You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[80ad7753] refactor: split canonical_path and identity; strict wire identity without @

- Add canonical_path.rs (tag + item URL normalization) and identity.rs
  (parse_username/parse_agent; reject @ in API input).
- Slim events.rs to event types only; reducer applies no identity rewriting.
- JSON APIs return stored-form usernames and agent ids; HTML keeps @/@@ for display.
- Optional delegate on ingest; CLI and tests use naked uuid:rig:model.

Made-with: Cursor

Side A — unified diff (full patch):
diff --git a/cli/src/main.rs b/cli/src/main.rs
index 5ac8e289f2b7a366b5959d9338d02f9b546f408a..630c5dea1f78c0ec9bc53e6b96234a0dc75bb705 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -61,8 +61,8 @@ enum Command {
         /// Example: --before 2026-06-01
         #[arg(long, value_name = "DATE_OR_MS")]
         before: Option<String>,
-        /// Filter to posts from this actor (UUID prefix match).
-        /// Example: --actor 4d9d6173
+        /// Filter to posts from this principal username (prefix match, stored form).
+        /// Example: --actor alice
         #[arg(long, value_name = "PREFIX")]
         actor: Option<String>,
         /// Fetch a single post by its ingest ID (from --json output).
@@ -75,9 +75,8 @@ enum Command {
     ///
     /// SYNTAX:
     ///
-    /// Actor (required, once per document):
-    ///   @<uuid>:<rig>:<model>
-    ///   Example: @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet
+    /// Identity: human comes from the bearer token; optional AI delegate from `--delegate`
+    /// (`uuid:rig:provider/model`). The document body is DSL only (items, votes, prose) — no `@` lines.
     ///
     /// Thread (required, once per document):
     ///   #thread-tag
@@ -109,7 +108,7 @@ enum Command {
     ///   Example: ~/python > ~/rust { Python's simpler syntax reduces learning curve. }
     ///
     /// Prose (optional, anywhere):
-    ///   Any line that doesn't start with @, #, or ~ is prose.
+    ///   Any line that doesn't start with # or ~ (or `http`) is prose.
     ///   Prose is displayed in thread context but does not affect rankings or items.
     ///   Use prose to write blog posts, reasoning, or notes within your ingest.
     ///
@@ -125,8 +124,7 @@ enum Command {
     /// EXAMPLES:
     ///
     ///   # From heredoc (recommended for agents)
-    ///   npx slugsocial ingest << 'EOF'
-    ///   @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet
+    ///   npx slugsocial ingest --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet' << 'EOF'
     ///   #languages: Python vs Rust for systems programming
     ///
     ///   ~/languages/python { A high-level language with simple syntax and rich ecosystem. }
@@ -153,14 +151,9 @@ enum Command {
         /// Thread identifier (public tag like "languages", without #).
         #[arg(long, env = "SLUG_THREAD", default_value = "public", value_name = "THREAD")]
         thread: String,
-        /// Agent delegate identity (request form), e.g. @@uuid:rig:provider/model
-        #[arg(
-            long,
-            env = "SLUG_DELEGATE",
-            default_value = "@@00000000-0000-0000-0000-000000000000:cli:local/dev",
-            value_name = "DELEGATE"
-        )]
-        delegate: String,
+        /// Agent delegate `uuid:rig:provider/model`. Omit for human-only ingests.
+        #[arg(long, env = "SLUG_DELEGATE", value_name = "DELEGATE")]
+        delegate: Option<String>,
         /// Output as JSON for agent parsing
         #[arg(long)]
         json: bool,
@@ -174,14 +167,9 @@ enum Command {
         /// Thread identifier (public tag like "languages", without #).
         #[arg(long, env = "SLUG_THREAD", default_value = "public", value_name = "THREAD")]
         thread: String,
-        /// Agent delegate identity (request form), e.g. @@uuid:rig:provider/model
-        #[arg(
-            long,
-            env = "SLUG_DELEGATE",
-            default_value = "@@00000000-0000-0000-0000-000000000000:cli:local/dev",
-            value_name = "DELEGATE"
-        )]
-        delegate: String,
+        /// Agent delegate `uuid:rig:provider/model`. Omit for human-only ingests.
+        #[arg(long, env = "SLUG_DELEGATE", value_name = "DELEGATE")]
+        delegate: Option<String>,
         /// Output as JSON for agent parsing
         #[arg(long)]
         json: bool,
@@ -193,10 +181,10 @@ enum Command {
     /// Useful for agents to catch up on activity after a context reset.
     ///
     /// Examples:
-    ///   npx slugsocial feed @<uuid>:<rig>:<model>
-    ///   npx slugsocial feed @<uuid>:<rig>:<model> --since 2026-01-01
+    ///   npx slugsocial feed tommy
+    ///   npx slugsocial feed tommy --since 2026-01-01
     Feed {
-        /// Actor identifier (@uuid:rig:model)
+        /// Principal username (stored form)
         #[arg(value_name = "ACTOR")]
         actor: String,
         /// Override the lower bound. Accepts Unix ms or YYYY-MM-DD.
@@ -455,7 +443,7 @@ fn print_rank_history_response(resp: &slug_types::RankHistoryResponse) {
             label,
         );
         for v in &e.caused_by {
-            println!("    {} {} {} {}", v.a, v.ratio, v.b, v.actor.as_deref().map(|a| format!("  (@{})", a)).unwrap_or_default());
+            println!("    {} {} {} {}", v.a, v.ratio, v.b, v.actor.as_deref().map(|a| format!("  ({})", a)).unwrap_or_default());
             if !v.body.is_empty() {
                 println!("      {}", v.body.lines().next().unwrap_or(&v.body).trim());
             }
@@ -1116,7 +1104,7 @@ async fn main() -> Result<()> {
             IdentityCmd::Start { rig, model, json } => {
                 let client = http_client()?;
                 let uuid = uuid::Uuid::new_v4().to_string();
-                let delegate = format!("@@{}:{}:{}", uuid, rig, model);
+                let delegate = format!("{uuid}:{rig}:{model}");
 
                 let start: PendingSessionStartResponse = expect_json(
                     client
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index cb0faa29b834931e2c2b2f5c174c875e2e2e9346..995ce4a61d29b024c399c656134f541ecfd880cf 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -12,10 +12,8 @@ use tokio::sync::RwLock;
 
 use crate::{
     api::helpers::{api_error, now_ms, sha256_hex},
-    events::{
-        canonicalize_username, validate_agent_format, validate_username,
-        Event, TokenIssued, UserRegistered,
-    },
+    events::{Event, TokenIssued, UserRegistered},
+    identity::{parse_agent, parse_username},
     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
     state::{AppState, PendingSession},
 };
@@ -77,9 +75,9 @@ fn verify_token(reduced: &crate::reducer::ReducerState, bearer: &str) -> Result<
     Ok(username)
 }
 
-fn issue_token_for_user(username: &str) -> (String, TokenIssued, String) {
-    // Returns: (bearer, event, canonical_username)
-    let canonical_user = canonicalize_username(username);
+/// `stored_username` must already be in persisted shape (lowercase slug, no `@`).
+fn issue_token_for_user(stored_username: &str) -> (String, TokenIssued) {
+    let username = stored_username.to_string();
     let token_id = {
         let mut id = String::new();
         let alphabet = b"abcdefghijklmnopqrstuvwxyz0123456789";
@@ -103,13 +101,13 @@ fn issue_token_for_user(username: &str) -> (String, TokenIssued, String) {
     let bearer = format!("slug_{token_id}_{secret}");
     let event = TokenIssued {
         ts: now_ms(),
-        username: canonical_user.clone(),
+        username: username.clone(),
         token_id,
         token_hash,
         salt,
         issued_via: "oauth".to_string(),
     };
-    (bearer, event, canonical_user)
+    (bearer, event)
 }
 
 #[derive(Debug, Deserialize)]
@@ -207,7 +205,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
         s.provider = Some("google".to_string());
         s.provider_id = Some(sub.clone());
         if let Some(username) = existing {
-            let (bearer, token_event, canon_user) = issue_token_for_user(&username);
+            let (bearer, token_event) = issue_token_for_user(&username);
             // append token event
             let ev = Event::TokenIssued(token_event);
             if let Err(err) = state.event_log.append(&ev).await {
@@ -217,7 +215,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
                 let mut reduced = reduced_arc.write().await;
                 reduced.apply_event(ev);
             }
-            s.complete = Some((canon_user, bearer));
+            s.complete = Some((username, bearer));
             return Redirect::temporary(&format!("{public_url}/auth/complete")).into_response();
         }
     }
@@ -251,9 +249,10 @@ pub async fn post_choose_username(
     State(state): State<AppState>,
     Form(form): Form<ChooseUsernameForm>,
 ) -> impl IntoResponse {
-    if let Err(msg) = validate_username(&form.username) {
-        return api_error(StatusCode::BAD_REQUEST, "invalid username", Some(msg)).into_response();
-    }
+    let canon_user = match parse_username(&form.username) {
+        Ok(u) => u,
+        Err(msg) => return api_error(StatusCode::BAD_REQUEST, "invalid username", Some(msg)).into_response(),
+    };
 
     let sessions = pending_sessions(&state);
     let (provider, provider_id, agent) = {
@@ -270,7 +269,7 @@ pub async fn post_choose_username(
         (provider, provider_id, s.agent.clone())
     };
 
-    if let Err(msg) = validate_agent_format(&agent) {
+    if let Err(msg) = parse_agent(&agent) {
         return api_error(StatusCode::BAD_REQUEST, "invalid agent format", Some(msg)).into_response();
     }
 
@@ -280,7 +279,7 @@ pub async fn post_choose_username(
     if reduced.users_by_provider.contains_key(&provider_key) {
         return api_error(StatusCode::CONFLICT, "provider already registered", None).into_response();
     }
-    if reduced.users_by_provider.values().any(|u| u == &canonicalize_username(&form.username)) {
+    if reduced.users_by_provider.values().any(|u| u == &canon_user) {
         drop(reduced);
         return choose_username_error_fragment(&form.session, "that username is taken — try another").into_response();
     }
@@ -288,12 +287,12 @@ pub async fn post_choose_username(
 
     let ur = Event::UserRegistered(UserRegistered {
         ts: now_ms(),
-        username: canonicalize_username(&form.username),
+        username: canon_user.clone(),
         provider: provider.to_lowercase(),
         provider_id: provider_id.clone(),
     });
 
-    let (bearer, ti, canon_user) = issue_token_for_user(&form.username);
+    let (bearer, ti) = issue_token_for_user(&canon_user);
     let ti_ev = Event::TokenIssued(ti);
 
     // Persist events.
@@ -325,15 +324,18 @@ pub async fn post_pending_session(
     State(state): State<AppState>,
     Json(req): Json<PendingSessionStartRequest>,
 ) -> impl IntoResponse {
-    if let Err(msg) = validate_agent_format(&req.agent) {
-        return api_error(StatusCode::BAD_REQUEST, "invalid agent format", Some(msg)).into_response();
-    }
+    let agent_naked = match parse_agent(&req.agent) {
+        Ok(a) => a,
+        Err(msg) => {
+            return api_error(StatusCode::BAD_REQUEST, "invalid agent format", Some(msg)).into_response();
+        }
+    };
     let session = format!("p_{}", uuid::Uuid::new_v4().simple());
     let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
     let login_url = format!("{public_url}/auth/login?session={}", urlencoding::encode(&session));
     let poll_url = format!("/api/v0/pending-session/{}", session);
     let s = PendingSession {
-        agent: req.agent.clone(),
+        agent: agent_naked,
         created_ts: now_ms(),
         provider: None,
         provider_id: None,
@@ -359,7 +361,7 @@ pub async fn get_pending_session(
         return api_error(StatusCode::NOT_FOUND, "unknown session", None).into_response();
     };
     let (complete, user, token) = match &s.complete {
-        Some((u, t)) => (true, Some(format!("@{}", u)), Some(t.clone())),
+        Some((u, t)) => (true, Some(u.clone()), Some(t.clone())),
         None => (false, None, None),
     };
     Json(PendingSessionPollResponse {
@@ -388,7 +390,7 @@ pub async fn get_whoami(State(state): State<AppState>, headers: HeaderMap) -> im
     };
     let agents_bound = reduced.agent_bindings.values().filter(|u| *u == &username).count();
     Json(WhoamiResponse {
-        user: format!("@{}", username),
+        user: username,
         agents_bound,
     })
     .into_response()
diff --git a/server/src/api/feed.rs b/server/src/api/feed.rs
index f665d34aef12f2bd6e71d1fb4a3d0b4d509aa775..983b7397a846bd540b6baf3773dd54c55ade4c45 100644
--- a/server/src/api/feed.rs
+++ b/server/src/api/feed.rs
@@ -1,11 +1,12 @@
 use axum::{
     extract::{Query, State},
+    http::StatusCode,
     response::IntoResponse,
     Json,
 };
 use serde::Deserialize;
 
-use crate::{events::canonicalize_username, state::AppState};
+use crate::{api::helpers::api_error, identity::parse_username, state::AppState};
 
 // ============================================================================
 // Feed -- global reverse-chronological ingest stream since a cutoff
@@ -32,7 +33,12 @@ pub async fn get_feed(
 
     let reduced_arc = state.reduced.clone();
     let reduced = reduced_arc.read().await;
-    let actor = canonicalize_username(&q.actor);
+    let actor = match parse_username(&q.actor) {
+        Ok(u) => u,
+        Err(msg) => {
+            return api_error(StatusCode::BAD_REQUEST, "invalid actor", Some(msg)).into_response();
+        }
+    };
     let since = q.since.or_else(|| reduced.actor_last_post_ts.get(&actor).copied());
     let cutoff = since.unwrap_or(0);
     let limit = q.limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);
@@ -65,7 +71,7 @@ pub async fn get_feed(
         .collect();
 
     Json(slug_types::FeedResponse {
-        actor: format!("@{}", actor),
+        actor,
         since,
         posts,
         total,
diff --git a/server/src/api/forum.rs b/server/src/api/forum.rs
index cf134e97a3aa9f2cea5efcf5bfa2564b9fc2ea46..ab6f3ec4936979fed9b3a9c47bef609610c751dd 100644
--- a/server/src/api/forum.rs
+++ b/server/src/api/forum.rs
@@ -8,7 +8,8 @@ use serde::Deserialize;
 use slug_types::*;
 
 use crate::{
-    events::canonicalize_tag,
+    canonical_path::canonicalize_tag,
+    identity::parse_username,
     state::AppState,
 };
 
@@ -46,7 +47,7 @@ pub struct ThreadDetailQuery {
     pub since: Option<i64>,
     /// Only posts strictly before this Unix ms timestamp.
     pub before: Option<i64>,
-    /// Filter to posts whose actor starts with this prefix (UUID prefix or full actor string).
+    /// Filter to posts whose principal username starts with this prefix (stored form, no `@`).
     pub actor: Option<String>,
     /// Return the single post with this ingest ID.
     pub post_id: Option<String>,
@@ -56,6 +57,13 @@ pub struct ThreadDetailQuery {
 pub async fn get_thread(State(state): State<AppState>, Query(q): Query<ThreadDetailQuery>) -> impl IntoResponse {
     let reduced_arc = state.reduced.clone();
     let tag = canonicalize_tag(&q.tag);
+    let actor_prefix = match q.actor.as_deref().map(str::trim) {
+        None | Some("") => String::new(),
+        Some(s) => match parse_username(s) {
+            Ok(u) => u,
+            Err(msg) => return api_error(StatusCode::BAD_REQUEST, "invalid actor filter", Some(msg)).into_response(),
+        },
+    };
     let reduced = reduced_arc.read().await;
 
     // Single post lookup by ingest ID -- return full body untruncated.
@@ -72,7 +80,7 @@ pub async fn get_thread(State(state): State<AppState>, Query(q): Query<ThreadDet
                     id: ing.id.clone(),
                     index: idx,
                     ts: ing.ts,
-                    actor: format!("@{}", ing.principal),
+                    actor: ing.principal.clone(),
                     body: ing.raw.clone(),
                     truncated: false,
                 }],
@@ -92,7 +100,6 @@ pub async fn get_thread(State(state): State<AppState>, Query(q): Query<ThreadDet
         .map(|q| q.iter().rev().cloned().collect())
         .unwrap_or_default();
 
-    let actor_prefix = q.actor.as_deref().unwrap_or("").to_lowercase();
     let filtered: Vec<(usize, _)> = all_ids
         .into_iter()
         .enumerate()
@@ -119,7 +126,7 @@ pub async fn get_thread(State(state): State<AppState>, Query(q): Query<ThreadDet
                 id: ing.id.clone(),
                 index: idx,
                 ts: ing.ts,
-                actor: format!("@{}", ing.principal),
+                actor: ing.principal.clone(),
                 body,
                 truncated,
             }
diff --git a/server/src/api/garden.rs b/server/src/api/garden.rs
index 137f43f26a1983224fd0fa66ae71301626fb9762..ca0e9e735b8e02e31075ffb77d99941129a045f0 100644
--- a/server/src/api/garden.rs
+++ b/server/src/api/garden.rs
@@ -9,7 +9,7 @@ use slug_types::*;
 use std::collections::HashSet;
 
 use crate::{
-    events::canonicalize_item,
+    canonical_path::canonicalize_item,
     path_types::CanonicalItemUrl,
     state::AppState,
 };
@@ -160,7 +160,7 @@ pub async fn get_recent_votes(
             a: v.a.as_str().to_string(),
             b: v.b.as_str().to_string(),
             ratio: format!("{}:{}", v.ratio_left, v.ratio_right),
-            actor: Some(format!("@{}", v.principal)),
+            actor: Some(v.principal.clone()),
             body: v.body.clone(),
             thread: Some(v.thread_id.clone()),
         }).collect();
@@ -207,7 +207,7 @@ pub async fn get_matchup(
                     a: v.a.as_str().to_string(),
                     b: v.b.as_str().to_string(),
                     ratio: format!("{}:{}", v.ratio_left, v.ratio_right),
-                    actor: Some(format!("@{}", v.principal)),
+                    actor: Some(v.principal.clone()),
                     body: v.body.clone(),
                     thread: Some(v.thread_id.clone()),
                 })
diff --git a/server/src/api/helpers.rs b/server/src/api/helpers.rs
index 41b496fcd79948a0e86c286704ed4c062b338e6c..a16c3df6f9d8eaa2e587f5575b78660880062f81 100644
--- a/server/src/api/helpers.rs
+++ b/server/src/api/helpers.rs
@@ -8,7 +8,7 @@ use slug_types::*;
 use std::collections::HashMap;
 
 use crate::{
-    events::canonicalize_item,
+    canonical_path::canonicalize_item,
     path_types::CanonicalItemUrl,
     ranking::connected_components_from_voted_pairs,
     reducer::ReducerState,
diff --git a/server/src/api/ingest.rs b/server/src/api/ingest.rs
index 76ad8efd802b67f3fdf0f3d306830a68736cb384..5a58754bae8ed5f7ae9ce89e659a61de81c1bc01 100644
--- a/server/src/api/ingest.rs
+++ b/server/src/api/ingest.rs
@@ -9,11 +9,10 @@ use slug_types::*;
 use std::collections::{HashMap, HashSet};
 
 use crate::{
+    canonical_path::canonicalize_tag,
     dsl,
-    events::{
-        canonicalize_agent, canonicalize_tag, canonicalize_username, validate_agent_format,
-        AgentBound, Event, Ingest, ThreadCapability, ThreadVisibility,
-    },
+    events::{AgentBound, Event, Ingest, ThreadCapability, ThreadVisibility},
+    identity::parse_agent,
     path_types::CanonicalItemUrl,
     reducer::{ReducerState, ScopeId},
     state::AppState,
@@ -238,11 +237,18 @@ pub async fn post_ingest(
     let event_log = state.event_log.clone();
     let reduced = reduced_arc.read().await;
 
-    if let Err(msg) = validate_agent_format(&req.delegate) {
-        drop(reduced);
-        return api_error(StatusCode::BAD_REQUEST, "invalid delegate format", Some(msg)).into_response();
-    }
-    let delegate = canonicalize_agent(&req.delegate);
+    let delegate: Option<String> = match &req.delegate {
+        None => None,
+        Some(s) if s.trim().is_empty() => None,
+        Some(s) => match parse_agent(s) {
+            Ok(d) => Some(d),
+            Err(msg) => {
+                drop(reduced);
+                return api_error(StatusCode::BAD_REQUEST, "invalid delegate format", Some(msg))
+                    .into_response();
+            }
+        },
+    };
     let thread_id = canonicalize_tag(&req.thread);
 
     let principal = match verify_bearer_principal(&headers, &reduced) {
@@ -290,36 +296,43 @@ pub async fn post_ingest(
         }
     }
 
-    match reduced.agent_bindings.get(&delegate) {
-        Some(u) if u != &principal => {
-            drop(reduced);
-            return api_error(
-                StatusCode::FORBIDDEN,
-                "delegate already bound to another user",
-                None,
-            )
-            .into_response();
+    if let Some(ref d) = delegate {
+        match reduced.agent_bindings.get(d) {
+            Some(u) if u != &principal => {
+                drop(reduced);
+                return api_error(
+                    StatusCode::FORBIDDEN,
+                    "delegate already bound to another user",
+                    None,
+                )
+                .into_response();
+            }
+            _ => {}
         }
-        _ => {}
     }
-    let need_agent_bind = reduced.agent_bindings.get(&delegate).is_none();
+    let need_agent_bind = delegate
+        .as_ref()
+        .map(|d| reduced.agent_bindings.get(d).is_none())
+        .unwrap_or(false);
     drop(reduced);
 
     let mut events_appended: usize = 0;
 
     if need_agent_bind {
-        let ab = Event::AgentBound(AgentBound {
-            ts: now_ms(),
-            agent: delegate.clone(),
-            username: principal.clone(),
-        });
-        if let Err(err) = event_log.append(&ab).await {
-            return api_error(StatusCode::INTERNAL_SERVER_ERROR, format!("{err}"), None);
-        }
-        events_appended += 1;
-        {
-            let mut reduced = reduced_arc.write().await;
-            reduced.apply_event(ab);
+        if let Some(agent_id) = delegate.clone() {
+            let ab = Event::AgentBound(AgentBound {
+                ts: now_ms(),
+                agent: agent_id,
+                username: principal.clone(),
+            });
+            if let Err(err) = event_log.append(&ab).await {
+                return api_error(StatusCode::INTERNAL_SERVER_ERROR, format!("{err}"), None);
+            }
+            events_appended += 1;
+            {
+                let mut reduced = reduced_arc.write().await;
+                reduced.apply_event(ab);
+            }
         }
     }
 
@@ -413,12 +426,18 @@ pub async fn post_check(
     };
     drop(reduced);
 
-    if let Err(msg) = validate_agent_format(&req.delegate) {
-        return api_error(StatusCode::BAD_REQUEST, "invalid delegate format", Some(msg)).into_response();
-    }
-    let delegate = canonicalize_agent(&req.delegate);
+    let delegate: Option<String> = match &req.delegate {
+        None => None,
+        Some(s) if s.trim().is_empty() => None,
+        Some(s) => match parse_agent(s) {
+            Ok(d) => Some(d),
+            Err(msg) => {
+                return api_error(StatusCode::BAD_REQUEST, "invalid delegate format", Some(msg)).into_response();
+            }
+        },
+    };
     let thread_id = canonicalize_tag(&req.thread);
-    let principal = canonicalize_username("placeholder");
+    let principal = "placeholder".to_string();
 
     let event = Event::Ingest(Ingest {
         ts: v.ts,
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index f1d5c139b875c268cc46c3085c332d8de31b092e..f42e907775645166c60aeae2d98c5855223a71be 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -65,7 +65,7 @@ mod tests {
             id: format!("test-{ts}"),
             raw: raw.to_string(),
             principal: "test".to_string(),
-            delegate: "@00000000-0000-0000-0000-000000000000:test:local/test".to_string(),
+            delegate: Some("00000000-0000-0000-0000-000000000000:test:local/test".to_string()),
             thread_id: "t".to_string(),
         }));
     }
diff --git a/server/src/api/rank.rs b/server/src/api/rank.rs
index 059095bb512096da5e9699ff9c4b92cb7de7fa1c..f2d348280ec4d70a32044601964cb5dc9382d9d7 100644
--- a/server/src/api/rank.rs
+++ b/server/src/api/rank.rs
@@ -226,7 +226,7 @@ pub async fn get_rank_history(
     let reduced = reduced_arc.read().await;
     let content = reduced.public();
 
-    let item_str = crate::events::canonicalize_item(&q.item);
+    let item_str = crate::canonical_path::canonicalize_item(&q.item);
     let item = CanonicalItemUrl(item_str.clone());
 
     let entries = content.rank_history.get(&item).cloned().unwrap_or_default();
@@ -238,15 +238,15 @@ pub async fn get_rank_history(
             .map(|doc| {
                 doc.statements.into_iter().filter_map(|s| {
                     if let crate::dsl::Stmt::Vote { item1, item2, ratio_left, ratio_right, explanation } = s {
-                        let a = crate::events::canonicalize_item(&item1);
-                        let b = crate::events::canonicalize_item(&item2);
+                        let a = crate::canonical_path::canonicalize_item(&item1);
+                        let b = crate::canonical_path::canonicalize_item(&item2);
                         if a == item_str || b == item_str {
                             Some(VoteRow {
                                 ts: e.ts,
                                 a: item_path_for_api(&a),
                                 b: item_path_for_api(&b),
                                 ratio: format!("{}:{}", ratio_left, ratio_right),
-                                actor: reduced.ingests_by_id.get(&e.post_id).map(|ing| format!("@{}", ing.principal)),
+                                actor: reduced.ingests_by_id.get(&e.post_id).map(|ing| ing.principal.clone()),
                                 body: explanation,
                                 thread: Some(format!("#{}", e.thread)),
                             })
diff --git a/server/src/api/search.rs b/server/src/api/search.rs
index 8028c3117b9b22460fb9677ca969741f6849d2d0..87621e6e4210a28c7802bb941200788f28518940 100644
--- a/server/src/api/search.rs
+++ b/server/src/api/search.rs
@@ -119,7 +119,7 @@ pub async fn get_search(
                 .unwrap_or_else(|| "#unknown".to_string());
             scored_posts.push((score, ingest.ts, slug_types::SearchPostHit {
                 thread,
-                actor: format!("@{}", ingest.principal),
+                actor: ingest.principal.clone(),
                 snippet: snippet_around(&ingest.raw, &words, 160),
                 ts: ingest.ts,
             }));
diff --git a/server/src/api/thread.rs b/server/src/api/thread.rs
index 576b0b5be2767b0c6cba5e0701e4ffc9f215029d..be6ef446e316fef352a7eef5b35b40583dca4442 100644
--- a/server/src/api/thread.rs
+++ b/server/src/api/thread.rs
@@ -8,9 +8,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     api::helpers::{api_error, now_ms},
-    events::{
-        canonicalize_username, Event, GrantAdded, ThreadCapability, ThreadCreated, ThreadVisibility,
-    },
+    events::{Event, GrantAdded, ThreadCapability, ThreadCreated, ThreadVisibility},
+    identity::parse_username,
     state::AppState,
 };
 use super::auth::verify_bearer_principal;
@@ -150,10 +149,10 @@ pub async fn post_thread_grants(
         return api_error(StatusCode::FORBIDDEN, "requires Manage capability", None).into_response();
     }
 
-    let target = canonicalize_username(&req.username);
-    if target.is_empty() {
-        return api_error(StatusCode::BAD_REQUEST, "invalid username", None).into_response();
-    }
+    let target = match parse_username(&req.username) {
+        Ok(u) => u,
+        Err(msg) => return api_error(StatusCode::BAD_REQUEST, "invalid username", Some(msg)).into_response(),
+    };
     if !reduced.users_by_provider.values().any(|u| u == &target) {
         return api_error(StatusCode::NOT_FOUND, format!("user @{target} not found"), None).into_response();
     }
diff --git a/server/src/canonical_path.rs b/server/src/canonical_path.rs
new file mode 100644
index 0000000000000000000000000000000000000000..5c0febe883d8b3978a25896ed0d71df8509a8717
--- /dev/null
+++ b/server/src/canonical_path.rs
@@ -0,0 +1,92 @@
+//! Normalization for thread tags and ontology item URLs (DSL ↔ stored canonical form).
+//! Not event types — see `events` and `path_types`.
+
+/// Thread / public tag: stored without leading `#`, lowercase.
+pub fn canonicalize_tag(input: &str) -> String {
+    input.trim().trim_start_matches('#').to_lowercase()
+}
+
+/// Ontology item reference → canonical absolute URL on the slug host.
+pub fn canonicalize_item(input: &str) -> String {
+    let s = input.trim();
+    if s.is_empty() {
+        return String::new();
+    }
+
+    if let Some(rest) = s.strip_prefix("https://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let host = host.trim().to_lowercase();
+        if tail.is_empty() {
+            return format!("https://{}", host);
+        } else {
+            return format!("https://{}/{}", host, tail);
+        }
+    }
+    if let Some(rest) = s.strip_prefix("http://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let host = host.trim().to_lowercase();
+        if tail.is_empty() {
+            return format!("http://{}", host);
+        } else {
+            return format!("http://{}/{}", host, tail);
+        }
+    }
+
+    let is_tilde = s.starts_with("~/");
+    let rest = s.strip_prefix("~/").or_else(|| s.strip_prefix("/")).unwrap_or(s);
+
+    let tail = rest
+        .split('/')
+        .filter_map(|seg| {
+            let t = seg.trim();
+            if t.is_empty() {
+                None
+            } else {
+                Some(t.to_lowercase())
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("/");
+
+    if is_tilde {
+        format!("https://slug.social/~/{}", tail)
+    } else if tail.is_empty() {
+        "https://slug.social".to_string()
+    } else {
+        format!("https://slug.social/{}", tail)
+    }
+}
+
+pub fn item_path_segments(input: &str) -> Vec<String> {
+    let canonical = canonicalize_item(input);
+    if canonical.is_empty() {
+        return vec![];
+    }
+
+    if let Some(rest) = canonical.strip_prefix("https://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let mut out = vec![format!("https://{}", host)];
+        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
+        return out;
+    }
+    if let Some(rest) = canonical.strip_prefix("http://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let mut out = vec![format!("http://{}", host)];
+        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
+        return out;
+    }
+
+    canonical
+        .split('/')
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string())
+        .collect()
+}
+
+pub fn item_parent_path(input: &str) -> Option<String> {
+    let segs = item_path_segments(input);
+    if segs.len() <= 1 {
+        return None;
+    }
+    Some(segs[..segs.len() - 1].join("/"))
+}
diff --git a/server/src/events.rs b/server/src/events.rs
index 7775e59974a521f5fea9361a600802898d05c6ab..26edac7505ce4e67a042a5511113efba5fea4950 100644
--- a/server/src/events.rs
+++ b/server/src/events.rs
@@ -1,150 +1,5 @@
 use serde::{Deserialize, Serialize};
 
-/// Canonical identifiers stored without sigils.
-/// - tags are stored without leading '#'
-/// - items are stored without leading '/'
-pub fn canonicalize_tag(input: &str) -> String {
-    input.trim().trim_start_matches('#').to_lowercase()
-}
-
-pub fn canonicalize_item(input: &str) -> String {
-    let s = input.trim();
-    if s.is_empty() {
-        return String::new();
-    }
-
-    if let Some(rest) = s.strip_prefix("https://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let host = host.trim().to_lowercase();
-        if tail.is_empty() {
-            return format!("https://{}", host);
-        } else {
-            return format!("https://{}/{}", host, tail);
-        }
-    }
-    if let Some(rest) = s.strip_prefix("http://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let host = host.trim().to_lowercase();
-        if tail.is_empty() {
-            return format!("http://{}", host);
-        } else {
-            return format!("http://{}/{}", host, tail);
-        }
-    }
-
-    let is_tilde = s.starts_with("~/");
-    let rest = s.strip_prefix("~/").or_else(|| s.strip_prefix("/")).unwrap_or(s);
-
-    let tail = rest
-        .split('/')
-        .filter_map(|seg| {
-            let t = seg.trim();
-            if t.is_empty() {
-                None
-            } else {
-                Some(t.to_lowercase())
-            }
-        })
-        .collect::<Vec<_>>()
-        .join("/");
-
-    if is_tilde {
-        format!("https://slug.social/~/{}", tail)
-    } else if tail.is_empty() {
-        "https://slug.social".to_string()
-    } else {
-        format!("https://slug.social/{}", tail)
-    }
-}
-
-pub fn item_path_segments(input: &str) -> Vec<String> {
-    let canonical = canonicalize_item(input);
-    if canonical.is_empty() {
-        return vec![];
-    }
-
-    if let Some(rest) = canonical.strip_prefix("https://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let mut out = vec![format!("https://{}", host)];
-        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
-        return out;
-    }
-    if let Some(rest) = canonical.strip_prefix("http://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let mut out = vec![format!("http://{}", host)];
-        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
-        return out;
-    }
-
-    // Should be unreachable since all canonical items are now URLs
-    canonical
-        .split('/')
-        .filter(|s| !s.is_empty())
-        .map(|s| s.to_string())
-        .collect()
-}
-
-pub fn item_parent_path(input: &str) -> Option<String> {
-    let segs = item_path_segments(input);
-    if segs.len() <= 1 {
-        return None;
-    }
-    Some(segs[..segs.len() - 1].join("/"))
-}
-
-/// Canonical username stored without leading '@'.
-pub fn canonicalize_username(input: &str) -> String {
-    input.trim().trim_start_matches('@').to_lowercase()
-}
-
-/// Validate username: lowercase alphanumeric + '-' '_' only; length 1-32.
-pub fn validate_username(username: &str) -> Result<(), String> {
-    let u = canonicalize_username(username);
-    if u.is_empty() || u.len() > 32 {
-        return Err("username must be 1-32 characters".to_string());
-    }
-    if !u
-        .chars()
-        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_')
-    {
-        return Err("username must be lowercase alphanumeric with '-' or '_' only".to_string());
-    }
-    Ok(())
-}
-
-/// Canonical agent identity stored with single leading '@'.
-///
-/// Request/display form is `@@uuid:rig:provider/model` but we store `@uuid:rig:provider/model`.
-pub fn canonicalize_agent(input: &str) -> String {
-    let s = input.trim();
-    let s = s.strip_prefix("@@").or_else(|| s.strip_prefix('@')).unwrap_or(s);
-    format!("@{}", s.to_lowercase())
-}
-
-/// Validate agent format: @@<uuid-v4>:<rig>:<provider/model>
-pub fn validate_agent_format(agent: &str) -> Result<(), String> {
-    let a = agent.trim();
-    if !a.starts_with("@@") && !a.starts_with('@') {
-        return Err("agent must start with @@".to_string());
-    }
-    let a = a.strip_prefix("@@").or_else(|| a.strip_prefix('@')).unwrap_or(a);
-    let parts: Vec<&str> = a.split(':').collect();
-    if parts.len() != 3 {
-        return Err("agent must be @@<uuid>:<rig>:<provider/model>".to_string());
-    }
-    let (uuid_part, rig_part, model_part) = (parts[0], parts[1], parts[2]);
-    if uuid::Uuid::parse_str(uuid_part).is_err() {
-        return Err("agent uuid must be a valid UUID v4".to_string());
-    }
-    if rig_part.trim().is_empty() {
-        return Err("agent rig must be non-empty".to_string());
-    }
-    if !model_part.contains('/') {
-        return Err("agent model must be <provider/model>".to_string());
-    }
-    Ok(())
-}
-
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ThreadVisibility {
@@ -236,10 +91,11 @@ pub struct Ingest {
     pub id: String,
     /// Raw DSL+prose body only (no identity/routing metadata).
     pub raw: String,
-    /// Human principal username (no leading '@').
+    /// Human principal username (wire and storage: no `@`).
     pub principal: String,
-    /// Delegate agent identity (canonical stored with single leading '@').
-    pub delegate: String,
+    /// AI delegate id `uuid:rig:model` (wire and storage: no `@`). Omitted when absent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub delegate: Option<String>,
     /// Thread identifier: public tag (e.g. "languages") or private id/slug (e.g. "a7f2k9x/project-review").
     pub thread_id: String,
 }
@@ -247,5 +103,3 @@ pub struct Ingest {
 fn generate_id() -> String {
     uuid::Uuid::new_v4().to_string()
 }
-
-
diff --git a/server/src/html/editor.rs b/server/src/html/editor.rs
index 1d2c4be7eef4cc437cacddd0949307895f3ef018..4f206a0a895b47592df7669cd8d2fb4d83286fe7 100644
--- a/server/src/html/editor.rs
+++ b/server/src/html/editor.rs
@@ -33,7 +33,7 @@ pub async fn editor_page() -> impl IntoResponse {
             p class="muted" { "write DSL, see what happens. nothing is saved." }
             div class="editor-container" {
                 textarea id="editor-input" rows="12" cols="80"
-                    placeholder="@your-uuid:rig:provider/model\n#your-thread\n\n~/path/item-a { description }\n~/path/item-b { description }\n\n~/path/item-a 3:1 ~/path/item-b { reasoning }"
+                    placeholder="your-uuid:rig:provider/model\n#your-thread\n\n~/path/item-a { description }\n~/path/item-b { description }\n\n~/path/item-a 3:1 ~/path/item-b { reasoning }"
                     autocomplete="off" autofocus {}
                 div id="editor-status" class="muted" { "type to check…" }
                 div id="editor-results" {}
@@ -110,7 +110,7 @@ pub async fn editor_check(
                 id: uuid::Uuid::new_v4().to_string(),
                 raw: form.text.clone(),
                 principal: String::new(),
-                delegate: String::new(),
+                delegate: None,
                 thread_id: String::new(),
             });
             let mut simulated = { reduced_arc.read().await.clone() };
diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs
index d40cc6398aaf3b2348d91498b5b3a80ed593e55c..a4e17ddf0064b08dfa221c964ccaa0eb99948b5b 100644
--- a/server/src/html/forum.rs
+++ b/server/src/html/forum.rs
@@ -7,14 +7,14 @@ use serde::Deserialize;
 use maud::{html, Markup};
 
 use crate::{
-    events::canonicalize_tag,
+    canonical_path::canonicalize_tag,
     reducer::ReducerState,
     state::AppState,
     timeago,
 };
 
 use super::{
-    actor_label, bc_threads, cli_panel, layout, now_ms,
+    authorship_address, bc_threads, cli_panel, layout, now_ms,
     recency_class, render_linkified_with_embeds,
 };
 
@@ -260,7 +260,7 @@ pub async fn thread_post_view(
                 @let ago = timeago::timeago(now, ing.ts);
                 div class="ingest-entry" data-ingest-id=(ing.id) {
                     div class="ingest-meta muted" title=(hover) {
-                        span class="address" { "@" (actor_label(&ing.delegate)) }
+                        span class="address" { (authorship_address(&ing.principal, &ing.delegate)) }
                         " · "
                         (ago)
                     }
diff --git a/server/src/html/garden.rs b/server/src/html/garden.rs
index bddd90aa6eb288c0c97bb08f472e2934fd2fe67a..dcd7f0d4a2d7b602026b643c564d212cb084ff9f 100644
--- a/server/src/html/garden.rs
+++ b/server/src/html/garden.rs
@@ -5,7 +5,7 @@ use axum::{
 use maud::html;
 
 use crate::{
-    events::canonicalize_item,
+    canonical_path::canonicalize_item,
     path_types::CanonicalItemUrl,
     ranking::{connected_components_from_voted_pairs, ranked_items_subset},
     scope_rank::{build_children_rankings, ChildrenRankings},
@@ -14,7 +14,7 @@ use crate::{
 };
 
 use super::{
-    actor_label, bc_path, cli_panel, layout, now_ms, ratio_pct, render_linkified_with_embeds,
+    authorship_address, bc_path, cli_panel, layout, now_ms, ratio_pct, render_linkified_with_embeds,
     breadcrumb_path::OntologyPath,
 };
 
@@ -204,8 +204,8 @@ fn build_rank_history(
             .map(|doc| {
                 doc.statements.into_iter().filter_map(|s| {
                     if let crate::dsl::Stmt::Vote { item1, item2, ratio_left, ratio_right, explanation } = s {
-                        let a_str = crate::events::canonicalize_item(&item1);
-                        let b_str = crate::events::canonicalize_item(&item2);
+                        let a_str = crate::canonical_path::canonicalize_item(&item1);
+                        let b_str = crate::canonical_path::canonicalize_item(&item2);
                         if a_str == item || b_str == item {
                             Some(crate::reducer::VoteData {
                                 ts: e.ts,
@@ -216,9 +216,7 @@ fn build_rank_history(
                                 principal: reduced.ingests_by_id.get(&e.post_id)
                                     .map(|ing| ing.principal.clone())
                                     .unwrap_or_default(),
-                                delegate: reduced.ingests_by_id.get(&e.post_id)
-                                    .map(|ing| ing.delegate.clone())
-                                    .unwrap_or_default(),
+                                delegate: reduced.ingests_by_id.get(&e.post_id).and_then(|ing| ing.delegate.clone()),
                                 thread_id: e.thread.clone(),
                             })
                         } else { None }
@@ -331,7 +329,7 @@ async fn render_scope_view(state: AppState, path: OntologyPath) -> axum::respons
                             @let right_class = if v.b.as_str() == model.item { "ratio-right current" } else { "ratio-right" };
                             div class="ont-vote-entry" {
                                 div class="ont-vote-meta" title=(hover) {
-                                    span class="address" { "@" (actor_label(&v.delegate)) }
+                                    span class="address" { (authorship_address(&v.principal, &v.delegate)) }
                                     " · "
                                     (ago)
                                 }
@@ -482,7 +480,7 @@ mod tests {
             id: format!("ing-{ts}"),
             raw: raw.to_string(),
             principal: "testuser".to_string(),
-            delegate: "@00000000-0000-0000-0000-000000000000:test:local/test".to_string(),
+            delegate: Some("00000000-0000-0000-0000-000000000000:test:local/test".to_string()),
             thread_id: String::new(),
         }));
     }
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 8b48a25cce79f0eefc7e29849e1a667cae4c7986..82c5993fabfeaf2ea8b9034bccaef37924100264 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -238,9 +238,9 @@ pub(super) fn bc_threads(thread_tag: Option<&str>) -> Markup {
     }
 }
 
-/// Input is canonicalized without leading '@' (usually uuid:rig:provider/model).
-pub(super) fn actor_label(actor: &str) -> String {
-    let a = actor.trim_start_matches('@').trim();
+/// Short display label for a stored agent id (`uuid:rig:model`, no `@`).
+pub(super) fn actor_label(agent_naked: &str) -> String {
+    let a = agent_naked.trim();
     let parts: Vec<&str> = a.split(':').collect();
     if parts.len() >= 3 {
         let rig = parts[1].trim();
@@ -258,6 +258,13 @@ pub(super) fn actor_label(actor: &str) -> String {
     a.to_string()
 }
 
+/// HTML attribution only: human `@name`, or agent `@@uuid8:rig:model` when a delegate is present.
+pub(super) fn authorship_address(principal: &str, delegate: &Option<String>) -> String {
+    match delegate {
+        Some(d) => format!("@@{}", actor_label(d)),
+        None => format!("@{}", principal),
+    }
+}
 
 /// Escape HTML special chars for safe injection.
 fn escape_html(s: &str) -> String {
diff --git a/server/src/html/search.rs b/server/src/html/search.rs
index f56f31546b4870d41e594d0e3ac2a4b50ba831b8..df5cb0a59ff72956f4bc94e53b86ab8337452817 100644
--- a/server/src/html/search.rs
+++ b/server/src/html/search.rs
@@ -11,7 +11,7 @@ use crate::{
     timeago,
 };
 
-use super::{actor_label, bc_segment, cli_panel, layout, now_ms};
+use super::{authorship_address, bc_segment, cli_panel, layout, now_ms};
 
 /// Escape HTML special chars for safe injection.
 fn escape_html(s: &str) -> String {
@@ -44,7 +44,8 @@ struct ThreadRow {
 
 struct PostRow {
     thread: String,
-    actor: String,
+    /// Pre-formatted attribution string for display (includes `@` / `@@` from `authorship_address`).
+    actor_display: String,
     text: String,
     ts: i64,
 }
@@ -151,7 +152,7 @@ fn search(state: &ReducerState, q: &str, limit: usize) -> SearchResults {
                 .unwrap_or_else(|| "unknown".to_string());
             scored_posts.push((score, PostRow {
                 thread,
-                actor: ingest.principal.clone(),
+                actor_display: authorship_address(&ingest.principal, &ingest.delegate),
                 text: ingest.raw.clone(),
                 ts: ingest.ts,
             }));
@@ -321,7 +322,7 @@ fn render_search_results(results: &SearchResults, query: &str) -> Markup {
                             li {
                                 div class="search-post-meta muted" {
                                     a href=(format!("/t/{}", r.thread)) { "#" (r.thread) }
-                                    " · " (actor_label(&r.actor))
+                                    " · " (r.actor_display)
                                     " · " (timeago::timeago(now, r.ts))
                                 }
                                 div class="search-snippet" {
diff --git a/server/src/html/tree.rs b/server/src/html/tree.rs
index 568a08edbb548291ab6f03b46c79cdcb4b432468..339f69af3b3279918a97b1dced62e4e3e0b528e3 100644
--- a/server/src/html/tree.rs
+++ b/server/src/html/tree.rs
@@ -13,7 +13,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::BTreeSet;
 
 use crate::{
-    events::canonicalize_item,
+    canonical_path::canonicalize_item,
     path_types::{CanonicalItemUrl, RelativePath},
     scope_rank::ChildrenRankings,
     state::AppState,
@@ -702,7 +702,8 @@ pub async fn tree_select(
 mod tests {
     use super::*;
 
-    use crate::events::{canonicalize_item, Event, Ingest};
+    use crate::canonical_path::canonicalize_item;
+    use crate::events::{Event, Ingest};
     use crate::reducer::ReducerState;
 
     fn ingest(raw: &str) -> Event {
@@ -711,7 +712,7 @@ mod tests {
             id: "test-ingest".to_string(),
             raw: raw.to_string(),
             principal: "tester".to_string(),
-            delegate: String::new(),
+            delegate: None,
             thread_id: String::new(),
         })
     }
@@ -789,9 +790,9 @@ mod tests {
     fn reducer_parent_key_for_tilde_items_is_without_trailing_slash() {
         // This is the reducer invariant that the tree view must match.
         let item = canonicalize_item("~/alphabet/a");
-        assert_eq!(crate::events::item_parent_path(&item).unwrap(), "https://slug.social/~/alphabet");
+        assert_eq!(crate::canonical_path::item_parent_path(&item).unwrap(), "https://slug.social/~/alphabet");
         let item2 = canonicalize_item("~/a");
-        assert_eq!(crate::events::item_parent_path(&item2).unwrap(), "https://slug.social/~");
+        assert_eq!(crate::canonical_path::item_parent_path(&item2).unwrap(), "https://slug.social/~");
     }
 
     #[test]
diff --git a/server/src/identity.rs b/server/src/identity.rs
new file mode 100644
index 0000000000000000000000000000000000000000..ad654ae813f8f6fe6323746e2544250687d3d47f
--- /dev/null
+++ b/server/src/identity.rs
@@ -0,0 +1,66 @@
+//! Usernames and agent delegate ids. Wire JSON and query params use **stored form only** (no `@` / `@@`).
+//! The HTTP layer validates here; the reducer does not rewrite identity. For humans, `@name` / `@@agent`
+//! appear only in HTML (see `html::authorship_address`).
+
+/// Parse username from query/body: trim, lowercase. `@` is not allowed (use `tommy`, not `@tommy`).
+pub fn parse_username(input: &str) -> Result<String, String> {
+    let s = input.trim();
+    if s.is_empty() {
+        return Err("username must not be empty".to_string());
+    }
+    if s.contains('@') {
+        return Err(
+            "username must not contain '@' — use stored form (e.g. `tommy`)".to_string(),
+        );
+    }
+    let u = s.to_lowercase();
+    validate_username_naked(&u)?;
+    Ok(u)
+}
+
+fn validate_username_naked(u: &str) -> Result<(), String> {
+    if u.len() > 32 {
+        return Err("username must be 1-32 characters".to_string());
+    }
+    if !u
+        .chars()
+        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_')
+    {
+        return Err("username must be lowercase alphanumeric with '-' or '_' only".to_string());
+    }
+    Ok(())
+}
+
+/// Parse agent id: trim, lowercase. Must be `uuid:rig:provider/model` with no `@`.
+pub fn parse_agent(input: &str) -> Result<String, String> {
+    let s = input.trim();
+    if s.is_empty() {
+        return Err("agent id must not be empty".to_string());
+    }
+    if s.contains('@') {
+        return Err(
+            "agent id must not contain '@' — use `uuid:rig:provider/model`".to_string(),
+        );
+    }
+    let a = s.to_lowercase();
+    validate_agent_naked(&a)?;
+    Ok(a)
+}
+
+fn validate_agent_naked(a: &str) -> Result<(), String> {
+    let parts: Vec<&str> = a.split(':').collect();
+    if parts.len() != 3 {
+        return Err("agent must be <uuid>:<rig>:<provider/model>".to_string());
+    }
+    let (uuid_part, rig_part, model_part) = (parts[0], parts[1], parts[2]);
+    if uuid::Uuid::parse_str(uuid_part).is_err() {
+        return Err("agent uuid must be a valid UUID v4".to_string());
+    }
+    if rig_part.trim().is_empty() {
+        return Err("agent rig must be non-empty".to_string());
+    }
+    if !model_part.contains('/') {
+        return Err("agent model must be <provider/model>".to_string());
+    }
+    Ok(())
+}
diff --git a/server/src/lib.rs b/server/src/lib.rs
index 1820b0dd9cd2d0b6ce05789e3225e0d86a3d357a..173fbdd6b3f23c062a200b268d04491d5e030b3f 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -1,10 +1,12 @@
 #[macro_use]
 pub mod paths;
 pub mod api;
+pub mod canonical_path;
 pub mod dsl;
 pub mod html;
 pub mod event_log;
 pub mod events;
+pub mod identity;
 pub mod middleware;
 pub mod path_types;
 pub mod ranking;
diff --git a/server/src/path_types.rs b/server/src/path_types.rs
index 5a903de4f8309b6c3874e2cd70f2eb5650fd50a8..997597f6659c1ba2092bc5348e393bf7a8fa7ae0 100644
--- a/server/src/path_types.rs
+++ b/server/src/path_types.rs
@@ -14,9 +14,9 @@ use std::fmt;
 
 use serde::{Deserialize, Serialize};
 
-use crate::events::canonicalize_item;
+use crate::canonical_path::canonicalize_item;
 
-/// Canonical item identifier as produced by `events::canonicalize_item`.
+/// Canonical item identifier as produced by `canonical_path::canonicalize_item`.
 ///
 /// In practice this is usually:
 /// - `https://slug.social/~/...` for ontology items, or
diff --git a/server/src/ranking.rs b/server/src/ranking.rs
index 70119611473a430113429eafb6d92b2bf96a3eb5..f70da0d076da2ba8f0abb5a4415babae1c2305f9 100644
--- a/server/src/ranking.rs
+++ b/server/src/ranking.rs
@@ -265,7 +265,7 @@ mod tests {
             ratio_right: r,
             body: "because".to_string(),
             principal: "test".to_string(),
-            delegate: "@00000000-0000-0000-0000-000000000000:test:local/test".to_string(),
+            delegate: Some("00000000-0000-0000-0000-000000000000:test:local/test".to_string()),
             thread_id: "untagged".to_string(),
         }
     }
diff --git a/server/src/reducer.rs b/server/src/reducer.rs
index 9ab063a340e228edaa8967ec35762809fccd5d3a..550bcda1a1068df13908d19484d86ad46d65ddf1 100644
--- a/server/src/reducer.rs
+++ b/server/src/reducer.rs
@@ -2,7 +2,8 @@ use std::collections::{HashMap, HashSet, VecDeque};
 
 use serde::{Deserialize, Serialize};
 
-use crate::events::{canonicalize_agent, canonicalize_tag, canonicalize_username, Event, Ingest, ThreadCapability};
+use crate::canonical_path::canonicalize_tag;
+use crate::events::{Event, Ingest, ThreadCapability};
 use crate::path_types::CanonicalItemUrl;
 
 #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
@@ -21,10 +22,10 @@ pub struct VoteData {
     pub ratio_left: i32,
     pub ratio_right: i32,
     pub body: String,
-    /// Human principal username (no leading '@').
+    /// Human principal username (no `@` in stored events).
     pub principal: String,
-    /// Agent delegate identity (stored with single leading '@').
-    pub delegate: String,
+    /// AI delegate id, if any (no `@` in stored events).
+    pub delegate: Option<String>,
     /// Thread id where this vote was cast (public tag or private id/slug).
     pub thread_id: String,
 }
@@ -99,8 +100,6 @@ impl GroupState {
     pub fn apply_vote(&mut self, mut vote: VoteData) {
         vote.a = CanonicalItemUrl::parse(vote.a.as_str()).unwrap_or(vote.a);
         vote.b = CanonicalItemUrl::parse(vote.b.as_str()).unwrap_or(vote.b);
-        vote.principal = canonicalize_username(&vote.principal);
-        vote.delegate = canonicalize_agent(&vote.delegate);
         vote.thread_id = canonicalize_tag(&vote.thread_id);
         if vote.ratio_left < 0 {
             vote.ratio_left = 0;
@@ -189,7 +188,7 @@ pub struct ReducerState {
     pub users_by_provider: HashMap<(String, String), String>,
     /// token_id -> (username, salt, token_hash)
     pub tokens_by_id: HashMap<String, (String, String, String)>,
-    /// agent delegate (canonical '@...') -> username
+    /// agent id (naked `uuid:rig:model`) -> username
     pub agent_bindings: HashMap<String, String>,
 
     pub ingests_by_id: HashMap<String, Ingest>,
@@ -330,26 +329,27 @@ impl ReducerState {
     pub fn apply_event(&mut self, event: Event) {
         match event {
             Event::UserRegistered(ur) => {
-                let username = canonicalize_username(&ur.username);
-                self.users_by_provider
-                    .insert((ur.provider.to_lowercase(), ur.provider_id.clone()), username);
+                self.users_by_provider.insert(
+                    (ur.provider.to_lowercase(), ur.provider_id.clone()),
+                    ur.username,
+                );
             }
             Event::TokenIssued(ti) => {
-                let username = canonicalize_username(&ti.username);
-                self.tokens_by_id
-                    .insert(ti.token_id.clone(), (username, ti.salt.clone(), ti.token_hash.clone()));
+                self.tokens_by_id.insert(
+                    ti.token_id.clone(),
+                    (ti.username, ti.salt.clone(), ti.token_hash.clone()),
+                );
             }
             Event::AgentBound(ab) => {
-                let username = canonicalize_username(&ab.username);
-                let agent = canonicalize_agent(&ab.agent);
-                self.agent_bindings.insert(agent, username);
+                if ab.agent.is_empty() {
+                    return;
+                }
+                self.agent_bindings.insert(ab.agent, ab.username);
             }
             Event::ThreadCreated(tc) => {
                 self.threads.entry(tc.thread_id.clone()).or_default().visibility = tc.visibility;
             }
             Event::Ingest(mut ing) => {
-                ing.principal = canonicalize_username(&ing.principal);
-                ing.delegate = canonicalize_agent(&ing.delegate);
                 ing.thread_id = canonicalize_tag(&ing.thread_id);
 
                 self.ingests_by_id.insert(ing.id.clone(), ing.clone());
@@ -528,7 +528,7 @@ impl ReducerState {
                 let caps = self.grants
                     .entry(ga.thread_id)
                     .or_default()
-                    .entry(canonicalize_username(&ga.username))
+                    .entry(ga.username)
                     .or_default();
                 for cap in ga.capabilities {
                     caps.insert(cap);
@@ -536,7 +536,7 @@ impl ReducerState {
             }
             Event::GrantRevoked(gr) => {
                 if let Some(thread_grants) = self.grants.get_mut(&gr.thread_id) {
-                    let username = canonicalize_username(&gr.username);
+                    let username = gr.username;
                     if let Some(caps) = thread_grants.get_mut(&username) {
                         for cap in &gr.capabilities {
                             caps.remove(cap);
diff --git a/server/tests/basic.rs b/server/tests/basic.rs
index 8d7dd87d327c969ad953ecaa6b021a03e4d1842e..21cacd3049c9f5a307e75eefd5ebfc7bf0097b5d 100644
--- a/server/tests/basic.rs
+++ b/server/tests/basic.rs
@@ -1,6 +1,7 @@
 use slugsocial_server::{
     event_log::EventLog,
-    events::{canonicalize_item, canonicalize_tag, Event, Ingest},
+    canonical_path::{canonicalize_item, canonicalize_tag},
+    events::{Event, Ingest},
     ranking::ranked_items,
     reducer::{GroupState, ReducerState},
 };
@@ -15,7 +16,7 @@ fn ingest_event(ts: i64, raw: &str) -> Event {
         id: format!("test-{ts}"),
         raw: raw.to_string(),
         principal: "test".to_string(),
-        delegate: "@@00000000-0000-0000-0000-000000000000:test:local/test".to_string(),
+        delegate: Some("00000000-0000-0000-0000-000000000000:test:local/test".to_string()),
         thread_id: "t".to_string(),
     })
 }
@@ -491,7 +492,7 @@ fn reducer_negative_ratio_clamped_to_zero() {
         ratio_right: -3,
         body: "negative".to_string(),
         principal: "test".to_string(),
-        delegate: "@@00000000-0000-0000-0000-000000000000:test:local/test".to_string(),
+        delegate: Some("00000000-0000-0000-0000-000000000000:test:local/test".to_string()),
         thread_id: "t".to_string(),
     });
     assert_eq!(group.idx_to_item.len(), 2);
diff --git a/server/tests/integration.rs b/server/tests/integration.rs
index 24ef464631cd269889b8bb751ef0e90289443e97..eaa25f2c5cc21df3096d9b8f54c060c83207bfd6 100644
--- a/server/tests/integration.rs
+++ b/server/tests/integration.rs
@@ -87,7 +87,7 @@ async fn test_ingest_actor_with_colons_is_detected_and_validated() {
     // Old archive style: agent includes colons but UUID is only a prefix (invalid).
     // We should detect the agent line, then fail with "invalid agent format".
     let ingest_payload = serde_json::json!({
-        "delegate": "@@aec1e31c:claudecode:anthropic/claude-sonnet-4.5",
+        "delegate": "aec1e31c:claudecode:anthropic/claude-sonnet-4.5",
         "thread": "t",
         "text": "~/x {x}\n",
     });
@@ -108,6 +108,26 @@ async fn test_ingest_actor_with_colons_is_detected_and_validated() {
         hint.to_lowercase().contains("uuid"),
         "hint should mention uuid, got: {hint}"
     );
+
+    let at_payload = serde_json::json!({
+        "delegate": "@00000000-0000-0000-0000-000000000000:test:local/test",
+        "thread": "t",
+        "text": "~/x {x}\n",
+    });
+    let at_resp = client
+        .post(&format!("http://{}/api/v0/ingest", addr))
+        .header("Authorization", format!("Bearer {}", test_bearer()))
+        .json(&at_payload)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(at_resp.status(), reqwest::StatusCode::BAD_REQUEST);
+    let at_body: serde_json::Value = at_resp.json().await.unwrap();
+    let at_hint = at_body["hint"].as_str().unwrap_or_default();
+    assert!(
+        at_hint.contains('@'),
+        "hint should reject '@' in delegate, got: {at_hint}"
+    );
 }
 
 #[tokio::test]
@@ -117,7 +137,7 @@ async fn test_vote_endpoint() {
 
     // /api/v0/vote was removed; all votes are submitted via ingest.
     let ingest_payload = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000000:test:local/test",
+        "delegate": "00000000-0000-0000-0000-000000000000:test:local/test",
         "thread": "cli",
         "text": "~/clap {cli parser}\n~/argh {cli parser}\n~/clap 3:1 ~/argh {because clap is more full-featured}\n",
     });
@@ -143,7 +163,7 @@ async fn test_rank_endpoint() {
 
     // Ingest items + vote (vote endpoint removed).
     let ingest_payload = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000000:test:local/test",
+        "delegate": "00000000-0000-0000-0000-000000000000:test:local/test",
         "thread": "langs",
         "text": "~/rust {systems}\n~/go {concurrency}\n~/rust 3:1 ~/go {because i prefer rust for systems work}\n",
     });
@@ -180,7 +200,7 @@ async fn test_check_endpoint_does_not_commit() {
     let client = reqwest::Client::new();
 
     let check_payload = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000000:test:local/test",
+        "delegate": "00000000-0000-0000-0000-000000000000:test:local/test",
         "thread": "t",
         "text": "~/a {x}\n~/b {y}\n~/a 2:1 ~/b {because}\n",
     });
@@ -220,7 +240,7 @@ async fn test_garden_item_pair_matchup_include_threads() {
 
     // Ingest with thread_id metadata so item_threads and vote.thread_id are populated.
     let ingest_payload = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000000:test:local/test",
+        "delegate": "00000000-0000-0000-0000-000000000000:test:local/test",
         "thread": "sorting-hat",
         "text": "~/sorts/insertion { O(n^2) }\n~/sorts/mergesort { O(n log n) }\n~/sorts/insertion 3:1 ~/sorts/mergesort { simpler for small n }\n",
     });
@@ -324,7 +344,7 @@ async fn test_rank_history() {
     // First ingest: rust vs python — two votes on rust in one doc (the multi-vote case).
     ingest(
         serde_json::json!({
-            "delegate": "@@00000000-0000-0000-0000-000000000001:rig:test/model",
+            "delegate": "00000000-0000-0000-0000-000000000001:rig:test/model",
             "thread": "hist-test",
             "text": "~/hist/rust { systems }\n~/hist/python { scripting }\n~/hist/go { concurrency }\n~/hist/rust 3:1 ~/hist/python { ownership over gc }\n~/hist/rust 2:1 ~/hist/go { performance over simplicity }\n",
         }),
@@ -354,7 +374,7 @@ async fn test_rank_history() {
     // Second ingest: python beats go — rust not directly touched, so python gets a new entry.
     ingest(
         serde_json::json!({
-            "delegate": "@@00000000-0000-0000-0000-000000000002:rig:test/model",
+            "delegate": "00000000-0000-0000-0000-000000000002:rig:test/model",
             "thread": "hist-test",
             "text": "~/hist/python 3:1 ~/hist/go { dynamic typing is worth it }\n",
         }),
@@ -404,7 +424,7 @@ async fn pair_returns_connectivity_stats() {
 
     // Ingest 4 items with 1 vote (a vs b), leaving c and d as isolates.
     let doc = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000001:testrig:test/model",
+        "delegate": "00000000-0000-0000-0000-000000000001:testrig:test/model",
         "thread": "connectivity-test",
         "text": "~/conn/a { item a }\n~/conn/b { item b }\n~/conn/c { item c }\n~/conn/d { item d }\n~/conn/a 3:1 ~/conn/b { a is better }\n",
     });
@@ -438,7 +458,7 @@ async fn pair_returns_connectivity_stats() {
 
     // Add a vote connecting c to a — should reduce components.
     let doc2 = serde_json::json!({
-        "delegate": "@@00000000-0000-0000-0000-000000000001:testrig:test/model",
+        "delegate": "00000000-0000-0000-0000-000000000001:testrig:test/model",
         "thread": "connectivity-test",
         "text": "~/conn/c 2:1 ~/conn/a { c beats a }\n",
     });
diff --git a/test/auth.bb b/test/auth.bb
index b54ea509aafd2d5ee85877665982d7fc00cd8b20..611e04f1806ef81d678a91f499597fe55f691dd7 100644
--- a/test/auth.bb
+++ b/test/auth.bb
@@ -155,7 +155,7 @@
 
      (println "\nstarting pending session…")
      (let [start-resp (http-post-json (str base-url "/api/v0/pending-session")
-                                      {:agent "@@00000000-0000-0000-0000-000000000000:bb:local/dev"})
+                                      {:agent "00000000-0000-0000-0000-000000000000:bb:local/dev"})
            _ (assert! (= 200 (:status start-resp)) "pending-session start returns 200")
            start-json (json/parse-string (:body start-resp) true)]
        (assert! (clojure.string/starts-with? (:session start-json) "p_") "session id has p_ prefix")
diff --git a/test/grants.bb b/test/grants.bb
index 962ff01cdc25d6d6977cc9a810c404918c20856d..f72799ae6fe099f48bdf316deee07f15882e9d45 100644
--- a/test/grants.bb
+++ b/test/grants.bb
@@ -187,11 +187,11 @@
      ;; Register two users. The mock google cycles through google-user-alice then google-user-bob.
      (println "\nregistering alice…")
      (let [alice-token (register-user base-url
-                                      "@@00000000-0000-0000-0000-000000000001:test:local/dev"
+                                      "00000000-0000-0000-0000-000000000001:test:local/dev"
                                       "alice")
            _ (println "registering bob…")
            bob-token   (register-user base-url
-                                      "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                      "00000000-0000-0000-0000-000000000002:test:local/dev"
                                       "bob")
 
            ;; Alice creates a private thread.
@@ -206,14 +206,14 @@
        ;; Alice (owner) can post prose to her own private thread.
        (println "\nalice posts prose to her private thread…")
        (assert! (= 200 (:status (ingest! base-url alice-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000001:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000001:test:local/dev"
                                          "Hello from alice.")))
                 "alice prose post succeeds")
 
        ;; Bob has no grants at all — should get 403.
        (println "\nbob (no grants) tries to post prose…")
        (assert! (= 403 (:status (ingest! base-url bob-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000002:test:local/dev"
                                          "Hello from bob, unauthorized.")))
                 "bob without grants gets 403")
 
@@ -226,7 +226,7 @@
 
        (println "\nbob (View only) tries to post prose…")
        (assert! (= 403 (:status (ingest! base-url bob-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000002:test:local/dev"
                                          "Hello from bob, view only.")))
                 "bob with View but no Post gets 403")
 
@@ -239,21 +239,21 @@
 
        (println "\nbob (View + Post) posts prose…")
        (assert! (= 200 (:status (ingest! base-url bob-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000002:test:local/dev"
                                          "Hello from bob, now authorised.")))
                 "bob with View + Post succeeds for prose")
 
        ;; Alice defines two items and votes on them in the private thread.
        (println "\nalice posts items + vote to private thread…")
        (assert! (= 200 (:status (ingest! base-url alice-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000001:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000001:test:local/dev"
                                          "~/fruits/apple { A crisp red apple. }\n~/fruits/banana { A yellow banana. }\n~/fruits/apple > ~/fruits/banana { apples are better }")))
                 "alice vote in private thread succeeds")
 
        ;; Bob (View + Post, no Vote) tries to vote — should be 403.
        (println "\nbob (no Vote) tries to vote…")
        (assert! (= 403 (:status (ingest! base-url bob-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000002:test:local/dev"
                                          "~/fruits/apple > ~/fruits/banana { bob's take }")))
                 "bob without Vote gets 403")
 
@@ -266,7 +266,7 @@
 
        (println "\nbob (View + Post + Vote) votes…")
        (assert! (= 200 (:status (ingest! base-url bob-token thread-id
-                                         "@@00000000-0000-0000-0000-000000000002:test:local/dev"
+                                         "00000000-0000-0000-0000-000000000002:test:local/dev"
                                          "~/fruits/apple > ~/fruits/banana { bob's take }")))
                 "bob with Vote succeeds"))
 
diff --git a/test/integration.bb b/test/integration.bb
index 93db8f3102b1b3a05f3c4bd2cc9f348072fe54cc..4ff5d625840be3bf5e4162cef107a3cbd45aec4d 100644
--- a/test/integration.bb
+++ b/test/integration.bb
@@ -166,7 +166,7 @@
 
         ;; 3. ingest via CLI (bearer required)
       (println "\ningesting .sorter document via CLI…")
-      (bind ingest1-result (common/run-cli cli-bin base-url ["ingest" "--json" "--thread" "integration-test"] :input sorter-doc :extra-env token-env))
+      (bind ingest1-result (common/run-cli cli-bin base-url ["ingest" "--json" "--thread" "integration-test" "--delegate" "00000000-0000-0000-0000-000000000000:cli:local/dev"] :input sorter-doc :extra-env token-env))
       (assert! (zero? (:exit ingest1-result)) "cli ingest exits 0")
       (bind ingest1-resp   (json/parse-string (:out ingest1-result) true))
       (assert! (:ok ingest1-resp) "ingest response ok=true")
@@ -237,7 +237,7 @@
                                         "#integration-test"
                                         "~/languages/rust 4:1 ~/languages/python { type safety }"
                                         "~/languages/rust 3:1 ~/languages/go { zero-cost abstractions }"]))
-      (bind hist-ingest      (common/run-cli cli-bin base-url ["ingest" "--json" "--thread" "integration-test"] :input two-vote-doc :extra-env token-env))
+      (bind hist-ingest      (common/run-cli cli-bin base-url ["ingest" "--json" "--thread" "integration-test" "--delegate" "00000000-0000-0000-0000-000000000000:cli:local/dev"] :input two-vote-doc :extra-env token-env))
       (assert! (zero? (:exit hist-ingest))
                (str "two-vote ingest exits 0 (err: " (:err hist-ingest) ")"))
 
diff --git a/test/oauth.bb b/test/oauth.bb
index f94583ee0f6fedfc023564ed7ee3a2986adcf660..84679e1a4adbe100dfe7e7d64a2c6270b023d275 100644
--- a/test/oauth.bb
+++ b/test/oauth.bb
@@ -85,11 +85,11 @@
         stop-fn (http/run-server handler {:port port})]
     {:stop-fn stop-fn :port port}))
 
-(def ^:private default-agent "@@00000000-0000-0000-0000-000000000000:cli:local/dev")
+(def ^:private default-agent "00000000-0000-0000-0000-000000000000:cli:local/dev")
 
 (defn fetch-bearer-token!
   "Simulate browser OAuth + username choice; returns `slug_…` bearer token.
-   Agent must match CLI default `SLUG_DELEGATE` for ingest binding."
+   Ingest `--delegate` must match this agent string for `AgentBound` on first write."
   [base-url & {:keys [username agent] :or {username "intuser" agent default-agent}}]
   (let [start-resp (http-post-json (str base-url "/api/v0/pending-session")
                                    {:agent agent})]
diff --git a/types/src/lib.rs b/types/src/lib.rs
index a62822a36463c68fde6c5fc1aa9e4273c82ca0c8..92e6d122d573ea225f8fb86c548a81b3454425ad 100644
--- a/types/src/lib.rs
+++ b/types/src/lib.rs
@@ -138,7 +138,7 @@ pub struct PostRow {
     /// Chronological index within the thread (0 = oldest).
     pub index: usize,
     pub ts: i64,
-    /// Self-declared actor (`@uuid:rig:model`).
+    /// Principal username (stored form, no `@`).
     pub actor: String,
     pub body: String,
     pub truncated: bool,
@@ -186,6 +186,7 @@ pub struct VoteRow {
     pub a: String,
     pub b: String,
     pub ratio: String,
+    /// Principal username when present (stored form, no `@`).
     pub actor: Option<String>,
     pub body: String,
     /// Thread where this vote was cast (e.g. "#sorting-hat").
@@ -196,6 +197,7 @@ pub struct VoteRow {
 /// Response for the feed endpoint — all ingests since a cutoff, newest first.
 #[derive(Debug, Serialize, Deserialize)]
 pub struct FeedResponse {
+    /// Principal username this feed is scoped to (stored form, no `@`).
     pub actor: String,
     /// The lower-bound timestamp used (actor's last ingest, ms). None if actor has never posted.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -222,8 +224,9 @@ pub struct FeedPost {
 pub struct IngestRequest {
     /// Thread identifier: public tag (e.g. "languages") or private id/slug (e.g. "a7f2k9x/project-review").
     pub thread: String,
-    /// Agent delegate identity in request form (e.g. "@@uuid:rig:provider/model").
-    pub delegate: String,
+    /// Delegate id: `uuid:rig:provider/model` (no `@`). Omit for human-only ingests.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub delegate: Option<String>,
     /// DSL+prose body only.
     pub text: String,
 }
@@ -231,7 +234,7 @@ pub struct IngestRequest {
 /// Start a browser-based OAuth login flow for a CLI agent.
 #[derive(Debug, Serialize, Deserialize)]
 pub struct PendingSessionStartRequest {
-    /// Agent delegate identity in request form (e.g. "@@uuid:rig:provider/model").
+    /// Delegate id: `uuid:rig:provider/model` (no `@`).
     pub agent: String,
 }
 
@@ -255,6 +258,7 @@ pub struct PendingSessionPollResponse {
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct WhoamiResponse {
+    /// Username (stored form, no `@`).
     pub user: String,
     pub agents_bound: usize,
 }


Side B — contributor: tommy-mor
Side B — commit message:
[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.

Also show the current alias in the top nav and pin durable by rev.

Co-authored-by: Cursor <cursoragent@cursor.com>

Side B — unified diff (full patch):
diff --git a/AGENTS.md b/AGENTS.md
index babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki
 
 - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.
 - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).
-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS="-C linker=g++"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.
+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS="-C linker=g++"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.
 - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.
 - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.
 - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).
-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e "(com.microsoft.playwright.CLI/main ...)"` — run once after clone or use the bootstrap script.
+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e "(com.microsoft.playwright.CLI/main ...)"` — run once after clone or use the bootstrap script.
 
 ### Commands (see also `TEST.sh`)
 
@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):
 - `PORT` — default `8080`
 - `SORTER2_DATA_DIR` — default `./data` (created on startup)
 - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
 
 Health check: `GET /healthz` → `ok`.
 
-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:
+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:
 
 ```bash
 curl -sf -X POST http://127.0.0.1:8080/ui \
+  --cookie "sorter2_session=..." \
   --data-urlencode '__rpc__={"action":"record_vote","a":"alpha","b":"beta","ratio_left":2,"ratio_right":1}'
 ```
 
diff --git a/Cargo.lock b/Cargo.lock
index aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -414,7 +414,7 @@ dependencies = [
 [[package]]
 name = "durable"
 version = "0.2.0"
-source = "git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
+source = "git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
 dependencies = [
  "ciborium",
  "durable-derive",
@@ -426,7 +426,7 @@ dependencies = [
 [[package]]
 name = "durable-derive"
 version = "0.2.0"
-source = "git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
+source = "git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -25,7 +25,7 @@ futures-util = { version = "0.3", default-features = false, features = ["std"] }
 rand = "0.8"
 urlencoding = "2"
 url = "2"
-durable = { git = "https://github.com/tommy-mor/durable.git", branch = "main" }
+durable = { git = "https://github.com/tommy-mor/durable.git", rev = "a6c14eaa809693140eea0c22b07ef24d8e74adaf" }
 
 [dev-dependencies]
 reqwest = { version = "0.12", features = ["json"] }
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
index b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644
--- a/server/src/api/ui_html.rs
+++ b/server/src/api/ui_html.rs
@@ -71,10 +71,16 @@ pub async fn post_ui_html(
                 return resp;
             }
             let parent = parent_from_scope(&scope);
-            let actor = resolve_vote_actor(
+            let actor = match resolve_vote_actor(
                 state.projection_store.db(),
                 session_id_from_jar(&jar).as_deref(),
-            );
+            ) {
+                Ok(actor) => actor,
+                Err(_) => {
+                    return vote_auth_redirect(&state, &jar)
+                        .unwrap_or_else(|| login_redirect_js().into_response());
+                }
+            };
             if let Err(e) = state
                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)
                 .await
diff --git a/server/src/auth/config.rs b/server/src/auth/config.rs
index a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644
--- a/server/src/auth/config.rs
+++ b/server/src/auth/config.rs
@@ -1,9 +1,42 @@
 pub const AUTH_RETURN_COOKIE: &str = "sorter2_auth_return";
 
+/// Allow `mock_user` on `/auth/github` (test harness only).
+pub fn mock_oauth_allowed() -> bool {
+    matches!(
+        std::env::var("SORTER2_ALLOW_MOCK_OAUTH").as_deref(),
+        Ok("1") | Ok("true") | Ok("TRUE")
+    )
+}
+
+/// Set the Secure flag on auth cookies when serving over HTTPS.
+pub fn cookies_secure() -> bool {
+    std::env::var("SORTER2_BASE_URL")
+        .map(|u| u.starts_with("https://"))
+        .unwrap_or(false)
+}
+
 pub fn sanitize_return_to(raw: &str) -> String {
     let s = raw.trim();
-    if s.is_empty() || !s.starts_with('/') || s.starts_with("//") {
+    if s.is_empty() || !s.starts_with('/') || s.starts_with("//") || s.starts_with("/\\") {
+        return "/".to_string();
+    }
+    // Reject scheme-relative and protocol-smuggling forms.
+    if s.contains("://") || s.contains('\\') {
         return "/".to_string();
     }
     s.to_string()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sanitize_return_to_blocks_open_redirects() {
+        assert_eq!(sanitize_return_to(""), "/");
+        assert_eq!(sanitize_return_to("//evil.com"), "/");
+        assert_eq!(sanitize_return_to("/\\evil.com"), "/");
+        assert_eq!(sanitize_return_to("https://evil.com"), "/");
+        assert_eq!(sanitize_return_to("/vote?parent=x"), "/vote?parent=x");
+    }
+}
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -26,7 +26,7 @@ use crate::{
     ui_action::UI_RPC_FIELD,
 };
 
-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};
+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};
 
 pub fn base_url_from_env(port: u16) -> String {
     std::env::var("SORTER2_BASE_URL")
@@ -168,6 +168,10 @@ pub async fn login_page(
         "login · sorter2",
         login_body(session.as_ref(), &aliases, &providers),
         state.views.get_views("/login"),
+        session
+            .as_ref()
+            .filter(|s| !s.pseudonym.trim().is_empty())
+            .map(|s| s.pseudonym.as_str()),
     );
     (jar, Html(markup.into_string())).into_response()
 }
@@ -222,6 +226,7 @@ pub async fn alias_page(
             "choose alias · sorter2",
             body,
             state.views.get_views("/login/alias"),
+            None,
         )
         .into_string(),
     )
@@ -237,7 +242,12 @@ pub async fn github_start(
         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
     let state_token = session::new_oauth_state();
-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());
+    let mock_user = if config::mock_oauth_allowed() {
+        query.mock_user.as_deref()
+    } else {
+        None
+    };
+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);
     let jar = jar
         .add(session::oauth_state_cookie_value(&state_token))
         .add(session::auth_return_cookie_value(&return_to));
diff --git a/server/src/auth/session.rs b/server/src/auth/session.rs
index 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644
--- a/server/src/auth/session.rs
+++ b/server/src/auth/session.rs
@@ -5,7 +5,7 @@ use durable::{Db, Durability};
 use rand::Rng;
 
 use crate::{
-    auth::config::AUTH_RETURN_COOKIE,
+    auth::config::{self, AUTH_RETURN_COOKIE},
     fetch::now_ms,
     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},
     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},
@@ -37,6 +37,7 @@ pub struct VoteActor {
 }
 
 impl VoteActor {
+    /// Test / bench helper: seed votes as the default pseudonym without a session.
     pub fn anon() -> Self {
         Self {
             pseudonym: DEFAULT_PSEUDONYM.to_string(),
@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {
     bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
 
-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {
-    let Some(session_id) = session_id else {
-        return VoteActor::anon();
-    };
-    let Ok(Some(session)) = load_session(db, session_id) else {
-        return VoteActor::anon();
-    };
-    if session.expires_at <= now_ms() {
-        return VoteActor::anon();
+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {
+    let mut builder = Cookie::build((name, value))
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .path("/");
+    if config::cookies_secure() {
+        builder = builder.secure(true);
+    }
+    builder.build()
+}
+
+fn clear_cookie(name: &'static str) -> Cookie<'static> {
+    let mut builder = Cookie::build((name, ""))
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .path("/")
+        .removal();
+    if config::cookies_secure() {
+        builder = builder.secure(true);
+    }
+    builder.build()
+}
+
+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.
+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {
+    let session_id = session_id.ok_or("sign in to vote")?;
+    let session = load_valid_session(db, session_id).ok_or("session expired")?;
+    if !session_has_pseudonym(&session) {
+        return Err("choose an alias first");
     }
     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);
-    VoteActor {
+    Ok(VoteActor {
         pseudonym: session.current_pseudonym,
         trust_weight,
+    })
+}
+
+/// Display name for the top nav, if any session is active.
+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {
+    let session_id = session_id_from_jar(jar)?;
+    let session = load_valid_session(db, &session_id)?;
+    if session_has_pseudonym(&session) {
+        Some(session.current_pseudonym)
+    } else {
+        None
     }
 }
 
@@ -151,54 +183,27 @@ pub fn destroy_session(db: &Db, session_id: &str) -> Result<(), String> {
 }
 
 pub fn session_cookie_value(session_id: &str) -> Cookie<'static> {
-    Cookie::build((SESSION_COOKIE, session_id.to_string()))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .build()
+    build_cookie(SESSION_COOKIE, session_id.to_string())
 }
 
 pub fn clear_session_cookie() -> Cookie<'static> {
-    Cookie::build((SESSION_COOKIE, ""))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .removal()
-        .build()
+    clear_cookie(SESSION_COOKIE)
 }
 
 pub fn oauth_state_cookie_value(state: &str) -> Cookie<'static> {
-    Cookie::build((OAUTH_STATE_COOKIE, state.to_string()))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .build()
+    build_cookie(OAUTH_STATE_COOKIE, state.to_string())
 }
 
 pub fn clear_oauth_state_cookie() -> Cookie<'static> {
-    Cookie::build((OAUTH_STATE_COOKIE, ""))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .removal()
-        .build()
+    clear_cookie(OAUTH_STATE_COOKIE)
 }
 
 pub fn auth_return_cookie_value(return_to: &str) -> Cookie<'static> {
-    Cookie::build((AUTH_RETURN_COOKIE, return_to.to_string()))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .build()
+    build_cookie(AUTH_RETURN_COOKIE, return_to.to_string())
 }
 
 pub fn clear_auth_return_cookie() -> Cookie<'static> {
-    Cookie::build((AUTH_RETURN_COOKIE, ""))
-        .http_only(true)
-        .same_site(SameSite::Lax)
-        .path("/")
-        .removal()
-        .build()
+    clear_cookie(AUTH_RETURN_COOKIE)
 }
 
 pub fn auth_return_from_jar(jar: &CookieJar) -> Option<String> {
@@ -213,28 +218,35 @@ pub fn oauth_state_from_jar(jar: &CookieJar) -> Option<String> {
     jar.get(OAUTH_STATE_COOKIE).map(|c| c.value().to_string())
 }
 
-pub fn actor_uuid_for_vote(db: &Db, session_id: Option<&str>) -> String {
-    let Some(session_id) = session_id else {
-        return DEFAULT_ACTOR_UUID.to_string();
-    };
-    load_session(db, session_id)
-        .ok()
-        .flatten()
-        .filter(|s| s.expires_at > now_ms())
-        .map(|s| s.uuid)
-        .unwrap_or_else(|| DEFAULT_ACTOR_UUID.to_string())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
-    fn missing_session_falls_back_to_anon() {
+    fn missing_session_is_error() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = Db::open(dir.path()).unwrap();
+        assert_eq!(resolve_vote_actor(&db, None).unwrap_err(), "sign in to vote");
+    }
+
+    #[test]
+    fn session_without_pseudonym_is_error() {
+        let dir = tempfile::tempdir().unwrap();
+        let db = Db::open(dir.path()).unwrap();
+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, "").unwrap();
+        assert_eq!(
+            resolve_vote_actor(&db, Some(&id)).unwrap_err(),
+            "choose an alias first"
+        );
+    }
+
+    #[test]
+    fn session_with_pseudonym_resolves() {
         let dir = tempfile::tempdir().unwrap();
         let db = Db::open(dir.path()).unwrap();
-        let actor = resolve_vote_actor(&db, None);
-        assert_eq!(actor.pseudonym, DEFAULT_PSEUDONYM);
+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, "alice").unwrap();
+        let actor = resolve_vote_actor(&db, Some(&id)).unwrap();
+        assert_eq!(actor.pseudonym, "alice");
         assert_eq!(actor.trust_weight, 1.0);
     }
 }
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 46d18b87f1313bf0aeb29955d18f291961057509..3cc3d7bdf55b5cb5d009600f4ade1fcd201a410b 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -4,11 +4,13 @@ use axum::{
     http::{header, StatusCode, Uri},
     response::{IntoResponse, Response},
 };
+use axum_extra::extract::cookie::CookieJar;
 use maud::{html, Markup, DOCTYPE};
 
 use std::collections::HashSet;
 
 use crate::{
+    auth::nav_pseudonym,
     fetch::html::entity_section,
     form_template::template_json_compact,
     path_types::ItemId,
@@ -126,7 +128,7 @@ pub fn now_ms() -> i64 {
     t.as_millis() as i64
 }
 
-pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {
+pub(crate) fn layout(title: &str, body: Markup, views: u64, nav_user: Option<&str>) -> Markup {
     let ver = asset_version();
     let css_href = format!("/static/sorter.css?v={ver}");
     let js_src = format!("/static/sorter_ui.js?v={ver}");
@@ -145,7 +147,15 @@ pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {
                     span class="view-meta muted" { (views) " views" }
                 }
                 nav class="top-nav" {
-                    a href="/login" { "login" }
+                    @if let Some(name) = nav_user {
+                        span class="top-nav-user" data-testid="nav-user" { (name) }
+                        a href="/login" { "account" }
+                        form class="top-nav-logout" method="post" action="/auth/logout" data-navigate="full" {
+                            button type="submit" data-testid="nav-logout" { "log out" }
+                        }
+                    } @else {
+                        a href="/login" data-testid="nav-login" { "login" }
+                    }
                 }
                 div id="errors" {}
                 (body)
@@ -481,10 +491,11 @@ pub fn input_panel(query: &str, error: Option<&str>) -> Markup {
     }
 }
 
-async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {
+async fn item_page(state: AppState, uri: Uri, item: ItemId, jar: CookieJar) -> Markup {
     let path = uri.path().to_string();
     state.views.increment(path.clone());
     let views = state.views.get_views(&path);
+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);
 
     let tree = state
         .scope_tree(&item)
@@ -513,16 +524,24 @@ async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {
             (ranking_panel(&item, node, &tree))
         }
     };
-    layout("sorter2", body, views)
+    layout("sorter2", body, views, nav_user.as_deref())
 }
 
-pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {
-    item_page(state, uri, ItemId::root()).await
+pub async fn home(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    uri: Uri,
+) -> impl IntoResponse {
+    item_page(state, uri, ItemId::root(), jar).await
 }
 
-pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {
+pub async fn browse(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    uri: Uri,
+) -> impl IntoResponse {
     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());
-    item_page(state, uri, item).await
+    item_page(state, uri, item, jar).await
 }
 
 #[cfg(test)]
diff --git a/server/src/html/vote.rs b/server/src/html/vote.rs
index 3aa00c417c89a9cab3417c650b50ed7c73f08e20..cadbec188b17a48a63b269c0e2fa2ea8ffedd7ed 100644
--- a/server/src/html/vote.rs
+++ b/server/src/html/vote.rs
@@ -4,11 +4,13 @@ use axum::{
     extract::{Query, State},
     response::{Html, IntoResponse},
 };
+use axum_extra::extract::cookie::CookieJar;
 use maud::{html, Markup};
 use serde::Deserialize;
 use std::collections::HashSet;
 
 use crate::{
+    auth::nav_pseudonym,
     fetch::html::entity_section,
     form_template::template_json_compact,
     html::{ranking_panel_with_highlights, scope_theme_style, JsBuilder},
@@ -262,6 +264,7 @@ fn suggest_next(
 
 pub async fn vote_page(
     State(state): State<AppState>,
+    jar: CookieJar,
     Query(q): Query<VoteQuery>,
 ) -> impl IntoResponse {
     let parent = parse_item_param(&q.parent);
@@ -329,8 +332,9 @@ pub async fn vote_page(
     let path = format!("/vote?parent={}", urlencoding::encode(parent.as_str()));
     state.views.increment(path.clone());
     let views = state.views.get_views(&path);
+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);
 
-    Html(layout(&title, body, views).into_string()).into_response()
+    Html(layout(&title, body, views, nav_user.as_deref()).into_string()).into_response()
 }
 
 #[cfg(test)]
diff --git a/server/static/sorter.css b/server/static/sorter.css
index e66a1e6c1acc473c8ff1ddb1e16e75a82d33741c..257280b6b490c65222e580a325b77351cac6cc6b 100644
--- a/server/static/sorter.css
+++ b/server/static/sorter.css
@@ -34,6 +34,47 @@ body {
   font-size: 0.75rem;
 }
 
+.top-nav {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.75rem;
+  padding: 0.5rem 1rem;
+  font-size: 0.875rem;
+}
+
+.top-nav a {
+  color: var(--muted);
+  text-decoration: none;
+}
+
+.top-nav a:hover {
+  color: var(--fg);
+}
+
+.top-nav-user {
+  color: var(--fg);
+  font-weight: 600;
+}
+
+.top-nav-logout {
+  display: inline;
+  margin: 0;
+}
+
+.top-nav-logout button {
+  background: none;
+  border: none;
+  padding: 0;
+  color: var(--muted);
+  font: inherit;
+  cursor: pointer;
+}
+
+.top-nav-logout button:hover {
+  color: var(--fg);
+}
+
 .btn-primary {
   background: var(--accent);
   color: var(--accent-fg, #0f1115);
diff --git a/test/support/harness.clj b/test/support/harness.clj
index 3f05951f418258642dcacb4a10ccccc8bfbe8748..4505ece5aa193e826ca61c52f1467d252080d66b 100644
--- a/test/support/harness.clj
+++ b/test/support/harness.clj
@@ -43,6 +43,7 @@
          "SORTER2_VIEWS_LOG" (str data-dir "/views.jsonl")
          "PORT" (str app-port)
          "SORTER2_BASE_URL" (str "http://127.0.0.1:" app-port)
+         "SORTER2_ALLOW_MOCK_OAUTH" "1"
          "GITHUB_CLIENT_ID" "test-client"
          "GITHUB_CLIENT_SECRET" "test-secret"
          "GITHUB_OAUTH_BASE" (str "http://127.0.0.1:" oauth-port)