.tester` false and `s.user` sessions have no thread: not taken. |
+| `#owner`, `#sender`, `#event` | changed: `user:<id>`, `user`, actor columns. |
+| `#userThread` | new; false for a user session itself. |
+| `endLaunch` session sweep | matches `s.run === record.run`; a user's run is null and a record's run is an identifier: never matches. |
+| `identity` | returns `{business, role: null, run: null, human: null}`. server.mjs reads only `business`, for the web service, and requestWeb then refuses. |
+| `recordTask` | its cap check would pass a user, but only `requestTask`'s handler and the git ops call it with a cap: not reachable. |
+| `request()` creative raise, usage, limitStop, organization verbs, hosts, project, library, credentials, reader and tester gates | after the user gate: not reachable. |
+| `#hostsCaller`, `#requestCredential`, `#limitStop`, `#dispatch` role checks, `#claimEnd`, `#checkBlock` | reached only from verbs off the list: not reachable. |
+| `message.send`, `message.receive`, `message.read`, `messages`, `replies`, `trail`, `decisions`, `credentials`, `state`, `usage`, `decision.withdraw`, `assistant.stop`, `name.set`, `project.create`, `role.claim` | off the list: not reachable. |
+| `project.list`, `thread.create`, `thread.list`, `thread.open`, `thread.send`, `thread.messages`, `names` | changed as above. |
+
+## Mutants (each must fail its named test, in user-principal.test.mjs unless named)
+
+| Mutant | Edit | Named test |
+|---|---|---|
+| M1 | the grant read skipped: no `access-revoked` after the per-request read | a removed or expired grant refuses the next request access-revoked ... |
+| M2a | project.list filter dropped | R3 leak: project.list shows granted projects only |
+| M2b | thread.list filter dropped | R3 leak: thread.list shows ... never others |
+| M2c | names filter dropped | R3 leak: names shows granted instances only |
+| M2d | `#grantedThread` check dropped | R3 leak: thread.list shows ... never others |
+| M2e | thread.create grant check dropped | R3 leak: thread.create needs the project and the thread instance granted ... |
+| M3x | `message.send` added to `USER_VERBS` (list mutant) | every verb off the collaborator list refuses ... |
+| M4 | the reply-to check dropped | a reply to: user without a matching in_reply_to is refused user-reply-required |
+| M5 | the business human dropped from bindUser's reserved list | a user named like the business human ... |
+| M6x | `trail` and `replies` added to `USER_VERBS` (second list mutant) | every verb off the collaborator list refuses ... |
+| M7 | user-thread-human check dropped | a user thread run cannot message the owner ..., B9 |
+| M8 | `to === 'user'` dropped from `#waiting` | the run reply to a user message reaches ... with no waiting and no notice |
+| M9 | thread.send writes `human.input` for a user | thread.send is from user:<id> and writes no human.input |
+| M10 | the load check accepts a role keyed `user` | a business with a role keyed user refuses invalid-business |
+| M11 | instance-settings accepts instance `user` | instance-settings.test.mjs: row 165 refuses each validation failure ... |
+
+Rulings from Dewey's early look (dewey-0777), confirmed by Sage (sage-2299 rulings 1 and 2), on the two
+mutants the design and brief name:
+1. "#threadFor's user refusal removed" is an equivalent mutant. No user request reaches `#threadFor`: its
+   only callers are message.send and `#reviewMessage` (review.request and review.verdict), all off the list.
+   The line stays as defence in depth. M3x stays as a list mutant. The kit also runs the reply-chain test
+   under M3x as the two-walls evidence: with the access-refused assertion turned into a log line, it records
+   the code alice's send gets (expected `human-required`, from `#human`, since a user has no run) and still
+   asserts bob's thread holds one message.
+2. The brief's "drops the 193b1a filter for user sessions" line is void (sage-2299 ruling 2): a user can't
+   call trail or replies, so no filtered read reaches a user. M6x is a second list mutant, not a stand-in.
+
+## Notes
+
+- N1: fixed in r2 (dewey-0777). The broker's load check and the instance writer refuse `user`, one test each
+  (M10, M11). The instance-settings change stays in R3 and the manifest widens to it and its test (sage-2299
+  ruling 3). Sage checked the live business config: no role or instance is named `user`, so a re-pin
+  carrying R3 loads (ruling 4; Sage checks again before that re-pin).
+- N2: server.mjs answers a `user` envelope with no `authenticateUser` as `human-required`, the existing
+  default for a non-tester kind. The runtime always passes `authenticateUser`, so only a bare test server sees it.
+
+## Gate
+
+The kit is /mnt/storage/scratch/morgana-r3 (`slot-r3.sh`, `mutate.py`, `busy.sh`), run as
+`bash busy.sh && CAND=<sha> bash slot-r3.sh` on Sage's CLEAR. It runs these files whole: user-principal,
+principal, human, tester, tester-threads, tester-writes, threads, names, messaging, messages, decisions,
+decision-route, broker, transport, peer-transport, process, message-filter, harness runner and business
+instance-settings. Then the bus, harness and business suites, then the fifteen mutants, each on its named
+test and restored after each, then the M3x two-walls run. It uses
+umask 022 and TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/gr3XXXX`, refuses unless HEAD is the
+candidate and the tree is clean, and stops after two unexpected failures (mos-0823).
+
+Sage's gate adds every `scripts/test-*.sh` and the business suite. Every run is slot work (sage-2280,
+sage-2299 ruling 5); the brief's "single test files run freely" line is stale.
+
+Static check: `node --check` on every changed source and test file, run from `/`. All parse. All fifteen
+mutant anchors match exactly once.
@@ -4,6 +4,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
+import { covers } from '../../business/src/access.mjs';
 import { ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS } from '../../business/src/vocabulary.mjs';

 // Kept closed while S1 lands; its vocabulary is the integration authority.
@@ -118,6 +119,12 @@ export const TASK_VERBS = Object.freeze(ACTIONS.filter((a) => a.startsWith('task
 export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'message.read', 'inbox', 'agents', 'tasks', 'trail', 'decisions', 'messages', 'replies',
  'usage', 'names', 'limits', 'plugins', 'instances', 'project.list', 'thread.list', 'name.set', 'project.create', 'credentials',
  'thread.create', 'thread.open', 'thread.send', 'thread.messages', 'assistant.stop']);
+// FED R3 (#414, federation design 3.5): the collaborator level is this exact list. Every other verb
+// refuses a user access-refused before its own checks: owner verbs, board reads, message.*,
+// decision.*, project files, spec.read, assistant.stop, launch.*, name.set and usage.*.
+export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
+// The level a user's grant must reach for USER_VERBS (R1's covers, morgana-0005).
+const USER_LEVEL = 'collaborator';
 // Row 175: the organization verbs a tester may call. Its writes run every check the human's do
 // and log actor `tester`; row 176 adds routes reads; limits.set, organization.set and organization.revision refuse it.
 export const TESTER_ORGANIZATION_VERBS = Object.freeze(['limits', 'plugins', 'instances', 'plugins.set', 'instances.set', 'routes.set', 'routes']);
@@ -290,6 +297,9 @@ export class Broker {
  #hostGrant;
  // Row 235 (#1741, r6 X2 to X5): grantKeys from host-grant.mjs, the executor's calls on Credentials, or null.
  #hostKeys;
+  // FED R3: () => the checked access document (R1's loadAccess), read once per user request. Null,
+  // a throw or no document leaves every user with no grant (design 3.5, fail closed).
+  #access;
  // r6 X3: interrupted host grants whose remote undo waits for reconcileHosts, each with its claim.
  #hostUndo = [];
  // r6 section 6 (N4): revokes a restart cut short, whose step 3 waits for reconcileHosts.
@@ -299,7 +309,7 @@ export class Broker {
  #clock = 0;
  #processing;
  // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null }) {
+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, access = null }) {
    if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
    this.#businesses = structuredClone(businesses);
    this.#store = store;
@@ -317,6 +327,8 @@ export class Broker {
    this.#credentialVerbs = credentialVerbs;
    this.#hostGrant = hostGrant;
    this.#hostKeys = hostKeys;
+    if (access !== null && typeof access !== 'function') throw new TypeError('access must be a function');
+    this.#access = access;
    this.#project = project;
    this.#library = library;
    this.#usage = usage;
@@ -353,7 +365,9 @@ export class Broker {
      if (!id(name) || b.id !== name || !id(b.human) || b.human === 'tester' || !object(b.roles) || !object(b.arbiters))
        fail('invalid-business');
      for (const role of Object.keys(b.roles)) {
-        if (!id(role) || role === 'human' || role === 'tester') fail('invalid-business');
+        // FED R3 (dewey-0777): a role keyed `user` would be read as the user principal by #sender,
+        // #checkMessaging, a reply's routing and the runner's header.
+        if (!id(role) || role === 'human' || role === 'tester' || role === 'user') fail('invalid-business');
        const a = b.roles[role].authority;
        if (!object(a) || !Array.isArray(a.withinRole) || !Array.isArray(a.crossRole))
          fail('invalid-authority');
@@ -508,7 +522,7 @@ export class Broker {
    if (s.thread) return s.thread;
    if (!this.#threaded(s.business, to)) return null;
    // The user names the thread with thread.send, which checks the owner (REQ-USER-2).
-    if (s.human) fail('thread-required-use-thread-send');
+    if (s.human || s.user) fail('thread-required-use-thread-send');
    const seen = new Set();
    for (let at = inReplyTo ?? null; at !== null && !seen.has(at); ) {
      seen.add(at);
@@ -547,7 +561,35 @@ export class Broker {
  }
  // Row 177 (#1675): who owns the threads a session makes. A tester's are `tester`'s, never the human's.
  #owner(s) {
-    return s.tester ? 'tester' : s.human;
+    return s.tester ? 'tester' : s.user ? 'user:' + s.user : s.human;
+  }
+  // FED R3 (design 3.5): the user's live grants in the session's business, from one read of the
+  // access file. Any failure to read leaves none.
+  #userGrants(s) {
+    let doc = null;
+    try {
+      doc = this.#access?.() ?? null;
+    } catch {
+      doc = null;
+    }
+    const now = new Date();
+    return (doc?.grants ?? []).filter((g) => g.user === s.user && g.business === s.business &&
+      covers(g, { business: s.business, project: g.projects[0], instance: g.instances[0] }, now, { level: USER_LEVEL }));
+  }
+  // Does one of the request's grants cover a thread of `instance` in `project`? A null `instance`
+  // asks about the project alone, a null `project` about the instance alone.
+  #granted(s, project, instance) {
+    const now = new Date();
+    return s.grants.some((g) => covers(g, {
+      business: s.business,
+      project: project ?? g.projects[0],
+      instance: instance ?? g.instances[0],
+    }, now, { level: USER_LEVEL }));
+  }
+  // A thread the request's grants still cover, else access-refused (design 3.5, thread.open/send/messages).
+  #grantedThread(s, t) {
+    if (s.user && !this.#granted(s, t.project, t.instance)) fail('access-refused');
+    return t;
  }
  // Row 205 (193b1a, #1703, row 193 design 5.7): a message in a thread a user other than the caller
  // owns is hidden from trail and replies unless #readable holds. The business human's and the
@@ -746,6 +788,19 @@ export class Broker {
    if (this.#business(record.business).vars?.['bus.tester'] !== true) fail('tester-off');
    return this.#cap({ business: record.business, tester: true, role: 'tester', run: null, human: false });
  }
+  // FED R3 (#414, design 3.6): the trusted user transport invokes this only after row 196's
+  // verifyPrincipal checked the user CLI and its Console parent. It binds only a user the access
+  // file gives a live collaborator grant in the business (check 3), else access-revoked. A user id
+  // is never the bus's own principals' or the business human's, whatever the file says.
+  bindUser(record) {
+    keys(record, ['business', 'user'], ['business', 'user']);
+    const b = this.#business(record.business);
+    if (typeof record.user !== 'string' || !ID_PATTERN.test(record.user) ||
+      ['human', 'tester', 'user', b.human].includes(record.user)) fail('access-refused');
+    const s = { business: record.business, user: record.user, role: null, run: null, human: false };
+    if (!this.#userGrants(s).length) fail('access-revoked');
+    return this.#cap(s);
+  }
  bindReader({ business }) {
    this.#business(business);
    return this.#cap({ business, reader: true, role: null, run: null, human: false });
@@ -771,8 +826,8 @@ export class Broker {
      this.#now(),
      s.business,
      kind,
-      s.role,
-      s.run,
+      s.user ? 'user' : s.role,
+      s.user ? 'user:' + s.user : s.run,
      subject,
      JSON.stringify(body),
    );
@@ -1556,8 +1611,9 @@ export class Broker {
  // check its route as the sender of the close message; `refused` replaces both codes when given.
  #checkMessaging(business, from, to, refused) {
    const b = this.#business(business);
-    const person = (who) => who === 'human' || who === 'tester';
-    const name = (who) => (person(who) ? who : b.roles[who]?.definition);
+    const person = (who) => who === 'human' || who === 'tester' || who === 'user';
+    // FED R3: the role files' lists name no user, so a user is read as the human.
+    const name = (who) => (who === 'user' ? 'human' : person(who) ? who : b.roles[who]?.definition);
    const lists = (who) => (person(who) ? undefined : b.definitions?.[name(who)]?.messaging);
    const out = lists(from);
    if (out && !out.sendTo.includes(name(to))) fail(refused ?? 'message-recipient-refused');
@@ -1565,7 +1621,12 @@ export class Broker {
    if (inbound && !inbound.receiveFrom.includes(name(from))) fail(refused ?? 'message-sender-refused');
  }
  #sender(s) {
-    return s.human ? 'human' : s.tester ? 'tester' : s.role;
+    return s.human ? 'human' : s.tester ? 'tester' : s.user ? 'user' : s.role;
+  }
+  // FED R3 (design 3.6 item 7): a run of a thread a user owns. It answers that user, never the human.
+  #userThread(s) {
+    return !s.human && !s.tester && !s.user && !!s.thread
+      && Boolean(this.#store.get('SELECT owner FROM threads WHERE id=?', s.thread)?.owner?.startsWith('user:'));
  }
  // Row 177 (#1675): a run of a thread the tester owns. It answers the tester, never the human.
  #testerThread(s) {
@@ -2282,6 +2343,14 @@ export class Broker {
    try {
      keys(request, ['verb', 'args'], ['verb']);
      string(request.verb, 64);
+      // FED R3 (design 3.5, 3.7 trigger 1): a user reaches the collaborator list only, and each
+      // request reads the access file again, so a removed or expired grant refuses the next one.
+      let grants = null;
+      if (s.user) {
+        if (!USER_VERBS.includes(request.verb)) fail('access-refused');
+        grants = this.#userGrants(s);
+        if (!grants.length) fail('access-revoked');
+      }
      const args = request.args ?? {};
      if (!object(args)) fail('invalid-request');
      this.#secretCheck(args);
@@ -2374,7 +2443,7 @@ export class Broker {
        // Since row 175 the view also carries the writes name.set and project.create, and since row 177
        // thread.create, thread.open, thread.send, thread.messages and assistant.stop. None of their
        // branches checks `reader`: each passes a tester by `s.tester`, and each write records `tester`.
-        const view = s.tester && !request.verb.startsWith('message.') ? { ...s, reader: true } : s;
+        const view = s.tester && !request.verb.startsWith('message.') ? { ...s, reader: true } : s.user ? { ...s, grants } : s;
        const result = this.#dispatch(view, request.verb, args);
        this.#secretCheck(result);
        return result;
@@ -2592,6 +2661,7 @@ export class Broker {
  async requestTask(cap, request, handler) {
    const s = this.#session(cap);
    try {
+      if (s.user) fail('access-refused');
      this.#processingWork();
      keys(request, ['verb', 'args'], ['verb']);
      if (!TASK_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -2629,6 +2699,7 @@ export class Broker {
    };
    let args;
    try {
+      if (s.user) fail('access-refused');
      keys(request, ['verb', 'args'], ['verb']);
      this.#processingWork();
      if (!verb) fail('unknown-verb');
@@ -2687,6 +2758,7 @@ export class Broker {
    };
    let a, entry, timeout, bound;
    try {
+      if (s.user) fail('access-refused');
      this.#processingWork();
      keys(request, ['verb', 'args'], ['verb']);
      if (!HOST_VERBS.includes(request.verb)) fail('unknown-verb');
@@ -3086,7 +3158,7 @@ export class Broker {
        // key, and the message records both. name.set refuses a name equal to a key or a role, but an
        // instance or definition added later can take a word some instance holds as its name. The key
        // or the role wins: a send to a definition no instance is keyed by refuses unknown-role.
-        const named = typeof a.to === 'string' && !Object.hasOwn(b.roles, a.to) && a.to !== 'human' && a.to !== 'tester'
+        const named = typeof a.to === 'string' && !Object.hasOwn(b.roles, a.to) && !['human', 'tester', 'user'].includes(a.to)
          && !this.#definitions(b).has(a.to)
          ? this.#named(s.business, a.to) : null;
        const to = named ?? a.to;
@@ -3107,15 +3179,29 @@ export class Broker {
            !(id(a.in_reply_to) && this.#store.get("SELECT 1 FROM messages WHERE id=? AND business=? AND from_role='tester'", a.in_reply_to, s.business))
          )
            fail('tester-reply-required');
+          // FED R3 (design 3.6 item 7, B6): a run answers a user only in reply to that user's message
+          // in its own thread, the thread the user owns. Anything else, another user's message or one
+          // outside the thread included, refuses.
+          if (to === 'user') {
+            const m = id(a.in_reply_to) && s.thread
+              ? this.#store.get(
+                "SELECT m.from_run FROM messages m JOIN message_threads mt ON mt.message=m.id JOIN threads t ON t.id=mt.thread WHERE m.id=? AND m.business=? AND m.from_role='user' AND mt.thread=? AND t.owner=m.from_run",
+                a.in_reply_to, s.business, s.thread)
+              : null;
+            if (!m) fail('user-reply-required');
+          }
        } else {
          this.#human(s);
-          if (to === 'tester') fail('unknown-role');
+          if (to === 'tester' || to === 'user') fail('unknown-role');
        }
-        if (to !== 'human' && to !== 'tester' && !Object.hasOwn(b.roles, to)) fail('unknown-role');
+        if (to !== 'human' && to !== 'tester' && to !== 'user' && !Object.hasOwn(b.roles, to)) fail('unknown-role');
        // Row 177 (#1675): a run of a tester's thread answers the tester, never the human, and the
        // lists read the tester there as the human, so the run reaches it as far as it reaches the human.
        const testerThread = this.#testerThread(s);
        if (testerThread && to === 'human') fail('tester-thread-human');
+        // FED R3 (design 3.6 item 7): a run of a user's thread never messages the owner. Its gated
+        // decisions still route to the owner (B9, sage-1368), so decision.raise has no such check.
+        if (this.#userThread(s) && to === 'human') fail('user-thread-human');
        this.#checkMessaging(s.business, this.#sender(s), testerThread && to === 'tester' ? 'human' : to);
        string(a.body, 32768);
        if (
@@ -3509,7 +3595,7 @@ export class Broker {
        if (s.human) this.#human(s);
        if (!Object.hasOwn(b.roles, identifier(a.instance))) fail('unknown-role');
        if (typeof a.name !== 'string' || !ID_PATTERN.test(a.name)) fail('invalid-request');
-        if (Object.hasOwn(b.roles, a.name) || a.name === 'human' || a.name === 'tester') fail('name-is-instance');
+        if (Object.hasOwn(b.roles, a.name) || ['human', 'tester', 'user'].includes(a.name)) fail('name-is-instance');
        if (this.#definitions(b).has(a.name)) fail('name-is-role');
        const holder = this.#named(s.business, a.name);
        if (holder && holder !== a.instance) fail('name-taken');
@@ -3541,11 +3627,12 @@ export class Broker {
      }
      case 'names': {
        keys(a, []);
-        if (!s.human && !s.tester) this.#agent(s);
+        // FED R3 (design 3.5): a user sees the names of granted instances only.
+        if (!s.human && !s.tester && !s.user) this.#agent(s);
        return this.#store.all(
          'SELECT instance,name,at FROM instance_names n WHERE business=? AND seq=(SELECT max(seq) FROM instance_names WHERE business=n.business AND instance=n.instance) ORDER BY instance',
          s.business,
-        );
+        ).filter((r) => !s.user || this.#granted(s, null, r.instance));
      }
      // Row 121 (#1615): projects group the user's threads (REQ-ORG-2). `repo` names a
      // project from the business file; the rename to repos is a P19 follow-up.
@@ -3570,16 +3657,25 @@ export class Broker {
        return { id: pid };
      }
      case 'project.list': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, []);
-        return this.#store.all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business);
+        // FED R3 (design 3.5): a user lists granted projects only.
+        return this.#store
+          .all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business)
+          .filter((p) => !s.user || this.#granted(s, p.id, null));
      }
      // A thread belongs to the user who made it and to the business's one thread instance.
      // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
      case 'thread.create': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['project', 'name'], ['project', 'name']);
        if (!name(a.name)) fail('invalid-request');
+        // FED R3 (design 3.5): a user's grant must cover the project and the thread instance, checked
+        // before the project is looked up, so an ungranted id reads the same whether it exists or not.
+        if (s.user) {
+          const threaded = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
+          if (threaded.length !== 1 || !this.#granted(s, identifier(a.project), threaded[0])) fail('access-refused');
+        }
        if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', identifier(a.project), s.business))
          fail('project-not-found');
        // The bus never picks between instances; the business file declares exactly one.
@@ -3603,9 +3699,10 @@ export class Broker {
      // Row 177 (#1675): each lists its own threads. The human's list leaves out the tester's,
      // and the tester's lists only its own (row 175 listed it the business human's).
      case 'thread.list': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['project']);
        if (a.project !== undefined) identifier(a.project);
+        // FED R3 (design 3.5): a user's own threads that its grants still cover.
        return this.#store.all(
          'SELECT id,at,project,instance,name FROM threads WHERE business=? AND owner=?' +
            (a.project === undefined ? '' : ' AND project=?') +
@@ -3613,22 +3710,22 @@ export class Broker {
          s.business,
          this.#owner(s),
          ...(a.project === undefined ? [] : [a.project]),
-        );
+        ).filter((t) => !s.user || this.#granted(s, t.project, t.instance));
      }
      // Opening a thread asks the launcher to start its session (REQ-LAUNCH-1).
      case 'thread.open': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['thread'], ['thread']);
-        const t = this.#thread(s, a.thread);
+        const t = this.#grantedThread(s, this.#thread(s, a.thread));
        this.#store.run('INSERT INTO thread_opens(at,thread,by) VALUES(?,?,?)', this.#now(), t.id, this.#owner(s));
        return { opened: t.id };
      }
      // Row 177 (#1675): a tester's message is the tester's, from tester-cli, and writes no
      // human.input, as on message.send. In its own thread the lists read it as the human.
      case 'thread.send': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['thread', 'body', 'class'], ['thread', 'body']);
-        const t = this.#thread(s, a.thread);
+        const t = this.#grantedThread(s, this.#thread(s, a.thread));
        // Row 120's lists hold here as on message.send: the instance must hear from the human.
        this.#checkMessaging(s.business, 'human', t.instance);
        string(a.body, 32768);
@@ -3639,8 +3736,8 @@ export class Broker {
          mid,
          this.#now(),
          s.business,
-          s.tester ? 'tester' : 'human',
-          s.tester ? 'tester-cli' : 'human-cli',
+          s.tester ? 'tester' : s.user ? 'user' : 'human',
+          s.tester ? 'tester-cli' : s.user ? this.#owner(s) : 'human-cli',
          t.instance,
          a.class ?? 'INFO',
          null,
@@ -3649,13 +3746,14 @@ export class Broker {
          a.body,
        );
        this.#route(s.business, mid, t.instance, t.id);
-        return { id: mid, request: s.tester ? null : this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid) };
+        // A user's message, like a tester's, is never the owner's authority evidence (design 3.5).
+        return { id: mid, request: s.tester || s.user ? null : this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid) };
      }
      // The thread's history, oldest first. Reading writes nothing.
      case 'thread.messages': {
-        if (!s.tester) this.#human(s);
+        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['thread', 'after', 'limit'], ['thread']);
-        const t = this.#thread(s, a.thread);
+        const t = this.#grantedThread(s, this.#thread(s, a.thread));
        const limit = a.limit ?? THREAD_PAGE;
        if (!Number.isInteger(limit) || limit < 1 || limit > THREAD_PAGE_MAX) fail('invalid-request');
        let after = 0;
@@ -3812,7 +3910,7 @@ export class Broker {
  // launch.instances, so the sender learns at once that no launch can follow. launch.by is
  // still told: the Console shows the notice as the reply to the human's message.
  #waiting(s, mid, to, thread) {
-    if (to === 'human' || to === 'tester' || (thread && this.#threaded(s.business, to))) return null;
+    if (to === 'human' || to === 'tester' || to === 'user' || (thread && this.#threaded(s.business, to))) return null;
    if (this.#recipient(s.business, to, thread)) return null;
    const launch = this.#business(s.business).launch;
    const by = launch?.by ?? null;
@@ -1,17 +1,18 @@
 import { connect } from 'node:net';
 import { BusError, PROJECT_SAVE_VERB, PROJECT_SAVE_REQUEST_MAX } from './broker.mjs';
 export class Client {
-  constructor({ path, cap, human, tester, timeout = 5000 }) {
+  constructor({ path, cap, human, tester, user, timeout = 5000 }) {
    this.path = path;
    this.cap = cap;
    this.human = human;
    this.tester = tester;
+    this.user = user;
    this.timeout = timeout;
  }
  call(verb, args = {}) {
    const request =
      JSON.stringify({
-        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : { cap: this.cap }),
+        ...(this.human ? { human: this.human } : this.tester ? { tester: this.tester } : this.user ? { user: this.user } : { cap: this.cap }),
        verb,
        args,
      }) + '\n';
@@ -19,6 +19,7 @@ import { webService } from './web.mjs';
 import { hostExecutor, sweepRunDir } from './host-run.mjs';
 import { grantKeys, hostGrant, hostReference, sweepHostKeys } from './host-grant.mjs';
 import { verifyPrincipal } from './principal.mjs';
+import { loadAccess } from '../../business/src/access.mjs';
 import { inspectInterpreter, recordInterpreterStart } from './interpreter.mjs';
 import { createPeerReader } from './peercred.mjs';
 import { createUsage } from './usage.mjs';
@@ -89,7 +90,12 @@ export async function startBroker({
  // slot, { command, intervalMs, configDir }. A boot config is JSON and can't carry a function, so
  // a librarySync without one is refused.
  librarySync = null,
+  // FED R3 (#414): the access file and its loader context, { file, context } (R1's loadAccess).
+  // Without it no user binds. R6 and R8 pass it; the live boot config doesn't yet.
+  access = null,
 }) {
+  if (access !== null && (typeof access?.file !== 'string' || access.context === null || typeof access.context !== 'object'))
+    throw new BusError('invalid-host-request');
  if (librarySync !== null && (typeof librarySync?.command !== 'function'
      || (Object.hasOwn(librarySync, 'intervalMs') && !(Number.isSafeInteger(librarySync.intervalMs) && librarySync.intervalMs > 0))
      || (Object.hasOwn(librarySync, 'configDir') && typeof librarySync.configDir !== 'string')))
@@ -163,6 +169,8 @@ export async function startBroker({
      ...(librarySync ? { command: librarySync.command } : {}),
    });
    broker = new Broker({
+      // FED R3: the access file is read per user request; a refusal leaves the user no grant.
+      access: access ? () => loadAccess(access.file, access.context) : null,
      hostGrant: runRoot ? hostGrant({ configDir: organization.dir, runRoot }) : null,
      // Row 235 (#1741, r6 X4, X5): the grant executor's claim, register and issue, never use().
      hostKeys: storeRoot ? grantKeys({ credentials, storeRoot }) : null,
@@ -285,6 +293,11 @@ export async function startBroker({
        const p = verifyPrincipal({ tester: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords });
        return broker.bindTester({ business: p.business });
      },
+      // FED R3 (design 3.6): checks 1 and 2 are row 196's user kind; check 3, the live grant, is bindUser's.
+      authenticateUser: (proof, peer) => {
+        const p = verifyPrincipal({ user: proof }, { peer, paths: principalPaths, businesses, launches: launchRecords });
+        return broker.bindUser({ business: p.business, user: p.id });
+      },
    });
    // Row 235 (r6 X3): the remote undo of interrupted host grants, once the bus is up, so a start doesn't
    // wait on the network.
@@ -0,0 +1,43 @@
+// FED R3 (#414, design 3.6): the granted user's transport shim, human-cli.mjs with its own nonce
+// variable, a `user` in its input and a user proof. Only the Console's tree runs it (row 196's user
+// kind checks the parent). Not a second product CLI. Input and proof never carry service tokens.
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
+import { Client } from './client.mjs';
+import { readProcess } from './human.mjs';
+const file = fileURLToPath(import.meta.url);
+if (!process.env.MOSAIC_BUS_USER_NONCE) {
+  const child = spawnSync(process.execPath, [file, ...process.argv.slice(2)], {
+    stdio: 'inherit',
+    env: { ...process.env, MOSAIC_BUS_USER_NONCE: randomBytes(32).toString('hex') },
+  });
+  process.exit(child.status ?? 2);
+}
+try {
+  const request = JSON.parse(readFileSync(0, 'utf8'));
+  if (
+    !request ||
+    typeof request !== 'object' ||
+    typeof request.user !== 'string' ||
+    Object.keys(request).some((k) => !['business', 'user', 'verb', 'args'].includes(k))
+  )
+    throw Error();
+  const me = readProcess(process.pid);
+  const client = new Client({
+    path: process.argv[2],
+    user: {
+      business: request.business,
+      user: request.user,
+      pid: me.pid,
+      startTime: me.startTime,
+      nonce: process.env.MOSAIC_BUS_USER_NONCE,
+    },
+  });
+  const result = await client.call(request.verb, request.args ?? {});
+  process.stdout.write(JSON.stringify(result) + '\n');
+} catch (e) {
+  process.stderr.write((/^[a-z-]{1,64}$/.test(e.code ?? '') ? e.code : 'invalid-request') + '\n');
+  process.exitCode = 2;
+}
@@ -0,0 +1,345 @@
+// FED R3 (#414, federation design 3.5, 3.6 and the R3 row of section 7): the broker's user principal.
+// A user binds only with a live collaborator grant, reaches the exact collaborator verb list, sees
+// only what its grants cover, and talks to the granted instance in its own threads. The access
+// document comes in as a function, as the runtime passes R1's loadAccess; each test changes it.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from '../src/store.mjs';
+import {
+  Broker, ACTIONS, USER_VERBS, TESTER_VERBS, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, CREDENTIAL_VERBS,
+  PROJECT_FILE_VERBS, LIBRARY_VERBS, TESTER_ORGANIZATION_VERBS,
+} from '../src/broker.mjs';
+
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+const grant = (over = {}) => ({
+  id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator', ...over,
+});
+
+function setup(t, { grants = [grant()] } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-user-principal-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  // The document a test edits between requests; `reads` counts the loader calls.
+  const access = { doc: { accessVersion: 1, revision: 1, users: [], grants }, reads: 0, fail: false };
+  const b = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: {
+          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+        },
+        definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
+      },
+    },
+    access: () => {
+      access.reads++;
+      if (access.fail) throw new Error('access file refused');
+      return access.doc;
+    },
+  });
+  const caps = {
+    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
+    tester: b.bindTester({ business: 'demo' }),
+  };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const code = (who, verb, args = {}) => {
+    try {
+      call(who, verb, args);
+    } catch (e) {
+      return e.code;
+    }
+    return null;
+  };
+  const user = (name, as = name) => (caps[as] = b.bindUser({ business: 'demo', user: name }));
+  const launch = (name, thread) => {
+    caps[name] = b.bindLaunch({ business: 'demo', role: 'assistant', run: `${name}-run`, harness: 'pi', thread });
+    return call(name, 'role.claim');
+  };
+  const inputs = () => store.get("SELECT count(*) n FROM events WHERE kind='human.input'").n;
+  return { b, store, access, caps, call, code, user, launch, inputs };
+}
+
+// Two projects, alice granted only `p1`, and alice's thread A in it.
+function granted(t) {
+  const ctx = setup(t);
+  const p1 = ctx.call('human', 'project.create', { name: 'shared' }).id;
+  const p2 = ctx.call('human', 'project.create', { name: 'private' }).id;
+  ctx.access.doc.grants = [grant({ projects: [p1] })];
+  ctx.user('alice');
+  const A = ctx.call('alice', 'thread.create', { project: p1, name: 'alice work' }).id;
+  return { ...ctx, p1, p2, A };
+}
+
+test('R3: bindUser binds a granted user and refuses one with no live collaborator grant', (t) => {
+  const { b, access, user } = setup(t);
+  assert.ok(user('alice'));
+  for (const [what, grants] of [
+    ['no grant', []],
+    ['another user', [grant({ user: 'bob' })]],
+    ['another business', [grant({ business: 'other' })]],
+    ['expired', [grant({ expires: '2000-01-01T00:00:00Z' })]],
+    ['viewer level', [grant({ level: 'viewer' })]],
+  ]) {
+    access.doc.grants = grants;
+    assert.throws(() => b.bindUser({ business: 'demo', user: 'alice' }), { code: 'access-revoked' }, what);
+  }
+  access.doc.grants = [grant()];
+  access.fail = true;
+  assert.throws(() => b.bindUser({ business: 'demo', user: 'alice' }), { code: 'access-revoked' }, 'unreadable file');
+  access.fail = false;
+  access.doc = null;
+  assert.throws(() => b.bindUser({ business: 'demo', user: 'alice' }), { code: 'access-revoked' }, 'no file');
+  assert.throws(() => b.bindUser({ business: 'demo', user: 'alice', extra: 1 }), { code: 'invalid-request' });
+});
+
+test('R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say', (t) => {
+  const { b, access } = setup(t);
+  for (const name of ['jason', 'human', 'tester', 'user']) {
+    access.doc.grants = [grant({ user: name })];
+    assert.throws(() => b.bindUser({ business: 'demo', user: name }), { code: 'access-refused' }, name);
+  }
+  access.doc.grants = [grant({ user: 'Alice!' })];
+  assert.throws(() => b.bindUser({ business: 'demo', user: 'Alice!' }), { code: 'access-refused' });
+});
+
+test('R3: each collaborator verb is allowed to a granted user', (t) => {
+  const { call, store, p1, A } = granted(t);
+  assert.deepEqual(call('alice', 'project.list').map((p) => p.id), [p1]);
+  assert.deepEqual(call('alice', 'thread.list').map((x) => x.id), [A]);
+  assert.deepEqual(call('alice', 'thread.open', { thread: A }), { opened: A });
+  const sent = call('alice', 'thread.send', { thread: A, body: 'hello' });
+  assert.deepEqual(call('alice', 'thread.messages', { thread: A }).map((m) => m.id), [sent.id]);
+  assert.ok(Array.isArray(call('alice', 'names')));
+  assert.equal(store.get('SELECT owner FROM threads WHERE id=?', A).owner, 'user:alice');
+  assert.equal(store.get('SELECT by FROM thread_opens WHERE thread=?', A).by, 'user:alice');
+});
+
+test('R3: every verb off the collaborator list refuses a user access-refused before its own checks', (t) => {
+  const { b, caps } = granted(t);
+  const others = new Set([
+    ...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...LIBRARY_VERBS, ...CREDENTIAL_VERBS, ...HOSTS_VERBS,
+    'decision.raise', 'decision.resolve', 'decision.seen', 'role.claim', 'role.release', 'role.end', 'record.write', 'spec.read',
+    'usage.begin', 'usage.end', 'limits.set', 'organization.set', 'organization.revision', 'review.request', 'review.verdict',
+    'staff.request', 'state', 'input', 'launch', 'no.such.verb',
+  ]);
+  for (const v of USER_VERBS) others.delete(v);
+  assert.ok(others.size > 40);
+  for (const verb of others) {
+    // Bad arguments on purpose: the refusal comes before any argument check.
+    assert.throws(() => b.request(caps.alice, { verb, args: { junk: true } }), { code: 'access-refused' }, verb);
+  }
+});
+
+test('R3: task, web and host verbs refuse a user access-refused', async (t) => {
+  const { b, caps } = granted(t);
+  for (const verb of TASK_VERBS)
+    await assert.rejects(b.requestTask(caps.alice, { verb, args: {} }, async () => ({})), { code: 'access-refused' }, verb);
+  for (const verb of WEB_VERBS)
+    await assert.rejects(b.requestWeb(caps.alice, { verb, args: {} }, null), { code: 'access-refused' }, verb);
+  for (const verb of HOST_VERBS)
+    await assert.rejects(b.requestHost(caps.alice, { verb, args: {} }, null), { code: 'access-refused' }, verb);
+});
+
+test('R3 leak: project.list shows granted projects only', (t) => {
+  const { call, access, p1, p2 } = granted(t);
+  assert.deepEqual(call('alice', 'project.list').map((p) => p.id), [p1]);
+  assert.deepEqual(call('human', 'project.list').map((p) => p.id), [p1, p2]);
+  access.doc.grants = [grant()];
+  assert.deepEqual(call('alice', 'project.list').map((p) => p.id), [p1, p2]);
+});
+
+test('R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist', (t) => {
+  const { call, code, access, p1, p2 } = granted(t);
+  assert.equal(code('alice', 'thread.create', { project: p2, name: 'x' }), 'access-refused');
+  assert.equal(code('alice', 'thread.create', { project: '00000000-0000-4000-8000-000000000000', name: 'x' }), 'access-refused');
+  access.doc.grants = [grant({ projects: [p1] }), grant({ id: 'g-2', projects: [p2], instances: ['chief'] })];
+  assert.equal(code('alice', 'thread.create', { project: p2, name: 'x' }), 'access-refused', 'another instance');
+  assert.ok(call('alice', 'thread.create', { project: p1, name: 'second' }).id);
+});
+
+test('R3 leak: thread.list shows the user its own threads that are still granted, never others', (t) => {
+  const { call, code, access, user, p1, p2, A } = granted(t);
+  const H = call('human', 'thread.create', { project: p1, name: 'owner work' }).id;
+  const T = call('tester', 'thread.create', { project: p1, name: 'probe' }).id;
+  access.doc.grants = [grant(), grant({ id: 'g-b', user: 'bob' })];
+  user('bob');
+  const B = call('bob', 'thread.create', { project: p2, name: 'bob work' }).id;
+  assert.deepEqual(call('alice', 'thread.list').map((x) => x.id), [A]);
+  assert.deepEqual(call('bob', 'thread.list').map((x) => x.id), [B]);
+  // Neither the owner's nor the tester's lists carry a user's thread.
+  assert.deepEqual(call('human', 'thread.list').map((x) => x.id), [H]);
+  assert.deepEqual(call('tester', 'thread.list').map((x) => x.id), [T]);
+  for (const [verb, args] of [['thread.open', {}], ['thread.send', { body: 'hi' }], ['thread.messages', {}]]) {
+    for (const other of [B, H, T]) assert.equal(code('alice', verb, { thread: other, ...args }), 'thread-not-owned', `${verb} ${other}`);
+    assert.equal(code('human', verb, { thread: A, ...args }), 'thread-not-owned', `human ${verb}`);
+    assert.equal(code('tester', verb, { thread: A, ...args }), 'thread-not-owned', `tester ${verb}`);
+  }
+  // A thread whose project is no longer granted drops off the list and refuses the thread verbs.
+  access.doc.grants = [grant({ projects: [p2] })];
+  assert.deepEqual(call('alice', 'thread.list'), []);
+  for (const [verb, args] of [['thread.open', {}], ['thread.send', { body: 'hi' }], ['thread.messages', {}]])
+    assert.equal(code('alice', verb, { thread: A, ...args }), 'access-refused', verb);
+});
+
+test('R3 leak: names shows granted instances only', (t) => {
+  const { call, access } = granted(t);
+  call('human', 'name.set', { instance: 'assistant', name: 'ada' });
+  call('human', 'name.set', { instance: 'chief', name: 'cleo' });
+  assert.deepEqual(call('alice', 'names').map((n) => n.instance), ['assistant']);
+  assert.deepEqual(call('human', 'names').map((n) => n.instance), ['assistant', 'chief']);
+  access.doc.grants = [grant({ instances: ['*'] })];
+  assert.deepEqual(call('alice', 'names').map((n) => n.instance), ['assistant', 'chief']);
+});
+
+test('R3: thread.send is from user:<id> and writes no human.input', (t) => {
+  const { store, call, inputs, A } = granted(t);
+  const before = inputs();
+  const sent = call('alice', 'thread.send', { thread: A, body: 'please draft it' });
+  assert.equal(sent.request, null);
+  assert.equal(inputs(), before);
+  const m = store.get('SELECT * FROM messages WHERE id=?', sent.id);
+  assert.equal(m.from_role, 'user');
+  assert.equal(m.from_run, 'user:alice');
+  assert.equal(m.to_role, 'assistant');
+  assert.equal(store.get('SELECT thread FROM message_threads WHERE message=?', sent.id).thread, A);
+});
+
+test('R3: a reply-chain message.send into another user thread is refused', (t) => {
+  const { call, code, access, user, p1 } = granted(t);
+  access.doc.grants = [grant(), grant({ id: 'g-b', user: 'bob' })];
+  user('bob');
+  const B = call('bob', 'thread.create', { project: p1, name: 'bob work' }).id;
+  const asked = call('bob', 'thread.send', { thread: B, body: 'bob asks' }).id;
+  assert.equal(code('alice', 'message.send', { to: 'assistant', body: 'me too', in_reply_to: asked }), 'access-refused');
+  assert.equal(call('bob', 'thread.messages', { thread: B }).length, 1);
+});
+
+test('R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice', (t) => {
+  const { store, call, launch, A } = granted(t);
+  const asked = call('alice', 'thread.send', { thread: A, body: 'question' }).id;
+  launch('a', A);
+  const before = store.get('SELECT count(*) n FROM messages').n;
+  const reply = call('a', 'message.send', { to: 'user', body: 'answer', class: 'RESULT', in_reply_to: asked });
+  assert.equal('waiting' in reply, false);
+  assert.equal(reply.request, null);
+  assert.equal(store.get('SELECT count(*) n FROM messages').n, before + 1, 'no notice message');
+  const r = store.get('SELECT * FROM messages WHERE id=?', reply.id);
+  assert.equal(r.to_role, 'user');
+  assert.equal(r.from_run, 'a-run');
+  assert.deepEqual(call('alice', 'thread.messages', { thread: A }).map((m) => m.id), [asked, reply.id]);
+  // The owner's and the tester's receive get nothing of it.
+  assert.deepEqual(call('human', 'message.receive'), []);
+  assert.deepEqual(call('tester', 'message.receive'), []);
+});
+
+test('R3: a reply to: user without a matching in_reply_to is refused user-reply-required', (t) => {
+  const { store, call, code, access, user, launch, p1, A } = granted(t);
+  access.doc.grants = [grant(), grant({ id: 'g-b', user: 'bob' })];
+  user('bob');
+  const B = call('bob', 'thread.create', { project: p1, name: 'bob work' }).id;
+  const fromBob = call('bob', 'thread.send', { thread: B, body: 'bob asks' }).id;
+  const fromAlice = call('alice', 'thread.send', { thread: A, body: 'alice asks' }).id;
+  const A2 = call('alice', 'thread.create', { project: p1, name: 'alice other' }).id;
+  const elsewhere = call('alice', 'thread.send', { thread: A2, body: 'alice asks elsewhere' }).id;
+  const H = call('human', 'thread.create', { project: p1, name: 'owner work' }).id;
+  const fromOwner = call('human', 'thread.send', { thread: H, body: 'owner asks' }).id;
+  launch('a', A);
+  const send = (in_reply_to) => code('a', 'message.send', { to: 'user', body: 'x', ...(in_reply_to ? { in_reply_to } : {}) });
+  assert.equal(send(null), 'user-reply-required', 'no in_reply_to');
+  assert.equal(send(fromBob), 'user-reply-required', 'another user message in another thread');
+  assert.equal(send(elsewhere), 'user-reply-required', 'the same user message outside the thread');
+  assert.equal(send(fromOwner), 'user-reply-required', 'the owner message');
+  assert.equal(send('00000000-0000-4000-8000-000000000000'), 'user-reply-required', 'an unknown id');
+  assert.equal(send(fromAlice), null, 'its own user message in its own thread');
+  assert.equal(store.get("SELECT count(*) n FROM messages WHERE to_role='user'").n, 1);
+});
+
+test('R3: a non-thread run, the human and the tester cannot send to: user', (t) => {
+  const { b, call, code, A } = granted(t);
+  const asked = call('alice', 'thread.send', { thread: A, body: 'question' }).id;
+  const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  b.request(chief, { verb: 'role.claim' });
+  assert.throws(() => b.request(chief, { verb: 'message.send', args: { to: 'user', body: 'x', in_reply_to: asked } }), { code: 'user-reply-required' });
+  assert.equal(code('human', 'message.send', { to: 'user', body: 'x' }), 'unknown-role');
+  assert.equal(code('tester', 'message.send', { to: 'user', body: 'x' }), 'unknown-role');
+});
+
+test('R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9', (t) => {
+  const { store, call, code, launch, A } = granted(t);
+  call('alice', 'thread.send', { thread: A, body: 'ship it' });
+  launch('a', A);
+  assert.equal(code('a', 'message.send', { to: 'human', body: 'psst' }), 'user-thread-human');
+  const before = store.get('SELECT count(*) n FROM messages').n;
+  const d = call('a', 'decision.raise', { action: 'deploy', question: 'Ship?', options, recommendation: 'yes', blocking: false }).id;
+  assert.equal(store.get('SELECT route_to FROM decisions WHERE id=?', d).route_to, 'human');
+  assert.ok(call('human', 'inbox').some((x) => x.id === d), 'in the owner inbox');
+  assert.equal(store.get('SELECT count(*) n FROM messages').n, before, 'no message to any role');
+  assert.equal(code('alice', 'inbox'), 'access-refused', 'the user has no inbox');
+  assert.equal(code('a', 'message.send', { to: 'human', body: 'about that raise' }), 'user-thread-human');
+});
+
+test('R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request', (t) => {
+  const { call, code, access } = granted(t);
+  const reads = access.reads;
+  call('alice', 'thread.list');
+  call('alice', 'project.list');
+  assert.equal(access.reads, reads + 2);
+  const kept = access.doc.grants;
+  access.doc.grants = [];
+  assert.equal(code('alice', 'thread.list'), 'access-revoked', 'removed');
+  access.doc.grants = kept.map((g) => ({ ...g, expires: '2000-01-01T00:00:00Z' }));
+  assert.equal(code('alice', 'project.list'), 'access-revoked', 'expired');
+  access.doc.grants = kept.map((g) => ({ ...g, level: 'viewer' }));
+  assert.equal(code('alice', 'thread.list'), 'access-revoked', 'downgraded');
+  access.fail = true;
+  access.doc.grants = kept;
+  assert.equal(code('alice', 'thread.list'), 'access-revoked', 'file refused');
+  access.fail = false;
+  assert.equal(code('alice', 'thread.list'), null, 'restored');
+});
+
+test('R3: a user refusal is recorded as action.refused by user:<id>', (t) => {
+  const { store, code, access, A } = granted(t);
+  assert.equal(code('alice', 'inbox'), 'access-refused');
+  access.doc.grants = [];
+  assert.equal(code('alice', 'thread.messages', { thread: A }), 'access-revoked');
+  const rows = store.all("SELECT actor_role, actor_run, body FROM events WHERE kind='action.refused' AND actor_run='user:alice' ORDER BY seq");
+  assert.deepEqual(rows.map((r) => [r.actor_role, JSON.parse(r.body).code]), [['user', 'access-refused'], ['user', 'access-revoked']]);
+});
+
+test('R3: a business with a role keyed user refuses invalid-business', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'bus-user-principal-boot-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const businesses = {
+    demo: {
+      id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+      roles: {
+        chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+        user: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+      },
+    },
+  };
+  assert.throws(() => new Broker({ store, businesses }), { code: 'invalid-business' });
+  delete businesses.demo.roles.user;
+  assert.ok(new Broker({ store, businesses }), 'the same business without it loads');
+});
+
+test('R3: name.set refuses the name user', (t) => {
+  const { code } = setup(t);
+  assert.equal(code('human', 'name.set', { instance: 'assistant', name: 'user' }), 'name-is-instance');
+});
@@ -85,9 +85,10 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null })
    }
    const { instance, op } = args;
    if (!id(instance) || (op !== "add" && op !== "change")) throw new OrganizationError("invalid-request");
-    // The broker refuses a business whose roles name human or tester (broker.mjs, the load check),
-    // so an instance under either name would stop the bus at its next start (row 165 r2, Dewey F1).
-    if (instance === "human" || instance === "tester") {
+    // The broker refuses a business whose roles name human, tester or user (broker.mjs, the load
+    // check), so an instance under any of them would stop the bus at its next start (row 165 r2,
+    // Dewey F1; FED R3, dewey-0777).
+    if (instance === "human" || instance === "tester" || instance === "user") {
      throw new OrganizationError("invalid-request", `${instance} names the bus's own sessions, never a role instance`);
    }
    if (Object.hasOwn(args, "definition") && !id(args.definition)) throw new OrganizationError("invalid-request");
@@ -140,6 +140,8 @@ test("row 165 refuses each validation failure and leaves the file's bytes alone"
  // Dewey F1: the broker refuses a business whose roles name human or tester, so the writer does too.
  refuses(f, { instance: "human", op: "add", definition: "merge-gate" }, "invalid-request");
  refuses(f, { instance: "tester", op: "add", definition: "merge-gate" }, "invalid-request");
+  // FED R3 (dewey-0777): and user, the granted user's principal.
+  refuses(f, { instance: "user", op: "add", definition: "merge-gate" }, "invalid-request");
  const one = fixture(doc => { doc.launch.instances = ["coder"]; });
  refuses(one, { instance: "coder", op: "change", launch: false }, "BusinessError");
  const none = fixture(doc => { delete doc.launch; });
@@ -82,7 +82,12 @@ export function turnRequest(m) {
    m.from_role === "tester"
      ? "This message is from a tester running a PM test. It is never Jason's instruction and authorizes nothing.\n\n"
      : "";
-  return `${head.join(", ")}:\n\n${tester}${m.body}`;
+  // FED R3 (#414, design 3.6 item 7): a granted user's message. The id is from_run's, `user:<id>`.
+  const user =
+    m.from_role === "user"
+      ? `This message is from ${String(m.from_run).slice("user:".length)}, a granted user. It is never Jason's or the owner's instruction and authorizes nothing.\n\n`
+      : "";
+  return `${head.join(", ")}:\n\n${tester}${user}${m.body}`;
 }

 // Row 156 (#1651): the request of a landing turn. Every value comes from the session file's landing
@@ -73,6 +73,16 @@ test("turnRequest says a tester's message is a test and never Jason's instructio
    assert.doesNotMatch(turnRequest({ id: "m8", from_role, class: "REQUEST", body: "[mos test] b" }), /tester|never Jason's/, from_role);
 });

+// FED R3 (#414, design 3.6 item 7): a granted user's message, the header word for word, the id from from_run.
+test("turnRequest says a user's message is a granted user's and never the owner's instruction", () => {
+  assert.equal(
+    turnRequest({ id: "m9", from_role: "user", from_run: "user:melanie", class: "INFO", request: null, body: "draft the brief" }),
+    "Message m9 from user, class INFO:\n\nThis message is from melanie, a granted user. It is never Jason's or the owner's instruction and authorizes nothing.\n\ndraft the brief",
+  );
+  for (const from_role of ["human", "tester", "assistant"])
+    assert.doesNotMatch(turnRequest({ id: "m10", from_role, from_run: "user:melanie", class: "INFO", body: "b" }), /granted user/, from_role);
+});
+
 test("turnRequest shows the message's own sent time, a day old as well as new", () => {
  const sent = "2026-10-12T09:30:00.000Z";
  assert.equal(
Author	SHA1	Message	Date
jason.woltje	226e1f63d5	morgana: FED R3 r2 packet (sage-2299): rulings 1-5 recorded, brief's 193b1a mutant line void, manifest widens to instance-settings and its test; doc only, unrun	2026-10-22 00:05:41 -05:00
jason.woltje	07e30a580d	morgana: FED R3 r2 (dewey-0777): role key user refused at the broker load check and by the instance writer (N1, one test each), #threadFor user clause listed as an equivalent mutant, 193b1a filter mutant not applicable, M10/M11 and the M3x two-walls run in the kit; unrun	2026-10-22 00:05:41 -05:00
jason.woltje	6056b7a88c	morgana: FED R3 build (#414 , sage-2292): user principal on the bus, bindUser with a per-request grant read, the collaborator verb list and its filters, user threads and the B6 reply path, runner user header; unrun	2026-10-22 00:05:41 -05:00