fleetd #689: pin the answerGatePasses call site via the audit trail

A unit test on the extracted helper proves the helper, not the call
site in sendMessage. allow() logs an AuditLog.allowed() entry for
every granted non-READ/METRICS/TASK_READ action, so a granted turnId
request must log both SEND and ANSWER, and a granted plain request
must log SEND alone. Verified this goes red when the call site is
deleted from sendMessage, and restores to a clean diff.

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -20,16 +20,22 @@ public final class Authz {
         SPAWN,
         /** Tear a worker peer down. */
         STOP,
-        /** Deliver a turn to a session (or answer a worker's question). */
+        /** Deliver a turn to a local session, addressed by {@code sessionId}. */
         SEND,
+        /** Resolve a worker's blocked question and resume its turn, addressed by {@code turnId}. */
+        ANSWER,
+        /** Address a peer lead on another daemon over the coordination broker, by {@code coordId}. */
+        COORD_SEND,
         /** A worker's terminal reply for its own turn. */
         REPLY,
         /** A worker's mid-turn question to the primary. */
         ASK,
         /** Collect held replies from a session's inbox. */
         DRAIN,
-        /** Read-only observation: status, roster, profiles, task polling. */
+        /** Read-only roster, profile, and identity observation: no ticket, task, or turn state. */
         READ,
+        /** Poll a ticket, or read a session's status. */
+        TASK_READ,
         /**
          * Read (never ack) this daemon's own held lead-to-lead coordination mail (fleetd #421).
          *
@@ -71,11 +77,19 @@ public final class Authz {
             // escalating into the orchestrator role.
             case SPAWN, STOP, DRAIN, HANDOVER -> caller.isPrimary();
 
-            // Delivering a turn is open to the primary and the architect: an architect delegates
-            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
-            // excluded — sending would be it escalating.
+            // Delivering a turn to a local session is open to the primary and the architect: an
+            // architect delegates to workers (that is the role's point) but still has no lifecycle
+            // rights. A worker is excluded — sending would be it escalating.
             case SEND -> caller.isPrimary() || caller.isArchitect();
 
+            // Same grant as SEND. Resolving a worker's blocked question is part of delegating to
+            // it, not a separate capability.
+            case ANSWER -> caller.isPrimary() || caller.isArchitect();
+
+            // Same grant as SEND. This leaves the daemon over the coordination broker rather than
+            // addressing a local session, but the caller who may do one may do the other.
+            case COORD_SEND -> caller.isPrimary() || caller.isArchitect();
+
             // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
             // that can be — a lead answering another lead is replying for its OWN terminal, which
             // this already permits — while the rule itself is unchanged, and is what stops anyone
@@ -84,10 +98,17 @@ public final class Authz {
             // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
             case REPLY, ASK -> caller.ownsSession(targetSession);
 
-            // Observation is open to every authenticated role: a worker legitimately polls its own
-            // status, and the roster carries no secrets.
+            // READ is roster, profile, and identity observation — fleet_list, fleet_profiles, and
+            // fleet_whoami — and carries no secrets: no ticket reply, no pending question, and no
+            // other session's turn state. Those live under TASK_READ. METRICS is the separate
+            // Prometheus scrape. Both stay open to every authenticated role.
             case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
 
+            // Ticket polling and session status, open to every authenticated role the same as READ.
+            // Unlike READ, a holder may poll a ticket it did not create, or read another session's
+            // pending question and the turnId that answers it.
+            case TASK_READ -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
+
             // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect
             // holds READ today (CB-548), so "not primary" must mean not-architect here too — this
             // is coordination between leads, not observation of the roster.

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -690,7 +690,7 @@ public final class FleetMcp {
             return null; // AuthorizationMode.UNENFORCED: authorization not enforced (fleetd #518)
         }
         if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ) {
+            if (action != Authz.Action.READ && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return null;
@@ -1035,31 +1035,21 @@ public final class FleetMcp {
     }
 
     /**
-     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments
-     * (fleetd #272, widened by fleetd #421).
+     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments.
      *
-     * <p>{@code fleet_poll} is now <strong>three operations behind one tool name</strong>. With
+     * <p>{@code fleet_poll} is <strong>three operations behind one tool name</strong>. With
      * {@code ticket} it observes an async delegation and changes nothing, which is a {@link
-     * Authz.Action#READ}. With {@code target} it calls {@link MessageService#drainReplies} on that
-     * session -- the replies are removed from the inbox and a second call returns nothing -- so it
-     * is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for removing a
-     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}. With
-     * {@code coordId} it reads (never acks) this daemon's own held lead-to-lead mail, which is a
-     * {@link Authz.Action#COORD_READ} -- <strong>not</strong> {@code READ}, even though nothing is
-     * consumed: {@code READ}'s grant is open to every authenticated role on the premise that the
-     * roster carries no secrets, and a lead-to-lead body is not the roster. Mapping a non-destructive
-     * peer-mail read to {@code READ} would let any worker read every peer lead's mail in full.
-     *
-     * <p>Before this method existed (fleetd #272) the handler passed a constant {@code READ} for
-     * both of the original branches. {@code READ} is open to every authenticated role, so any
-     * worker could read a peer's id out of {@code fleet_list} and destroy the replies that peer had
-     * queued for the primary. The gate failed open, and it did so because the required action is a
-     * function of the arguments while the handler chose it before looking at them.
+     * Authz.Action#TASK_READ}. With {@code target} it calls {@link MessageService#drainReplies} on
+     * that session -- the replies are removed from the inbox and a second call returns nothing --
+     * so it is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for
+     * removing a single message, and the same one the REST path uses at
+     * {@code FleetApp.drainReplies}. With {@code coordId} it reads (never acks) this daemon's own
+     * held lead-to-lead mail, which is a {@link Authz.Action#COORD_READ} -- <strong>not</strong>
+     * {@code TASK_READ} or {@code READ}: a lead-to-lead body is a different inbox from either, and
+     * folding it into either would let any worker or architect read every peer lead's mail in full.
      *
      * <p>The choice lives in this method, and not inline in the handler, so that a test can assert
-     * the mapping the handler actually uses. {@code FleetMcpAuthzTest} already checked every
-     * {@link Authz.Action} against every {@link Role} and passed throughout -- it tested the policy
-     * table, which was correct, while the defect was in which action the caller handed it.
+     * the mapping the handler actually uses.
      *
      * <p>Checked first, and exclusively of {@code target}: a call naming {@code coordId} is reading
      * a different inbox entirely (this daemon's own lead channel, never a worker's), so it takes
@@ -1072,7 +1062,30 @@ public final class FleetMcp {
         if (!isBlank(coordId)) {
             return Authz.Action.COORD_READ;
         }
-        return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
+        return isBlank(target) ? Authz.Action.TASK_READ : Authz.Action.DRAIN;
+    }
+
+    /**
+     * Which authorization action a {@code fleet_send} call needs, decided by its arguments.
+     *
+     * <p>{@code fleet_send} is three call shapes behind one tool name, mirroring {@link
+     * #pollAction}. With {@code coordId} it addresses a peer lead on another daemon over the
+     * coordination broker, which is {@link Authz.Action#COORD_SEND}. With {@code turnId} it
+     * resolves a worker's blocked {@code fleet_ask} and resumes that turn, which is {@link
+     * Authz.Action#ANSWER}. Otherwise it delivers to a local session by {@code sessionId}, which is
+     * the plain {@link Authz.Action#SEND}.
+     *
+     * <p>Checked in the same order the handler branches: {@code coordId} first and exclusively of
+     * {@code turnId}, matching {@link #sendToLead}'s own mutual-exclusion check.
+     *
+     * @param coordId the {@code coordId} argument of the call, or {@code null}/blank when absent
+     * @param turnId  the {@code turnId} argument of the call, or {@code null}/blank when absent
+     */
+    static Authz.Action sendAction(String coordId, String turnId) {
+        if (!isBlank(coordId)) {
+            return Authz.Action.COORD_SEND;
+        }
+        return isBlank(turnId) ? Authz.Action.SEND : Authz.Action.ANSWER;
     }
 
     /**
@@ -1097,10 +1110,11 @@ public final class FleetMcp {
      */
     private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
         return switch (tool) {
-            case SEND -> Authz.Action.SEND;
+            case SEND -> sendAction(str(arguments, "coordId"), str(arguments, "turnId"));
             case REPLY -> Authz.Action.REPLY;
             case ASK -> Authz.Action.ASK;
-            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case STATUS -> Authz.Action.TASK_READ;
+            case LIST, PROFILES, WHOAMI -> Authz.Action.READ;
             case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
             case ACK -> Authz.Action.DRAIN;
             case SPAWN -> Authz.Action.SPAWN;

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -49,22 +49,52 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
-    /** The authorization action the matching route handler hands to {@link #allow}. */
+    /**
+     * The authorization action the matching route handler hands to {@link #allow}, for a route
+     * whose action does not depend on the request body.
+     */
     static Authz.Action routeAction(String route) {
+        return routeAction(route, null);
+    }
+
+    /**
+     * As above, plus the one route whose action depends on the body: {@code POST
+     * /sessions/{id}/message} carries a {@code turnId} (the answer-a-blocked-worker shape) or not
+     * (a plain delivery), mirroring {@code FleetMcp#sendAction}'s split of the same two call
+     * shapes over MCP. {@code turnId} is ignored by every other route.
+     *
+     * @param turnId the request body's {@code turnId}, or {@code null}/blank when absent or not
+     *               applicable to this route
+     */
+    static Authz.Action routeAction(String route, String turnId) {
         return switch (route) {
             case "GET /metrics" -> Authz.Action.METRICS;
             case "POST /members" -> Authz.Action.SPAWN;
             case "DELETE /members/{paneId}" -> Authz.Action.STOP;
-            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
+            case "POST /sessions/{id}/message" -> turnId == null || turnId.isBlank()
+                    ? Authz.Action.SEND : Authz.Action.ANSWER;
             case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
             case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
             case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
             case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
+                    "GET /member-credentials" -> Authz.Action.READ;
+            case "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.TASK_READ;
             default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
         };
     }
 
+    /**
+     * The second gate for {@code POST /sessions/{id}/message}: checked only when {@code turnId}
+     * is present and non-blank, against {@link Authz.Action#ANSWER}. A request with no {@code
+     * turnId} passes this gate unconditionally, without consulting {@code permit} at all, having
+     * already cleared the coarse {@link Authz.Action#SEND} grant checked ahead of it.
+     *
+     * @param permit reports whether the caller holds the named grant
+     */
+    static boolean answerGatePasses(String turnId, Predicate<Authz.Action> permit) {
+        return turnId == null || turnId.isBlank() || permit.test(Authz.Action.ANSWER);
+    }
+
     /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
     private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
     private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
@@ -250,7 +280,8 @@ public final class FleetApp {
         }
         Principal caller = ctx.attribute(CALLER);
         if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
+            if (action != Authz.Action.READ && action != Authz.Action.METRICS
+                    && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return true;
@@ -603,26 +634,37 @@ public final class FleetApp {
      * status-gated injector and block until the worker returns a structured {@code fleet_reply}.
      * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
      * still land.
+     *
+     * <p>Two call shapes share this route, exactly as {@code fleet_send} does over MCP (see
+     * {@code FleetMcp#sendAction}): a plain delivery to {@code id}, and -- when the body carries
+     * {@code turnId} -- resolving a worker's blocked question. The coarse {@link
+     * Authz.Action#SEND} grant is checked first, before the body is read at all; only once that
+     * passes is the body parsed, and a present {@code turnId} is then checked again against
+     * {@link Authz.Action#ANSWER}. A body that fails to parse is rejected with 400 and reaches
+     * neither {@code messages.answer} nor {@code messages.send}.
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
         if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
             return;
         }
-        String content;
-        String turnId;
-        long timeout;
-        boolean wait;
+        JsonNode body;
         try {
-            JsonNode body = mapper.readTree(ctx.body());
-            content = body.path("content").asText("");
-            turnId = body.path("turnId").asText(null);
-            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
-            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
+            body = mapper.readTree(ctx.body());
         } catch (Exception e) {
+            body = null;
+        }
+        if (body == null) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
             return;
         }
+        String turnId = body.path("turnId").asText(null);
+        if (!answerGatePasses(turnId, action -> allow(ctx, action, id))) {
+            return;
+        }
+        String content = body.path("content").asText("");
+        long timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
+        boolean wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
         if (content.isBlank()) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
             return;

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyTimingDefaultsTest.java

@@ -0,0 +1,190 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * Asserts that the assembled loops use the production reminder, coordination, and delivery timing
+ * defaults when no {@code primary:} block configures the reply-push values.
+ */
+class FleetdAssemblyTimingDefaultsTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private TestResourcePorts ports;
+
+    @AfterEach
+    void tearDown() {
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private FleetdRuntime assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new TestResourcePorts();
+        return FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+    }
+
+    private static long longField(Object target, String name) throws Exception {
+        Field field = target.getClass().getDeclaredField(name);
+        field.setAccessible(true);
+        return field.getLong(target);
+    }
+
+    @Test
+    void productionBootPathUsesTheExpectedLoopTimingDefaults(@TempDir Path dir) throws Exception {
+        FleetdRuntime runtime = assemble(dir);
+
+        ReplyPushLoop pushLoop = runtime.pushLoop();
+        assertEquals(5, longField(pushLoop, "maxReminders"),
+                "without primary:, ReplyPushLoop must stop after five reminder attempts");
+        assertEquals(15_000L, longField(pushLoop, "backoffMs"),
+                "without primary:, ReplyPushLoop must wait fifteen seconds before the next reminder");
+
+        LeadCoordLoop leadCoordLoop = runtime.leadCoordLoop();
+        assertNotNull(leadCoordLoop, "control: coordinator: must build LeadCoordLoop");
+        assertEquals(3_000L, longField(leadCoordLoop, "intervalMs"),
+                "LeadCoordLoop must poll for peer-lead mail every three seconds");
+
+        StatusPoller poller = runtime.poller();
+        assertEquals(Injector.POLL_INTERVAL_MILLIS, longField(poller, "intervalMillis"),
+                "StatusPoller must use Injector's delivery poll interval");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -38,6 +38,37 @@ class AuthzTest {
         }
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one action name until {@code
+     * FleetMcp#sendAction} picks one: a plain local {@link Authz.Action#SEND}, the {@code coordId}
+     * route ({@link Authz.Action#COORD_SEND}), and the {@code turnId} answer form ({@link
+     * Authz.Action#ANSWER}). All three carry the same grant as the undivided action did — a worker
+     * is excluded from every one, exactly as it was excluded from the one combined action before.
+     */
+    @Test
+    void theThreeSendShapesCarryTheSameGrantAsTheOldUndividedAction() {
+        for (Authz.Action a : new Authz.Action[]{SEND, COORD_SEND, ANSWER}) {
+            assertTrue(Authz.permits(PRIMARY, a, "term_a"), "the primary may " + a);
+            assertTrue(Authz.permits(ARCH_DESIGN, a, "term_a"), "an architect may " + a);
+            assertFalse(Authz.permits(WORKER_A, a, "term_a"),
+                    "a worker performing " + a + " would be escalating into the orchestrator role");
+            assertFalse(Authz.permits(ANON, a, "term_a"));
+        }
+    }
+
+    /**
+     * {@code fleet_poll{ticket}} and {@code fleet_status} are {@link Authz.Action#TASK_READ}, split
+     * out of the roster-only {@link Authz.Action#READ} (fleetd #678). The grant is unchanged from
+     * what the undivided {@code READ} action gave every one of these callers.
+     */
+    @Test
+    void taskReadCarriesTheSameGrantReadDidBeforeTheSplit() {
+        assertTrue(Authz.permits(PRIMARY, TASK_READ, null));
+        assertTrue(Authz.permits(WORKER_A, TASK_READ, null));
+        assertTrue(Authz.permits(ARCH_DESIGN, TASK_READ, null));
+        assertFalse(Authz.permits(ANON, TASK_READ, null));
+    }
+
     @Test
     void aWorkerMayReplyAndAskOnlyAsItself() {
         assertTrue(Authz.permits(WORKER_A, REPLY, "term_a"));

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -156,6 +156,45 @@ class FleetMcpAuthzTest {
         }
     }
 
+    /**
+     * fleetd #669 Unit A: {@code SEND} is split into three actions ({@link Authz.Action#SEND},
+     * {@link Authz.Action#COORD_SEND}, {@link Authz.Action#ANSWER}), each carrying the same grant
+     * the one undivided action gave. An architect holds all three, exactly as it held the one.
+     */
+    @Test
+    void anArchitectMayUseAllThreeSendShapesOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            assertNull(m.denyFor(ARCH_DESIGN, a, "term_a"),
+                    a + " carries the same grant the undivided SEND action gave an architect");
+        }
+    }
+
+    /** The other half of the same split: a worker is excluded from all three, as it was from one. */
+    @Test
+    void aWorkerMayNotUseAnySendShapeOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            McpSchema.CallToolResult denied = m.denyFor(WORKER_A, a, "term_a");
+            assertNotNull(denied, a + " must stay refused to a worker");
+            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
+        }
+    }
+
+    /**
+     * fleetd #669 Unit A / #678: {@code TASK_READ} (ticket polling, session status) is split out of
+     * the roster-only {@code READ}, carrying forward the grant the undivided action gave. A worker
+     * still has both — it never gained or lost anything by the split.
+     */
+    @Test
+    void aWorkerKeepsBothReadActionsAfterTheSplit() {
+        FleetMcp m = mcp(true);
+        assertNull(m.denyFor(WORKER_A, Authz.Action.READ, null));
+        assertNull(m.denyFor(WORKER_A, Authz.Action.TASK_READ, null));
+    }
+
     @Test
     void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
         FleetMcp m = mcp(true);
@@ -297,35 +336,53 @@ class FleetMcpAuthzTest {
      * the whole time the defect was live -- the table was right, the action fed to it was wrong.
      */
     @Test
-    void pollingByTargetIsADrainAndPollingByTicketIsARead() {
+    void pollingByTargetIsADrainAndPollingByTicketIsATaskRead() {
         assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b", null),
                 "poll by target removes the replies — that is a drain, not an observation");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, null),
-                "poll by ticket changes nothing");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  ", null),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, null),
+                "poll by ticket changes nothing, but is not the roster-only READ action");
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction("  ", null),
                 "a blank target is an absent target");
     }
 
     /**
      * fleetd #421: a coordId branch is a THIRD operation behind fleet_poll's one name, and it must
-     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ}, even though this
-     * branch also consumes nothing. READ's grant is open to every authenticated role on the premise
-     * that the roster carries no secrets; a lead-to-lead body is not the roster, so folding this
-     * branch into READ would let any worker read every peer lead's mail in full. coordId also takes
-     * priority over target when both happen to be present — it addresses a different inbox entirely.
+     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ} or {@link
+     * Authz.Action#TASK_READ}, even though this branch also consumes nothing. A lead-to-lead body
+     * is not the roster and not a ticket/status read, so folding this branch into either would let
+     * any worker or architect read every peer lead's mail in full. coordId also takes priority over
+     * target when both happen to be present — it addresses a different inbox entirely.
      */
     @Test
-    void pollingByCoordIdIsACoordReadNeverAPlainRead() {
+    void pollingByCoordIdIsACoordReadNeverAPlainOrTaskRead() {
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction(null, "mac-opus"),
-                "reading held peer mail must not be mapped to the everyone-readable READ action");
+                "reading held peer mail must not be mapped to a widely-readable action");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("  ", "mac-opus"),
                 "a blank target must not fall through to READ/DRAIN when coordId is present");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, "  "),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, "  "),
                 "a blank coordId is an absent coordId, same as target/ticket");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("term_b", "mac-opus"),
                 "coordId takes priority over target — this is a different inbox, not a drain");
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one tool name, exactly as {@code fleet_poll}
+     * is (fleetd #669 Unit A). {@link FleetMcp#sendAction} picks the action from the arguments, not
+     * the handler, for the same reason {@link FleetMcp#pollAction} does: a test can assert the
+     * mapping the handler actually uses.
+     */
+    @Test
+    void sendMapsToThreeDifferentActionsByItsArguments() {
+        assertEquals(Authz.Action.SEND, FleetMcp.sendAction(null, null),
+                "a plain delivery, with neither coordId nor turnId, is a local SEND");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", null),
+                "coordId addresses a peer lead over the coordination broker");
+        assertEquals(Authz.Action.ANSWER, FleetMcp.sendAction(null, "turn-1"),
+                "turnId resolves a worker's blocked question");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", "turn-1"),
+                "coordId takes priority over turnId, mirroring sendToLead's own mutual-exclusion check");
+    }
+
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
         // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
@@ -344,16 +401,22 @@ class FleetMcpAuthzTest {
                 () -> tool + " is registered but has no pinned authorization action"));
 
         assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
+        assertEquals(Authz.Action.SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("sessionId", "term_a", "content", "hi")));
+        assertEquals(Authz.Action.COORD_SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("coordId", "mac-opus", "content", "hi")));
+        assertEquals(Authz.Action.ANSWER,
+                FleetMcp.toolAction("fleet_send", Map.of("turnId", "turn-1", "content", "hi")));
         assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
         assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_status", Map.of()));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
         assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
         assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
         assertEquals(Authz.Action.COORD_READ,
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -1,5 +1,8 @@
 package dev.ltms.fleet.rest;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
@@ -18,6 +21,7 @@ import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.session.FakeWorktrees;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.testing.CapturedLog;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -28,10 +32,13 @@ import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Predicate;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -122,12 +129,60 @@ class FleetAppAuthTest {
         assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
         assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
         for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+                "GET /member-credentials")) {
             assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
         }
+        for (String route : Set.of("GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+            assertEquals(Authz.Action.TASK_READ, FleetApp.routeAction(route), route);
+        }
         assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
     }
 
+    /**
+     * fleetd #669 Unit A: {@code POST /sessions/{id}/message} is two call shapes behind one route,
+     * mirroring {@code fleet_send}'s MCP-side split into {@link Authz.Action#SEND} and {@link
+     * Authz.Action#ANSWER} ({@code FleetMcp#sendAction}). The route never carries a {@code coordId}
+     * shape — that peer-lead route is MCP-only — so only these two apply here.
+     */
+    @Test
+    void theMessageRouteIsASendWithNoTurnIdAndAnAnswerWithOne() {
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", null));
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", "  "));
+        assertEquals(Authz.Action.ANSWER, FleetApp.routeAction("POST /sessions/{id}/message", "turn-1"));
+    }
+
+    /**
+     * fleetd #689: {@code answerGatePasses} is the second, conditional gate behind {@code
+     * sendMessage}'s coarse {@link Authz.Action#SEND} check. With the {@code ANSWER} grant denied,
+     * a {@code turnId}-bearing request is refused while a plain one still passes — and the denied
+     * permit is queried only for the {@code turnId} case, never for the plain one, which is what
+     * proves this is a genuinely separate, conditional check rather than the {@code SEND} check
+     * renamed or an unconditional call whose result is ignored. Flipping only the {@code ANSWER}
+     * grant to allowed then flips only the {@code turnId} shape's outcome.
+     */
+    @Test
+    void answerGatePassesOnlyWhenTurnIdAbsentOrAnswerGranted() {
+        List<Authz.Action> queried = new ArrayList<>();
+        Predicate<Authz.Action> denyAnswer = action -> {
+            queried.add(action);
+            return false;
+        };
+
+        assertFalse(FleetApp.answerGatePasses("turn-1", denyAnswer),
+                "ANSWER denied ⇒ the turnId shape is refused");
+        assertEquals(List.of(Authz.Action.ANSWER), queried,
+                "the ANSWER grant, specifically, must be the one consulted");
+
+        queried.clear();
+        assertTrue(FleetApp.answerGatePasses(null, denyAnswer),
+                "no turnId ⇒ the plain shape passes even though ANSWER is denied");
+        assertTrue(FleetApp.answerGatePasses("  ", denyAnswer), "a blank turnId is treated as absent");
+        assertEquals(List.of(), queried, "the plain shape must never consult the permit at all");
+
+        assertTrue(FleetApp.answerGatePasses("turn-1", action -> true),
+                "flipping only the ANSWER grant to allowed flips only the turnId shape's outcome");
+    }
+
     private static Set<String> routesTheServerRegisters() {
         try {
             String source = Files.readString(REST_SOURCE).lines()
@@ -192,6 +247,107 @@ class FleetAppAuthTest {
                 "draining an inbox is the primary's collection step");
     }
 
+    /**
+     * fleetd #669 Unit A: the {@code turnId} shape of {@code POST /sessions/{id}/message} maps to
+     * {@link Authz.Action#ANSWER}, not the plain {@link Authz.Action#SEND} the test above drives —
+     * a worker must stay refused on this shape too, exactly as it was refused on the one undivided
+     * action before the split.
+     */
+    @Test
+    void aWorkerMayNotAnswerAnotherSessionsBlockedQuestionOverRest() throws Exception {
+        int port = start(FakeHerdr.WORKER_PID, false, null);
+
+        assertEquals(403, send(port, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null).statusCode(),
+                "resolving another session's blocked question would be a worker escalating too");
+    }
+
+    /**
+     * fleetd #689: a caller refused the coarse {@link Authz.Action#SEND} grant is refused on
+     * {@code SEND} specifically, even on the {@code turnId}-bearing shape that otherwise raises
+     * the check to {@link Authz.Action#ANSWER} — proving {@code turnId} was never read from the
+     * body before the refusal (reading it would have changed which action is named in the 403).
+     * The same caller refused with no body at all gets the identical detail, which could not hold
+     * if the decision depended on anything read from the body. Control: a caller who IS granted
+     * reaches past the gate and the body is used normally.
+     */
+    @Test
+    void aDeniedCallerIsRefusedOnSendEvenWithATurnIdBodyAndNeverReadsTheBody() throws Exception {
+        int workerPort = start(FakeHerdr.WORKER_PID, false, null); // denied: not primary/architect
+
+        HttpResponse<String> withTurnId = send(workerPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(403, withTurnId.statusCode());
+        assertTrue(withTurnId.body().contains("may not SEND"),
+                "the SEND check must be the one that fired, not ANSWER — ANSWER would only be "
+                        + "reachable by having already read turnId out of the body");
+
+        HttpResponse<String> noBody = send(workerPort, "POST", "/sessions/term_b/message", null, null);
+        assertEquals(403, noBody.statusCode());
+        assertTrue(noBody.body().contains("may not SEND"),
+                "refused identically with no body at all — the refusal cannot depend on body content");
+
+        // Control: a primary IS granted SEND, so the same turnId body is read and acted on —
+        // reaching messages.answer, which reports this unknown turnId as a stale one.
+        int primaryPort = start(999_999, false, null);
+        HttpResponse<String> granted = send(primaryPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(409, granted.statusCode());
+        assertTrue(granted.body().contains("stale_turn"), "a granted caller's body IS read and acted on");
+    }
+
+    /**
+     * fleetd #689 (ticket comment 18353): the only place {@code sendMessage}'s call to {@code
+     * answerGatePasses} is observable is the audit trail — {@code allow()} logs an {@code
+     * "allowed"} entry for every granted action except {@code READ}/{@code METRICS}/{@code
+     * TASK_READ}, and {@code ANSWER} is none of those. A granted {@code turnId} request must
+     * therefore log both a {@code SEND} and an {@code ANSWER} entry; a granted plain request must
+     * log {@code SEND} alone. A unit test of the extracted helper pins the helper; this pins the
+     * call site — deleting the {@code answerGatePasses} call from {@code sendMessage} leaves the
+     * helper's own test green but turns this one red.
+     */
+    @Test
+    void aGrantedTurnIdRequestAuditsBothSendAndAnswerButAPlainRequestAuditsSendAlone() throws Exception {
+        int port = start(999_999, false, null); // primary: granted both SEND and ANSWER
+        ObjectMapper mapper = new ObjectMapper();
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertTrue(allowed.contains("SEND"),
+                    "a turnId request must still clear the coarse SEND grant first");
+            assertTrue(allowed.contains("ANSWER"),
+                    "a turnId request must ALSO clear the ANSWER grant — this is the call site itself");
+        }
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"content\":\"hi\",\"timeoutMs\":50}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertEquals(List.of("SEND"), allowed,
+                    "a plain request must log SEND and nothing else — ANSWER is conditional on "
+                            + "turnId, not something every request happens to log");
+        }
+    }
+
+    private static List<String> allowedActions(CapturedLog audit, ObjectMapper mapper) {
+        return audit.events().stream()
+                .map(ILoggingEvent::getFormattedMessage)
+                .map(line -> {
+                    try {
+                        return mapper.readTree(line);
+                    } catch (Exception e) {
+                        throw new AssertionError("audit line is not valid JSON: " + line, e);
+                    }
+                })
+                .filter(n -> "allowed".equals(n.path("outcome").asText()))
+                .map(n -> n.path("action").asText())
+                .toList();
+    }
+
     // --- token mode ---------------------------------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -675,6 +675,26 @@ class FleetAppTest {
         assertEquals(400, postMessage(port, "{}").statusCode());
     }
 
+    /**
+     * fleetd #689: a body that fails to parse is rejected with 400 before {@code turnId} is ever
+     * read from it, so it reaches neither {@code messages.answer} (which needs a {@code turnId})
+     * nor {@code messages.send} — confirmed here for {@code send} by the fake agent's idle status,
+     * which would otherwise make an immediate {@code agent.prompt} delivery observable.
+     */
+    @Test
+    void malformedBodyReturns400AndNeverReachesSendOrAnswer() throws Exception {
+        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // idle ⇒ send would deliver right away if reached
+        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        HttpResponse<String> res = postMessage(port, "not json at all");
+        assertEquals(400, res.statusCode());
+        JsonNode err = mapper.readTree(res.body());
+        assertEquals("bad_request", err.get("error").asText());
+        assertEquals("body must be JSON", err.get("detail").asText());
+        assertFalse(herdr.called("agent.prompt"),
+                "a malformed body must never reach messages.send's delivery");
+    }
+
     @Test
     void sessionStatusReportsLiveAgentStatus() throws Exception {
         FakeHerdr herdr = new FakeHerdr().agentStatus("blocked");