From e9894cb77688be72b46d98b4e689b131a2a60ab9 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Mon, 2 Nov 2026 22:50:22 +0000
Subject: [PATCH 1/3] fix(slack): Never steer another person's message into a
 running Turn

A running Turn uses its author's credentials. JUNIOR_CROSS_ACTOR_MID_RUN_MODE=steer
and the !! prefix both let a different Slack author inject input into that Turn,
which could make Junior act for them with someone else's grants.

Remove the mode and the !! cross-author bypass. Another person's mid-run message
now always waits for its own Turn. !! still interrupts for the active author.

Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com>
---
 .../actor-identity-end-state/design.md        |  5 +-
 .../content/docs/reference/config-and-env.md  |  6 --
 .../integration/conversation/steering.eval.ts | 33 +--------
 .../junior-evals/evals/memory/actors.eval.ts  | 72 -------------------
 packages/junior/src/app.ts                    | 11 ---
 packages/junior/src/chat/config.ts            | 21 ------
 .../src/chat/task-execution/slack-work.ts     | 21 ++----
 packages/junior/src/cli/init.ts               |  1 -
 .../component/config/chat-config.test.ts      | 19 -----
 .../slack-conversation-work.test.ts           | 22 +++++-
 .../tests/unit/app-model-config.test.ts       |  3 -
 .../junior/tests/unit/cli/init-cli.test.ts    |  1 -
 12 files changed, 32 insertions(+), 183 deletions(-)

diff --git a/openspec/changes/actor-identity-end-state/design.md b/openspec/changes/actor-identity-end-state/design.md
index 93341c5cef..5758a7d0e0 100644
--- a/openspec/changes/actor-identity-end-state/design.md
+++ b/openspec/changes/actor-identity-end-state/design.md
@@ -177,9 +177,8 @@ This matches the current rules on `main`:
 - Another Actor's message does not join an active Actor's credentialed work.
   The worker puts messages in one Turn only when their author and Source
   match (`selectContiguousTurnBatch` in
-  `task-execution/attempt-selection.ts`). By default, another Actor's
-  mid-run Slack ask waits for its own Turn (`JUNIOR_CROSS_ACTOR_MID_RUN_MODE`,
-  `follow_up`).
+  `task-execution/attempt-selection.ts`). Another Actor's mid-run Slack
+  ask always waits for its own Turn.
 - A system-acted event Turn uses the grants of a Watch creator only through
   `timerWatchCredentialSubject` (`chat/events/notification.ts`). It gives a
   credential subject only when every event in the batch has a valid subject
diff --git a/packages/docs/src/content/docs/reference/config-and-env.md b/packages/docs/src/content/docs/reference/config-and-env.md
index 1d370b21d4..cf2a2635c2 100644
--- a/packages/docs/src/content/docs/reference/config-and-env.md
+++ b/packages/docs/src/content/docs/reference/config-and-env.md
@@ -24,7 +24,6 @@ related:
 | `JUNIOR_CONVERSATION_WORK_ENABLED`          | No          | Operational kill switch for queue processing and heartbeat recovery. Defaults to `true`; set `false` to acknowledge wakes without running or recovering conversation work.  |
 | `JUNIOR_SECRET`                             | Yes         | Signs internal queue/callback payloads and sandbox egress actor context.                                                                                                    |
 | `JUNIOR_BOT_NAME`                           | No          | Bot display/config naming.                                                                                                                                                  |
-| `JUNIOR_CROSS_ACTOR_MID_RUN_MODE`           | No          | Cross-actor Slack steering policy. Defaults to `follow_up`; see below.                                                                                                      |
 | `AI_MODEL`                                  | No          | Deprecated profile setting. Creates `standard` and remains the fallback for `AI_FAST_MODEL`. Defaults to `openai/gpt-6-luna` with high reasoning.                           |
 | `AI_REASONING_LEVEL`                        | No          | Main-agent reasoning override: `none`, `low`, `medium`, `high`, or `xhigh`. Unset by default. An explicit profile reasoning level takes precedence when routing is enabled. |
 | `AI_FAST_MODEL`                             | No          | Faster model for lightweight tasks and routing/classification passes before the main turn begins. Defaults to `openai/gpt-6-luna`.                                          |
@@ -82,11 +81,6 @@ Redis, each one can take the other's jobs.
 
 Junior applies `JUNIOR_SQL_STATEMENT_TIMEOUT_MS` through PostgreSQL `statement_timeout` for both the Neon and node-postgres drivers. `junior upgrade` does not apply this runtime limit because schema migrations can legitimately take longer.
 
-`JUNIOR_CROSS_ACTOR_MID_RUN_MODE=follow_up` keeps another actor's mid-run ask
-for its own turn. Set it to `steer` to preserve collaborative steering across
-actors. In `follow_up` mode, a user can start one message with `!!` to steer the
-active turn explicitly.
-
 Model profile names are durable conversation bindings. Each later turn resolves
 the stored name through current configuration; the exact model ID recorded when
 an epoch opens is audit evidence, not a runtime pin. Changing a mapping retargets
diff --git a/packages/junior-evals/evals/integration/conversation/steering.eval.ts b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
index 5ca559edcb..017a6ee7c9 100644
--- a/packages/junior-evals/evals/integration/conversation/steering.eval.ts
+++ b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
@@ -52,7 +52,7 @@ describe("Slack Turn Steering", () => {
     ]);
   });
 
-  test("when other people mention Junior during a turn, each person gets a follow-up turn unless they override with !!", async ({
+  test("when other people mention Junior during a turn, each person gets a follow-up turn, even with !!", async ({
     run,
   }) => {
     // Only routing is asserted, so the inputs are manufactured and short.
@@ -72,40 +72,13 @@ describe("Slack Turn Steering", () => {
       },
     );
 
-    // Sam's turn, then Rio, Kai, and Rio again in arrival order. Alex's !!
-    // mention joins Sam's running turn.
+    // Sam's turn, then Rio, Kai, Rio again, and Alex in arrival order. The
+    // running turn uses Sam's credentials, so !! does not let Alex join it.
     expect(conversation.turns.map((turn) => turn.status)).toEqual([
       "succeeded",
       "succeeded",
       "succeeded",
       "succeeded",
-    ]);
-  });
-
-  test("when cross-actor steering is configured, another person's mention joins the running turn", async ({
-    agent,
-  }) => {
-    const { run } = await agent({
-      slack: { crossActorMidRunMode: "steer" },
-    });
-    const conversation = await run(
-      slackMention(INCIDENT_REQUEST, { author: person("U0SAM", "Sam") }),
-      {
-        onProgress: sendDuringFirstModelRequest([
-          slackMention("include the rollback owner: Dana", {
-            author: person("U0RIO", "Rio"),
-          }),
-        ]),
-      },
-    );
-    await expect(conversation).toSatisfyJudge(
-      RubricJudge,
-      rubric({
-        pass: ["The summary names Dana as the rollback owner."],
-      }),
-    );
-
-    expect(conversation.turns.map((turn) => turn.status)).toEqual([
       "succeeded",
     ]);
   });
diff --git a/packages/junior-evals/evals/memory/actors.eval.ts b/packages/junior-evals/evals/memory/actors.eval.ts
index c80776343e..3677dbfc27 100644
--- a/packages/junior-evals/evals/memory/actors.eval.ts
+++ b/packages/junior-evals/evals/memory/actors.eval.ts
@@ -6,7 +6,6 @@ import {
 } from "@junior-evals/fixture/inputs";
 import { rubric, RubricJudge } from "@junior-evals/fixture/judge";
 import { readMemories } from "@junior-evals/fixture/memory";
-import { sendDuringFirstModelRequest } from "@junior-evals/fixture/progress";
 import { test } from "@junior-evals/fixture/test";
 
 /**
@@ -129,77 +128,6 @@ describe("Memory with Multiple Actors", () => {
     }
   });
 
-  test("when another User steers a preference into the active turn, do not store it as the Actor's user memory", async ({
-    run,
-  }) => {
-    await run(
-      slackMention("Can you recap what has been asked in this thread so far?", {
-        author: ALICE,
-      }),
-      {
-        onProgress: sendDuringFirstModelRequest([
-          slackMention(
-            "!! When you write up the recap, I prefer short bullet summaries over prose.",
-            { author: BOB },
-          ),
-        ]),
-      },
-    );
-
-    const memories = await readThreadMemories();
-    // Multi-actor runs never store any preference from passive extraction, no
-    // matter whose instruction the citations point at.
-    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
-      [],
-    );
-    // Anti-laundering: Bob's stated preference content must not resurface as any
-    // stored memory of any kind. This path is prompt-defended only, so this
-    // assertion is its real coverage.
-    for (const memory of memories) {
-      expect(memory.content).not.toMatch(/bullet/i);
-    }
-  });
-
-  // Issue #776: the case the citation router alone cannot cover. Alice's own
-  // durable first-person preference cites only her own run-Actor instruction.
-  // A single-Actor run can store this as user memory, but Bob's steering makes
-  // this a multi-Actor run, so no preference may be stored.
-  test("when the actor states their own durable preference in a multi-actor turn, store no preference memory at all", async ({
-    run,
-  }) => {
-    await run(
-      slackMention(
-        "I prefer recaps as numbered lists, not paragraphs. Can you recap the asks in this thread so far?",
-        { author: ALICE },
-      ),
-      {
-        onProgress: sendDuringFirstModelRequest([
-          slackMention(
-            "!! Open question: should we pause the launch? Please list it when you get a chance.",
-            { author: BOB },
-          ),
-        ]),
-      },
-    );
-
-    const memories = await readThreadMemories();
-    // The multi-actor gate: no active preference may exist, even though the
-    // preference is the run actor's own and its citations would pass the
-    // single-actor router.
-    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
-      [],
-    );
-    // Preferences are the only route into a user subject for passive
-    // extraction, so the user-subject memories must stay empty too.
-    expect(await readUserMemories()).toEqual([]);
-    // Anti-laundering: the preference must not resurface as knowledge or
-    // procedure. This path is prompt-defended only, so this assertion is its
-    // real coverage.
-    for (const memory of memories) {
-      expect(memory.content).not.toMatch(/numbered/i);
-    }
-  });
-
   // TDD target (issue #773): red until the completed-run projection carries
   // non-actor public messages as conversation-scope evidence. Today a
   // passive participant's knowledge never reaches passive extraction: it is
diff --git a/packages/junior/src/app.ts b/packages/junior/src/app.ts
index d97c085fe1..51d056f788 100644
--- a/packages/junior/src/app.ts
+++ b/packages/junior/src/app.ts
@@ -12,12 +12,10 @@ import {
   resetRuntimeConfig,
   restoreRuntimeConfig as restoreChatRuntimeConfig,
   setBotModelConfig,
-  setCrossActorMidRunMode,
   setProfiles,
   setRuntimeLimits,
   snapshotRuntimeConfig,
   type BotModelConfig,
-  type CrossActorMidRunMode,
   type RuntimeLimits,
   setSlackReactionConfig,
 } from "@/chat/config";
@@ -200,12 +198,6 @@ export interface JuniorAppOptions extends BotModelConfig {
     processingReactionEmoji?: string;
     /** Slack emoji shown after a turn completes. Defaults to `white_check_mark`. */
     completedReactionEmoji?: string;
-    /**
-     * What a mention from another person does while a turn runs: `follow_up`
-     * waits for its own turn, `steer` joins the running turn. Defaults to
-     * `JUNIOR_CROSS_ACTOR_MID_RUN_MODE` or `follow_up`.
-     */
-    crossActorMidRunMode?: CrossActorMidRunMode;
     /**
      * Slack user IDs of bots that may start a Turn from a mention or DM. Bots
      * have no profile email, so `allowedDomains` blocks them otherwise.
@@ -549,9 +541,6 @@ export async function createApp(
     setBotModelConfig(options ?? {});
     setRuntimeLimits(options?.limits);
     setSlackReactionConfig(options?.slack ?? {});
-    if (options?.slack?.crossActorMidRunMode) {
-      setCrossActorMidRunMode(options.slack.crossActorMidRunMode);
-    }
     // One domain list for Slack authors and dashboard sign-ins.
     assertNoLegacyAllowedDomains(Object.keys(dashboard ?? {}));
     allowedDomains = resolveAllowedDomains(options?.allowedDomains);
diff --git a/packages/junior/src/chat/config.ts b/packages/junior/src/chat/config.ts
index 5e543b6203..ceedc8f6cf 100644
--- a/packages/junior/src/chat/config.ts
+++ b/packages/junior/src/chat/config.ts
@@ -101,7 +101,6 @@ export interface BotModelConfig {
 
 export interface BotConfig {
   contextWindowTokens: number;
-  crossActorMidRunMode: CrossActorMidRunMode;
   decisionModelId: string;
   defaultProfile: ModelProfile;
   embeddingModelId: string;
@@ -124,8 +123,6 @@ export interface BotConfig {
   webSearchModelId: string;
 }
 
-export type CrossActorMidRunMode = "follow_up" | "steer";
-
 export type SqlDriver = "neon" | "postgres";
 
 export interface ChatConfig {
@@ -247,16 +244,6 @@ function parseConversationWorkEnabled(rawValue: string | undefined): boolean {
   throw new Error("JUNIOR_CONVERSATION_WORK_ENABLED must be true or false");
 }
 
-function parseCrossActorMidRunMode(
-  rawValue: string | undefined,
-): CrossActorMidRunMode {
-  const value = toOptionalTrimmed(rawValue) ?? "follow_up";
-  if (value === "follow_up" || value === "steer") {
-    return value;
-  }
-  throw new Error("JUNIOR_CROSS_ACTOR_MID_RUN_MODE must be follow_up or steer");
-}
-
 const DEFAULT_MODEL_ID = resolveGatewayModel(
   DEFAULT_MODEL_PROFILES.standard.modelId,
 ).id;
@@ -495,9 +482,6 @@ function readBotConfig(
   return {
     userName: toOptionalTrimmed(env.JUNIOR_BOT_NAME) ?? "junior",
     defaultProfile: "standard",
-    crossActorMidRunMode: parseCrossActorMidRunMode(
-      env.JUNIOR_CROSS_ACTOR_MID_RUN_MODE,
-    ),
     profiles: parseProfiles(env.AI_MODEL_PROFILES, modelId, handoffModelId),
     contextWindowTokens:
       parseOptionalPositiveInteger(
@@ -798,11 +782,6 @@ export function setRuntimeLimits(limits: RuntimeLimits | undefined): void {
   }
 }
 
-/** Apply the Slack cross-actor steering mode from createApp(). */
-export function setCrossActorMidRunMode(mode: CrossActorMidRunMode): void {
-  chatConfig.bot.crossActorMidRunMode = parseCrossActorMidRunMode(mode);
-}
-
 /** Return the chat configuration (parsed once at startup). */
 export function getChatConfig(): ChatConfig {
   return chatConfig;
diff --git a/packages/junior/src/chat/task-execution/slack-work.ts b/packages/junior/src/chat/task-execution/slack-work.ts
index d50612a031..92489c735e 100644
--- a/packages/junior/src/chat/task-execution/slack-work.ts
+++ b/packages/junior/src/chat/task-execution/slack-work.ts
@@ -57,11 +57,7 @@ import {
   requireSlackDestination,
 } from "@/chat/destination";
 import { stripLeadingSteeringOverride } from "@/chat/slack/message-control";
-import {
-  botConfig,
-  getChatConfig,
-  type CrossActorMidRunMode,
-} from "@/chat/config";
+import { getChatConfig } from "@/chat/config";
 
 const slackConversationRouteSchema = z.enum(["mention", "subscribed"]);
 export type SlackConversationRoute = z.output<
@@ -455,7 +451,6 @@ interface SlackInboxTurnRuntime {
 }
 
 export interface CreateSlackConversationWorkerOptions {
-  crossActorMidRunMode?: CrossActorMidRunMode;
   getSlackAdapter: () => SlackAdapter;
   lookupSlackUser?: (
     teamId: string,
@@ -655,8 +650,6 @@ function getPendingRecords(
 export function createSlackConversationWorker(
   options: CreateSlackConversationWorkerOptions,
 ): (context: ConversationWorkerContext) => Promise<ConversationWorkerResult> {
-  const crossActorMidRunMode =
-    options.crossActorMidRunMode ?? botConfig.crossActorMidRunMode;
   return async (context) => {
     const adapter = options.getSlackAdapter();
     const actorLookup = options.lookupSlackUser ?? lookupSlackUser;
@@ -766,9 +759,11 @@ export function createSlackConversationWorker(
             );
           }
         };
-        // Only explicit Slack interruptions enter the active turn. Deferred
-        // work and steered messages from other sources, such as the
-        // dashboard, stay pending for their own turn.
+        // Only explicit Slack interruptions from the active author enter the
+        // active turn. The turn runs with that author's credentials, so another
+        // person's message always waits for its own turn. Deferred work and
+        // steered messages from other sources, such as the dashboard, stay
+        // pending for their own turn.
         const drainSteeringMessages = async (
           accept: (
             messages: SteeringCandidateMessage[],
@@ -786,9 +781,7 @@ export function createSlackConversationWorker(
               }))
               .filter(
                 (candidate) =>
-                  crossActorMidRunMode === "steer" ||
-                  requireSlackAuthorId(candidate.message) === activeAuthorId ||
-                  hasSteeringOverride(candidate.message.text),
+                  requireSlackAuthorId(candidate.message) === activeAuthorId,
               );
             return candidates.length > 0 ? await accept(candidates) : [];
           });
diff --git a/packages/junior/src/cli/init.ts b/packages/junior/src/cli/init.ts
index a4b862135a..40ea660802 100644
--- a/packages/junior/src/cli/init.ts
+++ b/packages/junior/src/cli/init.ts
@@ -223,7 +223,6 @@ export async function runInit(
 SLACK_SIGNING_SECRET=
 JUNIOR_SECRET=
 JUNIOR_BOT_NAME=
-JUNIOR_CROSS_ACTOR_MID_RUN_MODE=
 AI_MODEL=
 AI_FAST_MODEL=
 AI_GUARDIAN_MODEL=
diff --git a/packages/junior/tests/component/config/chat-config.test.ts b/packages/junior/tests/component/config/chat-config.test.ts
index 867bf9861c..17b047786b 100644
--- a/packages/junior/tests/component/config/chat-config.test.ts
+++ b/packages/junior/tests/component/config/chat-config.test.ts
@@ -569,25 +569,6 @@ describe("chat config", () => {
     );
   });
 
-  it("defaults cross-actor mid-run messages to follow-up", async () => {
-    delete process.env.JUNIOR_CROSS_ACTOR_MID_RUN_MODE;
-    const { botConfig } = await loadConfig();
-    expect(botConfig.crossActorMidRunMode).toBe("follow_up");
-  });
-
-  it("supports collaborative cross-actor steering", async () => {
-    process.env.JUNIOR_CROSS_ACTOR_MID_RUN_MODE = "steer";
-    const { botConfig } = await loadConfig();
-    expect(botConfig.crossActorMidRunMode).toBe("steer");
-  });
-
-  it("rejects unsupported cross-actor mid-run modes", async () => {
-    process.env.JUNIOR_CROSS_ACTOR_MID_RUN_MODE = "router";
-    await expect(loadConfig()).rejects.toThrow(
-      "JUNIOR_CROSS_ACTOR_MID_RUN_MODE must be follow_up or steer",
-    );
-  });
-
   it("sets max slices per turn from core config", async () => {
     const { botConfig } = await loadConfig();
     expect(botConfig.maxSlicesPerTurn).toBe(100);
diff --git a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
index c164823fd6..527d5261d3 100644
--- a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
+++ b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
@@ -841,7 +841,7 @@ describe("Slack conversation work execution", () => {
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
   });
 
-  it("drains Slack messages that arrive during an active turn into steering", async () => {
+  it("drains only the active author's Slack messages into steering", async () => {
     const queue = createConversationWorkQueueTestAdapter();
     const state = getStateAdapter();
     await state.connect();
@@ -863,9 +863,12 @@ describe("Slack conversation work execution", () => {
     });
 
     const injected: string[][] = [];
+    const turns: string[] = [];
     const runtime: SlackWorkerOptions["runtime"] = {
-      handleNewMention: async (_thread, _message, hooks) => {
+      handleNewMention: async (_thread, message, hooks) => {
+        turns.push(message.id);
         await hooks.ack?.();
+        if (turns.length > 1) return;
         await handleSlackWebhookAndFlush({
           request: slackWebhookRequest(
             slackEnvelope({
@@ -876,6 +879,19 @@ describe("Slack conversation work execution", () => {
           ),
           services: ingressServices,
         });
+        // The turn runs with U123's credentials, so another person cannot
+        // join it, even with the !! marker.
+        await handleSlackWebhookAndFlush({
+          request: slackWebhookRequest(
+            slackEnvelope({
+              text: `<@${SLACK_BOT_USER_ID}> !! steer this too`,
+              ts: "1712345.0003",
+              threadTs: "1712345.0001",
+              user: "U456",
+            }),
+          ),
+          services: ingressServices,
+        });
         await hooks.drainSteeringMessages?.(async (steering) => {
           injected.push(steering.map((candidate) => candidate.message.id));
           return steering.map((candidate) => candidate.inboundMessageId);
@@ -895,6 +911,7 @@ describe("Slack conversation work execution", () => {
     ).resolves.toEqual({ status: "completed" });
 
     expect(injected).toEqual([["1712345.0002"]]);
+    expect(turns).toEqual(["1712345.0001", "1712345.0003"]);
     const work = await getConversationWorkState({
       conversationId: CONVERSATION_ID,
       state,
@@ -903,6 +920,7 @@ describe("Slack conversation work execution", () => {
     expect(work?.execution.inboundMessageIds).toEqual([
       "slack:T123:slack:C123:1712345.0001:1712345.0001",
       "slack:T123:slack:C123:1712345.0001:1712345.0002",
+      "slack:T123:slack:C123:1712345.0001:1712345.0003",
     ]);
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
     await expectRemainingQueuedSlackWorkIsNoop({
diff --git a/packages/junior/tests/unit/app-model-config.test.ts b/packages/junior/tests/unit/app-model-config.test.ts
index f49077f6aa..8ebd0af2a3 100644
--- a/packages/junior/tests/unit/app-model-config.test.ts
+++ b/packages/junior/tests/unit/app-model-config.test.ts
@@ -82,13 +82,11 @@ describe("createApp profiles", () => {
       },
       slack: {
         completedReactionEmoji: "jr-done",
-        crossActorMidRunMode: "steer",
       },
       plugins: defineJuniorPlugins([]),
     });
     expect(botConfig).toMatchObject({
       contextWindowTokens: 2_000,
-      crossActorMidRunMode: "steer",
       defaultProfile: "gpt-5",
       eventAutomationRunWindowMs: 60 * 60 * 1000,
       maxEventAutomationRuns: 2,
@@ -99,7 +97,6 @@ describe("createApp profiles", () => {
 
     expect(botConfig).toMatchObject({
       contextWindowTokens: originalBotConfig.contextWindowTokens,
-      crossActorMidRunMode: originalBotConfig.crossActorMidRunMode,
       defaultProfile: originalBotConfig.defaultProfile,
       fastModelId: originalBotConfig.fastModelId,
       eventAutomationRunWindowMs: originalBotConfig.eventAutomationRunWindowMs,
diff --git a/packages/junior/tests/unit/cli/init-cli.test.ts b/packages/junior/tests/unit/cli/init-cli.test.ts
index 64ec307e40..2b2d062a0c 100644
--- a/packages/junior/tests/unit/cli/init-cli.test.ts
+++ b/packages/junior/tests/unit/cli/init-cli.test.ts
@@ -181,7 +181,6 @@ minimumReleaseAgeExclude:
       "utf8",
     );
     expect(envExample).toContain("CRON_SECRET=");
-    expect(envExample).toContain("JUNIOR_CROSS_ACTOR_MID_RUN_MODE=");
     expect(envExample).toContain("AI_GUARDIAN_MODEL=");
     expect(envExample).toContain("DATABASE_URL=");
     expect(envExample).toContain("JUNIOR_DATABASE_DRIVER=");

From de7b2ce627fa7f1f5d148f2542067432c598b415 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Mon, 2 Nov 2026 22:55:11 +0000
Subject: [PATCH 2/3] fix(slack): Keep !! steering for other people, remove
 only the steer mode

Another person's !! message joins the running Turn as their own attributed
input, as in the default follow_up mode. Plain mentions from other people still
wait for their own Turn. Only the configurable steer mode is removed.

Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com>
---
 .../actor-identity-end-state/design.md        |  3 +-
 .../integration/conversation/steering.eval.ts |  7 +-
 .../junior-evals/evals/memory/actors.eval.ts  | 72 +++++++++++++++++++
 .../src/chat/task-execution/slack-work.ts     | 13 ++--
 .../slack-conversation-work.test.ts           | 22 +-----
 5 files changed, 86 insertions(+), 31 deletions(-)

diff --git a/openspec/changes/actor-identity-end-state/design.md b/openspec/changes/actor-identity-end-state/design.md
index 5758a7d0e0..3c36655887 100644
--- a/openspec/changes/actor-identity-end-state/design.md
+++ b/openspec/changes/actor-identity-end-state/design.md
@@ -178,7 +178,8 @@ This matches the current rules on `main`:
   The worker puts messages in one Turn only when their author and Source
   match (`selectContiguousTurnBatch` in
   `task-execution/attempt-selection.ts`). Another Actor's mid-run Slack
-  ask always waits for its own Turn.
+  ask waits for its own Turn. A message that starts with `!!` steers the
+  running Turn as that Actor's own attributed input.
 - A system-acted event Turn uses the grants of a Watch creator only through
   `timerWatchCredentialSubject` (`chat/events/notification.ts`). It gives a
   credential subject only when every event in the batch has a valid subject
diff --git a/packages/junior-evals/evals/integration/conversation/steering.eval.ts b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
index 017a6ee7c9..4eaaf601a4 100644
--- a/packages/junior-evals/evals/integration/conversation/steering.eval.ts
+++ b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
@@ -52,7 +52,7 @@ describe("Slack Turn Steering", () => {
     ]);
   });
 
-  test("when other people mention Junior during a turn, each person gets a follow-up turn, even with !!", async ({
+  test("when other people mention Junior during a turn, each person gets a follow-up turn unless they override with !!", async ({
     run,
   }) => {
     // Only routing is asserted, so the inputs are manufactured and short.
@@ -72,14 +72,13 @@ describe("Slack Turn Steering", () => {
       },
     );
 
-    // Sam's turn, then Rio, Kai, Rio again, and Alex in arrival order. The
-    // running turn uses Sam's credentials, so !! does not let Alex join it.
+    // Sam's turn, then Rio, Kai, and Rio again in arrival order. Alex's !!
+    // mention joins Sam's running turn.
     expect(conversation.turns.map((turn) => turn.status)).toEqual([
       "succeeded",
       "succeeded",
       "succeeded",
       "succeeded",
-      "succeeded",
     ]);
   });
 
diff --git a/packages/junior-evals/evals/memory/actors.eval.ts b/packages/junior-evals/evals/memory/actors.eval.ts
index 3677dbfc27..c80776343e 100644
--- a/packages/junior-evals/evals/memory/actors.eval.ts
+++ b/packages/junior-evals/evals/memory/actors.eval.ts
@@ -6,6 +6,7 @@ import {
 } from "@junior-evals/fixture/inputs";
 import { rubric, RubricJudge } from "@junior-evals/fixture/judge";
 import { readMemories } from "@junior-evals/fixture/memory";
+import { sendDuringFirstModelRequest } from "@junior-evals/fixture/progress";
 import { test } from "@junior-evals/fixture/test";
 
 /**
@@ -128,6 +129,77 @@ describe("Memory with Multiple Actors", () => {
     }
   });
 
+  test("when another User steers a preference into the active turn, do not store it as the Actor's user memory", async ({
+    run,
+  }) => {
+    await run(
+      slackMention("Can you recap what has been asked in this thread so far?", {
+        author: ALICE,
+      }),
+      {
+        onProgress: sendDuringFirstModelRequest([
+          slackMention(
+            "!! When you write up the recap, I prefer short bullet summaries over prose.",
+            { author: BOB },
+          ),
+        ]),
+      },
+    );
+
+    const memories = await readThreadMemories();
+    // Multi-actor runs never store any preference from passive extraction, no
+    // matter whose instruction the citations point at.
+    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
+      [],
+    );
+    // Anti-laundering: Bob's stated preference content must not resurface as any
+    // stored memory of any kind. This path is prompt-defended only, so this
+    // assertion is its real coverage.
+    for (const memory of memories) {
+      expect(memory.content).not.toMatch(/bullet/i);
+    }
+  });
+
+  // Issue #776: the case the citation router alone cannot cover. Alice's own
+  // durable first-person preference cites only her own run-Actor instruction.
+  // A single-Actor run can store this as user memory, but Bob's steering makes
+  // this a multi-Actor run, so no preference may be stored.
+  test("when the actor states their own durable preference in a multi-actor turn, store no preference memory at all", async ({
+    run,
+  }) => {
+    await run(
+      slackMention(
+        "I prefer recaps as numbered lists, not paragraphs. Can you recap the asks in this thread so far?",
+        { author: ALICE },
+      ),
+      {
+        onProgress: sendDuringFirstModelRequest([
+          slackMention(
+            "!! Open question: should we pause the launch? Please list it when you get a chance.",
+            { author: BOB },
+          ),
+        ]),
+      },
+    );
+
+    const memories = await readThreadMemories();
+    // The multi-actor gate: no active preference may exist, even though the
+    // preference is the run actor's own and its citations would pass the
+    // single-actor router.
+    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
+      [],
+    );
+    // Preferences are the only route into a user subject for passive
+    // extraction, so the user-subject memories must stay empty too.
+    expect(await readUserMemories()).toEqual([]);
+    // Anti-laundering: the preference must not resurface as knowledge or
+    // procedure. This path is prompt-defended only, so this assertion is its
+    // real coverage.
+    for (const memory of memories) {
+      expect(memory.content).not.toMatch(/numbered/i);
+    }
+  });
+
   // TDD target (issue #773): red until the completed-run projection carries
   // non-actor public messages as conversation-scope evidence. Today a
   // passive participant's knowledge never reaches passive extraction: it is
diff --git a/packages/junior/src/chat/task-execution/slack-work.ts b/packages/junior/src/chat/task-execution/slack-work.ts
index 92489c735e..cd5ef5ea92 100644
--- a/packages/junior/src/chat/task-execution/slack-work.ts
+++ b/packages/junior/src/chat/task-execution/slack-work.ts
@@ -759,11 +759,11 @@ export function createSlackConversationWorker(
             );
           }
         };
-        // Only explicit Slack interruptions from the active author enter the
-        // active turn. The turn runs with that author's credentials, so another
-        // person's message always waits for its own turn. Deferred work and
-        // steered messages from other sources, such as the dashboard, stay
-        // pending for their own turn.
+        // Only explicit Slack interruptions enter the active turn. Another
+        // person's message joins only when it starts with !!; otherwise it
+        // waits for its own turn. Deferred work and steered messages from
+        // other sources, such as the dashboard, stay pending for their own
+        // turn.
         const drainSteeringMessages = async (
           accept: (
             messages: SteeringCandidateMessage[],
@@ -781,7 +781,8 @@ export function createSlackConversationWorker(
               }))
               .filter(
                 (candidate) =>
-                  requireSlackAuthorId(candidate.message) === activeAuthorId,
+                  requireSlackAuthorId(candidate.message) === activeAuthorId ||
+                  hasSteeringOverride(candidate.message.text),
               );
             return candidates.length > 0 ? await accept(candidates) : [];
           });
diff --git a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
index 527d5261d3..c164823fd6 100644
--- a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
+++ b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
@@ -841,7 +841,7 @@ describe("Slack conversation work execution", () => {
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
   });
 
-  it("drains only the active author's Slack messages into steering", async () => {
+  it("drains Slack messages that arrive during an active turn into steering", async () => {
     const queue = createConversationWorkQueueTestAdapter();
     const state = getStateAdapter();
     await state.connect();
@@ -863,12 +863,9 @@ describe("Slack conversation work execution", () => {
     });
 
     const injected: string[][] = [];
-    const turns: string[] = [];
     const runtime: SlackWorkerOptions["runtime"] = {
-      handleNewMention: async (_thread, message, hooks) => {
-        turns.push(message.id);
+      handleNewMention: async (_thread, _message, hooks) => {
         await hooks.ack?.();
-        if (turns.length > 1) return;
         await handleSlackWebhookAndFlush({
           request: slackWebhookRequest(
             slackEnvelope({
@@ -879,19 +876,6 @@ describe("Slack conversation work execution", () => {
           ),
           services: ingressServices,
         });
-        // The turn runs with U123's credentials, so another person cannot
-        // join it, even with the !! marker.
-        await handleSlackWebhookAndFlush({
-          request: slackWebhookRequest(
-            slackEnvelope({
-              text: `<@${SLACK_BOT_USER_ID}> !! steer this too`,
-              ts: "1712345.0003",
-              threadTs: "1712345.0001",
-              user: "U456",
-            }),
-          ),
-          services: ingressServices,
-        });
         await hooks.drainSteeringMessages?.(async (steering) => {
           injected.push(steering.map((candidate) => candidate.message.id));
           return steering.map((candidate) => candidate.inboundMessageId);
@@ -911,7 +895,6 @@ describe("Slack conversation work execution", () => {
     ).resolves.toEqual({ status: "completed" });
 
     expect(injected).toEqual([["1712345.0002"]]);
-    expect(turns).toEqual(["1712345.0001", "1712345.0003"]);
     const work = await getConversationWorkState({
       conversationId: CONVERSATION_ID,
       state,
@@ -920,7 +903,6 @@ describe("Slack conversation work execution", () => {
     expect(work?.execution.inboundMessageIds).toEqual([
       "slack:T123:slack:C123:1712345.0001:1712345.0001",
       "slack:T123:slack:C123:1712345.0001:1712345.0002",
-      "slack:T123:slack:C123:1712345.0001:1712345.0003",
     ]);
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
     await expectRemainingQueuedSlackWorkIsNoop({

From 210204c4b54c5244b0445af0ec304f6e55addc38 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Mon, 2 Nov 2026 23:05:30 +0000
Subject: [PATCH 3/3] fix(slack): Keep each Turn to a single Actor

A running Turn uses its author's credentials. Another person's !! message
joined that Turn, so their ask ran with the starter's grants. Only the
active author's messages now steer a Slack Turn. Another person's message,
with or without !!, waits for its own Turn.

Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com>
---
 .../actor-identity-end-state/design.md        |  3 +-
 .../integration/conversation/steering.eval.ts |  7 +-
 .../junior-evals/evals/memory/actors.eval.ts  | 72 -------------------
 .../src/chat/task-execution/slack-work.ts     | 13 ++--
 .../slack-conversation-work.test.ts           | 22 +++++-
 5 files changed, 31 insertions(+), 86 deletions(-)

diff --git a/openspec/changes/actor-identity-end-state/design.md b/openspec/changes/actor-identity-end-state/design.md
index 3c36655887..5758a7d0e0 100644
--- a/openspec/changes/actor-identity-end-state/design.md
+++ b/openspec/changes/actor-identity-end-state/design.md
@@ -178,8 +178,7 @@ This matches the current rules on `main`:
   The worker puts messages in one Turn only when their author and Source
   match (`selectContiguousTurnBatch` in
   `task-execution/attempt-selection.ts`). Another Actor's mid-run Slack
-  ask waits for its own Turn. A message that starts with `!!` steers the
-  running Turn as that Actor's own attributed input.
+  ask always waits for its own Turn.
 - A system-acted event Turn uses the grants of a Watch creator only through
   `timerWatchCredentialSubject` (`chat/events/notification.ts`). It gives a
   credential subject only when every event in the batch has a valid subject
diff --git a/packages/junior-evals/evals/integration/conversation/steering.eval.ts b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
index 4eaaf601a4..017a6ee7c9 100644
--- a/packages/junior-evals/evals/integration/conversation/steering.eval.ts
+++ b/packages/junior-evals/evals/integration/conversation/steering.eval.ts
@@ -52,7 +52,7 @@ describe("Slack Turn Steering", () => {
     ]);
   });
 
-  test("when other people mention Junior during a turn, each person gets a follow-up turn unless they override with !!", async ({
+  test("when other people mention Junior during a turn, each person gets a follow-up turn, even with !!", async ({
     run,
   }) => {
     // Only routing is asserted, so the inputs are manufactured and short.
@@ -72,13 +72,14 @@ describe("Slack Turn Steering", () => {
       },
     );
 
-    // Sam's turn, then Rio, Kai, and Rio again in arrival order. Alex's !!
-    // mention joins Sam's running turn.
+    // Sam's turn, then Rio, Kai, Rio again, and Alex in arrival order. The
+    // running turn uses Sam's credentials, so !! does not let Alex join it.
     expect(conversation.turns.map((turn) => turn.status)).toEqual([
       "succeeded",
       "succeeded",
       "succeeded",
       "succeeded",
+      "succeeded",
     ]);
   });
 
diff --git a/packages/junior-evals/evals/memory/actors.eval.ts b/packages/junior-evals/evals/memory/actors.eval.ts
index c80776343e..3677dbfc27 100644
--- a/packages/junior-evals/evals/memory/actors.eval.ts
+++ b/packages/junior-evals/evals/memory/actors.eval.ts
@@ -6,7 +6,6 @@ import {
 } from "@junior-evals/fixture/inputs";
 import { rubric, RubricJudge } from "@junior-evals/fixture/judge";
 import { readMemories } from "@junior-evals/fixture/memory";
-import { sendDuringFirstModelRequest } from "@junior-evals/fixture/progress";
 import { test } from "@junior-evals/fixture/test";
 
 /**
@@ -129,77 +128,6 @@ describe("Memory with Multiple Actors", () => {
     }
   });
 
-  test("when another User steers a preference into the active turn, do not store it as the Actor's user memory", async ({
-    run,
-  }) => {
-    await run(
-      slackMention("Can you recap what has been asked in this thread so far?", {
-        author: ALICE,
-      }),
-      {
-        onProgress: sendDuringFirstModelRequest([
-          slackMention(
-            "!! When you write up the recap, I prefer short bullet summaries over prose.",
-            { author: BOB },
-          ),
-        ]),
-      },
-    );
-
-    const memories = await readThreadMemories();
-    // Multi-actor runs never store any preference from passive extraction, no
-    // matter whose instruction the citations point at.
-    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
-      [],
-    );
-    // Anti-laundering: Bob's stated preference content must not resurface as any
-    // stored memory of any kind. This path is prompt-defended only, so this
-    // assertion is its real coverage.
-    for (const memory of memories) {
-      expect(memory.content).not.toMatch(/bullet/i);
-    }
-  });
-
-  // Issue #776: the case the citation router alone cannot cover. Alice's own
-  // durable first-person preference cites only her own run-Actor instruction.
-  // A single-Actor run can store this as user memory, but Bob's steering makes
-  // this a multi-Actor run, so no preference may be stored.
-  test("when the actor states their own durable preference in a multi-actor turn, store no preference memory at all", async ({
-    run,
-  }) => {
-    await run(
-      slackMention(
-        "I prefer recaps as numbered lists, not paragraphs. Can you recap the asks in this thread so far?",
-        { author: ALICE },
-      ),
-      {
-        onProgress: sendDuringFirstModelRequest([
-          slackMention(
-            "!! Open question: should we pause the launch? Please list it when you get a chance.",
-            { author: BOB },
-          ),
-        ]),
-      },
-    );
-
-    const memories = await readThreadMemories();
-    // The multi-actor gate: no active preference may exist, even though the
-    // preference is the run actor's own and its citations would pass the
-    // single-actor router.
-    expect(memories.filter((memory) => memory.kind === "preference")).toEqual(
-      [],
-    );
-    // Preferences are the only route into a user subject for passive
-    // extraction, so the user-subject memories must stay empty too.
-    expect(await readUserMemories()).toEqual([]);
-    // Anti-laundering: the preference must not resurface as knowledge or
-    // procedure. This path is prompt-defended only, so this assertion is its
-    // real coverage.
-    for (const memory of memories) {
-      expect(memory.content).not.toMatch(/numbered/i);
-    }
-  });
-
   // TDD target (issue #773): red until the completed-run projection carries
   // non-actor public messages as conversation-scope evidence. Today a
   // passive participant's knowledge never reaches passive extraction: it is
diff --git a/packages/junior/src/chat/task-execution/slack-work.ts b/packages/junior/src/chat/task-execution/slack-work.ts
index cd5ef5ea92..92489c735e 100644
--- a/packages/junior/src/chat/task-execution/slack-work.ts
+++ b/packages/junior/src/chat/task-execution/slack-work.ts
@@ -759,11 +759,11 @@ export function createSlackConversationWorker(
             );
           }
         };
-        // Only explicit Slack interruptions enter the active turn. Another
-        // person's message joins only when it starts with !!; otherwise it
-        // waits for its own turn. Deferred work and steered messages from
-        // other sources, such as the dashboard, stay pending for their own
-        // turn.
+        // Only explicit Slack interruptions from the active author enter the
+        // active turn. The turn runs with that author's credentials, so another
+        // person's message always waits for its own turn. Deferred work and
+        // steered messages from other sources, such as the dashboard, stay
+        // pending for their own turn.
         const drainSteeringMessages = async (
           accept: (
             messages: SteeringCandidateMessage[],
@@ -781,8 +781,7 @@ export function createSlackConversationWorker(
               }))
               .filter(
                 (candidate) =>
-                  requireSlackAuthorId(candidate.message) === activeAuthorId ||
-                  hasSteeringOverride(candidate.message.text),
+                  requireSlackAuthorId(candidate.message) === activeAuthorId,
               );
             return candidates.length > 0 ? await accept(candidates) : [];
           });
diff --git a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
index c164823fd6..527d5261d3 100644
--- a/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
+++ b/packages/junior/tests/component/task-execution/slack-conversation-work.test.ts
@@ -841,7 +841,7 @@ describe("Slack conversation work execution", () => {
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
   });
 
-  it("drains Slack messages that arrive during an active turn into steering", async () => {
+  it("drains only the active author's Slack messages into steering", async () => {
     const queue = createConversationWorkQueueTestAdapter();
     const state = getStateAdapter();
     await state.connect();
@@ -863,9 +863,12 @@ describe("Slack conversation work execution", () => {
     });
 
     const injected: string[][] = [];
+    const turns: string[] = [];
     const runtime: SlackWorkerOptions["runtime"] = {
-      handleNewMention: async (_thread, _message, hooks) => {
+      handleNewMention: async (_thread, message, hooks) => {
+        turns.push(message.id);
         await hooks.ack?.();
+        if (turns.length > 1) return;
         await handleSlackWebhookAndFlush({
           request: slackWebhookRequest(
             slackEnvelope({
@@ -876,6 +879,19 @@ describe("Slack conversation work execution", () => {
           ),
           services: ingressServices,
         });
+        // The turn runs with U123's credentials, so another person cannot
+        // join it, even with the !! marker.
+        await handleSlackWebhookAndFlush({
+          request: slackWebhookRequest(
+            slackEnvelope({
+              text: `<@${SLACK_BOT_USER_ID}> !! steer this too`,
+              ts: "1712345.0003",
+              threadTs: "1712345.0001",
+              user: "U456",
+            }),
+          ),
+          services: ingressServices,
+        });
         await hooks.drainSteeringMessages?.(async (steering) => {
           injected.push(steering.map((candidate) => candidate.message.id));
           return steering.map((candidate) => candidate.inboundMessageId);
@@ -895,6 +911,7 @@ describe("Slack conversation work execution", () => {
     ).resolves.toEqual({ status: "completed" });
 
     expect(injected).toEqual([["1712345.0002"]]);
+    expect(turns).toEqual(["1712345.0001", "1712345.0003"]);
     const work = await getConversationWorkState({
       conversationId: CONVERSATION_ID,
       state,
@@ -903,6 +920,7 @@ describe("Slack conversation work execution", () => {
     expect(work?.execution.inboundMessageIds).toEqual([
       "slack:T123:slack:C123:1712345.0001:1712345.0001",
       "slack:T123:slack:C123:1712345.0001:1712345.0002",
+      "slack:T123:slack:C123:1712345.0001:1712345.0003",
     ]);
     expect(work ? countPendingConversationMessages(work) : 0).toBe(0);
     await expectRemainingQueuedSlackWorkIsNoop({