@agentunion/fastaun 0.5.20 → 0.5.22

package/dist/ownership-v21.d.ts

@@ -44,15 +44,26 @@ export interface OwnershipFile {
     action?: 'declare' | 'release' | 'transfer_owner';
     transfer?: OwnershipTransferV21;
 }
+export interface OwnershipOwnerMd {
+    owner_aid: string;
+    bucket: string;
+    path: string;
+    exists: boolean;
+    content: string;
+    sha256: string;
+    observed_at: number;
+}
 export interface OwnershipConsensusResult {
     status: OwnershipConsensusStatus;
     sub_aid: string;
     owner_aid: string | null;
     relation_version: number;
     lock: 'locked' | 'unlocked';
+    ownership_status?: string;
     agent_md_etag: string;
     agent_md_sha256: string;
     owner_md_sha256: string;
+    owner_md?: OwnershipOwnerMd;
     code?: string;
     reason?: string;
     retryable?: boolean;
@@ -74,11 +85,15 @@ export interface OwnershipAgentObservation {
     protocol: string;
     relation_version: number;
     lock: 'locked' | 'unlocked';
+    ownership_status?: string;
+    pending?: boolean;
+    stage_supported?: boolean;
     owner_aid?: string | null;
     observed_at: number;
     recovery_ready?: boolean;
 }
 export interface OwnershipOwnerObservation {
+    revision?: string;
     owner_aid: string;
     sub_aid?: string;
     bucket: string;
@@ -105,12 +120,14 @@ export interface OwnershipSavedFile {
         exists: boolean;
         raw: string;
         sha256: string;
+        revision?: string;
     };
     expires_at?: number;
     deleted?: boolean;
 }
 export interface OwnershipFileTask {
     operation_id?: string;
+    stage?: boolean;
     operation: 'bind' | 'release' | 'transfer';
     sub_aid: string;
     owner_aid: string;
@@ -125,6 +142,16 @@ export interface OwnershipFileTask {
         sha256: string;
         etag: string;
         statement: OwnershipStatementV21 | null;
+        pending?: boolean;
+    };
+    pending_agent_md?: {
+        raw: string;
+        sha256: string;
+        etag: string;
+    };
+    owner_proposal?: {
+        raw: string;
+        sha256: string;
     };
     base_owner_md?: {
         exists: boolean;
@@ -133,6 +160,7 @@ export interface OwnershipFileTask {
     };
     authorization_sha256?: string;
     expires_at?: number;
+    assertActive?(): void;
     persist(): Promise<void>;
 }
 export interface OwnershipFileDependencies {
@@ -140,10 +168,10 @@ export interface OwnershipFileDependencies {
     currentType?(): string;
     now(): number;
     readAgentMdFresh(subAid: string): Promise<OwnershipAgentObservation>;
-    submitAgentMdRaw(subAid: string, raw: string, condition: OwnershipSavedFile['condition']): Promise<OwnershipAgentObservation>;
+    submitAgentMdRaw(subAid: string, raw: string, condition: OwnershipSavedFile['condition'], assertActive?: () => void, stage?: boolean): Promise<OwnershipAgentObservation>;
     readOwnerMd(ownerAid: string, subAid: string): Promise<OwnershipOwnerObservation>;
-    writeOwnerMd(ownerAid: string, subAid: string, raw: string): Promise<OwnershipOwnerObservation>;
-    deleteOwnerMd(ownerAid: string, subAid: string): Promise<unknown>;
+    writeOwnerMd(ownerAid: string, subAid: string, raw: string, original?: Pick<OwnershipOwnerObservation, 'exists' | 'content' | 'sha256' | 'version'>, assertActive?: () => void): Promise<OwnershipOwnerObservation>;
+    deleteOwnerMd(ownerAid: string, subAid: string, expectedVersion: number): Promise<unknown>;
     resolveCertificate(aid: string, fingerprint: string, purpose?: 'signing' | 'group_identity'): Promise<OwnershipCertificate>;
 }
 export declare function ownershipFailure(code: string, reason: string, retryable?: boolean): StateError;
@@ -159,8 +187,10 @@ export declare class OwnershipFiles {
     declareOwneraid(task: OwnershipFileTask): Promise<OwnershipAgentObservation>;
     revokeSubaid(task: OwnershipFileTask): Promise<OwnershipOwnerObservation>;
     revokeOwneraid(task: OwnershipFileTask): Promise<OwnershipAgentObservation>;
+    cancelPendingBind(task: OwnershipFileTask, candidate: OwnershipSavedFile): Promise<OwnershipAgentObservation>;
     transferOwneraid(task: OwnershipFileTask): Promise<OwnershipOwnerObservation>;
     cleanupOwnerFile(task: OwnershipFileTask): Promise<void>;
+    cancelOwnerProposal(task: OwnershipFileTask): Promise<void>;
     readAgent(subAid: string): Promise<OwnershipAgentObservation>;
     readOwner(ownerAid: string, subAid: string): Promise<OwnershipOwnerObservation>;
     verifyFile(raw: string, role: OwnershipFileRole, subAid: string, ownerAid?: string): Promise<OwnershipFile>;
@@ -170,6 +200,7 @@ export declare class OwnershipFiles {
     private statement;
     private assertBase;
     private requireOriginal;
+    private currentConsensus;
     private savedFile;
     private validSavedCondition;
     private publishOwner;
@@ -189,8 +220,8 @@ export declare class OwnershipStorageAdapter {
     private metadata;
     readObject(ownerAid: string, path: string): Promise<OwnershipOwnerObservation>;
     readOwnerMd(ownerAid: string, subAid: string): Promise<OwnershipOwnerObservation>;
-    writeOwnerMd(ownerAid: string, subAid: string, raw: string): Promise<OwnershipOwnerObservation>;
-    deleteOwnerMd(ownerAid: string, subAid: string): Promise<void>;
+    writeOwnerMd(ownerAid: string, subAid: string, raw: string, original?: Pick<OwnershipOwnerObservation, 'exists' | 'content' | 'sha256' | 'version'>, assertActive?: () => void): Promise<OwnershipOwnerObservation>;
+    deleteOwnerMd(ownerAid: string, subAid: string, expectedVersion: number): Promise<void>;
     private requireLocal;
 }
 export {};

package/dist/ownership-v21.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { updateOwnershipAgentMd } from './agent-md.js';
+import { buildDefaultAgentMd, updateOwnershipAgentMd } from './agent-md.js';
 import { parseFileFrontmatter, validateAgentMdCertificate, validateAgentMdDocument } from './agent-md-schema.js';
 import { certFingerprint, isStrictBase64, parseAgentMdTailSignature, publicKeyMatchesFingerprint, signDocument, verifyDocument } from './cert-utils.js';
 import { StateError, ValidationError } from './errors.js';
@@ -124,7 +124,7 @@ export function parseOwnershipFile(content, role, context = {}) {
     let action;
     let transfer;
     if (role === 'agent') {
-        frontmatter = validateAgentMdDocument(parsed.payload, { expectedAid: context.expectedSubAid, validateOwnership: false, now: context.now }).frontmatter;
+        frontmatter = validateAgentMdDocument(parsed.payload, { expectedAid: context.expectedSubAid, validateOwnership: true, now: context.now }).frontmatter;
         requireOwnershipApplicable(frontmatter.type);
         statement = validateOwnershipAgentFrontmatter(frontmatter, context.expectedSubAid);
         if (context.expectedOwnerAid && statement && statement.owner_aid !== context.expectedOwnerAid)
@@ -239,18 +239,36 @@ export class OwnershipFiles {
         const began = this.deps.now();
         const result = { status: 'unavailable', sub_aid: subAid, owner_aid: null, relation_version: 0, lock: 'unlocked', agent_md_etag: '', agent_md_sha256: '', owner_md_sha256: '' };
         try {
-            const before = await this.readAgent(subAid);
+            let before = await this.readAgent(subAid);
+            if (before.ownership_status)
+                result.ownership_status = before.ownership_status;
             Object.assign(result, { relation_version: before.relation_version, lock: before.lock, agent_md_etag: before.etag, agent_md_sha256: before.exists ? ownershipSha256(before.content) : '' });
-            const agent = before.exists ? await this.verifyFile(before.content, 'agent', subAid) : undefined;
-            const statement = agent?.statement;
-            if (before.relation_version !== (statement?.relation_version ?? 0))
-                throw ownershipFailure('unavailable', 'NS relation metadata does not match agent.md', true);
-            if (before.lock === 'locked' && (!statement || statement.relation_version !== before.relation_version))
-                throw ownershipFailure('unavailable', 'NS locked relation does not match agent.md', true);
-            const currentOwner = before.lock === 'locked' ? statement.owner_aid : null;
-            if (before.owner_aid !== undefined && before.owner_aid !== currentOwner)
-                throw ownershipFailure('unavailable', 'NS owner metadata does not match agent.md', true);
-            result.owner_aid = currentOwner;
+            let agent = before.exists ? await this.verifyFile(before.content, 'agent', subAid) : undefined;
+            let statement = agent?.statement;
+            let projectionRetried = false;
+            const refreshProjection = async () => {
+                if (projectionRetried)
+                    throw ownershipFailure('unavailable', 'NS relationship projection does not match current signed materials', true);
+                projectionRetried = true;
+                const current = await this.readAgent(subAid);
+                if (current.exists !== before.exists || current.content !== before.content)
+                    throw ownershipFailure('unavailable', 'agent.md changed while rechecking NS projection', true);
+                const currentAgent = current.exists ? await this.verifyFile(current.content, 'agent', subAid) : undefined;
+                const currentStatement = currentAgent?.statement;
+                const currentOwner = current.lock === 'locked' ? currentStatement?.owner_aid : null;
+                if (current.relation_version !== (currentStatement?.relation_version ?? 0) || current.lock === 'locked' && !currentStatement || current.owner_aid !== undefined && current.owner_aid !== currentOwner)
+                    throw ownershipFailure('unavailable', 'NS relationship projection still does not match agent.md', true);
+                before = current;
+                agent = currentAgent;
+                statement = currentStatement;
+                Object.assign(result, { relation_version: before.relation_version, lock: before.lock, agent_md_etag: before.etag, agent_md_sha256: before.exists ? ownershipSha256(before.content) : '' });
+            };
+            const agentProjectionMatches = () => before.relation_version === (statement?.relation_version ?? 0) && !(before.lock === 'locked' && !statement) && (before.owner_aid === undefined || before.owner_aid === (before.lock === 'locked' ? statement?.owner_aid ?? null : null));
+            if (!agentProjectionMatches())
+                await refreshProjection();
+            if (!agentProjectionMatches())
+                throw ownershipFailure('unavailable', 'NS relationship projection does not match agent.md', true);
+            result.owner_aid = before.lock === 'locked' ? statement.owner_aid : null;
             result.status = statement ? 'single_sided' : 'unbound';
             const ownerAid = statement?.owner_aid ?? target?.owner_aid;
             let ownerBefore;
@@ -258,9 +276,13 @@ export class OwnershipFiles {
                 const owner = await this.readOwner(ownerAid, subAid);
                 ownerBefore = owner;
                 result.owner_md_sha256 = owner.exists ? owner.sha256 ?? '' : '';
+                result.owner_md = { owner_aid: ownerAid, bucket: 'default', path: `sub_aids/${subAid}/owner.md`, exists: owner.exists, content: owner.content, sha256: owner.sha256 ?? '', observed_at: owner.observed_at };
                 if (owner.exists) {
                     const declaration = await this.verifyFile(owner.content, 'owner', subAid, ownerAid);
-                    if (statement) {
+                    if (statement && (before.pending || before.ownership_status === 'pending')) {
+                        result.status = 'single_sided';
+                    }
+                    else if (statement) {
                         if (declaration.statement.relation_version !== before.relation_version)
                             throw new ValidationError('ownership relation_version mismatch');
                         result.status = declaration.action === 'release' ? 'released' : 'consensus';
@@ -270,10 +292,14 @@ export class OwnershipFiles {
                     }
                 }
                 else if (statement)
-                    result.status = 'released';
+                    result.status = before.pending || before.ownership_status === 'pending' ? 'single_sided' : 'released';
             }
-            if (statement && before.lock !== (result.status === 'released' ? 'unlocked' : 'locked'))
-                throw ownershipFailure('unavailable', 'NS lock does not match current ownership materials', true);
+            if (before.lock !== (result.status === 'consensus' ? 'locked' : 'unlocked')) {
+                await refreshProjection();
+                if (before.lock !== (result.status === 'consensus' ? 'locked' : 'unlocked'))
+                    throw ownershipFailure('unavailable', 'NS lock projection still conflicts with signed ownership files', true);
+            }
+            result.lock = before.lock;
             result.owner_aid = result.status === 'consensus' ? statement.owner_aid : null;
             const after = await this.readAgent(subAid);
             if (ownerAid && ownerBefore) {
@@ -312,13 +338,22 @@ export class OwnershipFiles {
             await this.assertBase(task, agent);
             if (task.operation === 'transfer')
                 await this.requireTransfer(task);
+            if (task.operation === 'bind' && task.stage)
+                return { owner: ownerAid, ownership: { statement: this.statement(task, ownerAid, task.target_relation_version) } };
             const owner = await this.readOwner(ownerAid, task.sub_aid);
             if (!owner.exists)
                 throw ownershipFailure('unavailable', 'target owner declaration is missing', true);
             const declaration = await this.verifyFile(owner.content, 'owner', task.sub_aid, ownerAid);
+            if (task.owner_proposal && (owner.content !== task.owner_proposal.raw || owner.sha256 !== task.owner_proposal.sha256))
+                throw ownershipFailure('conflict', 'owner binding proposal changed');
+            const savedOwner = task.files.owner;
+            if (savedOwner && (savedOwner.raw !== owner.content || savedOwner.hash !== owner.sha256))
+                throw ownershipFailure('conflict', 'fixed target owner declaration changed');
+            if (declaration.action === 'declare' && declaration.statement.relation_version < task.target_relation_version)
+                throw ownershipFailure('unavailable', 'target owner declaration is not ready', true);
             if (declaration.action !== 'declare' || declaration.statement.relation_version !== task.target_relation_version)
                 throw ownershipFailure('conflict', 'target owner declaration does not match this task');
-            return { owner: ownerAid, ownership: { statement: this.statement(task, ownerAid, task.target_relation_version) } };
+            return { owner: ownerAid, ownership: { statement: task.owner_proposal ? declaration.statement : this.statement(task, ownerAid, task.target_relation_version) } };
         });
     }
     async revokeSubaid(task) {
@@ -332,12 +367,13 @@ export class OwnershipFiles {
     async revokeOwneraid(task) {
         this.requireLocal(task.sub_aid);
         return this.publishAgent(task, async (agent) => {
-            if (agent.lock === 'locked')
-                throw ownershipFailure('owner_locked', 'NS has not confirmed release');
+            const consensus = await this.currentConsensus(agent);
+            if (consensus.lock === 'locked')
+                throw ownershipFailure('owner_locked', 'current ownership materials have not confirmed release');
             const parsed = parseOwnershipFile(agent.content, 'agent', { expectedSubAid: task.sub_aid });
             if (!parsed.statement && agent.relation_version === 0)
                 return {};
-            if (agent.relation_version !== task.target_relation_version)
+            if (agent.relation_version !== task.base_relation_version)
                 throw ownershipFailure('conflict', 'release relation_version changed');
             if (parsed.statement && (parsed.statement.owner_aid !== task.owner_aid || parsed.statement.relation_version !== task.base_relation_version))
                 throw ownershipFailure('conflict', 'agent.md no longer contains the released relation');
@@ -346,6 +382,19 @@ export class OwnershipFiles {
             return {};
         }, true);
     }
+    async cancelPendingBind(task, candidate) {
+        this.requireLocal(task.sub_aid);
+        const current = await this.readAgent(task.sub_aid), saved = task.files.agent;
+        if (!(saved && current.content === saved.raw && ownershipSha256(current.content) === saved.hash)) {
+            if (current.lock !== 'unlocked' || !(current.pending || current.ownership_status === 'pending') || current.content !== candidate.raw || ownershipSha256(current.content) !== candidate.hash || candidate.published_etag !== undefined && current.etag !== candidate.published_etag)
+                throw ownershipFailure('conflict', 'pending ownership candidate changed before rejection cleanup');
+        }
+        return this.publishAgent({ ...task, operation: 'release', base_relation_version: task.target_relation_version }, async (agent) => {
+            if (agent.lock !== 'unlocked' || !(agent.pending || agent.ownership_status === 'pending') || agent.content !== candidate.raw || ownershipSha256(agent.content) !== candidate.hash || candidate.published_etag !== undefined && agent.etag !== candidate.published_etag)
+                throw ownershipFailure('conflict', 'pending ownership candidate changed before signing rejection cleanup');
+            return {};
+        }, true);
+    }
     async transferOwneraid(task) {
         this.requireLocal(task.owner_aid);
         ownershipAid(task.new_owner_aid, 'new_owner_aid');
@@ -385,11 +434,31 @@ export class OwnershipFiles {
         const beforeDelete = await this.readOwner(task.owner_aid, task.sub_aid);
         if (beforeDelete.exists && (beforeDelete.content !== source.raw || beforeDelete.sha256 !== source.hash))
             throw ownershipFailure('conflict', 'owner file changed before cleanup');
-        if (beforeDelete.exists)
-            await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid);
+        if (beforeDelete.exists) {
+            if (!Number.isSafeInteger(beforeDelete.version) || beforeDelete.version <= 0)
+                throw ownershipFailure('unavailable', 'Storage owner.md version is unavailable', true);
+            task.assertActive?.();
+            await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid, beforeDelete.version);
+        }
         task.files.cleanup.deleted = true;
         await task.persist();
     }
+    async cancelOwnerProposal(task) {
+        this.requireLocal(task.owner_aid);
+        const source = this.savedFile(task, 'owner');
+        if (!source)
+            throw ownershipFailure('conflict', 'owner binding proposal is unavailable');
+        await this.assertBase(task, await this.readAgent(task.sub_aid));
+        const current = await this.readOwner(task.owner_aid, task.sub_aid);
+        if (!current.exists)
+            return;
+        if (current.content !== source.raw || current.sha256 !== source.hash)
+            throw ownershipFailure('conflict', 'owner binding proposal changed before rejection cleanup');
+        if (!Number.isSafeInteger(current.version) || current.version <= 0)
+            throw ownershipFailure('unavailable', 'Storage owner.md version is unavailable', true);
+        task.assertActive?.();
+        await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid, current.version);
+    }
     async readAgent(subAid) {
         if (this.deps.currentType && subAid === this.deps.currentAid().aid)
             requireOwnershipApplicable(this.deps.currentType());
@@ -462,23 +531,38 @@ export class OwnershipFiles {
     }
     async assertBase(task, agent) {
         ownershipInteger(task.base_relation_version, 'base_relation_version', 0);
-        if (ownershipInteger(task.target_relation_version, 'target_relation_version') !== task.base_relation_version + (task.operation === 'release' ? 0 : 1) || agent.relation_version !== task.base_relation_version)
+        const candidate = task.files.agent ? { raw: task.files.agent.raw, sha256: task.files.agent.hash, etag: task.files.agent.published_etag } : task.pending_agent_md ?? (task.base_agent_md?.pending ? task.base_agent_md : undefined);
+        if (task.operation === 'bind' && task.base_agent_md?.pending && agent.lock === 'unlocked' && (agent.pending || agent.ownership_status === 'pending') && agent.relation_version === task.base_relation_version && agent.content === task.base_agent_md.raw && ownershipSha256(agent.content) === task.base_agent_md.sha256 && agent.etag === task.base_agent_md.etag)
+            return;
+        if (task.operation === 'bind' && (agent.pending || agent.ownership_status === 'pending') && agent.lock === 'unlocked' && agent.relation_version === task.target_relation_version && candidate && agent.content === candidate.raw && ownershipSha256(agent.content) === candidate.sha256 && (!candidate.etag || agent.etag === candidate.etag)) {
+            const parsed = await this.verifyFile(agent.content, 'agent', task.sub_aid);
+            if (parsed.statement?.owner_aid !== task.owner_aid)
+                throw ownershipFailure('conflict', 'pending owner does not match this task');
+            return;
+        }
+        const target = ownershipInteger(task.target_relation_version, 'target_relation_version');
+        if (target !== task.base_relation_version + 1 && !(task.operation === 'release' && target === task.base_relation_version) || agent.relation_version !== task.base_relation_version)
             throw ownershipFailure('conflict', 'NS relation_version changed');
-        if (!agent.exists)
-            throw ownershipFailure('unavailable', 'initial agent.md is not published', true);
+        if (!agent.exists) {
+            if (task.operation !== 'bind' || task.base_relation_version !== 0 || agent.lock !== 'unlocked' || task.base_agent_md?.exists)
+                throw ownershipFailure('conflict', 'original agent.md is missing');
+            return;
+        }
         const parsed = await this.verifyFile(agent.content, 'agent', task.sub_aid);
         const base = task.base_agent_md;
+        if (base?.pending && (agent.content !== base.raw || agent.etag !== base.etag))
+            throw ownershipFailure('conflict', 'the pending ownership original was replaced');
         if (base && (agent.exists !== base.exists || (base.statement ? !parsed.statement || Object.keys(base.statement).some((field) => base.statement[field] !== parsed.statement[field]) : parsed.statement || agent.content !== base.raw || ownershipSha256(agent.content) !== base.sha256)))
             throw ownershipFailure('conflict', 'the original ownership statement was replaced');
         if (agent.relation_version !== (parsed.statement?.relation_version ?? 0))
             throw ownershipFailure('unavailable', 'NS relation metadata does not match agent.md', true);
         if (task.operation === 'bind' && parsed.frontmatter.type === 'human')
             throw ownershipFailure('invalid', 'human cannot declare an owner');
-        if (task.operation === 'bind' && agent.lock !== 'unlocked')
+        if (task.operation === 'bind' && parsed.statement && !(agent.lock === 'unlocked' && (agent.pending || agent.ownership_status === 'pending')) && (await this.currentConsensus(agent)).status !== 'released')
             throw ownershipFailure('owner_locked', 'an existing owner relation is locked');
-        if (task.operation === 'bind' && parsed.statement?.owner_aid === this.targetOwner(task))
+        if (task.operation === 'bind' && parsed.statement?.owner_aid === this.targetOwner(task) && !(agent.pending || agent.ownership_status === 'pending'))
             throw ownershipFailure('conflict', 'clear the released agent.md statement before binding the same owner');
-        if (task.operation !== 'bind' && (agent.lock !== 'locked' || parsed.statement?.owner_aid !== task.owner_aid || parsed.statement.relation_version !== task.base_relation_version))
+        if (task.operation !== 'bind' && (parsed.statement?.owner_aid !== task.owner_aid || parsed.statement.relation_version !== task.base_relation_version || (await this.currentConsensus(agent)).status !== 'consensus'))
             throw ownershipFailure('conflict', 'the original relation is no longer current');
     }
     async requireOriginal(task) {
@@ -487,6 +571,14 @@ export class OwnershipFiles {
         if (consensus.status !== 'consensus' || consensus.owner_aid !== task.owner_aid || consensus.relation_version !== task.base_relation_version)
             throw ownershipFailure(consensus.status === 'invalid' ? 'invalid' : 'unavailable', 'the original ownership consensus cannot be confirmed', consensus.status !== 'invalid');
     }
+    async currentConsensus(agent) {
+        const result = await this.checkConsensus(agent.sub_aid);
+        if (result.status === 'invalid' || result.status === 'unavailable' || result.status === 'not_applicable')
+            throw ownershipFailure(result.code ?? result.status, result.reason ?? 'ownership materials cannot be verified', result.retryable);
+        if (result.relation_version !== agent.relation_version || result.agent_md_etag !== agent.etag || result.agent_md_sha256 !== (agent.exists ? ownershipSha256(agent.content) : ''))
+            throw ownershipFailure('unavailable', 'agent.md changed during ownership verification', true);
+        return result;
+    }
     savedFile(task, key) {
         const saved = task.files[key];
         if (saved && (typeof saved.raw !== 'string' || saved.hash !== ownershipSha256(saved.raw) || !this.validSavedCondition(key, saved.condition) || saved.published_etag !== undefined && (typeof saved.published_etag !== 'string' || !saved.published_etag)))
@@ -524,6 +616,8 @@ export class OwnershipFiles {
             await task.persist();
         }
         await this.verifyFile(saved.raw, 'owner', task.sub_aid, ownerAid);
+        if (saved.original_owner?.revision && current.revision !== saved.original_owner.revision)
+            throw ownershipFailure('conflict', 'legacy owner original revision changed');
         if (current.exists && current.sha256 === saved.hash && current.content === saved.raw) {
             await task.persist();
             return current;
@@ -539,9 +633,12 @@ export class OwnershipFiles {
         if (key === 'transfer' && saved.expires_at <= this.deps.now())
             throw ownershipFailure('conflict', 'transfer authorization expired');
         const beforeWrite = await this.readOwner(ownerAid, task.sub_aid);
+        if (original.revision && beforeWrite.revision !== original.revision)
+            throw ownershipFailure('conflict', 'legacy owner original revision changed before publication');
         if (beforeWrite.exists !== original.exists || beforeWrite.content !== original.raw || (beforeWrite.exists ? beforeWrite.sha256 : '') !== original.sha256)
             throw ownershipFailure('conflict', 'owner file original material changed before publication');
-        const published = await this.deps.writeOwnerMd(ownerAid, task.sub_aid, saved.raw);
+        task.assertActive?.();
+        const published = await this.deps.writeOwnerMd(ownerAid, task.sub_aid, saved.raw, beforeWrite, task.assertActive);
         if (!published.exists || published.sha256 !== saved.hash || published.content !== saved.raw)
             throw ownershipFailure('unavailable', 'owner publication could not be verified', true);
         await task.persist();
@@ -550,46 +647,58 @@ export class OwnershipFiles {
     async publishAgent(task, prepare, cleanup = false) {
         let saved = this.savedFile(task, 'agent');
         const current = await this.readAgent(task.sub_aid);
+        if (task.stage && !cleanup && current.stage_supported !== true)
+            throw ownershipFailure('unsupported_protocol', 'NS does not support Ownership Stage', true);
         if (!saved) {
             const fields = await prepare(current);
             if (cleanup && !parseOwnershipFile(current.content, 'agent', { now: this.deps.now() }).statement)
                 return current;
-            const payload = updateOwnershipAgentMd(current.content, fields);
+            const payload = updateOwnershipAgentMd(current.exists ? current.content : buildDefaultAgentMd(task.sub_aid, { type: this.deps.currentType?.() ?? 'agent' }), fields);
             const raw = signOwnershipFile(this.deps.currentAid(), payload.endsWith('\n') || payload.endsWith('\r') ? payload : `${payload}\n`, 'agent', { now: this.deps.now(), expectedSubAid: task.sub_aid });
             saved = { raw, hash: ownershipSha256(raw), condition: current.exists ? { if_match: current.etag } : { if_none_match: '*' } };
             task.files.agent = saved;
             await task.persist();
         }
         await this.verifyFile(saved.raw, 'agent', task.sub_aid);
-        if (current.exists && ownershipSha256(current.content) === saved.hash && current.content === saved.raw && current.relation_version === (cleanup ? 0 : task.target_relation_version) && current.lock === (cleanup ? 'unlocked' : 'locked')) {
+        const pendingBind = task.operation === 'bind' && !cleanup && current.lock === 'unlocked' && (current.pending || current.ownership_status === 'pending');
+        if (current.exists && ownershipSha256(current.content) === saved.hash && current.content === saved.raw && current.relation_version === (cleanup ? 0 : task.target_relation_version) && (current.lock === (cleanup ? 'unlocked' : 'locked') || pendingBind)) {
             if (saved.published_etag !== undefined && current.etag !== saved.published_etag)
                 throw ownershipFailure('conflict', 'agent.md published ETag changed');
             saved.published_etag = current.etag;
             await task.persist();
             return current;
         }
-        if (current.etag !== saved.condition.if_match)
+        if (saved.condition.if_none_match === '*' ? current.exists : !current.exists || current.etag !== saved.condition.if_match)
             throw ownershipFailure('conflict', 'agent.md original ETag condition changed');
         if (cleanup) {
-            if (current.lock !== 'unlocked' || current.relation_version !== task.target_relation_version)
+            if ((await this.currentConsensus(current)).lock !== 'unlocked' || current.relation_version !== task.base_relation_version)
                 throw ownershipFailure('conflict', 'release target is no longer current');
         }
         else {
             await this.assertBase(task, current);
             if (task.operation === 'transfer')
                 await this.requireTransfer(task);
-            const target = await this.readOwner(this.targetOwner(task), task.sub_aid);
-            if (!target.exists)
-                throw ownershipFailure('unavailable', 'target owner declaration is missing', true);
-            const declaration = await this.verifyFile(target.content, 'owner', task.sub_aid, this.targetOwner(task));
-            const savedOwner = task.files.owner;
-            if (savedOwner && (savedOwner.raw !== target.content || savedOwner.hash !== target.sha256))
-                throw ownershipFailure('conflict', 'fixed target owner declaration changed');
-            if (declaration.action !== 'declare' || declaration.statement.relation_version !== task.target_relation_version)
-                throw ownershipFailure('conflict', 'target owner declaration changed');
+            const target = task.operation === 'bind' && task.stage ? undefined : await this.readOwner(this.targetOwner(task), task.sub_aid);
+            if (target) {
+                if (!target.exists)
+                    throw ownershipFailure('unavailable', 'target owner declaration is missing', true);
+                const declaration = await this.verifyFile(target.content, 'owner', task.sub_aid, this.targetOwner(task));
+                const savedOwner = task.files.owner;
+                if (task.owner_proposal && (target.content !== task.owner_proposal.raw || target.sha256 !== task.owner_proposal.sha256))
+                    throw ownershipFailure('conflict', 'owner binding proposal changed');
+                if (savedOwner && (savedOwner.raw !== target.content || savedOwner.hash !== target.sha256))
+                    throw ownershipFailure('conflict', 'fixed target owner declaration changed');
+                if (declaration.action === 'declare' && declaration.statement.relation_version < task.target_relation_version)
+                    throw ownershipFailure('unavailable', 'target owner declaration is not ready', true);
+                if (declaration.action !== 'declare' || declaration.statement.relation_version !== task.target_relation_version)
+                    throw ownershipFailure('conflict', 'target owner declaration changed');
+            }
         }
-        const published = await this.deps.submitAgentMdRaw(task.sub_aid, saved.raw, saved.condition);
-        if (published.content !== saved.raw || published.relation_version !== (cleanup ? 0 : task.target_relation_version) || published.lock !== (cleanup ? 'unlocked' : 'locked'))
+        task.assertActive?.();
+        const published = task.stage && !cleanup ? await this.deps.submitAgentMdRaw(task.sub_aid, saved.raw, saved.condition, task.assertActive, true) : await this.deps.submitAgentMdRaw(task.sub_aid, saved.raw, saved.condition, task.assertActive);
+        if (task.stage && !cleanup && (published.stage_supported !== true || published.lock !== 'unlocked' || !(published.pending || published.ownership_status === 'pending')))
+            throw ownershipFailure('unsupported_protocol', 'NS did not confirm Ownership Stage', true);
+        if (published.content !== saved.raw || published.relation_version !== (cleanup ? 0 : task.target_relation_version) || published.lock !== (cleanup ? 'unlocked' : 'locked') && !(task.operation === 'bind' && !cleanup && published.lock === 'unlocked' && (published.pending || published.ownership_status === 'pending')))
             throw ownershipFailure('unavailable', 'agent.md publication could not be verified', true);
         saved.published_etag = published.etag;
         await task.persist();
@@ -640,7 +749,7 @@ export class OwnershipStorageAdapter {
         if (before.exists) {
             const object = await this.call('storage.get_object', params);
             this.metadata(object, ownerAid, path);
-            if (object.exists !== true || object.sha256 !== before.sha256 || typeof object.content !== 'string')
+            if (object.exists !== true || object.sha256 !== before.sha256 || before.revision !== undefined && object.revision !== before.revision || typeof object.content !== 'string')
                 throw ownershipFailure('unavailable', 'Storage object changed or full Base64 content is unavailable', true);
             if (object.content !== '' && !isStrictBase64(object.content))
                 throw ownershipFailure('unavailable', 'Storage Base64 content is unavailable', true);
@@ -655,26 +764,29 @@ export class OwnershipStorageAdapter {
             }
             final = await this.call('storage.head_object', params);
             this.metadata(final, ownerAid, path);
-            if (final.exists !== true || final.sha256 !== before.sha256 || this.now() - began > 30)
+            if (final.exists !== true || final.sha256 !== before.sha256 || before.revision !== undefined && final.revision !== before.revision || this.now() - began > 30)
                 throw ownershipFailure('unavailable', 'Storage material changed during authoritative read', true);
         }
         const service = `st.${ownerAid.slice(ownerAid.indexOf('.') + 1)}`;
         return { owner_aid: ownerAid, bucket: 'default', path, exists: Boolean(final.exists), observed_at: Number(final.observed_at),
-            content, sha256: final.exists ? String(final.sha256) : undefined, authoritative: true, recovery_ready: final.recovery_ready, service_aid: service, authenticated_service_aid: service, version: final.exists && Number.isSafeInteger(final.version) && Number(final.version) > 0 ? final.version : undefined };
+            content, sha256: final.exists ? String(final.sha256) : undefined, authoritative: true, recovery_ready: final.recovery_ready, service_aid: service, authenticated_service_aid: service, version: final.exists && Number.isSafeInteger(final.version) && Number(final.version) > 0 ? final.version : undefined, ...(typeof final.revision === 'string' && final.revision ? { revision: final.revision } : {}) };
     }
     async readOwnerMd(ownerAid, subAid) {
         ownershipAid(subAid, 'sub_aid');
         return this.readObject(ownerAid, `sub_aids/${subAid}/owner.md`);
     }
-    async writeOwnerMd(ownerAid, subAid, raw) {
+    async writeOwnerMd(ownerAid, subAid, raw, original, assertActive) {
         this.requireLocal(ownerAid);
         ownershipAid(subAid, 'sub_aid');
         const path = `sub_aids/${subAid}/owner.md`;
         const before = await this.readOwnerMd(ownerAid, subAid);
+        if (original && (before.exists !== original.exists || before.content !== original.content || (before.exists ? before.sha256 : '') !== (original.exists ? original.sha256 : '') || original.revision !== undefined && before.revision !== original.revision))
+            throw ownershipFailure('conflict', 'owner file original material changed');
         const bytes = new TextEncoder().encode(raw);
-        const expectedVersion = before.exists ? before.version : 0;
+        const expectedVersion = (original ?? before).exists ? (original ?? before).version : 0;
         if (typeof expectedVersion !== 'number' || !Number.isSafeInteger(expectedVersion) || expectedVersion < (before.exists ? 1 : 0))
             throw ownershipFailure('unavailable', 'Storage owner.md version is unavailable', true);
+        assertActive?.();
         const session = await this.call('storage.create_upload_session', { owner_aid: ownerAid, bucket: 'default', object_key: path, size_bytes: bytes.length, content_type: 'text/markdown; charset=utf-8', expected_version: expectedVersion, overwrite: true });
         const uploadURL = String(session.upload_url ?? ''), sessionID = String(session.session_id ?? '');
         if (!uploadURL || !sessionID)
@@ -685,6 +797,7 @@ export class OwnershipStorageAdapter {
                 if (value !== undefined && value !== null && key.toLowerCase() !== 'content-type')
                     headers[key] = String(value);
         headers['Content-Type'] = 'text/markdown; charset=utf-8';
+        assertActive?.();
         if (this.deps.httpPut)
             await this.deps.httpPut(uploadURL, bytes, headers);
         else {
@@ -694,13 +807,16 @@ export class OwnershipStorageAdapter {
         }
         const complete = { owner_aid: ownerAid, bucket: 'default', object_key: path, session_id: sessionID, size_bytes: bytes.length, sha256: ownershipSha256(bytes), content_type: 'text/markdown; charset=utf-8', is_private: false, overwrite: true };
         complete.expected_version = expectedVersion;
+        assertActive?.();
         await this.call('storage.complete_upload', complete);
         return this.readOwnerMd(ownerAid, subAid);
     }
-    async deleteOwnerMd(ownerAid, subAid) {
+    async deleteOwnerMd(ownerAid, subAid, expectedVersion) {
         this.requireLocal(ownerAid);
         ownershipAid(subAid, 'sub_aid');
-        await this.call('storage.delete_object', { owner_aid: ownerAid, bucket: 'default', object_key: `sub_aids/${subAid}/owner.md` });
+        if (!Number.isSafeInteger(expectedVersion) || expectedVersion <= 0)
+            throw ownershipFailure('unavailable', 'Storage owner.md version is unavailable', true);
+        await this.call('storage.delete_object', { owner_aid: ownerAid, bucket: 'default', object_key: `sub_aids/${subAid}/owner.md`, expected_version: expectedVersion });
         if ((await this.readOwnerMd(ownerAid, subAid)).exists)
             throw ownershipFailure('unavailable', 'Storage deletion could not be confirmed', true);
     }