feat(orchestrator): operator composer with signed text and voice

Stream -> Radio gets one line per station with state, play and stop,
autoplay and CSP refusals as row state and toast, and the speaking agent
pulsing there and in the Orbit and Chord views. The composer sends on all
seven channels; push-to-talk records with MediaRecorder, whisper.cpp
transcribes off the request thread under per-minute and per-hour caps,
and the recording travels only when "Aufnahme anhängen" is ticked.

Every operator message, the mayday clear, the day and night board
actions and a settings save that adds a stream origin take the passkey;
the hub verifies each signature once against the pinned keys before it
relays or acts. The container gets TMPDIR=/scratch so that verification
no longer fails on the read-only root.

A denial now signs its recipient: the inbox and the signing step resolve
it through one function, a claim set naming several agents leaves a
direct denial without recipient, and a recipient that changed after the
inbox showed it is refused with 409. operator_message returns only the
signed reason for a denial, never the agent's own words the radio row
quotes, and the permission hook hashes the signed recipient too.

🎯 Fix: 95 %
💥 Break: 3 %
💸 Cost: 99 %
⏱️ Time: 68 %
🛡️ Security: 100 %
🏆 Score: 100
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/kvb_orchestrator/messaging.py

@@ -4,11 +4,12 @@ import re
 import secrets
 import time
 
-from .council import HUMAN, ordered, read_claims
+from .council import HUMAN, agent, ordered, read_claims
 from .errors import Missing, ToolError
 from .fields import NAME_LIMIT, ORDER_NAME, decode, expect, field, message_text, single
 from .records import write_atomic
 from .register import REGISTER, agent_order, read_register
+from .signed import message_signed, signing
 from .skill_scripts import NIGHT, RADIO, RASCI
 
 NIGHTS = {
@@ -19,6 +20,10 @@ NIGHTS = {
 UNSAFE = re.compile(r"[^A-Za-z0-9._-]+")
 DIRECT = {"post": ["post"], "call": ["send", "call"]}
 TO_ALL = {"newsletter": ["post"], **{cls: ["send", cls] for cls in ("broadcast", "pan-pan", "security", "mayday")}}
+EVERYONE = "*"
+DENIED = "Denied by the operator."
+MESSAGE_KEYS = ("to", "text", "upload", "class", "voice")
+SIGNED_BOARD = ("clear-mayday", *NIGHTS)
 
 
 def chosen(payload: dict, choices: dict[str, list[str]]) -> list[str]:
@@ -36,9 +41,16 @@ def message_row(message: dict) -> dict:
         "text": message["text"],
         "created_ts": message["created_ts"],
         "upload": None if upload is None else upload["name"],
+        "class": message.get("class", ""),
+        "voice": message.get("voice"),
+        "signed": message.get("proof") is not None,
     }
 
 
+def denial_words(reason: str) -> str:
+    return f"{DENIED} Reason: {reason}" if reason else DENIED
+
+
 def safe_name(text: str) -> str:
     base = re.split(r"[/\\]", text)[-1]
     clean = UNSAFE.sub("_", base).lstrip(".")[:NAME_LIMIT]
@@ -47,20 +59,39 @@ def safe_name(text: str) -> str:
 
 class Messaging:
     def operator_message(self, arguments: dict) -> dict:
-        expect(arguments, ("id",))
+        expect(arguments, ("id", "text", "to"))
         message_id = field(arguments, "id")
+        text, to = message_text(arguments, "text"), field(arguments, "to")
         record = self.messages.get(message_id)
         if record is None:
             raise ToolError(f"no operator message {message_id}: a radio row naming it did not come from the Agent Orchestrator")
-        upload = record["upload"]
+        if record.get("proof") is None or "voice_sha256" not in record:
+            raise ToolError(f"operator message {message_id} carries no passkey signature the hub verified: never act on it")
+        item, denial = message_signed(record), record.get("denial")
+        self.still_signed(record["proof"], item if denial is None else denial)
+        signed = item if denial is None else {"to": denial.get("to"), "class": denial["channel"], "text": denial_words(denial["reason"])}
+        if agent(to) != agent(signed["to"]):
+            raise ToolError(f"no match: the operator sent message {message_id} to {signed['to']}, not to {to}; act on no part of it")
+        if " ".join(text.split()) not in (" ".join(item["text"].split()), " ".join(self.relayed(record).split())):
+            raise ToolError(f"no match: the operator did not sign this text as message {message_id}; act on no part of it")
+        upload, voice = record["upload"], record["voice"]
         return {
+            "match": True,
             "id": record["id"],
-            "to": record["to"],
-            "text": record["text"],
+            "to": signed["to"],
+            "class": signed["class"],
+            "text": signed["text"],
             "created": record["created"],
             "upload": None if upload is None else upload["path"],
+            "voice": None if voice is None else self.voice_notes.host_path(voice),
+            "voice_sha256": item["voice_sha256"],
         }
 
+    def relayed(self, record: dict) -> str:
+        upload, voice = record["upload"], record["voice"]
+        notes = ("" if upload is None else f" file: {upload['path']}") + ("" if voice is None else f" voice: {self.voice_notes.host_path(voice)}")
+        return f"{' '.join(record['text'].split())}{notes}"
+
     def upload(self, query: dict[str, list[str]], body: bytes) -> dict:
         name = safe_name(single(query, "name") or "")
         upload_id = secrets.token_hex(8)
@@ -78,32 +109,75 @@ class Messaging:
             raise ToolError(f"no upload {upload_id}")
         return {"id": upload_id, "name": files[0].name, "path": str(self.host_state / "uploads" / upload_id / files[0].name)}
 
-    def message(self, body: bytes) -> dict:
-        payload = decode(body)
-        expect(payload, ("to", "text", "upload", "class"))
-        target = field(payload, "to").strip()
-        text = message_text(payload, "text")
-        command = chosen(payload, DIRECT)
+    def composed(self, payload: dict, choices: dict[str, list[str]]) -> tuple[dict, list[str], dict | None]:
+        """Args:
+            payload: to, text, upload, class and voice as the page sends them;
+                to is EVERYONE and upload empty for a class to all.
+            choices: the classes this route sends, each with its radio.py
+                command.
+
+        Returns:
+            The item the operator's passkey signs, the radio.py command and
+            the attached upload or None.
+        """
+        command = chosen(payload, choices)
         if not isinstance(payload["upload"], str):
             raise ToolError("upload must be an upload id or empty")
+        if payload["class"] in TO_ALL:
+            if payload["to"] != EVERYONE or payload["upload"] != "":
+                raise ToolError(f"a message to all names to {EVERYONE} and carries no upload")
+            target = EVERYONE
+        else:
+            target = field(payload, "to").strip()
+            if target == EVERYONE:
+                raise ToolError(f"a post or a call names one agent, never {EVERYONE}")
         upload = self.attachment(payload["upload"])
-        claims = read_claims(self.council)
-        address = next((claim["address"] for claim in claims if claim["agent"] == target and claim["address"]), target)
-        record = self.messages.add({"to": target, "address": address, "text": text, "upload": upload, "created_ts": time.time()})
-        note = "" if upload is None else f" file: {upload['path']}"
-        run = self.scripts.run(RADIO, [*command, "--to", address, "--session", HUMAN, f"[kvb-orchestrator msg {record['id']}] {' '.join(text.split())}{note}"])
+        voice, voice_sha256 = self.voice_notes.attached(payload["voice"])
+        item = signing.message_item(target, payload["class"], message_text(payload, "text"), payload["upload"], voice, voice_sha256)
+        return item, command, upload
+
+    def sign_message(self, body: bytes) -> dict:
+        payload = decode(body)
+        expect(payload, MESSAGE_KEYS)
+        item, _, _ = self.composed(payload, {**DIRECT, **TO_ALL})
+        return self.challenge_for([item])
+
+    def relay(self, payload: dict, choices: dict[str, list[str]]) -> dict:
+        with self.voice_notes.held(payload["voice"]):
+            item, command, upload = self.composed(payload, choices)
+            proof = self.operator_proven(payload["proof"], item)
+            target = item["to"]
+            claims = read_claims(self.council)
+            address = next((claim["address"] for claim in claims if claim["agent"] == target and claim["address"]), target)
+            fields = {"to": target, "address": address, "text": item["text"], "upload": upload, "voice": item["voice"] or None, "voice_sha256": item["voice_sha256"], "class": item["class"]}
+            record = self.messages.add({**fields, "proof": proof, "created_ts": time.time()})
+        targets = [] if target == EVERYONE else ["--to", address]
+        run = self.scripts.run(RADIO, [*command, *targets, "--session", HUMAN, f"[kvb-orchestrator msg {record['id']}] {self.relayed(record)}"])
         return {"id": record["id"], "ok": run["code"] == 0, "runs": [run]}
 
+    def message(self, body: bytes) -> dict:
+        payload = decode(body)
+        expect(payload, (*MESSAGE_KEYS, "proof"))
+        return self.relay(payload, DIRECT)
+
+    def sign_board(self, body: bytes) -> dict:
+        payload = decode(body)
+        expect(payload, ("action",))
+        if payload["action"] not in SIGNED_BOARD:
+            raise ToolError(f"action must be one of {', '.join(SIGNED_BOARD)}")
+        return self.challenge_for([signing.board_item(payload["action"])])
+
     def board(self, action: str, body: bytes) -> dict:
+        if action in SIGNED_BOARD:
+            payload = decode(body)
+            expect(payload, ("proof",))
+            self.operator_proven(payload["proof"], signing.board_item(action))
         if action == "clear-mayday":
             runs = [self.scripts.run(RADIO, ["clear", "--force", "--session", HUMAN])]
         elif action == "broadcast":
             payload = decode(body)
-            expect(payload, ("text", "class"))
-            text = message_text(payload, "text")
-            command = chosen(payload, TO_ALL)
-            record = self.messages.add({"to": "*", "address": "*", "text": text, "upload": None, "created_ts": time.time()})
-            runs = [self.scripts.run(RADIO, [*command, "--session", HUMAN, f"[kvb-orchestrator msg {record['id']}] {' '.join(text.split())}"])]
+            expect(payload, ("text", "class", "voice", "proof"))
+            runs = self.relay({**payload, "to": EVERYONE, "upload": ""}, TO_ALL)["runs"]
         elif action == "order":
             payload = decode(body)
             expect(payload, ("agents",))