Audit identity & trace-id uniqueness — plan

Design: ../specs/2026-07-08-audit-identity-and-trace-uniqueness-design.md.
TDD; pnpm check + agent pytest green before ship; no deploy without go-ahead.

Part 1 — trace-id uniqueness

1. native-provider.ts — add nonce?: () => string to NativeProviderConfig
   (default crypto.randomUUID); line 77 → `${sessionId}-t${history.length}-${nonce()}`;
   reword the CONVENTIONS comment (72–76).
2. orchestrate.ts — replace turnRequestId with exported
   makeTurnTraceId(req, nonce = () => crypto.randomUUID()); export buildLlms
   (now (req, turnTraceId)) and buildTools; in runOrchestrator compute
   const turnTraceId = makeTurnTraceId(req) once and thread through both;
   reword comment (38–46).
3. Tests: update packages/streams/tests/friendly-errors.test.ts:139; add
   packages/streams/tests/native-provider-traceid.test.ts (uniqueness); add
   apps/public-web/tests/orchestrator/trace-id.test.ts (sharing + decoupling).

Part 2 — identity (X-User-Id)

4. dash/gateway.py (edit internal, copy to public — byte-identical): add
   user_id_var; RequestIdMiddleware seeds it from x-user-id;
   GatewayHeaders._snapshot() injects X-User-Id.
5. dash/agents.py (both, comment-only): replace the # TODO(gateway) block
   with the ContextVar explanation.
6. dash/embedder.py (both, comment-only): note X-User-Id now rides along.
7. tools/data.ts — add userId? param → X-User-Id header.
8. orchestrate.ts buildTools — pass req.sessionId as the DataTool userId.
9. auth/actor-id.ts (new) — opaqueStaffId(email) = staff-<hmac16>.
10. api/dash-proxy/[...path]/route.ts — read verified session, inject
    X-User-Id: opaqueStaffId(email), overriding any client-sent value.
11. Tests: extend test_gateway.py (user_id var + middleware); extend
    data-tool.test.ts (X-User-Id); add orchestrate identity assertion; add
    internal-web actor-id + dash-proxy identity tests.

Gate & ship

• corepack pnpm check (typecheck + suites + check-conventions).
• Agent pytest via scratch venv (agno==2.4.7, openai==2.16.0).
• Completion notes; upload changed .md. Deploy only on explicit go-ahead.