messages/authorize
Server → TM round-trip asking for the per-message fan-out verdict. Triggered fromMessageService.sendCommit after the durable insert
lands and before the broadcast. Manifests opt in by declaring
hooks.message_authorize. Failure / timeout in the round-trip
synthesizes a fail-closed Block { reason: "tm_unreachable" }
verdict at the AppHost envelope (mirrors runAuthorizeDispatch’s
wrapHookEffectWithEnvelope posture).
Forward { recipients } MUST be a subset of the conversation’s
participants; the server does not re-fan to non-participants.
Forward { recipients: [] } is legal — message lands in the
sender’s transcript but is delivered to no one else.
Parameters
Branded TaskId
The appId field.
Branded ConversationId
The message field.
The receivedAt field.
The clock field.
Response
The verdict field.