@@ -161,0 +164,4 @@
+  // Durable sessions intentionally do not trust x-user-id.  A self-hosted
+  // deployment may configure one owner through MUZICK_VIBE_USER_ID today;
+  // an authenticated deployment can replace this resolver at registration.
+  const vibeOwnerId = process.env.MUZICK_VIBE_USER_ID?.trim() || null;

@@ -0,0 +10,4 @@
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+/** Identity must come from authenticated server configuration/middleware, never a client header. */

@@ -0,0 +25,4 @@
+  // Require an actual offset-bearing timestamp, rather than Date.parse's
+  // permissive inputs such as "2026" or locale-dependent strings.
+  return typeof value === 'string'
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/i.test(value)

@@ -0,0 +36,4 @@
+  const { coordinator, identityResolver } = options;
+  const requireUser = (request: FastifyRequest, reply: { code: (statusCode: number) => { send: (payload: unknown) => unknown } }): string | null => {
+    const userId = identityResolver(request);
+    if (userId && validUuid(userId)) return userId;

@@ -0,0 +41,4 @@
+    return null;
+  };
+
+  fastify.post('/v2/vibe/sessions', async (request, reply) => {

@@ -0,0 +105,4 @@
+    if (!body || !VIBE_EVENT_TYPES.includes(body.type as typeof VIBE_EVENT_TYPES[number])) {
+      return reply.code(400).send({ error: 'type must be a supported Vibe event type' });
+    }
+    // Delivery is an authoritative state transition performed only by /next.

@@ -0,0 +161,4 @@
+    }
+  });
+
+  fastify.post('/v2/vibe/sessions/:sessionId/next', async (request, reply) => {

@@ -0,0 +3,4 @@
+ * has no precise location, identifiers, or browser telemetry: clients can
+ * supply a hint, but the server owns the time fields and can ignore all of it.
+ */
+export const VIBE_CONTEXT_VALUES = {