@agentunion/fastaun-browser 0.5.19 → 0.5.20

package/dist/ownership-workflow.js

@@ -81,8 +81,8 @@ export function parseOwnershipMessage(content) {
     ownershipAid(message.sub_aid, 'sub_aid');
     ownershipAid(message.owner_aid, 'owner_aid');
     ownershipInteger(message.base_relation_version, 'base_relation_version', 0);
-    if (ownershipInteger(message.target_relation_version, 'target_relation_version') !== message.base_relation_version + 1)
-        throw new ValidationError('ownership target version must be base plus one');
+    if (ownershipInteger(message.target_relation_version, 'target_relation_version') !== message.base_relation_version + (message.operation === 'release' ? 0 : 1))
+        throw new ValidationError('ownership target version does not match operation');
     if (message.operation === 'transfer') {
         if (ownershipAid(message.new_owner_aid, 'new_owner_aid') === message.owner_aid)
             throw new ValidationError('transfer target must differ from current owner');
@@ -149,7 +149,8 @@ export function validateOwnershipMessage(message, context) {
             throw failure('unsupported_protocol', 'NS ownership protocol is unavailable');
         const base = ns.relation_version === message.base_relation_version && (message.operation === 'bind' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === message.owner_aid);
         const target = ns.relation_version === message.target_relation_version && (message.operation === 'release' ? ns.lock === 'unlocked' && !ns.owner_aid : ns.lock === 'locked' && ns.owner_aid === targetOwner(message));
-        if (message.action !== 'operation.stopped' && (['relation.confirmed', 'sub.cleaned'].includes(message.action) ? !target : !base && !target))
+        const cleaned = message.action === 'sub.cleaned' && Boolean(task) && ns.relation_version === 0 && ns.lock === 'unlocked' && !ns.owner_aid;
+        if (message.action !== 'operation.stopped' && (['relation.confirmed', 'sub.cleaned'].includes(message.action) ? !target && !cleaned : !base && !target))
             throw failure('conflict', 'ownership current NS relation does not match this task');
     }
 }
@@ -215,10 +216,12 @@ export class OwnershipWorkflow {
         const task = snapshot.record;
         const localAid = this.deps.currentAid();
         try {
+            if (!Number.isSafeInteger(snapshot.revision) || snapshot.revision < 1)
+                throw new Error('invalid persisted task revision');
             if (task.schema_version !== 1 || !['pending', 'completed', 'rejected', 'stopped', 'error'].includes(task.status) || !['pending', 'accept', 'reject'].includes(task.local_decision) || typeof task.step !== 'string')
                 throw new Error('invalid task state');
             parseOwnershipMessage({ ...this.message(task, task.operation === 'bind' ? 'bind.request' : task.operation === 'transfer' ? 'transfer.request' : 'relation.confirmed') });
-            if (!participants(task).includes(task.initiator_aid) || JSON.stringify(task.local_roles) !== JSON.stringify(ownershipLocalRoles(task, localAid)) || !task.local_roles.length)
+            if (!participants(task).includes(task.initiator_aid) || task.operation !== 'bind' && task.initiator_aid !== task.owner_aid || JSON.stringify(task.local_roles) !== JSON.stringify(ownershipLocalRoles(task, localAid)) || !task.local_roles.length)
                 throw new Error('invalid local task identity');
             if (!task.approvals || typeof task.approvals !== 'object' || Array.isArray(task.approvals) || Object.entries(task.approvals).some(([aid, decision]) => !participants(task).includes(aid) || !['pending', 'accept', 'reject'].includes(decision)))
                 throw new Error('invalid task approvals');
@@ -226,6 +229,30 @@ export class OwnershipWorkflow {
                 throw new Error('incomplete task approvals or initiator decision');
             if (!task.files || typeof task.files !== 'object' || Array.isArray(task.files) || !Array.isArray(task.inbox) || !Array.isArray(task.received) || !Array.isArray(task.outbox) || !Array.isArray(task.sent) || !task.hints || typeof task.hints !== 'object' || typeof task.request_validated !== 'boolean')
                 throw new Error('invalid task journals');
+            const base = task.base_agent_md;
+            if (!base && (task.request_validated || Object.keys(task.files).length || task.local_decision !== 'pending'))
+                throw new Error('missing original agent.md context');
+            if (base) {
+                if (typeof base.exists !== 'boolean' || typeof base.raw !== 'string' || typeof base.etag !== 'string' || base.exists && !base.etag || base.sha256 !== await ownershipSha256(base.raw))
+                    throw new Error('invalid original agent.md bytes or ETag');
+                const statement = base.exists ? parseOwnershipFile(base.raw, 'agent', { expectedSubAid: task.sub_aid }).statement : undefined;
+                if ((statement?.relation_version ?? 0) !== task.base_relation_version || statement && task.operation !== 'bind' && statement.owner_aid !== task.owner_aid || (statement ? !this.sameStatement(statement, base.statement ?? undefined) : base.statement !== null))
+                    throw new Error('invalid original agent.md statement');
+            }
+            if (task.base_owner_md) {
+                const prior = task.base_owner_md;
+                if (typeof prior.exists !== 'boolean' || typeof prior.raw !== 'string' || prior.sha256 !== (prior.exists ? await ownershipSha256(prior.raw) : '') || !prior.exists && prior.raw !== '')
+                    throw new Error('invalid original owner.md context');
+                if (base?.statement && !prior.exists && (task.operation === 'transfer' || task.operation === 'release' && task.local_roles.includes('owner')))
+                    throw new Error('missing original owner.md relation');
+                if (prior.exists) {
+                    const file = parseOwnershipFile(prior.raw, 'owner', { expectedSubAid: task.sub_aid });
+                    if (!file.statement || file.statement.owner_aid !== base?.statement?.owner_aid || file.statement.relation_version !== base?.statement?.relation_version)
+                        throw new Error('invalid original owner.md statement');
+                }
+            }
+            if (base?.statement && !task.base_owner_md && !(task.operation === 'release' && task.local_roles.includes('sub') && !task.local_roles.includes('owner') && task.cleanup_authorization_operation_id && !task.files.cleanup))
+                throw new Error('missing original owner.md context');
             if (task.approvals[localAid] !== task.local_decision)
                 throw new Error('task decision and approval differ');
             if (task.status === 'completed' && (task.verified_relation_version !== task.target_relation_version || task.operation !== 'release' && task.local_decision !== 'accept'))
@@ -239,8 +266,11 @@ export class OwnershipWorkflow {
                 if (!['agent', 'owner', 'release', 'transfer', 'cleanup'].includes(key) || !prepared || typeof prepared.raw !== 'string' || !/^[0-9a-f]{64}$/.test(prepared.sha256) || await ownershipSha256(prepared.raw) !== prepared.sha256 || !prepared.condition || typeof prepared.condition !== 'object' || Array.isArray(prepared.condition))
                     throw new Error('invalid prepared file bytes');
                 const condition = prepared.condition;
-                if (Object.keys(condition).length !== 1 || (agentFile ? !(typeof condition.if_match === 'string' && condition.if_match || condition.if_none_match === '*') : typeof condition.expected_revision !== 'string' || !condition.expected_revision))
+                if (agentFile ? Object.keys(condition).length !== 1 || !(typeof condition.if_match === 'string' && condition.if_match || condition.if_none_match === '*') : Object.keys(condition).length !== 0)
                     throw new Error('invalid prepared file condition');
+                const original = prepared.original_owner;
+                if (!agentFile && (!original || typeof original.exists !== 'boolean' || typeof original.raw !== 'string' || original.sha256 !== (original.exists ? await ownershipSha256(original.raw) : '') || !original.exists && original.raw !== ''))
+                    throw new Error('invalid prepared owner original');
                 if (key === 'cleanup' && task.operation !== 'release' || key === 'release' && task.operation !== 'release' || key === 'transfer' && task.operation !== 'transfer' || ['agent', 'owner'].includes(key) && task.operation === 'release')
                     throw new Error('invalid prepared file operation');
                 const ownerAid = key === 'owner' || key === 'agent' ? targetOwner(task) : task.owner_aid;
@@ -252,7 +282,7 @@ export class OwnershipWorkflow {
                 const fileExpiry = prepared.expires_at;
                 if (!agentFile && file.action !== (key === 'owner' ? 'declare' : key === 'release' ? 'release' : 'transfer_owner') || key === 'transfer' && (typeof fileExpiry !== 'number' || !Number.isSafeInteger(fileExpiry) || fileExpiry <= 0 || fileExpiry !== task.expires_at || file.transfer?.new_owner_aid !== task.new_owner_aid || file.transfer?.target_relation_version !== task.target_relation_version || file.transfer?.expires_at !== fileExpiry) || key !== 'transfer' && fileExpiry !== undefined)
                     throw new Error('invalid prepared file authorization');
-                if (prepared.published_revision !== undefined && (agentFile || typeof prepared.published_revision !== 'string' || !prepared.published_revision) || prepared.published_etag !== undefined && (!agentFile || typeof prepared.published_etag !== 'string' || !prepared.published_etag) || prepared.cleaned !== undefined && typeof prepared.cleaned !== 'boolean')
+                if (prepared.published_etag !== undefined && (!agentFile || typeof prepared.published_etag !== 'string' || !prepared.published_etag) || prepared.cleaned !== undefined && typeof prepared.cleaned !== 'boolean')
                     throw new Error('invalid prepared file result');
             }
             if (task.release_cleanup !== undefined) {
@@ -266,19 +296,27 @@ export class OwnershipWorkflow {
             }
             if (task.status === 'completed') {
                 const consensus = task.verified_consensus;
-                if (!consensus || consensus.protocol !== '2.1' || consensus.sub_aid !== task.sub_aid || consensus.relation_version !== task.target_relation_version || typeof consensus.agent_md_etag !== 'string' || !consensus.agent_md_etag || !/^[0-9a-f]{64}$/.test(consensus.agent_md_sha256))
+                const cleaned = task.operation === 'release' && consensus?.status === 'unbound' && consensus.relation_version === 0 && Boolean(await this.cleanupEvidence(task, consensus));
+                if (!consensus || consensus.protocol !== '2.1' || consensus.sub_aid !== task.sub_aid || !cleaned && consensus.relation_version !== task.target_relation_version || typeof consensus.agent_md_etag !== 'string' || !consensus.agent_md_etag || !/^[0-9a-f]{64}$/.test(consensus.agent_md_sha256))
                     throw new Error('invalid persisted consensus evidence');
                 if (task.operation === 'release') {
-                    if (consensus.status !== 'released' || consensus.lock !== 'unlocked' || consensus.owner_aid !== null || task.local_roles.includes('owner') && !task.files.release)
+                    if (!cleaned && consensus.status !== 'released' || consensus.lock !== 'unlocked' || consensus.owner_aid !== null || task.local_roles.includes('owner') && !task.files.release)
                         throw new Error('invalid persisted release evidence');
                 }
                 else {
-                    if (consensus.status !== 'consensus' || consensus.lock !== 'locked' || consensus.owner_aid !== targetOwner(task) || typeof consensus.owner_md_revision !== 'string' || !consensus.owner_md_revision || !/^[0-9a-f]{64}$/.test(consensus.owner_md_sha256))
+                    if (consensus.status !== 'consensus' || consensus.lock !== 'locked' || consensus.owner_aid !== targetOwner(task) || !/^[0-9a-f]{64}$/.test(consensus.owner_md_sha256))
                         throw new Error('invalid persisted binding evidence');
                     if (task.local_roles.includes('sub') && task.files.agent?.sha256 !== consensus.agent_md_sha256 || task.local_roles.includes(task.operation === 'transfer' ? 'new_owner' : 'owner') && task.files.owner?.sha256 !== consensus.owner_md_sha256 || task.operation === 'transfer' && task.local_roles.includes('owner') && !task.files.transfer)
                         throw new Error('persisted consensus differs from local original files');
                 }
             }
+            for (const key of task.received) {
+                if (typeof key !== 'string' || key.split('|').length !== 2)
+                    throw new Error('invalid received journal');
+                const [fromAid, action] = key.split('|');
+                const message = parseOwnershipMessage(this.message(task, action));
+                validateOwnershipMessage(message, { authenticated_from_aid: fromAid, local_aid: localAid, task });
+            }
             for (const item of task.inbox) {
                 parseOwnershipMessage(item.payload);
                 validateOwnershipMessage(item.payload, { authenticated_from_aid: item.from_aid, local_aid: localAid, task });
@@ -287,6 +325,11 @@ export class OwnershipWorkflow {
             }
             for (const item of task.outbox) {
                 parseOwnershipMessage(item.payload);
+                const action = item.payload.action;
+                if (['bind.accept', 'transfer.accept', 'owner.ready', 'transfer.ready'].includes(action) && task.local_decision !== 'accept' || ['bind.reject', 'transfer.reject'].includes(action) && task.local_decision !== 'reject')
+                    throw new Error('invalid outbox local approval');
+                if (['bind.accept', 'transfer.accept', 'bind.reject', 'transfer.reject'].includes(action) && !task.request_validated)
+                    throw new Error('invalid outbox received request');
                 validateOwnershipMessage(item.payload, { authenticated_from_aid: localAid, local_aid: item.to_aid, task });
                 if (item.key !== `${item.to_aid}|${item.payload.action}` || typeof item.message_id !== 'string' || !/^m-[0-9a-f]{32}$/.test(item.message_id))
                     throw new Error('invalid outbox target');
@@ -394,7 +437,7 @@ export class OwnershipWorkflow {
                 if (!saved && !initial)
                     throw failure('operation_not_found', 'ownership operation was not found');
                 if (!saved && initial) {
-                    const existing = (await this.records(aid)).find((task) => task.sub_aid === subAid && this.ongoing(task));
+                    const existing = (await this.records(aid, subAid)).find((task) => task.sub_aid === subAid && this.ongoing(task));
                     if (existing) {
                         if (!this.sameIntent(existing, initial) || existing.base_relation_version !== initial.base_relation_version || existing.target_relation_version !== initial.target_relation_version)
                             throw failure('conflict', 'another local operation for this sub is pending');
@@ -435,7 +478,7 @@ export class OwnershipWorkflow {
     sameIntent(task, intent) {
         return task.initiator_aid === intent.initiator_aid && task.operation === intent.operation && task.sub_aid === intent.sub_aid && task.owner_aid === intent.owner_aid && task.new_owner_aid === intent.new_owner_aid;
     }
-    async records(aid) {
+    async records(aid, subAid) {
         let snapshots;
         try {
             snapshots = await this.storage().listOwnershipTasks(aid);
@@ -443,32 +486,39 @@ export class OwnershipWorkflow {
         catch (error) {
             throw failure('persistence_unavailable', `ownership task list failed: ${String(error)}`);
         }
-        return await Promise.all(snapshots.map((snapshot) => this.record(snapshot)));
+        return await Promise.all(snapshots.filter((snapshot) => !subAid || typeof snapshot.record.sub_aid !== 'string' || snapshot.record.sub_aid === subAid).map((snapshot) => this.record(snapshot)));
     }
     async observe(subAid) {
         this.requireApplicable(subAid);
         const snapshot = await this.deps.files.readAgent(subAid);
-        const file = snapshot.exists ? snapshot.lock === 'unlocked' && snapshot.relation_version > 0
-            ? parseOwnershipFile(snapshot.content, 'agent', { expectedSubAid: subAid })
-            : await this.deps.files.verify(snapshot.content, 'agent', subAid) : null;
+        const file = snapshot.exists ? await this.deps.files.verify(snapshot.content, 'agent', subAid) : null;
         if (file)
             requireOwnershipApplicable(file.frontmatter.type);
-        if (snapshot.lock === 'unlocked' && snapshot.relation_version === 0 && file?.statement)
+        if ((file?.statement?.relation_version ?? 0) !== snapshot.relation_version)
             throw failure('unavailable', 'NS relation metadata does not match agent.md', true);
         if (snapshot.lock === 'locked' && (!file?.statement || file.statement.relation_version !== snapshot.relation_version || snapshot.owner_aid !== undefined && snapshot.owner_aid !== file.statement.owner_aid))
             throw failure('unavailable', 'NS lock and current signed agent.md differ', true);
         return { ...snapshot, file, owner_aid: snapshot.lock === 'locked' ? file.statement.owner_aid : null };
     }
     isBase(task, ns) {
-        return ns.relation_version === task.base_relation_version && (task.operation === 'bind' ? ns.lock === 'unlocked' : ns.lock === 'locked' && ns.owner_aid === task.owner_aid);
+        const base = task.base_agent_md;
+        return ns.relation_version === task.base_relation_version && (task.operation === 'bind' ? ns.lock === 'unlocked' : ns.lock === 'locked' && ns.owner_aid === task.owner_aid) && (!base || base.exists === ns.exists && (base.statement ? this.sameStatement(base.statement, ns.file?.statement) : !ns.file?.statement && base.raw === ns.content && base.etag === ns.etag));
+    }
+    async captureBase(task, ns) {
+        if (!task.base_agent_md)
+            task.base_agent_md = { exists: ns.exists, raw: ns.content, sha256: await ownershipSha256(ns.content), etag: ns.etag, statement: ns.file?.statement ?? null };
+        if (!task.base_owner_md) {
+            const prior = ns.file?.statement ? await this.deps.files.readOwner(ns.file.statement.owner_aid, task.sub_aid) : null;
+            task.base_owner_md = prior ? { exists: prior.exists, raw: prior.content, sha256: prior.sha256 } : { exists: false, raw: '', sha256: '' };
+        }
     }
     isTarget(task, ns) {
         return ns.relation_version === task.target_relation_version && (task.operation === 'release' ? ns.lock === 'unlocked' : ns.lock === 'locked' && ns.owner_aid === targetOwner(task));
     }
-    fileTask(context) {
-        const task = { ...context.task, files: context.task.files,
-            persist: async () => { context.task.expires_at = task.expires_at; context.task.authorization_sha256 = task.authorization_sha256; await this.save(context); },
-            guard: async () => { context.task.expires_at = task.expires_at; context.task.authorization_sha256 = task.authorization_sha256; await this.save(context); } };
+    fileTask(context, expectedStatement) {
+        const task = { ...context.task, files: context.task.files, expected_agent_statement: expectedStatement,
+            persist: async () => { context.task.expires_at = task.expires_at; context.task.authorization_sha256 = task.authorization_sha256; context.task.base_agent_md = task.base_agent_md; context.task.base_owner_md = task.base_owner_md; await this.save(context); },
+            guard: async () => { context.task.expires_at = task.expires_at; context.task.authorization_sha256 = task.authorization_sha256; context.task.base_agent_md = task.base_agent_md; context.task.base_owner_md = task.base_owner_md; await this.save(context); } };
         return task;
     }
     async start(operation, subAid, ownerAid, newOwnerAid, requestedId, guard) {
@@ -502,7 +552,7 @@ export class OwnershipWorkflow {
             }
         }
         const intent = { initiator_aid: aid, operation, sub_aid: subAid, owner_aid: ownerAid, new_owner_aid: newOwnerAid };
-        for (const pending of (await this.records(aid)).filter((task) => task.sub_aid === subAid && this.ongoing(task))) {
+        for (const pending of (await this.records(aid, subAid)).filter((task) => task.sub_aid === subAid && this.ongoing(task))) {
             if (this.sameIntent(pending, intent)) {
                 const result = await this.advance(subAid, pending.operation_id, undefined, events, undefined, guard);
                 if (result.status !== 'stopped' || result.code !== 'conflict' || !/relation version or target was replaced/.test(result.reason ?? ''))
@@ -525,6 +575,8 @@ export class OwnershipWorkflow {
                 throw failure('owner_locked', 'the sub AID has a current owner lock');
             if (ns.file?.frontmatter.type === 'human')
                 throw failure('invalid', 'human cannot declare an owner');
+            if (ns.file?.statement?.owner_aid === ownerAid)
+                throw failure('conflict', 'current owner release requires sub cleanup before binding again');
         }
         else {
             if (aid !== ownerAid || ns.lock !== 'locked' || ns.owner_aid !== aid)
@@ -533,10 +585,11 @@ export class OwnershipWorkflow {
             if (consensus.status !== 'consensus' || consensus.owner_aid !== aid || consensus.relation_version !== ns.relation_version)
                 throw failure(consensus.status === 'invalid' ? 'invalid' : 'unavailable', 'the current owner relation could not be verified', consensus.status !== 'invalid');
         }
-        ownershipInteger(ns.relation_version + 1, 'target_relation_version');
+        const targetVersion = ownershipInteger(ns.relation_version + (operation === 'release' ? 0 : 1), 'target_relation_version');
         const operationId = requestedId ?? crypto.randomUUID();
-        const payload = { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation, action: operation === 'bind' ? 'bind.request' : operation === 'transfer' ? 'transfer.request' : 'relation.confirmed', sub_aid: subAid, owner_aid: ownerAid, ...(newOwnerAid ? { new_owner_aid: newOwnerAid } : {}), base_relation_version: ns.relation_version, target_relation_version: ns.relation_version + 1 };
+        const payload = { type: OWNERSHIP_SDK_MESSAGE_TYPE, operation_id: operationId, operation, action: operation === 'bind' ? 'bind.request' : operation === 'transfer' ? 'transfer.request' : 'relation.confirmed', sub_aid: subAid, owner_aid: ownerAid, ...(newOwnerAid ? { new_owner_aid: newOwnerAid } : {}), base_relation_version: ns.relation_version, target_relation_version: targetVersion };
         const task = this.create(payload, aid, 'accept');
+        await this.captureBase(task, ns);
         if (!task.local_roles.length)
             throw failure('forbidden', 'the local AID is not an ownership participant');
         if (aid !== this.deps.currentAid())
@@ -662,13 +715,28 @@ export class OwnershipWorkflow {
         return true;
     }
     async confirmSubCleaned(task) {
-        const began = this.now(), before = await this.deps.files.readAgent(task.sub_aid), after = await this.deps.files.readAgent(task.sub_aid);
-        if (this.now() - began > 30 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || await ownershipSha256(before.content) !== await ownershipSha256(after.content))
-            throw failure('unavailable', 'NS changed during sub cleanup verification', true);
-        if (!before.exists || before.relation_version !== task.target_relation_version || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
+        const began = this.now(), before = await this.deps.files.readAgent(task.sub_aid);
+        if (!before.exists || before.relation_version !== 0 || before.lock !== 'unlocked' || before.owner_aid || !before.etag)
             return false;
         const file = parseOwnershipFile(before.content, 'agent', { expectedSubAid: task.sub_aid });
-        return !Object.hasOwn(file.frontmatter, 'owner') && !Object.hasOwn(file.frontmatter, 'ownership');
+        if (Object.hasOwn(file.frontmatter, 'owner') || Object.hasOwn(file.frontmatter, 'ownership'))
+            return false;
+        if (!task.base_agent_md?.statement || task.base_agent_md.statement.owner_aid !== task.owner_aid || task.base_agent_md.statement.sub_aid !== task.sub_aid || task.base_agent_md.statement.relation_version !== task.base_relation_version)
+            return false;
+        let ownerHash = '';
+        if (task.local_roles.includes('owner') && task.files.release) {
+            const original = task.files.release, object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
+            if (object.exists && object.content === original.raw && object.sha256 === original.sha256) {
+                const file = await this.deps.files.verify(object.content, 'owner', task.sub_aid, task.owner_aid);
+                if (file.action === 'release' && file.statement && ['version', 'owner_aid', 'sub_aid', 'relation_version'].every((key) => file.statement[key] === task.base_agent_md.statement[key]))
+                    ownerHash = object.sha256;
+            }
+        }
+        const confirmed = Boolean(await this.cleanupEvidence(task, { agent_md_etag: before.etag, agent_md_sha256: await ownershipSha256(before.content), owner_md_sha256: ownerHash }, before.content));
+        const after = await this.deps.files.readAgent(task.sub_aid);
+        if (this.now() - began > 30 || before.exists !== after.exists || before.etag !== after.etag || before.relation_version !== after.relation_version || before.lock !== after.lock || before.owner_aid !== after.owner_aid || before.content !== after.content)
+            throw failure('unavailable', 'NS changed during sub cleanup verification', true);
+        return confirmed;
     }
     async resume(guard) {
         guard?.();
@@ -681,15 +749,16 @@ export class OwnershipWorkflow {
         }
         for (const snapshot of snapshots) {
             guard?.();
-            const task = await this.record(snapshot);
-            if (['rejected', 'stopped'].includes(task.status) && !task.outbox.length && !task.inbox.length || task.status === 'completed' && !task.cleanup_pending && !task.outbox.length && !task.inbox.length && !(['bind', 'transfer'].includes(task.operation) && task.local_roles.includes('sub') && task.local_decision === 'accept' && !task.release_cleanup?.cleaned))
-                continue;
             try {
+                const task = await this.record(snapshot);
+                if (['rejected', 'stopped'].includes(task.status) && !task.outbox.length && !task.inbox.length || task.status === 'completed' && !task.cleanup_pending && !task.outbox.length && !task.inbox.length && !(['bind', 'transfer'].includes(task.operation) && task.local_roles.includes('sub') && task.local_decision === 'accept' && !task.release_cleanup?.cleaned))
+                    continue;
                 await this.execute(task.sub_aid, task.operation_id, undefined, undefined, guard);
             }
             catch (error) {
+                guard?.();
                 if (ownershipErrorCode(error) !== 'conflict')
-                    throw error;
+                    await this.deps.emit('ownership.error', { operation_id: snapshot.record.operation_id, sub_aid: snapshot.record.sub_aid, code: ownershipErrorCode(error), reason: String(error), retryable: false });
             }
         }
     }
@@ -703,6 +772,25 @@ export class OwnershipWorkflow {
             }
             const entry = task.inbox[0];
             const ns = await this.observe(task.sub_aid);
+            if (!task.base_agent_md && !task.request_validated && task.local_decision === 'pending' && !Object.keys(task.files).length) {
+                if (this.isBase(task, ns) || task.operation === 'release' && ns.relation_version === task.base_relation_version && ns.file?.statement?.owner_aid === task.owner_aid)
+                    await this.captureBase(task, ns);
+                else if (task.operation === 'release' && ns.relation_version === 0 && !ns.file?.statement && task.local_roles.includes('sub')) {
+                    for (const candidate of await this.records(context.aid, task.sub_aid)) {
+                        const original = candidate.files.agent, cleanup = candidate.release_cleanup?.files.cleanup;
+                        if (!['bind', 'transfer'].includes(candidate.operation) || candidate.local_decision !== 'accept' || !candidate.local_roles.includes('sub') || targetOwner(candidate) !== task.owner_aid || candidate.target_relation_version !== task.base_relation_version || !original || !cleanup || cleanup.raw !== ns.content || cleanup.sha256 !== await ownershipSha256(ns.content) || cleanup.published_etag !== undefined && cleanup.published_etag !== ns.etag)
+                            continue;
+                        const statement = parseOwnershipFile(original.raw, 'agent', { expectedSubAid: task.sub_aid }).statement;
+                        if (!statement || !cleanup.condition?.if_match)
+                            continue;
+                        task.base_agent_md = { exists: true, raw: original.raw, sha256: original.sha256, etag: cleanup.condition.if_match, statement };
+                        task.cleanup_authorization_operation_id = candidate.operation_id;
+                        break;
+                    }
+                }
+                if (task.base_agent_md)
+                    await this.save(context);
+            }
             try {
                 validateOwnershipMessage(entry.payload, { authenticated_from_aid: entry.from_aid, local_aid: context.aid, task, ns });
             }
@@ -719,6 +807,11 @@ export class OwnershipWorkflow {
                 }
                 else if (['bind.accept', 'transfer.accept', 'bind.reject', 'transfer.reject'].includes(action)) {
                     const decision = action.endsWith('.accept') ? 'accept' : 'reject';
+                    if (decision === 'reject' && await this.complete(context, ns)) {
+                        task.inbox.shift();
+                        await this.save(context);
+                        continue;
+                    }
                     if (!task.approvals[entry.from_aid] || task.approvals[entry.from_aid] === 'pending') {
                         task.approvals[entry.from_aid] = decision;
                         if (decision === 'reject') {
@@ -753,7 +846,7 @@ export class OwnershipWorkflow {
             }
             else if (action === 'sub.cleaned') {
                 const file = ns.file;
-                if (ns.relation_version === task.target_relation_version && ns.lock === 'unlocked' && !ns.owner_aid && file && !file.statement && !Object.hasOwn(file.frontmatter, 'owner') && !Object.hasOwn(file.frontmatter, 'ownership'))
+                if (ns.relation_version === 0 && ns.lock === 'unlocked' && !ns.owner_aid && file && !file.statement && !Object.hasOwn(file.frontmatter, 'owner') && !Object.hasOwn(file.frontmatter, 'ownership'))
                     task.hints[action] = true;
             }
             task.inbox.shift();
@@ -766,7 +859,8 @@ export class OwnershipWorkflow {
             const action = item.payload.action;
             const notification = ['relation.confirmed', 'sub.cleaned'].includes(action);
             const terminal = ['bind.reject', 'transfer.reject', 'operation.stopped'].includes(action);
-            if (!terminal && (notification ? !this.isTarget(task, ns) : !this.isBase(task, ns) || task.status === 'completed' || task.status === 'rejected' || task.status === 'stopped')) {
+            const cleaned = action === 'sub.cleaned' && task.status === 'completed' && await this.confirmSubCleaned(task);
+            if (!terminal && (notification ? !this.isTarget(task, ns) && !cleaned : !this.isBase(task, ns) || task.status === 'completed' || task.status === 'rejected' || task.status === 'stopped')) {
                 task.outbox = task.outbox.filter((row) => row.key !== item.key);
                 await this.save(context);
                 continue;
@@ -789,19 +883,43 @@ export class OwnershipWorkflow {
     }
     async complete(context, ns) {
         const task = context.task;
-        if (!this.isTarget(task, ns))
+        const began = Date.now(), cleaned = task.operation === 'release' && ns.exists && ns.relation_version === 0 && ns.lock === 'unlocked' && !ns.file?.statement;
+        if (!this.isTarget(task, ns) && !cleaned)
             return false;
         let consensus;
         if (task.operation === 'release') {
             consensus = await this.deps.files.checkConsensus(task.sub_aid);
-            if (consensus.status !== 'released' || consensus.relation_version !== task.target_relation_version || consensus.lock !== ns.lock || consensus.owner_aid !== ns.owner_aid || consensus.agent_md_etag !== ns.etag)
+            if ((cleaned ? consensus.status !== 'unbound' || consensus.relation_version !== 0 : consensus.status !== 'released' || consensus.relation_version !== task.target_relation_version) || consensus.lock !== ns.lock || consensus.owner_aid !== ns.owner_aid || consensus.agent_md_etag !== ns.etag || consensus.agent_md_sha256 !== await ownershipSha256(ns.content))
                 throw failure(consensus.status === 'invalid' ? 'invalid' : 'unavailable', 'ownership release could not be freshly confirmed', consensus.status !== 'invalid');
+            if (!cleaned && task.files.release && consensus.owner_md_sha256) {
+                const source = task.files.release;
+                if (source.sha256 !== consensus.owner_md_sha256)
+                    throw failure('conflict', 'current release material does not belong to this task');
+            }
+            if (cleaned) {
+                const source = task.files.release;
+                if (task.local_roles.includes('owner') && source) {
+                    const object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
+                    if (object.exists && object.content === source.raw && object.sha256 === source.sha256) {
+                        await this.deps.files.verify(object.content, 'owner', task.sub_aid, task.owner_aid);
+                        consensus.owner_md_sha256 = object.sha256;
+                    }
+                }
+                const authorization = await this.cleanupEvidence(task, consensus, ns.content);
+                if (!authorization)
+                    throw failure('conflict', 'no local cleanup original can confirm this release task');
+                const after = await this.observe(task.sub_aid);
+                if (Date.now() - began > 30_000 || after.etag !== ns.etag || after.content !== ns.content || !after.exists || after.relation_version !== 0 || after.lock !== 'unlocked' || after.owner_aid)
+                    throw failure('unavailable', 'NS changed during cleanup confirmation', true);
+                if (authorization !== task.operation_id)
+                    task.cleanup_authorization_operation_id = authorization;
+            }
             const prior = ns.file?.statement;
-            if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version))
+            if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version || !this.sameStatement(prior, task.base_agent_md?.statement ?? undefined)))
                 throw failure('conflict', 'ownership released document does not match this generation');
             if (task.local_roles.includes('owner') && !task.files.release)
                 throw failure('conflict', 'ownership completion lacks this task original owner file');
-            if (prior && task.local_roles.includes('sub') && !task.local_roles.includes('owner') && !await this.authorizeCleanup(context)) {
+            if (prior && task.local_roles.includes('sub') && !task.local_roles.includes('owner') && !await this.authorizeCleanup(context, prior)) {
                 task.status = 'pending';
                 task.step = 'cleanup_action_required';
                 task.cleanup_pending = true;
@@ -825,12 +943,10 @@ export class OwnershipWorkflow {
                 throw failure('conflict', 'Storage owner.md does not match this task original bytes');
             if (task.local_roles.includes('sub') && task.files.agent.published_etag !== undefined && task.files.agent.published_etag !== consensus.agent_md_etag && task.verified_relation_version === undefined)
                 throw failure('conflict', 'NS accepted agent.md revision changed');
-            if (task.local_roles.includes(task.operation === 'transfer' ? 'new_owner' : 'owner') && task.files.owner.published_revision !== undefined && task.files.owner.published_revision !== consensus.owner_md_revision && task.verified_relation_version === undefined)
-                throw failure('conflict', 'Storage owner.md revision changed');
         }
         task.status = 'completed';
         task.step = task.operation === 'release' ? 'released' : 'confirmed';
-        task.verified_relation_version = consensus.relation_version;
+        task.verified_relation_version = task.target_relation_version;
         task.verified_consensus = { ...consensus, protocol: '2.1' };
         delete task.code;
         delete task.reason;
@@ -850,9 +966,42 @@ export class OwnershipWorkflow {
             await this.save(context);
         return true;
     }
-    async authorizeCleanup(context) {
+    async cleanupEvidence(task, evidence, raw) {
+        const release = task.files.release;
+        if (task.local_roles.includes('owner') && release && release.sha256 === evidence.owner_md_sha256 && release.sha256 === await ownershipSha256(release.raw))
+            return task.operation_id;
+        if (!task.local_roles.includes('sub'))
+            return undefined;
+        const matches = async (prepared) => Boolean(prepared && prepared.sha256 === evidence.agent_md_sha256 && prepared.sha256 === await ownershipSha256(prepared.raw) && (raw === undefined || prepared.raw === raw) && (prepared.published_etag === undefined || prepared.published_etag === evidence.agent_md_etag));
+        if (await matches(task.files.cleanup))
+            return task.operation_id;
+        let history;
+        try {
+            history = await this.storage().listOwnershipTasks(this.deps.currentAid());
+        }
+        catch (error) {
+            throw failure('persistence_unavailable', `ownership cleanup history read failed: ${String(error)}`);
+        }
+        for (const snapshot of history) {
+            if (!['bind', 'transfer'].includes(String(snapshot.record.operation)))
+                continue;
+            if (snapshot.record.sub_aid !== task.sub_aid)
+                continue;
+            const candidate = await this.record(snapshot);
+            if (task.cleanup_authorization_operation_id && candidate.operation_id !== task.cleanup_authorization_operation_id || candidate.local_decision !== 'accept' || !candidate.local_roles.includes('sub') || candidate.sub_aid !== task.sub_aid || targetOwner(candidate) !== task.owner_aid || candidate.target_relation_version !== task.base_relation_version || !await matches(candidate.release_cleanup?.files.cleanup))
+                continue;
+            const statement = candidate.files.agent && parseOwnershipFile(candidate.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement;
+            if (statement?.owner_aid === task.owner_aid && statement.sub_aid === task.sub_aid && statement.relation_version === task.base_relation_version && this.sameStatement(statement, task.base_agent_md?.statement ?? undefined))
+                return candidate.operation_id;
+        }
+        return undefined;
+    }
+    sameStatement(left, right) {
+        return Boolean(left && right && ['version', 'declaration_id', 'owner_aid', 'sub_aid', 'relation_version', 'declared_at'].every((key) => left[key] === right[key]));
+    }
+    async authorizeCleanup(context, statement) {
         const task = context.task;
-        const matches = (record) => ['bind', 'transfer'].includes(record.operation) && record.sub_aid === task.sub_aid && record.target_relation_version === task.base_relation_version && record.local_decision === 'accept' && record.local_roles.includes('sub') && targetOwner(record) === task.owner_aid;
+        const matches = (record) => ['bind', 'transfer'].includes(record.operation) && record.sub_aid === task.sub_aid && record.target_relation_version === task.base_relation_version && record.local_decision === 'accept' && record.local_roles.includes('sub') && targetOwner(record) === task.owner_aid && Boolean(record.files.agent && this.sameStatement(parseOwnershipFile(record.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement, statement));
         if (task.cleanup_authorization_operation_id) {
             const saved = await this.load(task.cleanup_authorization_operation_id);
             if (!saved || !matches(await this.record(saved)))
@@ -866,7 +1015,7 @@ export class OwnershipWorkflow {
         catch (error) {
             throw failure('persistence_unavailable', `ownership cleanup history read failed: ${String(error)}`);
         }
-        const authorized = (await Promise.all(history.map((row) => this.record(row)))).find(matches);
+        const authorized = (await Promise.all(history.filter((row) => row.record.sub_aid === task.sub_aid).map((row) => this.record(row)))).find(matches);
         if (!authorized)
             return false;
         task.cleanup_authorization_operation_id = authorized.operation_id;
@@ -875,13 +1024,23 @@ export class OwnershipWorkflow {
     }
     async resumeSubCleanup(context, ns) {
         const task = context.task;
-        if (!['bind', 'transfer'].includes(task.operation) || !task.local_roles.includes('sub') || task.local_decision !== 'accept' || ns.lock !== 'unlocked' || ns.relation_version !== task.target_relation_version + 1 || task.release_cleanup?.cleaned)
+        if (!['bind', 'transfer'].includes(task.operation) || !task.local_roles.includes('sub') || task.local_decision !== 'accept' || ns.lock !== 'unlocked' || task.release_cleanup?.cleaned)
+            return;
+        if (ns.relation_version === 0 && !ns.file?.statement) {
+            const prepared = task.release_cleanup?.files.cleanup;
+            if (!prepared || !prepared.condition?.if_match || prepared.raw !== ns.content || prepared.sha256 !== await ownershipSha256(ns.content) || prepared.published_etag !== undefined && prepared.published_etag !== ns.etag)
+                throw failure('conflict', 'historical cleanup original file was not confirmed');
+            task.release_cleanup.cleaned = true;
+            await this.save(context);
+            return;
+        }
+        if (ns.relation_version !== task.target_relation_version)
             return;
         const consensus = await this.deps.files.checkConsensus(task.sub_aid);
         if (consensus.status !== 'released' || consensus.relation_version !== ns.relation_version || consensus.agent_md_etag !== ns.etag || consensus.agent_md_sha256 !== await ownershipSha256(ns.content))
             throw failure(consensus.status === 'invalid' ? 'invalid' : 'unavailable', 'NS changed during historical cleanup observation', consensus.status !== 'invalid');
         const statement = ns.file?.statement;
-        if (statement && (statement.owner_aid !== targetOwner(task) || statement.relation_version !== task.target_relation_version))
+        if (!statement || !task.files.agent || !this.sameStatement(statement, parseOwnershipFile(task.files.agent.raw, 'agent', { expectedSubAid: task.sub_aid }).statement))
             throw failure('conflict', 'historical cleanup fields belong to another relation');
         if (!task.release_cleanup) {
             task.release_cleanup = { files: {}, cleaned: false };
@@ -889,7 +1048,7 @@ export class OwnershipWorkflow {
         }
         if (statement || task.release_cleanup.files.cleanup)
             await this.deps.files.revokeOwneraid({ operation: 'release', sub_aid: task.sub_aid, owner_aid: targetOwner(task),
-                base_relation_version: task.target_relation_version, target_relation_version: ns.relation_version, files: task.release_cleanup.files,
+                base_relation_version: task.target_relation_version, target_relation_version: ns.relation_version, files: task.release_cleanup.files, expected_agent_statement: statement,
                 persist: () => this.save(context), guard: () => this.save(context) });
         task.release_cleanup.cleaned = true;
         await this.save(context);
@@ -899,7 +1058,9 @@ export class OwnershipWorkflow {
         const task = context.task;
         if (!task.cleanup_pending || task.cleanup_done)
             return;
-        if (!this.isTarget(task, ns)) {
+        const releaseOwner = task.operation === 'release' && task.local_roles.includes('owner');
+        const cleaned = task.operation === 'release' && ns.relation_version === 0 && ns.lock === 'unlocked' && !ns.file?.statement;
+        if (!this.isTarget(task, ns) && !cleaned && !releaseOwner) {
             task.cleanup_pending = false;
             task.step = 'cleanup_superseded';
             await this.save(context);
@@ -907,7 +1068,9 @@ export class OwnershipWorkflow {
         }
         if (task.operation === 'release' && task.local_roles.includes('sub')) {
             const prior = ns.file?.statement;
-            if (prior && !await this.authorizeCleanup(context)) {
+            if (prior && !this.sameStatement(prior, task.base_agent_md?.statement ?? undefined))
+                throw failure('conflict', 'ownership cleanup original relation was replaced');
+            if (prior && !await this.authorizeCleanup(context, prior)) {
                 task.step = 'cleanup_action_required';
                 await this.save(context);
                 this.event(context, 'ownership.action_required');
@@ -915,18 +1078,18 @@ export class OwnershipWorkflow {
             }
             if (prior && (prior.owner_aid !== task.owner_aid || prior.relation_version !== task.base_relation_version))
                 throw failure('conflict', 'ownership cleanup current fields differ');
-            if (prior)
-                await this.deps.files.revokeOwneraid(this.fileTask(context));
+            if (prior || task.files.cleanup)
+                await this.deps.files.revokeOwneraid(this.fileTask(context, prior));
             this.enqueue(task, task.owner_aid, 'sub.cleaned');
         }
         if (task.local_roles.includes('owner') && (task.operation === 'release' || task.operation === 'transfer')) {
+            if (releaseOwner && this.isTarget(task, ns) && ns.file?.statement)
+                return;
             const prepared = task.files[task.operation === 'release' ? 'release' : 'transfer'];
-            if (prepared && !prepared.published_revision) {
+            if (prepared) {
                 const object = await this.deps.files.readOwner(task.owner_aid, task.sub_aid);
-                if (object.exists && object.sha256 === prepared.sha256 && object.content === prepared.raw) {
-                    prepared.published_revision = object.revision;
-                    await this.save(context);
-                }
+                if (object.exists && (object.sha256 !== prepared.sha256 || object.content !== prepared.raw))
+                    throw failure('conflict', 'ownership cleanup original owner file has been replaced');
             }
             await this.deps.files.cleanupOwnerFile(this.fileTask(context));
         }
@@ -962,7 +1125,7 @@ export class OwnershipWorkflow {
             delete task.reason;
             task.retryable = true;
             if (await this.complete(context, ns)) {
-                if (task.status === 'completed' && task.operation === 'release' && task.local_roles.includes('sub')) {
+                if (task.status === 'completed' && task.operation === 'release') {
                     await this.cleanup(context, ns);
                     ns = await this.observe(task.sub_aid);
                 }