nearai
diff --git a/‎channels-src/discord/src/lib.rs‎
Lines changed: 2 additions & 2 deletions b/‎channels-src/discord/src/lib.rs‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎channels-src/feishu/src/lib.rs‎
Lines changed: 13 additions & 6 deletions b/‎channels-src/feishu/src/lib.rs‎
Lines changed: 13 additions & 6 deletions
diff --git a/‎channels-src/slack/src/lib.rs‎
Lines changed: 2 additions & 2 deletions b/‎channels-src/slack/src/lib.rs‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎channels-src/telegram/src/lib.rs‎
Lines changed: 2 additions & 2 deletions b/‎channels-src/telegram/src/lib.rs‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎channels-src/whatsapp/src/lib.rs‎
Lines changed: 2 additions & 2 deletions b/‎channels-src/whatsapp/src/lib.rs‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎docs/TELEGRAM_SETUP.md‎
Lines changed: 4 additions & 3 deletions b/‎docs/TELEGRAM_SETUP.md‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎migrations/V18__tool_scope.sql‎
Lines changed: 4 additions & 0 deletions b/‎migrations/V18__tool_scope.sql‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎migrations/V19__channel_identities.sql‎
Lines changed: 12 additions & 0 deletions b/‎migrations/V19__channel_identities.sql‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎migrations/V20__pairing_requests.sql‎
Lines changed: 16 additions & 0 deletions b/‎migrations/V20__pairing_requests.sql‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎src/agent/agent_loop.rs‎
Lines changed: 31 additions & 16 deletions b/‎src/agent/agent_loop.rs‎
Lines changed: 31 additions & 16 deletions
@@ -1152,8 +1152,8 @@ fn send_pairing_reply(ctx: &PairingReplyCtx, code: &str) -> Result<(), String> {
 
     let mut payload = serde_json::json!({
         "content": format!(
-            "To pair with this bot, run: `ironclaw pairing approve discord {}`",
-            code
+            "Enter this code in IronClaw to pair your discord account: `{}`. CLI fallback: `ironclaw pairing approve discord {}`",
+            code, code
         )
     });
 
 
@@ -517,16 +517,23 @@ fn handle_message_event(event_data: &serde_json::Value) {
     // DM pairing check for p2p chats.
     let chat_type = msg_event.message.chat_type.as_deref().unwrap_or("unknown");
 
+    // Resolved user_id for the emitted message. Defaults to sender_id but
+    // is overwritten with the owner_id when the sender is paired, ensuring
+    // the message is scoped to the correct owner/tenant.
+    let mut user_id = sender_id.to_string();
+
     if chat_type == "p2p" {
         let dm_policy =
             channel_host::workspace_read(DM_POLICY_PATH).unwrap_or_else(|| "pairing".to_string());
 
         if dm_policy == "pairing" {
-            let sender_name = sender_id.to_string();
-            match channel_host::pairing_is_allowed("feishu", sender_id, Some(&sender_name)) {
-                Ok(true) => {}
-                Ok(false) => {
-                    // Upsert a pairing request.
+            match channel_host::pairing_resolve_identity("feishu", sender_id) {
+                Ok(Some(owner_id)) => {
+                    // Sender is paired; scope message to owner.
+                    user_id = owner_id;
+                }
+                Ok(None) => {
+                    // Unknown sender — upsert a pairing request.
                     let meta = serde_json::json!({
                         "sender_id": sender_id,
                         "chat_id": msg_event.message.chat_id,
@@ -586,7 +593,7 @@ fn handle_message_event(event_data: &serde_json::Value) {
 
     // Emit message to the agent.
     channel_host::emit_message(&EmittedMessage {
-        user_id: sender_id.to_string(),
+        user_id,
         user_name: None,
         content: text,
         thread_id,
 
@@ -757,8 +757,8 @@ fn send_pairing_reply(channel_id: &str, code: &str) -> Result<(), String> {
     let payload = serde_json::json!({
         "channel": channel_id,
         "text": format!(
-            "To pair with this bot, run: `ironclaw pairing approve slack {}`",
-            code
+            "Enter this code in IronClaw to pair your slack account: `{}`. CLI fallback: `ironclaw pairing approve slack {}`",
+            code, code
         ),
     });
 
 
@@ -1634,8 +1634,8 @@ fn send_pairing_reply(chat_id: i64, code: &str) -> Result<(), String> {
     send_message(
         chat_id,
         &format!(
-            "To pair with this bot, run: `ironclaw pairing approve telegram {}`",
-            code
+            "Enter this code in IronClaw to pair your telegram account: `{}`. CLI fallback: `ironclaw pairing approve telegram {}`",
+            code, code
         ),
         None,
         Some("Markdown"),
 
@@ -910,8 +910,8 @@ fn send_pairing_reply(
         "text": {
             "preview_url": false,
             "body": format!(
-                "To pair with this bot, run: ironclaw pairing approve whatsapp {}",
-                code
+                "Enter this code in IronClaw to pair your whatsapp account: {}. CLI fallback: ironclaw pairing approve whatsapp {}",
+                code, code
             )
         }
     });
 
@@ -57,9 +57,10 @@ When an unknown user DMs your bot, they receive a pairing code. You must approve
 ### Flow
 
 1. Unknown user sends a message to your bot
-2. Bot replies: `To pair with this bot, run: ironclaw pairing approve telegram ABC12345`
-3. You run: `ironclaw pairing approve telegram ABC12345`
-4. User is added to the allow list; future messages are delivered
+2. Bot replies with a one-time pairing code
+3. The user enters that code in IronClaw's channel settings to claim the Telegram account
+4. CLI fallback: `ironclaw pairing approve telegram ABC12345`
+5. The user's Telegram identity is linked to the owner; future messages resolve to that owner and are delivered
 
 ### Commands
 
 
@@ -0,0 +1,4 @@
+-- Add scope column to tool tables for future admin-promoted global tools.
+-- All existing rows default to 'user'. Nothing sets 'global' yet.
+ALTER TABLE wasm_tools    ADD COLUMN IF NOT EXISTS scope TEXT NOT NULL DEFAULT 'user';
+ALTER TABLE dynamic_tools ADD COLUMN IF NOT EXISTS scope TEXT NOT NULL DEFAULT 'user';
@@ -0,0 +1,12 @@
+-- Maps a channel-specific external identity to an IronClaw owner.
+-- This is how inbound messages are resolved to the right user's resources.
+CREATE TABLE channel_identities (
+    id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+    owner_id    TEXT        NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    channel     TEXT        NOT NULL CHECK (channel = LOWER(channel)),
+    external_id TEXT        NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE (channel, external_id)
+);
+
+-- UNIQUE (channel, external_id) already creates an implicit index on (channel, external_id).
@@ -0,0 +1,16 @@
+-- Replaces file-based pairing store (~/.ironclaw/{channel}-pairing.json).
+-- A pending request has owner_id = NULL until approved.
+CREATE TABLE pairing_requests (
+    id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+    channel     TEXT        NOT NULL CHECK (channel = LOWER(channel)),
+    external_id TEXT        NOT NULL,
+    code        TEXT        NOT NULL UNIQUE,
+    owner_id    TEXT        REFERENCES users(id) ON DELETE CASCADE,
+    meta        JSONB,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at  TIMESTAMPTZ NOT NULL,
+    approved_at TIMESTAMPTZ
+);
+
+-- UNIQUE on code already creates an implicit index; no separate idx_pairing_requests_code needed.
+CREATE INDEX idx_pairing_requests_channel ON pairing_requests (channel, external_id);
@@ -247,7 +247,7 @@ impl Agent {
                 store: deps
                     .store
                     .as_ref()
-                    .map(|db| crate::tenant::AdminScope::new(Arc::clone(db))),
+                    .map(|db| crate::tenant::SystemScope::new(Arc::clone(db))),
                 hooks: deps.hooks.clone(),
             },
         );
@@ -363,13 +363,28 @@ impl Agent {
     /// [`TenantCtx`] provides a [`TenantScope`] that auto-binds `user_id` on
     /// every database operation and a per-user rate limiter.
     pub(super) async fn tenant_ctx(&self, user_id: &str) -> crate::tenant::TenantCtx {
+        use crate::ownership::{Identity, OwnerId, UserRole};
+        // Bridge: creates Member identity from raw string.
+        // Will be replaced by OwnershipCache lookup in Task 9.
+        let identity = Identity::new(OwnerId::from(user_id), UserRole::Member);
+        self.tenant_ctx_with_identity(identity).await
+    }
+
+    /// Build a tenant-scoped execution context from a resolved `Identity`.
+    ///
+    /// Preferred over [`tenant_ctx`](Self::tenant_ctx) once the call site has a
+    /// full `Identity` available.
+    pub(super) async fn tenant_ctx_with_identity(
+        &self,
+        identity: crate::ownership::Identity,
+    ) -> crate::tenant::TenantCtx {
+        let user_id = identity.owner_id.as_str();
         let rate = self.deps.tenant_rates.get_or_create(user_id).await;
 
-        let store = self
-            .deps
-            .store
-            .as_ref()
-            .map(|db| crate::tenant::TenantScope::new(user_id, Arc::clone(db)));
+        let store =
+            self.deps.store.as_ref().map(|db| {
+                crate::tenant::TenantScope::with_identity(identity.clone(), Arc::clone(db))
+            });
 
         // Reuse the owner workspace if user matches, otherwise create per-user.
         // Per-user workspaces are seeded on first creation so they get identity
@@ -394,23 +409,23 @@ impl Agent {
         };
 
         crate::tenant::TenantCtx::new(
-            user_id,
+            identity,
             store,
             workspace,
             Arc::clone(&self.deps.cost_guard),
             rate,
         )
     }
 
-    /// Get an admin-scoped database accessor for cross-tenant operations.
+    /// Get a system-scoped database accessor for cross-tenant operations.
     ///
     /// Only for system-level components (heartbeat, routine engine, self-repair,
     /// scheduler). Handler code should use [`tenant_ctx()`](Self::tenant_ctx) instead.
-    pub(super) fn admin_store(&self) -> Option<crate::tenant::AdminScope> {
+    pub(super) fn system_store(&self) -> Option<crate::tenant::SystemScope> {
         self.deps
             .store
             .as_ref()
-            .map(|db| crate::tenant::AdminScope::new(Arc::clone(db)))
+            .map(|db| crate::tenant::SystemScope::new(Arc::clone(db)))
     }
 
     pub(super) fn skill_registry(&self) -> Option<&Arc<std::sync::RwLock<SkillRegistry>>> {
@@ -507,8 +522,8 @@ impl Agent {
             self.config.stuck_threshold,
             self.config.max_repair_attempts,
         );
-        if let Some(admin) = self.admin_store() {
-            self_repair = self_repair.with_store(admin);
+        if let Some(system) = self.system_store() {
+            self_repair = self_repair.with_store(system);
         }
         if let Some(ref builder) = self.deps.builder {
             self_repair = self_repair.with_builder(Arc::clone(builder), Arc::clone(self.tools()));
@@ -704,13 +719,13 @@ impl Agent {
                         .unwrap_or_default();
 
                     if config.multi_tenant {
-                        if let Some(admin) = self.admin_store() {
+                        if let Some(system) = self.system_store() {
                             Some(spawn_multi_user_heartbeat(
                                 config,
                                 hygiene,
                                 self.cheap_llm().clone(),
                                 Some(notify_tx),
-                                admin,
+                                system,
                             ))
                         } else {
                             tracing::warn!("Multi-tenant heartbeat requires a database store");
@@ -723,7 +738,7 @@ impl Agent {
                             workspace.clone(),
                             self.cheap_llm().clone(),
                             Some(notify_tx),
-                            self.admin_store(),
+                            self.system_store(),
                         ))
                     }
                 } else {
@@ -747,7 +762,7 @@ impl Agent {
 
                     let engine = Arc::new(RoutineEngine::new(
                         rt_config.clone(),
-                        crate::tenant::AdminScope::new(Arc::clone(store)),
+                        crate::tenant::SystemScope::new(Arc::clone(store)),
                         self.llm().clone(),
                         Arc::clone(workspace),
                         notify_tx,
Original file line number	Diff line number	Diff line change
`@@ -1152,8 +1152,8 @@ fn send_pairing_reply(ctx: &PairingReplyCtx, code: &str) -> Result<(), String> {`
`1152`	`1152`
`1153`	`1153`	`let mut payload = serde_json::json!({`
`1154`	`1154`	`"content": format!(`
`1155`		- "To pair with this bot, run: `ironclaw pairing approve discord {}`",
`1156`		`- code`
	`1155`	+ "Enter this code in IronClaw to pair your discord account: `{}`. CLI fallback: `ironclaw pairing approve discord {}`",
	`1156`	`+ code, code`
`1157`	`1157`	`)`
`1158`	`1158`	`});`
`1159`	`1159`
Original file line number	Diff line number	Diff line change
`@@ -910,8 +910,8 @@ fn send_pairing_reply(`
`910`	`910`	`"text": {`
`911`	`911`	`"preview_url": false,`
`912`	`912`	`"body": format!(`
`913`		`- "To pair with this bot, run: ironclaw pairing approve whatsapp {}",`
`914`		`- code`
	`913`	`+ "Enter this code in IronClaw to pair your whatsapp account: {}. CLI fallback: ironclaw pairing approve whatsapp {}",`
	`914`	`+ code, code`
`915`	`915`	`)`
`916`	`916`	`}`
`917`	`917`	`});`