@agentshouse/kit 0.1.0-alpha.20 → 0.1.0-alpha.22

package/README.md

@@ -10,7 +10,7 @@ On Linux `amd64` or `arm64` with a working Docker Engine, run the published,
 versioned bootstrap once:
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.20/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.22/connect-linux.sh)
 ```
 
 The release asset pins one immutable multi-architecture image digest. It creates
@@ -142,11 +142,18 @@ which the User wrote once this adoption's proof had passed. The adapter
 packages themselves are Environment prerequisites, not Kit dependencies, and
 carry no record.
 
-The bootstrap invokes bare `kit login`. The first login names its new
+The bootstrap invokes bare `kit login`, which connects to `https://agents.house`;
+`--house <origin>` names another House. Login records the House in Kit home
+beside the credential. Every House-bound command talks to that recorded House,
+and every command but login refuses `--house` as an unknown argument. The first login names its new
 Environment after the host computer and stores its Environment id in Kit home;
-an explicit later login reconnects that retained id. `--environment <uuid>`
-selects a different retained Environment for explicit recovery. A malformed
-id or an answer naming a different Environment is refused before installation.
+the panel renames it. An explicit later login reconnects that retained id, and
+`--environment <uuid>` reconnects the Environment it names instead, whether or
+not Kit home records one, and Kit home then records that id. Reconnecting issues the next credential for the same Environment
+and ends the previous one, including one `envs/revoke` ended; House refuses an
+Environment it no longer holds with its cause and never creates a replacement.
+A malformed id or an answer naming a different Environment is refused before
+installation.
 
 Use `--manual` when the browser cannot reach the Kit's loopback listener. The
 command stores the issued Kit User credential in `$HOUSE_KIT_HOME/credential`
@@ -253,7 +260,7 @@ and the batch it produces, and the lease has to outlive both.
 Apply the declared source state to House:
 
 ```sh
-kit apply --house https://agents.house
+kit apply
 ```
 
 Only the state House declares - instances, services, `source_ref`, and Room
@@ -442,7 +449,7 @@ its owner asks it to renew what the Environment holds. The Kit acts on the
 request it acquires, never on its own:
 
 ```sh
-kit setup --house https://agents.house
+kit setup
 ```
 
 `kit worker run` performs the same step at the start of a pass, before it
@@ -558,7 +565,7 @@ command returns exactly one JSON object such as `{ "authorized": true }`.
 ## The Worker runtime
 
 ```sh
-kit worker run --house https://agents.house
+kit worker run
 ```
 
 Worker-runtime readiness validates the tmux this Kit declares support for,
@@ -1112,8 +1119,8 @@ into the evidence each spec writes under `tmp/delivery-evidence/`.
 ## Capturing
 
 ```sh
-kit source capture acme --house https://agents.house        # every declared service
-kit source capture acme notes --house https://agents.house  # one service
+kit source capture acme        # every declared service
+kit source capture acme notes  # one service
 ```
 
 Each run reads the checkpoint, acquires one bounded page, submits one batch,
@@ -1146,8 +1153,8 @@ Room and Record and exits non-zero while any stays unsaved; acquisition health
 stays about acquisition, so a failed save never changes it.
 
 ```sh
-kit source retry-files acme --house https://agents.house        # every declared service
-kit source retry-files acme notes --house https://agents.house  # one service
+kit source retry-files acme        # every declared service
+kit source retry-files acme notes  # one service
 ```
 
 `retry-files` saves only the references still outstanding. It runs no connector,
@@ -1203,8 +1210,7 @@ Git credential:
 ```sh
 kit repository capture /srv/acme \
   --room work-room \
-  --source-handle acme-repository \
-  --house https://agents.house
+  --source-handle acme-repository
 ```
 
 The command runs ordinary `git pull` in the checkout with the local User's Git
@@ -1261,9 +1267,35 @@ committed.
 Local edits, staging and commits change nothing in House until a commit is
 pushed. `refs/house/received` records the House content last received; each
 commit Kit wrote there, and each commit it acknowledged for a push, is a House
-state. The House revision of every file content Kit received, keyed by path and
-Git blob, stays in Kit home under `state/working-copies/`, outside the
-repository. A local commit is a local tree, never a House revision.
+state. The House revision of every file content Kit received, keyed by path,
+Git blob and the House state that received it, stays in Kit home under
+`state/working-copies/`, outside the repository. A local commit is a local tree, never a House revision.
+
+The resident Kit keeps every active copy current. On each pass, and whenever
+it reads the saved choice, one `POST /kit/door/discover` tells it where each
+copied Room stands, and for a Room that moved on it reads the changes after the
+copy's recorded position through `POST /kit/door/enumerate`. A changed, new or
+removed authored file becomes a commit on `refs/house/received`, its House
+revision kept in Kit home; changed, new or removed read-only content, such as
+Capture with its provenance sidecar or a House projection, is written into or
+removed from the ignored local tree, and `.gitignore` and `.ignore` follow it.
+Delivery never touches the branch, the index or a tracked file, and a push
+waiting for its outcome or its local integration keeps its record. A push takes
+each file's revision from the newest House state in its own base's history that
+received that content, so a local commit keeps the base it was made on even when
+House returns to the same text under a newer revision. A file new to the copy is tracked when a write scope
+House declares for the Room covers it more closely than a declared protected
+path, and a local file already sitting where new read-only content arrives
+stays yours: Kit neither overwrites nor later removes it. When the write scopes
+or protected paths House declares for the Room change, Kit reads the Room again
+as a reselection does. A position older than House
+retains, or from before House's database was restored, makes Kit read the Room
+again as a reselection does; while House's replica has not reached the position
+the copy waits for the next pass. A Room House no longer answers under its
+recorded handle makes Kit read the saved choice again, which follows a handle
+change or marks the copy inactive, and a Room that lost sync is named on
+standard error as `operation_denied` and keeps what it holds. `kit worker run`
+delivers once, after reading the saved choice.
 
 `house git push [commit]`, run anywhere inside a copy or one of its linked
 worktrees, submits one commit, `HEAD` by default, resolved once. Kit compares
@@ -1319,7 +1351,10 @@ commits, and pushes again. After acceptance Kit records House's result for the
 pushed paths, the contents an owner push receives or each accepted revision
 read by name, in a commit that covers the pushed one and in
 `refs/house/received`; a read-only path House regenerates, such as the Wiki
-index, stays out of Git. Kit then
+index, stays out of Git. The copy's recorded position goes back to where it
+stood when the push was sent, so the next delivery brings again anything House
+changed after the push's result, including what delivery received while the
+push awaited its answer. Kit then
 fast-forwards a clean branch still at the pushed commit, or rebases only its
 later commits. A result not yet readable, uncommitted tracked changes,
 a moved branch or a rebase conflict leave the branch as it was, with no stash or
@@ -1335,8 +1370,8 @@ Room again: if House holds the pushed content the push finishes as accepted,
 otherwise it is dropped and the next push submits it as a new operation.
 
 Deselecting a Room, or losing read access to it, marks its copy inactive:
-launches omit it, a new push is refused as `kit_working_copy_inactive`, and
-nothing local is deleted; a push already sent still settles and integrates. Selecting it again reads the Room
+launches omit it, delivery stops, a new push is refused as
+`kit_working_copy_inactive`, and nothing local is deleted; a push already sent still settles and integrates. Selecting it again reads the Room
 again, advances `refs/house/received`, and replaces only the read-only content
 Kit wrote, never the branch, the index or a tracked file. A Room the owner may
 read without sync is refused as `operation_denied` and stays uncopied, while its
@@ -1358,13 +1393,12 @@ beside `library/**`.
 
 ```sh
 kit sync bootstrap ./replica \
-  --house https://agents.house \
   --prefix /rooms/work/library \
   --prefix /rooms/work/capture \
   --prefix /private/library
-kit sync pull ./replica --house https://agents.house
-kit sync submit ./replica --house https://agents.house --changes ./changes.json
-kit sync rebootstrap ./replica --house https://agents.house
+kit sync pull ./replica
+kit sync submit ./replica --changes ./changes.json
+kit sync rebootstrap ./replica
 ```
 
 `bootstrap` writes `ROOM.md`, Library text, House-derived projections, and
@@ -1427,16 +1461,13 @@ absolute paths.
 
 ```sh
 kit attachment upload ./notes.bin \
-  --house https://agents.house \
   --room room:work \
   --media-type application/pdf
 
 kit attachment upload ./notes.bin \
-  --house https://agents.house \
   --private
 
 kit attachment get \
-  --house https://agents.house \
   --attachment at_1x.q \
   --room room:work \
   --output ./notes.bin
@@ -1482,7 +1513,7 @@ Any missing prerequisite refuses the create before House ever presents the
 workspace as constrained, naming the exact missing piece.
 
 ```sh
-kit workspace host --house https://agents.house
+kit workspace host
 ```
 
 The command acquires this host's workspace work under its Environment control
@@ -1537,7 +1568,7 @@ image from the original the Session stored.
 Bind the bot to this Environment:
 
 ```sh
-kit telegram connect --house https://agents.house
+kit telegram connect
 ```
 
 The command asks for the token on a hidden terminal prompt, or reads one line
@@ -1556,7 +1587,7 @@ proven owner's Telegram user id.
 Run the gateway:
 
 ```sh
-kit telegram serve --house https://agents.house
+kit telegram serve
 ```
 
 The command holds one Environment control lease for the whole run and performs
@@ -1602,7 +1633,7 @@ command is resident and stops on SIGINT or SIGTERM, printing what it settled.
 Release the bot:
 
 ```sh
-kit telegram disconnect --house https://agents.house
+kit telegram disconnect
 ```
 
 The command writes a local disconnect marker first, deletes the webhook, removes
@@ -1648,8 +1679,8 @@ Disabling a service or an instance leaves its state in place, so re-enabling
 resumes from the stored cursor instead of importing again.
 
 ```sh
-kit source reset acme --house https://agents.house        # every service
-kit source reset acme notes --house https://agents.house  # one service
+kit source reset acme        # every service
+kit source reset acme notes  # one service
 ```
 
 Reset is the only deletion of captured state. It removes the named checkpoints
@@ -1686,7 +1717,7 @@ refused rather than read as no limit. A ceiling is a shared ceiling, never a
 reservation, and House infers no supported Agent count from any of these values.
 
 ```sh
-kit host report --house https://agents.house
+kit host report
 ```
 
 The command reads `/proc/stat` twice a second apart, reads `/proc/meminfo`, and
@@ -1708,7 +1739,7 @@ Description=Report measured host capacity to House
 [Service]
 Type=oneshot
 User=house-kit
-ExecStart=/usr/bin/kit host report --house https://agents.house
+ExecStart=/usr/bin/kit host report
 ```
 
 ```
@@ -1757,11 +1788,10 @@ manifest, URLs, or attachments.
 
 ```sh
 kit migrate emit my-import --package /home/ada/exports/project
-kit migrate mount /home/ada/exports/project --house https://agents.house \
-  --subtree /rooms/work/library/project
+kit migrate mount /home/ada/exports/project --subtree /rooms/work/library/project
 # Or emit and mount in one maintained mount session:
 kit migrate run my-import --package /home/ada/exports/another-project \
-  --house https://agents.house --subtree /private/library/another-project
+  --subtree /private/library/another-project
 ```
 
 Emission refuses an existing output directory. The module reads one JSON line
@@ -1848,8 +1878,8 @@ leaves the pending mounted report plus the local outcomes. Re-migration is
 explicit unmount followed by mount.
 
 ```sh
-kit migrate unmount /rooms/work/library/project --house https://agents.house
-kit migrate unmount /rooms/work/library/project --house https://agents.house \
+kit migrate unmount /rooms/work/library/project
+kit migrate unmount /rooms/work/library/project \
   --confirm /rooms/work/library/project
 ```
 

package/bin/connect-linux.sh

@@ -39,7 +39,7 @@ login_kit() {
 }
 
 start_resident() {
-  docker run -d --name "$NAME" --restart unless-stopped --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident --house "$HOUSE" >/dev/null
+  docker run -d --name "$NAME" --restart unless-stopped --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident >/dev/null
 }
 
 if [[ "${1:-}" == kit || "${1:-}" == house ]]; then
@@ -168,7 +168,7 @@ if docker container inspect "$NAME" >/dev/null 2>&1; then
     printf 'House Kit updated for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
     exit 0
   fi
-  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+  "${DOCKER_RUN[@]}" credential check
   if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
     printf 'House Kit is already running for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
   else
@@ -185,15 +185,14 @@ if [[ ! -f "$KIT_HOME/kit.json" ]]; then
 fi
 
 if [[ -f "$KIT_HOME/credential" ]]; then
-  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+  "${DOCKER_RUN[@]}" credential check
 else
-  if ((MANUAL)); then
-    login_kit --house "$HOUSE" --manual
-  else
-    login_kit --house "$HOUSE"
-  fi
+  LOGIN=()
+  if ((HOUSE_SELECTED)); then LOGIN+=(--house "$HOUSE"); fi
+  if ((MANUAL)); then LOGIN+=(--manual); fi
+  login_kit "${LOGIN[@]}"
 fi
 
-"${DOCKER_RUN[@]}" apply --house "$HOUSE"
+"${DOCKER_RUN[@]}" apply
 start_resident
 printf 'House Kit connected for Environment %s.\n' "$(cat "$KIT_HOME/environment")"

package/bin/kit.js

@@ -2,7 +2,7 @@
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-import { connectHouse, storedEnvironment, storedHouse } from "../src/login.js";
+import { connectHouse, loginHouse, storedEnvironment, storedHouse } from "../src/login.js";
 import { apply } from "../src/apply.js";
 import { captureSource, resetSource, retrySourceOriginals, sourceStatus } from "../src/source.js";
 import { setupEnvironment } from "../src/setup.js";
@@ -32,44 +32,44 @@ const USAGE =
   "usage: kit <login|resident|credential|setup|apply|agents|source|repository|worker|sync|migrate|attachment|host|workspace|telegram> ...";
 const LOGIN_USAGE =
   "usage: kit login [--house <url>] [--environment <uuid>] [--manual|--host-browser]";
-const HOST_USAGE = "usage: kit host report [--house <url>] [--config <path>]";
+const HOST_USAGE = "usage: kit host report [--config <path>]";
 const AGENTS_USAGE =
-  "usage: kit agents update [--house <url>] [--config <path>] | kit agents sign-in <kind> [--house <url>] [--config <path>]";
-const WORKSPACE_USAGE = "usage: kit workspace host [--house <url>] [--config <path>] [--passes <count>]";
+  "usage: kit agents update [--config <path>] | kit agents sign-in <kind> [--config <path>]";
+const WORKSPACE_USAGE = "usage: kit workspace host [--config <path>] [--passes <count>]";
 const SOURCE_USAGE =
-  "usage: kit source <capture|reset|retry-files> <instance> [service] [--house <url>] [--config <path>]\n" +
+  "usage: kit source <capture|reset|retry-files> <instance> [service] [--config <path>]\n" +
   "       kit source status <instance> [service] [--config <path>]\n" +
   "       kit source sign-in <instance> [--config <path>]";
-const SETUP_USAGE = "usage: kit setup [--house <url>] [--config <path>]";
+const SETUP_USAGE = "usage: kit setup [--config <path>]";
 const REPOSITORY_USAGE =
-  "usage: kit repository capture <checkout> --room <room> --source-handle <handle> [--house <url>]";
+  "usage: kit repository capture <checkout> --room <room> --source-handle <handle>";
 const WORKER_USAGE =
-  "usage: kit worker run [--house <url>] [--config <path>] | kit worker attach [<session>]";
+  "usage: kit worker run [--config <path>] | kit worker attach [<session>]";
 const SYNC_USAGE =
   "usage: kit sync <bootstrap|pull|rebootstrap|submit> ...";
 const SYNC_BOOTSTRAP_USAGE =
-  "usage: kit sync bootstrap <directory> [--house <url>] --prefix <path> [--prefix <path> ...]";
-const SYNC_PULL_USAGE = "usage: kit sync pull <directory> [--house <url>]";
-const SYNC_REBOOTSTRAP_USAGE = "usage: kit sync rebootstrap <directory> [--house <url>]";
+  "usage: kit sync bootstrap <directory> --prefix <path> [--prefix <path> ...]";
+const SYNC_PULL_USAGE = "usage: kit sync pull <directory>";
+const SYNC_REBOOTSTRAP_USAGE = "usage: kit sync rebootstrap <directory>";
 const SYNC_SUBMIT_USAGE =
-  "usage: kit sync submit <directory> [--house <url>] [--changes <path>]";
+  "usage: kit sync submit <directory> [--changes <path>]";
 const MIGRATE_USAGE = "usage: kit migrate <emit|mount|unmount|run> ...";
 const MIGRATE_EMIT_USAGE =
   "usage: kit migrate emit <migrator> --package <directory> [--config <path>]";
 const MIGRATE_MOUNT_USAGE =
-  "usage: kit migrate mount <package> [--house <url>] --subtree <path>";
+  "usage: kit migrate mount <package> --subtree <path>";
 const MIGRATE_UNMOUNT_USAGE =
-  "usage: kit migrate unmount <subtree> [--house <url>] [--confirm <subtree>]";
+  "usage: kit migrate unmount <subtree> [--confirm <subtree>]";
 const MIGRATE_RUN_USAGE =
-  "usage: kit migrate run <migrator> [--house <url>] --subtree <path> --package <directory> [--config <path>]";
+  "usage: kit migrate run <migrator> --subtree <path> --package <directory> [--config <path>]";
 const ATTACHMENT_USAGE = "usage: kit attachment <upload|get> ...";
 const ATTACHMENT_UPLOAD_USAGE =
-  "usage: kit attachment upload <file> [--house <url>] (--room <ref> | --private) [--name <name>] [--media-type <type>]";
+  "usage: kit attachment upload <file> (--room <ref> | --private) [--name <name>] [--media-type <type>]";
 const ATTACHMENT_GET_USAGE =
-  "usage: kit attachment get [--house <url>] --attachment <at_ref> (--room <ref> | --private) [--output <path>]";
+  "usage: kit attachment get --attachment <at_ref> (--room <ref> | --private) [--output <path>]";
 const TELEGRAM_USAGE =
-  "usage: kit telegram <connect|disconnect> [--house <url>]\n" +
-  "       kit telegram serve [--house <url>] [--passes <count>]";
+  "usage: kit telegram <connect|disconnect>\n" +
+  "       kit telegram serve [--passes <count>]";
 
 function declared(argv, accepted, positionals, options = {}) {
   const repeated = options.repeated ?? [];
@@ -115,14 +115,10 @@ function builtGoogleOAuthClient() {
   return GOOGLE_OAUTH_CLIENT;
 }
 
-async function selectedHouse(values, directory) {
-  return storedHouse(directory, false, values["--house"]);
-}
-
 async function runLogin(args, directory) {
   const { values } = declared(args, ["--house", "--manual", "--host-browser", "--environment"], 0, { flags: ["--host-browser"] });
   if (values["--manual"] && values["--host-browser"]) throw new Error(LOGIN_USAGE);
-  const house = await storedHouse(directory, true, values["--house"]);
+  const house = await loginHouse(directory, values["--house"]);
   const presentation = values["--manual"] === true ? "manual" : "loopback";
   await connectHouse({
     house,
@@ -135,9 +131,9 @@ async function runLogin(args, directory) {
 }
 
 async function runCredentialCheck(args, directory) {
-  const { values } = declared(args, ["--house"], 0, { exact: true });
+  declared(args, [], 0, { exact: true });
   if (await storedEnvironment(directory) === null) throw new KitRefusal("kit_environment_invalid", "no enrolled Environment id");
-  const house = await selectedHouse(values, directory);
+  const house = await storedHouse(directory);
   let session;
   try {
     session = await openSession({ house, directory, acquire: true });
@@ -153,8 +149,8 @@ async function runCredentialCheck(args, directory) {
 }
 
 async function runResidentCommand(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
+  const { values } = declared(args, ["--config"], 0, { exact: true });
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const stop = () => cancellation.abort();
   process.once("SIGINT", stop);
@@ -185,9 +181,8 @@ async function runResidentDrain(args, directory) {
 }
 
 async function runSetup(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(SETUP_USAGE);
+  const { values } = declared(args, ["--config"], 0, { exact: true });
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);
@@ -240,9 +235,8 @@ async function runSourceSignIn(args, directory) {
 }
 
 async function runApply(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0);
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error("usage: kit apply --house <url> [--config <path>]");
+  const { values } = declared(args, ["--config"], 0);
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);
@@ -269,9 +263,9 @@ async function runApply(args, directory) {
 }
 
 async function runSourceCapture(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--config"], 2);
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length === 0) throw new Error(SOURCE_USAGE);
+  const { values, rest } = declared(args, ["--config"], 2);
+  if (rest.length === 0) throw new Error(SOURCE_USAGE);
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   process.once("SIGINT", () => cancellation.abort());
   const result = await captureSource(
@@ -314,9 +308,9 @@ function writeSourceOriginals(instance, service) {
 }
 
 async function runSourceRetryFiles(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--config"], 2);
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length === 0) throw new Error(SOURCE_USAGE);
+  const { values, rest } = declared(args, ["--config"], 2);
+  if (rest.length === 0) throw new Error(SOURCE_USAGE);
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   process.once("SIGINT", () => cancellation.abort());
   const result = await retrySourceOriginals({
@@ -359,9 +353,9 @@ async function runSourceStatus(args, directory) {
 }
 
 async function runSourceReset(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--config"], 2);
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length === 0) throw new Error(SOURCE_USAGE);
+  const { values, rest } = declared(args, ["--config"], 2);
+  if (rest.length === 0) throw new Error(SOURCE_USAGE);
+  const house = await storedHouse(directory);
   const result = await resetSource({
     house,
     directory,
@@ -377,11 +371,11 @@ async function runSourceReset(args, directory) {
 }
 
 async function runRepositoryCapture(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--room", "--source-handle"], 1);
-  const house = await selectedHouse(values, directory);
+  const { values, rest } = declared(args, ["--room", "--source-handle"], 1);
   const room = values["--room"];
   const sourceHandle = values["--source-handle"];
-  if (!house || !room || !sourceHandle || rest.length !== 1) throw new Error(REPOSITORY_USAGE);
+  if (!room || !sourceHandle || rest.length !== 1) throw new Error(REPOSITORY_USAGE);
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);
@@ -429,9 +423,8 @@ function writeConversationFiles(supervised) {
 }
 
 async function runWorkerRun(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0);
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(WORKER_USAGE);
+  const { values } = declared(args, ["--config"], 0);
+  const house = await storedHouse(directory);
   const supervised = await runWorkers(
     {
       house,
@@ -500,12 +493,12 @@ function syncCancellation() {
 }
 
 async function runSyncBootstrap(args, directory) {
-  const { values, lists, rest } = declared(args, ["--house", "--prefix"], 1, {
+  const { lists, rest } = declared(args, ["--prefix"], 1, {
     repeated: ["--prefix"],
     exact: true,
   });
-  const house = await selectedHouse(values, directory);
-  if (!house || lists["--prefix"].length === 0) throw new Error(SYNC_BOOTSTRAP_USAGE);
+  if (lists["--prefix"].length === 0) throw new Error(SYNC_BOOTSTRAP_USAGE);
+  const house = await storedHouse(directory);
   const run = syncCancellation();
   try {
     const result = await bootstrap({
@@ -524,9 +517,8 @@ async function runSyncBootstrap(args, directory) {
 }
 
 async function runSyncPull(args, directory) {
-  const { values, rest } = declared(args, ["--house"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(SYNC_PULL_USAGE);
+  const { rest } = declared(args, [], 1, { exact: true });
+  const house = await storedHouse(directory);
   const run = syncCancellation();
   try {
     const result = await pull({
@@ -544,9 +536,8 @@ async function runSyncPull(args, directory) {
 }
 
 async function runSyncRebootstrap(args, directory) {
-  const { values, rest } = declared(args, ["--house"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(SYNC_REBOOTSTRAP_USAGE);
+  const { rest } = declared(args, [], 1, { exact: true });
+  const house = await storedHouse(directory);
   const run = syncCancellation();
   try {
     const result = await rebootstrap({
@@ -571,9 +562,8 @@ async function readChanges(path) {
 }
 
 async function runSyncSubmit(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--changes"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(SYNC_SUBMIT_USAGE);
+  const { values, rest } = declared(args, ["--changes"], 1, { exact: true });
+  const house = await storedHouse(directory);
   const run = syncCancellation();
   try {
     const result = await submit({
@@ -646,11 +636,11 @@ async function mountEmitted(packagePath, options, run) {
 }
 
 async function runMigrateMount(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--subtree"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length !== 1 || values["--subtree"] === undefined) {
+  const { values, rest } = declared(args, ["--subtree"], 1, { exact: true });
+  if (rest.length !== 1 || values["--subtree"] === undefined) {
     throw new Error(MIGRATE_MOUNT_USAGE);
   }
+  const house = await storedHouse(directory);
   const run = migrateCancellation();
   try {
     await mountEmitted(rest[0], { house, directory, subtree: values["--subtree"] }, run);
@@ -660,18 +650,17 @@ async function runMigrateMount(args, directory) {
 }
 
 async function runMigrateRun(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--subtree", "--package", "--config"], 1, {
+  const { values, rest } = declared(args, ["--subtree", "--package", "--config"], 1, {
     exact: true,
   });
-  const house = await selectedHouse(values, directory);
   if (
-    !house ||
     rest.length !== 1 ||
     values["--subtree"] === undefined ||
     values["--package"] === undefined
   ) {
     throw new Error(MIGRATE_RUN_USAGE);
   }
+  const house = await storedHouse(directory);
   const run = migrateCancellation();
   try {
     const emitted = await emitPackage(
@@ -688,9 +677,9 @@ async function runMigrateRun(args, directory) {
 }
 
 async function runMigrateUnmount(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--confirm"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length !== 1) throw new Error(MIGRATE_UNMOUNT_USAGE);
+  const { values, rest } = declared(args, ["--confirm"], 1, { exact: true });
+  if (rest.length !== 1) throw new Error(MIGRATE_UNMOUNT_USAGE);
+  const house = await storedHouse(directory);
   const run = migrateCancellation();
   try {
     const result = await unmountSubtree({
@@ -746,12 +735,12 @@ function attachmentCancellation() {
 async function runAttachmentUpload(args, directory) {
   const { values, rest } = declared(
     args,
-    ["--house", "--room", "--private", "--name", "--media-type"],
+    ["--room", "--private", "--name", "--media-type"],
     1,
     { flags: ["--private"] },
   );
-  const house = await selectedHouse(values, directory);
-  if (!house || rest.length !== 1) throw new Error(ATTACHMENT_UPLOAD_USAGE);
+  if (rest.length !== 1) throw new Error(ATTACHMENT_UPLOAD_USAGE);
+  const house = await storedHouse(directory);
   const run = attachmentCancellation();
   try {
     const result = await uploadAttachment({
@@ -773,13 +762,13 @@ async function runAttachmentUpload(args, directory) {
 async function runAttachmentGet(args, directory) {
   const { values } = declared(
     args,
-    ["--house", "--attachment", "--room", "--private", "--output"],
+    ["--attachment", "--room", "--private", "--output"],
     0,
     { flags: ["--private"] },
   );
-  const house = await selectedHouse(values, directory);
   const attachment = values["--attachment"];
-  if (!house || !attachment) throw new Error(ATTACHMENT_GET_USAGE);
+  if (!attachment) throw new Error(ATTACHMENT_GET_USAGE);
+  const house = await storedHouse(directory);
   const run = attachmentCancellation();
   try {
     const result = await getAttachment({
@@ -805,9 +794,8 @@ async function runAttachment(args, directory) {
 }
 
 async function runHostReport(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(HOST_USAGE);
+  const { values } = declared(args, ["--config"], 0, { exact: true });
+  const house = await storedHouse(directory);
   const observed = await reportHost({
     house,
     directory,
@@ -819,9 +807,8 @@ async function runHostReport(args, directory) {
 }
 
 async function runAgentsUpdate(args, directory) {
-  const { values } = declared(args, ["--house", "--config"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(AGENTS_USAGE);
+  const { values } = declared(args, ["--config"], 0, { exact: true });
+  const house = await storedHouse(directory);
   const { updated } = await updateAgents({
     house,
     directory,
@@ -847,10 +834,10 @@ async function runAgentsUpdate(args, directory) {
 }
 
 async function runAgentsSignIn(args, directory) {
-  const { values, rest } = declared(args, ["--house", "--config"], 1, { exact: true });
-  const house = await selectedHouse(values, directory);
+  const { values, rest } = declared(args, ["--config"], 1, { exact: true });
   const [kind] = rest;
-  if (!house || !kind) throw new Error(AGENTS_USAGE);
+  if (!kind) throw new Error(AGENTS_USAGE);
+  const house = await storedHouse(directory);
   const { status, reported } = await signInAgent({
     house,
     directory,
@@ -867,13 +854,12 @@ async function runAgentsSignIn(args, directory) {
 }
 
 async function runWorkspaceHost(args, directory) {
-  const { values } = declared(args, ["--house", "--config", "--passes"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(WORKSPACE_USAGE);
+  const { values } = declared(args, ["--config", "--passes"], 0, { exact: true });
   const passes = values["--passes"] === undefined ? undefined : Number(values["--passes"]);
   if (passes !== undefined && (!Number.isSafeInteger(passes) || passes < 1)) {
     throw new Error(WORKSPACE_USAGE);
   }
+  const house = await storedHouse(directory);
   const served = await serveWorkspaces({
     house,
     directory,
@@ -894,9 +880,8 @@ async function runWorkspaceHost(args, directory) {
 }
 
 async function runTelegramConnect(args, directory) {
-  const { values } = declared(args, ["--house"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(TELEGRAM_USAGE);
+  declared(args, [], 0, { exact: true });
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);
@@ -914,9 +899,8 @@ async function runTelegramConnect(args, directory) {
 }
 
 async function runTelegramDisconnect(args, directory) {
-  const { values } = declared(args, ["--house"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(TELEGRAM_USAGE);
+  declared(args, [], 0, { exact: true });
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);
@@ -936,13 +920,12 @@ async function runTelegramDisconnect(args, directory) {
 }
 
 async function runTelegramServe(args, directory) {
-  const { values } = declared(args, ["--house", "--passes"], 0, { exact: true });
-  const house = await selectedHouse(values, directory);
-  if (!house) throw new Error(TELEGRAM_USAGE);
+  const { values } = declared(args, ["--passes"], 0, { exact: true });
   const passes = values["--passes"] === undefined ? undefined : Number(values["--passes"]);
   if (passes !== undefined && (!Number.isSafeInteger(passes) || passes < 1)) {
     throw new Error(TELEGRAM_USAGE);
   }
+  const house = await storedHouse(directory);
   const cancellation = new AbortController();
   const cancel = () => cancellation.abort();
   process.once("SIGINT", cancel);

package/bootstrap.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.20",
+  "version": "0.1.0-alpha.22",
   "hosts": {
     "linux": {
-      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.20/connect-linux.sh)",
+      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.22/connect-linux.sh)",
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.20/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.22/connect-linux.sh"
       },
       "workspace": {
         "argument": "--workspace",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.20",
+  "version": "0.1.0-alpha.22",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/contract.js

@@ -297,7 +297,7 @@ export const EXPLICIT_SYNC_VERSION = "explicit-sync/2";
 export const KIT_DOOR_UNMOUNT_PATH = "/kit/door/unmount";
 
 export const KIT_WORKING_COPY_SELECTION_PATH = "/kit/working-copy/selection";
-export const WORKING_COPY_VERSION = "working-copy-state/2";
+export const WORKING_COPY_VERSION = "working-copy-state/3";
 export const WORKING_COPIES_HOME = "working-copies";
 export const WORKING_COPY_ROOM_HOMES = ["capture", "library", "collaboration"];
 export const WORKING_COPY_PRIVATE_HOMES = ["library", "collaboration", "rooms", "agents", "house"];

package/src/login.js

@@ -14,6 +14,7 @@ import { writeText } from "./state.js";
 
 const ENVIRONMENT =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DEFAULT_HOUSE = "https://agents.house";
 
 function verifier() {
   return randomBytes(32).toString("base64url");
@@ -112,19 +113,29 @@ function houseOrigin(value) {
   return value;
 }
 
-export async function storedHouse(directory, firstLogin = false, requested = undefined) {
-  let value;
+async function recordedHouse(directory) {
   try {
-    value = (await readFile(join(directory, "house"), "utf8")).trim();
+    return (await readFile(join(directory, "house"), "utf8")).trim();
   } catch (error) {
-    if (error.code === "ENOENT") {
-      if ((firstLogin || requested !== undefined) &&
-        await storedEnvironment(directory) === null && !await storedCredentialPresent(directory)) {
-        return houseOrigin(requested ?? "https://agents.house");
-      }
-    }
+    if (error.code === "ENOENT") return null;
     throw new KitRefusal("kit_house_invalid", error.code ?? "unreadable");
   }
+}
+
+export async function storedHouse(directory) {
+  const value = await recordedHouse(directory);
+  if (value === null) throw new KitRefusal("kit_house_invalid", "ENOENT");
+  return houseOrigin(value);
+}
+
+export async function loginHouse(directory, requested) {
+  const value = await recordedHouse(directory);
+  if (value === null) {
+    if (await storedEnvironment(directory) !== null || await storedCredentialPresent(directory)) {
+      throw new KitRefusal("kit_house_invalid", "ENOENT");
+    }
+    return houseOrigin(requested ?? DEFAULT_HOUSE);
+  }
   houseOrigin(value);
   if (requested !== undefined && requested !== value) {
     throw new KitRefusal("kit_house_mismatch", "this Environment is bound to another House origin");
@@ -133,7 +144,7 @@ export async function storedHouse(directory, firstLogin = false, requested = und
 }
 
 export function enrollmentAct(options, retained, host) {
-  if (options.label !== undefined || (options.environment !== undefined && !ENVIRONMENT.test(options.environment))) {
+  if (options.environment !== undefined && !ENVIRONMENT.test(options.environment)) {
     throw new KitRefusal("kit_login_rejected", ENROLLMENT_USAGE);
   }
   const environment = options.environment ?? retained;

package/src/worker.js

@@ -19,7 +19,14 @@ import { localFiles } from "./local-files.js";
 import { answerText, answerYaml } from "./mcp.js";
 import { inheritedEnvironment } from "./command.js";
 import { watchKitWork } from "./kit-work-stream.js";
-import { applyWorkingCopies, ownerCaller, pushWorkingCopy, recordIndexChange, workingCopyPaths } from "./working-copy.js";
+import {
+  applyWorkingCopies,
+  deliverWorkingCopies,
+  ownerCaller,
+  pushWorkingCopy,
+  recordIndexChange,
+  workingCopyPaths,
+} from "./working-copy.js";
 import { readConfiguration } from "./configuration.js";
 import { launchBase, readyLaunchDirectory } from "./directory.js";
 import {
@@ -863,7 +870,7 @@ export async function runWorkers(options, dependencies = {}) {
   const { context, tmux } = await workerContext(options, dependencies);
   const { session, runtime } = context;
   const supervised = await maintainControl(session, async (signal) => {
-    await applySavedWorkingCopies(context, signal);
+    await reportedWorkingCopies(applyWorkingCopies, context, signal);
     return controlledPass(context, dependencies, context.configuration, signal);
   }, session.signal);
   return {
@@ -884,9 +891,8 @@ function reported(line) {
   process.stderr.write(`kit: ${line}\n`);
 }
 
-async function applySavedWorkingCopies(context, signal) {
-  const applied = await applyWorkingCopies(context, signal);
-  for (const refused of applied.refused) {
+async function reportedWorkingCopies(act, context, signal) {
+  for (const refused of (await act(context, signal)).refused) {
     reported(`working copy ${refused.path} refused: ${refused.code}`);
   }
 }
@@ -1078,10 +1084,12 @@ export async function runResident(options, dependencies = {}) {
       const needsLogin = await queueAgentRefresh(context, dependencies, signal, undefined, true);
       context.startLogins(needsLogin);
     });
-    const copies = coalescedTask(
-      signal,
-      (error) => reported(`working copies unavailable: ${error?.message ?? error}`),
-      () => applySavedWorkingCopies(context, signal),
+    const unavailable = (error) => reported(`working copies unavailable: ${error?.message ?? error}`);
+    const copies = coalescedTask(signal, unavailable, () =>
+      reportedWorkingCopies(applyWorkingCopies, context, signal),
+    );
+    const deliveries = coalescedTask(signal, unavailable, () =>
+      reportedWorkingCopies(deliverWorkingCopies, context, signal),
     );
     const pointer = () => {
       if (!update.requested) agentRefresh.trigger();
@@ -1114,18 +1122,20 @@ export async function runResident(options, dependencies = {}) {
           if (sessions.length > 0) update.answer({ ready: false, sessions });
           else if (
             session.refused ||
-            (!served.serving() && logins.size === 0 && agentRefresh.idle() && copies.idle())
+            (!served.serving() && logins.size === 0 && agentRefresh.idle() && copies.idle() && deliveries.idle())
           ) {
             return;
           }
         }
         await wake.wait(interval, signal);
+        if (!update.requested && !session.refused) deliveries.trigger();
       }
     } finally {
       watcher.abort();
       await watching;
       await agentRefresh.settled();
       await copies.settled();
+      await deliveries.settled();
       for (const running of logins.values()) running.controller.abort();
       await Promise.all([...logins.values()].map((running) => running.task));
       await context.agentRefresh;

package/src/working-copy.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { mkdir, readdir, realpath, rename, rm, stat } from "node:fs/promises";
+import { mkdir, readdir, readFile, realpath, rename, rm, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { readBindings } from "./binding.js";
 import {
@@ -21,7 +21,7 @@ import { operationId } from "./operation.js";
 import { formatCommandError, houseAnswered, houseFailed, KitRefusal } from "./refusal.js";
 import { readNote, writeNote, writeText } from "./state.js";
 import { bootstrapBundle, discoveryOf, door, withSession } from "./sync.js";
-import { sidecarPath, structuredOrReplace } from "./sync-library.js";
+import { isGeneratedProvenance, sidecarPath, structuredOrReplace } from "./sync-library.js";
 import { locate, removeReplicaFile, writeReplicaFile } from "./sync-state.js";
 
 const COMMITTER_NAME = "House Kit";
@@ -134,6 +134,7 @@ async function readScope(session, scope, signal) {
   if (
     authority === undefined ||
     !Array.isArray(authority.protected_paths) ||
+    !Array.isArray(authority.operations?.write) ||
     (scope.kind === "room" && view.manifest.anchor !== scope.ref)
   ) {
     throw rejected("discover");
@@ -142,11 +143,16 @@ async function readScope(session, scope, signal) {
     anchor: view.manifest.anchor,
     position: view.manifest.position,
     logEpoch: view.manifest.log_epoch,
-    protectedPaths: authority.protected_paths.filter((path) => typeof path === "string"),
+    protectedPaths: authority.protected_paths,
+    declared: declaration(authority),
     files,
   };
 }
 
+function declaration(authority) {
+  return { write: authority.operations.write, protected: authority.protected_paths };
+}
+
 function importData(text) {
   const bytes = Buffer.from(text, "utf8");
   return [Buffer.from(`data ${bytes.length}\n`), bytes, Buffer.from("\n")];
@@ -210,16 +216,28 @@ async function commitOf(repository, name, signal) {
   return commit.toString("utf8").trim();
 }
 
-async function remembered(repository, revisions, commit, files, signal) {
+async function remembered(repository, revisions, commit, files, signal, acknowledged = false) {
   const tree = await treeOf(repository, commit, signal);
   const next = { ...revisions };
   for (const { path, revision } of files) {
     const entry = tree.get(path);
-    if (entry !== undefined && revision !== null) next[path] = { ...next[path], [entry.object]: revision };
+    if (entry === undefined || revision === null) continue;
+    const seen = next[path]?.[entry.object] ?? [];
+    if (acknowledged || seen.at(-1)?.revision !== revision) {
+      next[path] = { ...next[path], [entry.object]: [...seen, { commit, revision }] };
+    }
   }
   return next;
 }
 
+async function revisionAt(copy, path, entry, base, signal) {
+  const seen = entry === undefined ? [] : (copy.revisions[path]?.[entry.object] ?? []);
+  for (const known of seen.toReversed()) {
+    if (seen.length === 1 || (await contains(copy.repository, known.commit, base, signal))) return known.revision;
+  }
+  return undefined;
+}
+
 function readOnlyContents(read) {
   const contents = new Map();
   for (const file of read.files) {
@@ -244,19 +262,22 @@ async function trackedPaths(repository, signal) {
   return new Set(listed.toString("utf8").split("\0").filter((path) => path !== ""));
 }
 
-async function replaceReadOnly(repository, previous, next, signal) {
+async function replaceReadOnly(repository, held, written, removed, signal) {
   const tracked = await trackedPaths(repository, signal);
-  const held = new Set(previous);
-  for (const [path, content] of next) {
+  const holding = new Set(held);
+  for (const [path, content] of written) {
     if (tracked.has(path)) continue;
     const target = locate(repository, "", path);
     if (!held.has(path) && (await present(target))) continue;
     await writeReplicaFile(target, content, signal);
+    holding.add(path);
   }
-  for (const path of held) {
-    if (next.has(path) || tracked.has(path)) continue;
-    await removeReplicaFile(locate(repository, "", path));
+  for (const path of removed) {
+    if (!held.has(path)) continue;
+    if (!tracked.has(path)) await removeReplicaFile(locate(repository, "", path));
+    holding.delete(path);
   }
+  return [...holding];
 }
 
 function covers(path, prefix) {
@@ -304,17 +325,16 @@ async function writeIgnoreRules(repository, read, signal) {
     ...[...house, ...granted].map((pattern) => `!${pattern}`),
     "",
   ];
-  await writeText(join(repository, ".gitignore"), gitignore.join("\n"), signal, 0o644);
-  await writeText(join(repository, ".ignore"), ignore.join("\n"), signal, 0o644);
+  await ruled(join(repository, ".gitignore"), gitignore.join("\n"), signal);
+  await ruled(join(repository, ".ignore"), ignore.join("\n"), signal);
 }
 
-function manifest(read, commit) {
-  return {
-    commit,
-    position: read.position,
-    log_epoch: read.logEpoch,
-    read_only: [...readOnlyContents(read).keys()],
-  };
+async function ruled(path, rules, signal) {
+  if ((await readFile(path, "utf8").catch(() => null)) !== rules) await writeText(path, rules, signal, 0o644);
+}
+
+function manifest(read, commit, readOnly) {
+  return { commit, position: read.position, log_epoch: read.logEpoch, read_only: readOnly, declared: read.declared };
 }
 
 function copyPath(directory, copy) {
@@ -376,6 +396,7 @@ async function materialize(context, scope, signal) {
   const imported = received(scope, read, []);
   let commit;
   let revisions;
+  let readOnly;
   try {
     await runGit(staging, ["init", "-q", "-b", WORKING_COPY_BRANCH], { signal, failure: GIT_FAILED });
     commit = (await importReceived(staging, imported, signal)).received;
@@ -385,7 +406,7 @@ async function materialize(context, scope, signal) {
       failure: GIT_FAILED,
     });
     await runGit(staging, ["read-tree", "-m", "-u", "HEAD"], { signal, failure: GIT_FAILED });
-    await replaceReadOnly(staging, [], readOnlyContents(read), signal);
+    readOnly = await replaceReadOnly(staging, new Set(), readOnlyContents(read), [], signal);
     await writeIgnoreRules(staging, read, signal);
     await rename(staging, repository);
   } catch (error) {
@@ -399,7 +420,7 @@ async function materialize(context, scope, signal) {
     room_handle: scope.handle,
     repository,
     active: true,
-    received: manifest(read, commit),
+    received: manifest(read, commit, readOnly),
     revisions,
   });
 }
@@ -409,11 +430,14 @@ async function receive(context, copy, scope, signal) {
   if (read.anchor !== copy.room_ref) throw rejected("bootstrap");
   const imported = received(scope, read, [copy.received.commit]);
   const commit = (await importReceived(copy.repository, imported, signal)).received;
-  await replaceReadOnly(copy.repository, copy.received.read_only, readOnlyContents(read), signal);
+  const next = readOnlyContents(read);
+  const held = copy.received.read_only;
+  const removed = held.filter((path) => !next.has(path));
+  const readOnly = await replaceReadOnly(copy.repository, new Set(held), next, removed, signal);
   await writeIgnoreRules(copy.repository, read, signal);
   return {
     ...copy,
-    received: manifest(read, commit),
+    received: manifest(read, commit, readOnly),
     revisions: await remembered(copy.repository, copy.revisions, commit, imported.files, signal),
   };
 }
@@ -432,6 +456,117 @@ function scopeRefused(error) {
   return error instanceof KitRefusal && (houseAnswered(error) || error.code.startsWith("kit_working_copy_"));
 }
 
+function declaredWritable(path, authority) {
+  const deepest = (scopes) =>
+    Math.max(-1, ...scopes.filter((scope) => scope === "" || covers(path, scope)).map((scope) => scope.length));
+  return deepest(authority.operations.write) > deepest(authority.protected_paths);
+}
+
+async function incorporated(copy, view, authority, signal) {
+  const tree = await treeOf(copy.repository, copy.received.commit, signal);
+  const held = new Set(copy.received.read_only);
+  const files = [];
+  const written = new Map();
+  const removed = [];
+  for (const change of view.changes) {
+    const gone = change.removed === true;
+    if (tree.has(change.path) || (!gone && !held.has(change.path) && declaredWritable(change.path, authority))) {
+      files.push({ path: change.path, revision: gone ? null : change.revision, content: gone ? null : change.content });
+    } else if (gone) {
+      removed.push(change.path, sidecarPath(change.path));
+    } else {
+      written.set(change.path, change.content);
+      if (typeof change.provenance === "string") written.set(sidecarPath(change.path), change.provenance);
+    }
+  }
+  const message = `House ${housePath(scopeOf(copy))} at position ${view.position}`;
+  const commit =
+    files.length === 0
+      ? copy.received.commit
+      : (await importReceived(copy.repository, { message, parents: [copy.received.commit], files }, signal)).received;
+  const readOnly = await replaceReadOnly(copy.repository, held, written, removed, signal);
+  if (view.changes.length > 0) {
+    const listed = [
+      ...[...(await treeOf(copy.repository, commit, signal)).keys()].map((path) => ({ path, writable: true })),
+      ...readOnly.filter((path) => !isGeneratedProvenance(path)).map((path) => ({ path, writable: false })),
+    ].sort((left, right) => (left.path < right.path ? -1 : 1));
+    await writeIgnoreRules(copy.repository, { files: listed, protectedPaths: authority.protected_paths }, signal);
+  }
+  return {
+    ...copy,
+    received: { ...copy.received, commit, position: view.position, log_epoch: view.log_epoch, read_only: readOnly },
+    revisions: await remembered(copy.repository, copy.revisions, commit, files, signal),
+  };
+}
+
+async function deliver(context, path, authority, signal) {
+  if (
+    typeof authority.position !== "string" ||
+    typeof authority.log_epoch !== "string" ||
+    !Array.isArray(authority.protected_paths) ||
+    !Array.isArray(authority.operations?.write)
+  ) {
+    throw rejected("discover");
+  }
+  let copy = await readCopy(path);
+  if (copy?.active && JSON.stringify(copy.received.declared) !== JSON.stringify(declaration(authority))) {
+    await writeCopy(context.directory, await receive(context, copy, scopeOf(copy), signal), signal);
+    return;
+  }
+  while (
+    copy?.active &&
+    (copy.received.log_epoch !== authority.log_epoch || BigInt(copy.received.position) < BigInt(authority.position))
+  ) {
+    const since = { position: copy.received.position, log_epoch: copy.received.log_epoch };
+    let view;
+    try {
+      view = await enumerated(context, copy, since, signal);
+    } catch (error) {
+      if (error.code === "replica_behind") return;
+      if (error.code !== "position_expired") throw error;
+      await writeCopy(context.directory, await receive(context, copy, scopeOf(copy), signal), signal);
+      return;
+    }
+    if (view.position === since.position) return;
+    copy = await incorporated(copy, view, authority, signal);
+    await writeCopy(context.directory, copy, signal);
+  }
+}
+
+async function delivering(context, signal) {
+  const copies = (await heldCopies(context.directory)).filter((copy) => copy.active);
+  if (copies.length === 0) return { refused: [], lost: false };
+  const prefixes = copies.flatMap((copy) => selectedPrefixes(scopeOf(copy)));
+  const discovery = discoveryOf(await door(context.session, KIT_DOOR_DISCOVER_PATH, { prefixes }, signal));
+  const refused = [];
+  let lost = false;
+  for (const copy of copies) {
+    const at = housePath(scopeOf(copy));
+    const authority = discovery.authorities.find((entry) => entry?.room_ref === copy.room_ref);
+    if (authority === undefined) {
+      lost = true;
+      continue;
+    }
+    if (authority.managed_replication !== "admitted") {
+      refused.push({ path: at, code: "operation_denied" });
+      continue;
+    }
+    const path = copyPath(context.directory, copy);
+    try {
+      await exclusively(path, () => deliver(context, path, authority, signal));
+    } catch (error) {
+      if (!scopeRefused(error)) throw error;
+      refused.push({ path: at, code: error.code });
+    }
+  }
+  return { refused, lost };
+}
+
+export async function deliverWorkingCopies(context, signal) {
+  const delivered = await delivering(context, signal);
+  return delivered.lost ? applyWorkingCopies(context, signal) : { refused: delivered.refused };
+}
+
 export async function applyWorkingCopies(context, signal) {
   const selected = (await savedSelection(context.session, signal)).filter(
     (scope) => scope.kind === "private" || scope.handle !== null,
@@ -461,7 +596,7 @@ export async function applyWorkingCopies(context, signal) {
       refused.push({ path: housePath(scope), code: error.code });
     }
   }
-  return { refused };
+  return { refused: [...refused, ...(await delivering(context, signal)).refused] };
 }
 
 export async function workingCopyPaths(directory) {
@@ -694,8 +829,8 @@ function renamed(chains, reached, before, after) {
   return new Map(pairs.filter(([from, to]) => pairs.filter((pair) => pair[0] === from || pair[1] === to).length === 1));
 }
 
-async function relocated(copy, root, [from, to], prior, next, signal) {
-  const base = copy.revisions[from]?.[prior.object];
+async function relocated(copy, root, [from, to], [prior, next], house, signal) {
+  const base = await revisionAt(copy, from, prior, house, signal);
   const rename = { op: "rename", path: `${root}/${from}`, to: `${root}/${to}`, base };
   if (prior.object === next.object) return [rename];
   return [rename, { op: "replace", path: `${root}/${to}`, base, content: await blobText(copy.repository, next, to, signal) }];
@@ -713,13 +848,13 @@ async function derived(copy, base, commit, signal) {
     const prior = before.get(path);
     if (moved.has(path)) {
       const to = moved.get(path);
-      changes.push(...(await relocated(copy, root, [path, to], prior, after.get(to), signal)));
+      changes.push(...(await relocated(copy, root, [path, to], [prior, after.get(to)], base, signal)));
       continue;
     }
     const next = after.get(path);
     if (prior?.object === next?.object) continue;
     const target = `${root}/${path}`;
-    const revision = copy.revisions[path]?.[prior?.object];
+    const revision = await revisionAt(copy, path, prior, base, signal);
     if (next === undefined) {
       changes.push({ op: "remove", path: target, base: revision });
       continue;
@@ -761,8 +896,15 @@ async function recorded(copy, files, message, acknowledging, signal) {
   return {
     copy: {
       ...copy,
-      received: { ...copy.received, commit: imported.received },
-      revisions: await remembered(copy.repository, copy.revisions, imported.received, files, signal),
+      received: { ...copy.received, commit: imported.received, ...(acknowledging === null ? {} : copy.push.from) },
+      revisions: await remembered(
+        copy.repository,
+        copy.revisions,
+        imported.acknowledged ?? imported.received,
+        files,
+        signal,
+        imported.acknowledged !== null,
+      ),
     },
     acknowledged: imported.acknowledged,
   };
@@ -952,11 +1094,12 @@ async function expired(context, copy, text, signal) {
     const entry = house.get(path);
     written.push({
       path: `${root}/${path}`,
-      revision: entry === undefined ? null : confirmed.revisions[path][entry.object],
+      revision: entry === undefined ? null : await revisionAt(confirmed, path, entry, confirmed.received.commit, signal),
       content: await blobText(copy.repository, entry, path, signal),
     });
   }
-  const accepted = { ...confirmed, push: { ...push, state: "accepted", written } };
+  const from = { position: confirmed.received.position, log_epoch: confirmed.received.log_epoch };
+  const accepted = { ...confirmed, push: { ...push, state: "accepted", written, from } };
   await writeCopy(context.directory, accepted, signal);
   return finish(context, accepted, signal);
 }
@@ -1030,6 +1173,7 @@ async function pushed(context, path, at, selector, caller, signal) {
       operation_id: operationId(),
       changes,
       commit,
+      from: { position: copy.received.position, log_epoch: copy.received.log_epoch },
       worktree: at.worktree,
       branch,
       ...(since === null ? {} : { since }),