Fix Slack continuation replies and Content provenance

.changeset/quiet-slack-continuations.md

@@ -0,0 +1,6 @@
+---
+"@agent-native/core": patch
+"@agent-native/dispatch": patch
+---
+
+Suppress provisional artifact warnings while delegated work is still running, and preserve verified Slack provenance for cross-app intake through an audience-scoped, fail-closed resolver.

packages/core/src/a2a/artifact-response.spec.ts

@@ -5,11 +5,24 @@ import {
   buildA2ARecoverableArtifactMessage,
   buildA2AVerifiedMutationReceipt,
   extractA2AArtifactIdentities,
+  guardA2AArtifactResponse,
   stripA2APersistedArtifactMarkers,
 } from "./artifact-response.js";
 
 describe("appendA2AArtifactLinks", () => {
   afterEach(() => vi.unstubAllEnvs());
+
+  it("identifies framework-generated unverified artifact rejections", () => {
+    const guarded = guardA2AArtifactResponse(
+      "Created it: https://content.agent-native.com/page/provisional",
+      [],
+      { baseUrl: "https://content.agent-native.com" },
+    );
+
+    expect(guarded.rejectedUnverifiedArtifactReferences).toBe(true);
+    expect(guarded.text).toContain("could not verify the document URL");
+  });
+
   it("appends a document URL from a successful create-document result", () => {
     const text = appendA2AArtifactLinks(
       "Created the brief.",

packages/core/src/a2a/artifact-response.ts

@@ -14,6 +14,11 @@ export interface A2AArtifactResponseOptions {
   persistedArtifactSecret?: string;
 }
 
+export interface GuardedA2AArtifactResponse {
+  text: string;
+  rejectedUnverifiedArtifactReferences: boolean;
+}
+
 export interface A2AArtifactIdentityOptions {
   persistedArtifactSecrets?: readonly string[];
 }
@@ -1395,11 +1400,11 @@ function formatUnverifiedArtifactMessage(
     : message;
 }
 
-export function appendA2AArtifactLinks(
+export function guardA2AArtifactResponse(
   responseText: string,
   toolResults: A2AToolResultSummary[],
   options: A2AArtifactResponseOptions = {},
-): string {
+): GuardedA2AArtifactResponse {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const includeReferencedArtifacts =
     options.includeReferencedArtifacts ?? false;
@@ -1440,7 +1445,10 @@ export function appendA2AArtifactLinks(
     ) ||
       /\b(?:done|created|ready|here(?:'s| is)|complete|finished)\b/i.test(text))
   ) {
-    return finalize(formatIncompleteDesignMessage(incompleteShells));
+    return {
+      text: finalize(formatIncompleteDesignMessage(incompleteShells)),
+      rejectedUnverifiedArtifactReferences: false,
+    };
   }
 
   const unverifiedRefs = findUnverifiedArtifactReferences(
@@ -1454,18 +1462,21 @@ export function appendA2AArtifactLinks(
     generatedDesigns,
   );
   if (unverifiedRefs.length > 0) {
-    return finalize(
-      formatUnverifiedArtifactMessage(
-        unverifiedRefs,
-        documents,
-        decks,
-        dashboards,
-        analyses,
-        images,
-        generatedDesigns,
-        baseUrl,
+    return {
+      text: finalize(
+        formatUnverifiedArtifactMessage(
+          unverifiedRefs,
+          documents,
+          decks,
+          dashboards,
+          analyses,
+          images,
+          generatedDesigns,
+          baseUrl,
+        ),
       ),
-    );
+      rejectedUnverifiedArtifactReferences: true,
+    };
   }
 
   const missingLines: string[] = [];
@@ -1541,10 +1552,25 @@ export function appendA2AArtifactLinks(
   }
 
   if (missingLines.length === 0) {
-    return finalize(text);
+    return {
+      text: finalize(text),
+      rejectedUnverifiedArtifactReferences: false,
+    };
   }
+
   const artifactBlock = `Artifacts:\n${missingLines.join("\n")}`;
-  return finalize(text ? `${text}\n\n${artifactBlock}` : artifactBlock);
+  return {
+    text: finalize(text ? `${text}\n\n${artifactBlock}` : artifactBlock),
+    rejectedUnverifiedArtifactReferences: false,
+  };
+}
+
+export function appendA2AArtifactLinks(
+  responseText: string,
+  toolResults: A2AToolResultSummary[],
+  options: A2AArtifactResponseOptions = {},
+): string {
+  return guardA2AArtifactResponse(responseText, toolResults, options).text;
 }
 
 export function buildA2ARecoverableArtifactMessage(

packages/core/src/a2a/client.spec.ts

@@ -250,6 +250,26 @@ describe("A2AClient", () => {
     );
   });
 
+  it("transports structured source context in A2A metadata", async () => {
+    const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body));
+      expect(body.params.metadata.sourceContext).toEqual({
+        platform: "slack",
+        integrationTaskId: "integration-task-1",
+      });
+      return completedResponse(body, "sent");
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await callAgent("https://agent.test", "capture this", {
+      async: false,
+      sourceContext: {
+        platform: "slack",
+        integrationTaskId: "integration-task-1",
+      },
+    });
+  });
+
   it("sends bounded correlation metadata and idempotency at the protocol top level", async () => {
     const fetchMock = vi.fn(async (_url: string, init?: RequestInit) => {
       const body = JSON.parse(String(init?.body));

packages/core/src/a2a/client.ts

@@ -5,6 +5,7 @@ import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
 import type {
   A2AApprovedAction,
   A2ACorrelationMetadata,
+  A2ASourceContextReference,
   A2AReadOnlyActionResult,
   AgentCard,
   JsonRpcRequest,
@@ -632,6 +633,8 @@ export async function callAgent(
     requestOrigin?: string;
     /** Exact downstream actions explicitly authorized in the caller's chat. */
     approvedActions?: A2AApprovedAction[];
+    /** Opaque provenance reference resolved by the receiver through Dispatch. */
+    sourceContext?: A2ASourceContextReference;
     /** Bounded telemetry-only lineage forwarded to the receiving app. */
     correlation?: A2ACorrelationMetadata;
     /** Stable caller-generated key for one message submission. */
@@ -673,6 +676,7 @@ export async function callAgent(
   if (opts?.userEmail) metadata.userEmail = opts.userEmail;
   if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;
   if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;
+  if (opts?.sourceContext) metadata.sourceContext = opts.sourceContext;
   Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));
 
   // Default to async + poll. The receiving A2A server's `_process-task` route