afx send --raw delivers inbound text with NO sender attribution — Tower should stamp provenance on every message

[waleedkadous]

Problem

afx send --raw skips the structured message envelope entirely, so the receiving agent (architect or builder) gets bare text with no sender header. In the shannon workspace tonight, a builder's status reports arrived at the architect terminal completely unattributed — indistinguishable from text typed by the human operator. The architect only trusted them because each report's commit hashes could be verified against origin (content authentication), which is not a general defense.

Why it matters

• Spoofing surface: any process that can invoke afx send --raw can put words in front of an architect with no provenance. Tower's existing builder spoofing-check guards addressing, not attribution of raw payloads.
• Human confusion: the operator watching the architect transcript cannot tell builder reports from their own channel ("who's sending us these messages?" — verbatim tonight).
• Instruction-injection risk: an unattributed message that looks like operator text could carry directives the receiving agent wrongly treats as human.

Ask

Tower should stamp sender identity server-side on every delivered message, including --raw — e.g. a one-line prefix ([raw from builder-spir-3358]) that the sender cannot omit or forge. --raw's legitimate uses (slash-command injection, ESC-interrupt bytes into a PTY) target the terminal input path and could be exempted or separately marked, but message-path deliveries should never arrive anonymous.

Workaround in use

Architect-side policy: treat header-less inbound text as untrusted; act only after verifying its claims against git artifacts; order builders onto plain afx send for all reports.

[waleedkadous]

Root cause of the --raw adoption, from the builder in question (relevant to fixing this properly): plain afx send shell-substituted backticks in the message body — twice it silently ate words from reports and a commit message. The builder switched to --raw to stop the mangling and unknowingly traded away the identity envelope.

So the full fix is a pair: (1) stamp provenance server-side on every delivery (original ask), and (2) make the structured send path content-safe — no shell interpretation of message bodies — so correctness never has to be bought with anonymity. Until (2), senders work around with quoted heredocs and no backticks.