34 agents could fire, 0 could aim

#3316 · every ork agent could message any of your live sessions by guessed name; none could list them.

Before / after, one bar each

              BEFORE                      AFTER
can SEND      ██████████████████ 34/36    ██████████ 19/36
can SEE       ░░░░░░░░░░░░░░░░░░  0/36    ██████████ 19/36
send blind    ██████████████████ 34       ░░░░░░░░░░  0   ◄ the fix

After: send == see, exactly. Every sender is a foreground agent that can enumerate its targets. No background agent holds the ambient grant — teammates get SendMessage force-granted by CC inside a team, which is the only context where they use it.

Try an agent

Pick any of the 36. The verdict shows its lane and what changed.

Why revoking cannot break a teammate

The verdict that reshaped this fix, from agent-teams.md:

"Team coordination tools such as SendMessage and the task management
 tools are always available to a teammate even when `tools` restricts
 other tools."

Context the agent runs in	tools: has SendMessage?	Can it message?
Agent-Teams teammate	irrelevant	YES — force-granted by CC
Ordinary background run	no (revoked)	NO — the ambient hole, closed
Foreground subagent	yes + ListAgents	YES — addressed, not guessed

So the revocation is surgical by construction: it can only remove the capability in exactly the context where it was unaccountable. A future teammate role for any of the 11 revoked agents still works, because CC re-grants inside a team.

The third layer: cross-machine approval

CC 2.1.225 let SendMessage start conversations with sessions on OTHER machines. Grants alone no longer bound the blast radius.

src/settings/ork.settings.json
+ "isolatePeerMachines": true

Docs: "A true from any settings scope applies, so a checked-in project file can turn the requirement on but not off." A plugin-shipped true is therefore enforceable — every cross-machine send prompts the operator, even in bypassPermissions mode. Verified against cross-session-messaging.md directly, not from an agent's paraphrase.

Defense in depth, assembled

  guess-proof   W2  ListAgents + "address, never guess" prose   19 fg agents
  grant-proof   W1  SendMessage revoked, NO exemptions           15/15 bg agents
  scope-proof   —   teammates: force-grant inside teams only,    4 bg teammates
                    discovery via team config, never the roster
  machine-proof W6  isolatePeerMachines: true                    every session
  rot-proof     W5  invariant test: the RULE, not a file list    agent #37 covered

Plus CC's own built-ins (unchanged, verified in docs): per-sender rate limiting, identical-repeat dropping, 50-message session cap, inbound hold/refuse controls on the receiving side.