@aiwg/cli 2026.10.4 → 2026.10.6

package/dist/src/rules/activation.mjs

@@ -1,9 +1,21 @@
 /** Shared source frontmatter contract for lint, deployment, and show/MCP (#2938). */
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
 import Ajv from 'ajv';
 import { parse } from 'yaml';
 
-export const RULE_ACTIVATIONS = Object.freeze(['kernel', 'summary', 'bound', 'paths', 'on-demand']);
+export const RULE_ACTIVATIONS = Object.freeze(['core', 'kernel', 'summary', 'bound', 'paths', 'on-demand']);
+
+// Core rules (#3450): compact normative bodies delivered to every harness's
+// always-loaded surface regardless of deploy mode. A body is `<rule>.core.md`
+// beside the full rule; the full rule is reachable only by plain path or
+// `aiwg show rule <name>`, never an @ import.
+export const CORE_BODY_MAX_BYTES = 1024;
+export const CORE_TOTAL_MAX_BYTES = 6144;
+export const CORE_RULES_START = '<!-- AIWG:core-rules:start -->';
+export const CORE_RULES_END = '<!-- AIWG:core-rules:end -->';
+const AT_IMPORT = /(?:^|[\s(`"'])@[\w$.\/-]*[\/.][\w$.\/-]*/m;
+
 export const RULE_BINDING_TYPES = Object.freeze({ skills: 'skill', agents: 'agent', flows: 'flow' });
 export const ruleFrontmatterSchema = JSON.parse(readFileSync(new URL('./rule-frontmatter.schema.json', import.meta.url), 'utf8'));
 const ajv = new Ajv({ strict: true, allErrors: true });
@@ -11,9 +23,9 @@ const validate = ajv.compile(ruleFrontmatterSchema);
 // Legacy paths/applies_to/scope never become activation inputs during migration.
 const validateLegacy = ajv.compile({ type: 'object', properties: ruleFrontmatterSchema.properties });
 
-export function inferRuleActivation(enforcement) {
-  return typeof enforcement === 'string' && ['medium', 'low'].includes(enforcement.trim().toLowerCase())
-    ? 'on-demand' : 'kernel';
+export function inferRuleActivation() {
+  // Missing metadata never grants an always-on policy surface.
+  return 'on-demand';
 }
 
 /** Validate a parsed YAML mapping. Invalid explicit activation never falls back. */
@@ -31,7 +43,7 @@ export function validateRuleFrontmatter(data) {
     });
   }
   if (!tagged) diagnostics.push({ severity: 'warn', code: 'missing-activation',
-    message: `Missing activation; inferred ${inferRuleActivation(data.enforcement)} delivery from legacy enforcement (migration fallback).` });
+    message: `Missing activation; inferred ${inferRuleActivation(data.enforcement)} delivery (migration fallback); add explicit activation frontmatter.` });
   if (Object.hasOwn(data, 'enforcedBy')) diagnostics.push({ severity: 'info', code: 'reserved-enforcedBy',
     message: 'enforcedBy is opaque reserved metadata (#2839); it has no effect.' });
   const valid = !diagnostics.some(item => item.severity === 'error');
@@ -60,3 +72,67 @@ export function parseRuleFrontmatter(content) {
     return { valid: false, diagnostics: [{ severity: 'error', code: 'frontmatter', message: `Invalid rule YAML: ${error.message}` }], data: {}, body: content };
   }
 }
+
+export function coreBodyPath(ruleFile) {
+  return ruleFile.replace(/\.md$/, '.core.md');
+}
+
+/** Validate one core body's text. Returns error strings (empty when valid). */
+export function validateCoreBody(text, label = 'core body') {
+  const errors = [];
+  const bytes = Buffer.byteLength(text, 'utf8');
+  if (!text.trim()) errors.push(`${label}: core body is empty`);
+  if (bytes > CORE_BODY_MAX_BYTES) errors.push(`${label}: core body is ${bytes} bytes; the per-body cap is ${CORE_BODY_MAX_BYTES} bytes`);
+  if (/^---\r?\n/.test(text)) errors.push(`${label}: core body must not carry frontmatter`);
+  if (AT_IMPORT.test(text)) errors.push(`${label}: core body must not contain an @ file reference/import; use a plain path or \`aiwg show rule <name>\``);
+  return errors;
+}
+
+/** Validate the whole core set against the reserved budget. */
+export function validateCoreSet(bodies) {
+  const total = bodies.reduce((sum, item) => sum + Buffer.byteLength(item.text, 'utf8'), 0);
+  return total > CORE_TOTAL_MAX_BYTES
+    ? [`Core rules total ${total} bytes; the reserved core budget is ${CORE_TOTAL_MAX_BYTES} bytes (${bodies.map(item => `${item.name}: ${Buffer.byteLength(item.text, 'utf8')}`).join(', ')})`]
+    : [];
+}
+
+/** Read and validate the core body for a rule file; throws with a clear diagnostic. */
+export function readCoreBody(ruleFile) {
+  const file = coreBodyPath(ruleFile);
+  if (!existsSync(file)) throw new Error(`${ruleFile}: activation core requires a compact body file ${path.basename(file)}`);
+  const text = readFileSync(file, 'utf8').trim();
+  const errors = validateCoreBody(text, file);
+  if (errors.length) throw new Error(errors.join('; '));
+  return text;
+}
+
+/**
+ * Measure the core slice already deployed in a project, for `aiwg doctor`.
+ * Native providers write core-<name>.md(c) files; the others carry a marked
+ * section in their startup context file.
+ */
+export function measureDeployedCoreRules(target, provider, rulesDir) {
+  const bodies = [];
+  if (['claude', 'cursor'].includes(provider)) {
+    const dir = rulesDir || path.join(target, `.${provider}`, 'rules');
+    if (existsSync(dir)) for (const name of readdirSync(dir).filter(n => /^core-.+\.(md|mdc)$/.test(n))) {
+      // Count the authored body only, not the managed marker or MDC frontmatter.
+      const text = readFileSync(path.join(dir, name), 'utf8')
+        .replace(/^<!-- aiwg:managed[^\n]*-->\n/, '').replace(/^---\n[\s\S]*?\n---\n/, '').trim();
+      bodies.push({ name, bytes: Buffer.byteLength(text, 'utf8') });
+    }
+  } else {
+    for (const name of ['AIWG.md', 'AGENTS.md', 'WARP.md']) {
+      const file = path.join(target, name);
+      if (!existsSync(file)) continue;
+      const content = readFileSync(file, 'utf8');
+      const start = content.indexOf(CORE_RULES_START);
+      const end = content.indexOf(CORE_RULES_END);
+      if (start >= 0 && end > start) {
+        bodies.push({ name, bytes: Buffer.byteLength(content.slice(start + CORE_RULES_START.length, end).trim(), 'utf8') });
+        break;
+      }
+    }
+  }
+  return { bodies, bytes: bodies.reduce((sum, item) => sum + item.bytes, 0), limit: CORE_TOTAL_MAX_BYTES };
+}

package/dist/src/rules/inventory.js

@@ -118,7 +118,7 @@ export async function ruleInventory(cwd, root, options) {
                 canonical_activation: canonical, effective_activation: installed ? effective : null,
                 enforcement, pin_reasons: pin?.matches ?? [],
                 bindings: relation ? relation[1].targets : null, binding_evidence: relation ? 'relationship-index' : 'unknown', bound_to: parsed.rule.bound_to, paths: parsed.rule.paths ?? [],
-                fetch_command: stableId ? `aiwg show rule ${stableId}` : null,
+                fetch_command: stableId ? `aiwg show rule ${stableId} --body` : null,
                 configured_providers: configuredProviders, delivery_evidence: configuredProviders.length ? 'capability deployment recorded; per-rule delivery unverified' : 'none', delivery: 'unknown', session_loaded: 'unknown',
                 ...(options.bodies ? { content } : {}) }];
     }).sort((a, b) => a.capability.localeCompare(b.capability) || a.source.localeCompare(b.source));

package/dist/src/rules/rule-frontmatter.schema.json

@@ -12,6 +12,7 @@
     "activation": {
       "type": "string",
       "enum": [
+        "core",
         "kernel",
         "summary",
         "bound",
@@ -95,6 +96,7 @@
         "properties": {
           "activation": {
             "enum": [
+              "core",
               "kernel",
               "on-demand"
             ]

package/dist/src/schema/zod-validation.d.mts

@@ -0,0 +1,6 @@
+import type { ZodNumber, ZodString, ZodType } from 'zod';
+
+export function integer(): ZodNumber;
+export function dateTime(options?: { offset?: boolean; error?: string }): ZodString;
+export function url(): ZodString;
+export function number(): ZodType<number>;

package/dist/src/schema/zod-validation.mjs

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+
+/** Preserve integer validation without narrowing existing inputs to safe integers. */
+export function integer() {
+  return z.number().check(context => {
+    if (!Number.isInteger(context.value)) {
+      context.issues.push({ code: 'invalid_type', expected: 'int', input: context.value, continue: true });
+    }
+  }).meta({ type: 'integer' });
+}
+
+// Calendar validation includes leap years. Existing timestamps also permit minute
+// precision and numeric offsets without a colon.
+const calendar = String.raw`((\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|(02)-(0[1-9]|1\d|2[0-8])))`;
+const time = String.raw`([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?`;
+
+/**
+ * Keep the timestamp grammar accepted by existing persisted AIWG documents.
+ * @param {{ offset?: boolean, error?: string }} [options]
+ */
+export function dateTime({ offset = false, error } = {}) {
+  const zone = offset ? String.raw`(Z|[+-]\d{2}:?\d{2})` : 'Z';
+  const pattern = new RegExp(`^${calendar}T${time}${zone}$`);
+  return z.string().check(context => {
+    if (!pattern.test(context.value)) {
+      context.issues.push({ code: 'invalid_format', format: 'datetime', input: context.value, continue: true,
+        ...(error === undefined ? {} : { message: error }) });
+    }
+  }).meta({ format: 'date-time' });
+}
+
+/** Validate URLs without rewriting their stored spelling or whitespace. */
+export function url() {
+  return z.string().check(context => {
+    try {
+      new URL(context.value);
+    } catch {
+      context.issues.push({ code: 'invalid_format', format: 'url', input: context.value, continue: true });
+    }
+  }).meta({ format: 'uri' });
+}
+
+/** Preserve numeric documents that may carry infinite measurements. */
+export function number() {
+  return z.unknown().check(context => {
+    if (typeof context.value !== 'number' || Number.isNaN(context.value)) {
+      context.issues.push({ code: 'invalid_type', expected: 'number', input: context.value, continue: false });
+    }
+  }).meta({ type: 'number' });
+}

package/dist/src/serve/executor-registry.js

@@ -15,13 +15,15 @@
  * @see docs/contracts/executor.v1.md — authoritative prose spec
  */
 import { randomBytes } from 'crypto';
+import { executorTokensEqual } from './executor-token.mjs';
 import { EventEmitter } from 'events';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from 'fs';
+import { constants, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync, lstatSync, realpathSync, openSync, closeSync, fstatSync, fsyncSync } from 'fs';
 import { homedir } from 'os';
-import { dirname, isAbsolute, join, resolve as resolvePath } from 'path';
+import { dirname, isAbsolute, join, relative, resolve as resolvePath } from 'path';
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
 import { projectAiwgPath } from '../config/project-artifacts.js';
+import { FileAdmissionStore, hostProjectAdmissionPolicy } from './shared-host-scheduler.js';
 // ============================================================
 // Ajv bootstrap (transitive dep — zero new top-level deps)
 // ============================================================
@@ -152,26 +154,72 @@ export function resolveExecutorIdentityStorePath(projectRootOverride) {
     catch { /* fall through */ }
     return DEFAULT_EXECUTOR_IDENTITY_STORE_PATH;
 }
-function loadExecutorIdentityStore() {
-    const path = resolveExecutorIdentityStorePath();
+function loadExecutorIdentityStore(path = resolveExecutorIdentityStorePath(), strict = false) {
     try {
         if (existsSync(path)) {
-            const data = JSON.parse(readFileSync(path, 'utf-8'));
-            return new Map(data.map((r) => [r.executorId, r]));
+            let contents;
+            if (strict) {
+                const file = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+                try {
+                    const stat = fstatSync(file);
+                    if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.() || stat.size > 1024 * 1024)
+                        throw new Error('host registration must be a private bounded regular file');
+                    contents = readFileSync(file, 'utf-8');
+                }
+                finally {
+                    closeSync(file);
+                }
+            }
+            else
+                contents = readFileSync(path, 'utf-8');
+            const data = JSON.parse(contents);
+            if (strict && (!Array.isArray(data) || data.some(record => !record || typeof record.executorId !== 'string' || !record.executorId)
+                || new Set(data.map(record => record.executorId)).size !== data.length))
+                throw new Error('invalid trusted executor identity store');
+            return new Map(data.map((r) => {
+                if (strict)
+                    return [r.executorId, r];
+                const { hostAdmission: _hostAdmission, ...identity } = r;
+                return [r.executorId, identity];
+            }));
         }
     }
-    catch { /* ignore */ }
+    catch (error) {
+        if (strict)
+            throw error; /* legacy best effort */
+    }
     return new Map();
 }
-function saveExecutorIdentityStore(store) {
-    const path = resolveExecutorIdentityStorePath();
+function saveExecutorIdentityStore(store, path = resolveExecutorIdentityStorePath(), strict = false) {
     try {
         const dir = dirname(path);
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, ...(strict ? { mode: 0o700 } : {}) });
+        if (strict)
+            assertHostRegistrationPath(path, []);
         const tmp = `${path}.tmp.${process.pid}`;
-        writeFileSync(tmp, JSON.stringify([...store.values()], null, 2), 'utf-8');
+        if (strict) {
+            const file = openSync(tmp, 'wx', 0o600);
+            try {
+                writeFileSync(file, JSON.stringify([...store.values()], null, 2));
+                fsyncSync(file);
+            }
+            finally {
+                closeSync(file);
+            }
+        }
+        else
+            writeFileSync(tmp, JSON.stringify([...store.values()], null, 2), { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
         try {
             renameSync(tmp, path);
+            if (strict) {
+                const directory = openSync(dir, 'r');
+                try {
+                    fsyncSync(directory);
+                }
+                finally {
+                    closeSync(directory);
+                }
+            }
         }
         catch (err) {
             try {
@@ -181,7 +229,30 @@ function saveExecutorIdentityStore(store) {
             throw err;
         }
     }
-    catch { /* non-fatal — best effort */ }
+    catch (error) {
+        if (strict)
+            throw error; /* legacy best effort */
+    }
+}
+/** Host registration has a fixed user authority location, independent of project
+ * storage redirects. A trusted embedding may provide an explicit location. */
+function assertHostRegistrationPath(path, workerWritableRoots) {
+    const parent = dirname(path);
+    if (!isAbsolute(path) || realpathSync(parent) !== resolvePath(parent))
+        throw new Error('host registration requires a canonical absolute path');
+    const directory = lstatSync(parent);
+    if ((directory.mode & 0o077) !== 0 || directory.uid !== process.getuid?.())
+        throw new Error('host registration directory must be private');
+    if (existsSync(path)) {
+        const stat = lstatSync(path);
+        if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.() || stat.size > 1024 * 1024)
+            throw new Error('host registration must be a private bounded regular file');
+    }
+    for (const root of workerWritableRoots) {
+        const within = relative(realpathSync(root), path);
+        if (!within || (!within.startsWith('../') && within !== '..' && !isAbsolute(within)))
+            throw new Error('worker writable mount includes the host registration');
+    }
 }
 // ============================================================
 // Max recent events kept per mission
@@ -201,21 +272,169 @@ const MAX_MISSION_EVENTS = 50;
  *   'mission:state_change'  — { missionId, executorId, state, prevState }
  */
 export class ExecutorRegistry extends EventEmitter {
+    hostIdentityStorePath;
     executors = new Map();
+    admissionAuthorities = new Map();
     missions = new Map();
     /** Persistent token store — executorId → identity record */
     identityStore;
-    constructor() {
+    constructor(hostIdentityStorePath = DEFAULT_EXECUTOR_IDENTITY_STORE_PATH) {
         super();
+        this.hostIdentityStorePath = hostIdentityStorePath;
         this.identityStore = loadExecutorIdentityStore();
     }
+    /** Trusted service bootstrap only. This is deliberately absent from the public
+     * executor registration payload: an executor cannot grant itself host authority.
+     * The owner supplies the protected existing AdmissionStore, never a project path. */
+    installHostAdmissionAuthority(executorId, version, store, workerWritableRoots) {
+        const executor = this.executors.get(executorId);
+        const binding = store.read().hostBinding;
+        if (!executor || executor.version !== version || !executor.capabilities.includes('x-admission-policy-revision:1') || !binding) {
+            throw new Error('qualified executor and revision-aware host admission binding are required');
+        }
+        if (store instanceof FileAdmissionStore)
+            store.protectHostAuthority(workerWritableRoots);
+        else if (!Array.isArray(workerWritableRoots))
+            throw new Error('worker writable roots are required');
+        const previous = this.admissionAuthorities.get(binding.authorityRef);
+        if (previous && (previous.executorId !== executorId || previous.store !== store || previous.version !== version))
+            throw new Error('host admission authority is already installed');
+        if (store instanceof FileAdmissionStore) {
+            mkdirSync(dirname(this.hostIdentityStorePath), { recursive: true, mode: 0o700 });
+            assertHostRegistrationPath(this.hostIdentityStorePath, workerWritableRoots);
+            const identities = loadExecutorIdentityStore(this.hostIdentityStorePath, true);
+            const identity = identities.get(executorId) ?? { executorId, lastSeenAt: new Date().toISOString() };
+            identities.set(executorId, { ...identity, token: executor.token, hostAdmission: { authorityRef: binding.authorityRef,
+                    path: store.hostAuthorityPath(), version, workerWritableRoots: [...workerWritableRoots], revisionSupport: 1 } });
+            saveExecutorIdentityStore(identities, this.hostIdentityStorePath, true);
+        }
+        if (store.read().hostRegistrationRevoked)
+            store.transact(snapshot => { snapshot.hostRegistrationRevoked = false; });
+        this.admissionAuthorities.set(binding.authorityRef, { executorId, version, store });
+    }
+    resolveHostAdmissionAuthority(authorityRef, projectPolicy) {
+        if (!this.admissionAuthorities.has(authorityRef) && existsSync(this.hostIdentityStorePath)) {
+            assertHostRegistrationPath(this.hostIdentityStorePath, []);
+            const identities = loadExecutorIdentityStore(this.hostIdentityStorePath, true);
+            for (const identity of identities.values()) {
+                const installed = identity.hostAdmission;
+                if (installed?.authorityRef !== authorityRef)
+                    continue;
+                if (installed.revisionSupport !== 1 || !Array.isArray(installed.workerWritableRoots))
+                    throw new Error('host registration lacks policy revision support');
+                assertHostRegistrationPath(this.hostIdentityStorePath, installed.workerWritableRoots);
+                const store = new FileAdmissionStore(installed.path);
+                store.protectHostAuthority(installed.workerWritableRoots);
+                if (store.read().hostBinding?.authorityRef !== authorityRef)
+                    throw new Error('host registration authority reference mismatch');
+                this.admissionAuthorities.set(authorityRef, { executorId: identity.executorId, version: installed.version, store, restored: true });
+            }
+        }
+        const installed = this.admissionAuthorities.get(authorityRef);
+        if (installed?.store instanceof FileAdmissionStore) {
+            assertHostRegistrationPath(this.hostIdentityStorePath, []);
+            const current = loadExecutorIdentityStore(this.hostIdentityStorePath, true).get(installed.executorId)?.hostAdmission;
+            if (!current || current.authorityRef !== authorityRef || current.version !== installed.version
+                || current.path !== installed.store.hostAuthorityPath())
+                throw new Error('trusted host executor registration has been revoked or changed');
+        }
+        const executor = installed && this.executors.get(installed.executorId);
+        if (!installed || (!executor && !installed.restored) || (executor && (executor.version !== installed.version || !executor.capabilities.includes('x-admission-policy-revision:1')))) {
+            throw new Error('missing current revision-aware trusted host executor binding');
+        }
+        const snapshot = installed.store.read();
+        if (snapshot.hostRegistrationRevoked)
+            throw new Error('trusted host executor registration is revoked');
+        const approved = snapshot.hostBinding?.projects[projectPolicy.managed.projectId]?.policy;
+        // Compare complete approved input, including defaults, rather than trusting a
+        // caller's activation digest to cover its effective limits.
+        const normalize = (value) => JSON.stringify(value, function (_key, node) {
+            return node && typeof node === 'object' && !Array.isArray(node)
+                ? Object.fromEntries(Object.keys(node).sort().filter(key => node[key] !== undefined).map(key => [key, node[key]])) : node;
+        });
+        if (snapshot.hostBinding?.authorityRef !== authorityRef || normalize(approved) !== normalize(projectPolicy))
+            throw new Error('project policy is not approved by the host authority');
+        return { store: installed.store, policy: hostProjectAdmissionPolicy(snapshot, projectPolicy.managed.projectId) };
+    }
+    revokeHostAdmissionAuthority(executorId) {
+        const installed = [...this.admissionAuthorities.values()].filter(entry => entry.executorId === executorId);
+        const view = this.hostView();
+        if (!view.trusted && view.untrustedHostBound.has(executorId))
+            throw new Error('host registration store is not protected');
+        const stored = view.identities.get(executorId)?.hostAdmission;
+        if (stored && !installed.length) {
+            const store = new FileAdmissionStore(stored.path);
+            store.protectHostAuthority(stored.workerWritableRoots);
+            installed.push({ executorId, version: stored.version, store });
+        }
+        if (!installed.length)
+            return;
+        // Fence first. A failed registration write can leave a discoverable binding,
+        // but cannot make an old scheduler's policy current again.
+        for (const entry of installed)
+            entry.store.transact(snapshot => {
+                if (snapshot.hostBinding) {
+                    snapshot.hostBinding.revision++;
+                    snapshot.hostRegistrationRevoked = true;
+                }
+            });
+        if (installed.some(entry => entry.store instanceof FileAdmissionStore)) {
+            assertHostRegistrationPath(this.hostIdentityStorePath, []);
+            const identities = loadExecutorIdentityStore(this.hostIdentityStorePath, true);
+            const identity = identities.get(executorId);
+            if (identity) {
+                delete identity.hostAdmission;
+                saveExecutorIdentityStore(identities, this.hostIdentityStorePath, true);
+            }
+        }
+        for (const [ref, entry] of this.admissionAuthorities)
+            if (entry.executorId === executorId)
+                this.admissionAuthorities.delete(ref);
+    }
+    loadHostIdentities() {
+        if (!existsSync(this.hostIdentityStorePath))
+            return new Map();
+        assertHostRegistrationPath(this.hostIdentityStorePath, []);
+        return loadExecutorIdentityStore(this.hostIdentityStorePath, true);
+    }
+    /**
+     * Host view for ordinary registry operations. When the shared identity file is
+     * not a protected host store (e.g. a 0755 ~/.config/aiwg holding only ordinary
+     * executors), ordinary IDs keep working; IDs that claim host admission in it
+     * are reported as untrusted so callers fail closed for them only. Untrusted
+     * content is never used for tokens, paths or metadata.
+     */
+    hostView() {
+        try {
+            return { trusted: true, identities: this.loadHostIdentities(), untrustedHostBound: new Set() };
+        }
+        catch {
+            const untrustedHostBound = new Set();
+            try {
+                const data = JSON.parse(readFileSync(this.hostIdentityStorePath, 'utf-8'));
+                if (Array.isArray(data))
+                    for (const record of data) {
+                        if (record && typeof record.executorId === 'string' && record.hostAdmission)
+                            untrustedHostBound.add(record.executorId);
+                    }
+            }
+            catch {
+                untrustedHostBound.add('*');
+            }
+            return { trusted: false, identities: new Map(), untrustedHostBound };
+        }
+    }
+    isUntrustedHostBound(view, executorId) {
+        return view.untrustedHostBound.has(executorId) || view.untrustedHostBound.has('*');
+    }
     // ---- Registration ----
     /**
      * Register an executor. Validates payload against `register_payload` schema.
-     * Returns 400-level error string on invalid payload.
-     * On re-register with same executor_id: reclaims prior token (per ADR §9).
+     * Returns a 400 error on invalid payload or 401 for unauthorized re-registration.
+     * Every existing identity requires its current bearer token before any update.
+     * Authenticated re-registration preserves the prior token (per ADR §9; #3439).
      */
-    register(req) {
+    register(req, bearerToken = '') {
         // Validate against JSON Schema
         const { valid, errors } = validateRegisterPayload(req);
         if (!valid) {
@@ -226,7 +445,25 @@ export class ExecutorRegistry extends EventEmitter {
         // Check for existing token in identity store (re-register reclaims it)
         const existing = this.executors.get(executorId);
         const storedIdentity = this.identityStore.get(executorId);
-        const token = existing?.token ?? storedIdentity?.token ?? issueToken();
+        const view = this.hostView();
+        const hostRecord = view.identities.get(executorId);
+        const hostAdmission = hostRecord?.hostAdmission;
+        const installedAuthority = [...this.admissionAuthorities.values()].find(binding => binding.executorId === executorId);
+        if (!view.trusted && (installedAuthority || this.isUntrustedHostBound(view, executorId)))
+            return { error: 'Unauthorized', status: 401 };
+        // Host-bound IDs authenticate only against the live executor or the protected
+        // host record, never the environment/project-selectable identity store.
+        const priorToken = (hostAdmission || installedAuthority)
+            ? existing?.token ?? hostRecord?.token
+            : existing?.token ?? storedIdentity?.token;
+        if (((hostAdmission || installedAuthority) || priorToken !== undefined) && !executorTokensEqual(priorToken, bearerToken)) {
+            return { error: 'Unauthorized', status: 401 };
+        }
+        const token = priorToken ?? issueToken();
+        if ((hostAdmission && (hostAdmission.version !== req.version || !req.capabilities.includes('x-admission-policy-revision:1')))
+            || (installedAuthority && (installedAuthority.version !== req.version || !req.capabilities.includes('x-admission-policy-revision:1')))) {
+            this.revokeHostAdmissionAuthority(executorId);
+        }
         // Update or create in-memory registration
         if (existing) {
             // Upsert — preserve token and registeredAt
@@ -261,7 +498,34 @@ export class ExecutorRegistry extends EventEmitter {
             token,
             lastSeenAt: now,
         });
-        saveExecutorIdentityStore(this.identityStore);
+        const identityPath = resolveExecutorIdentityStorePath();
+        if (identityPath === this.hostIdentityStorePath) {
+            mkdirSync(dirname(this.hostIdentityStorePath), { recursive: true, mode: 0o700 });
+            const persisted = this.hostView();
+            if (persisted.trusted) {
+                const identities = persisted.identities;
+                for (const [id, identity] of this.identityStore)
+                    identities.set(id, { ...identities.get(id), ...identity });
+                try {
+                    saveExecutorIdentityStore(identities, this.hostIdentityStorePath, true);
+                }
+                catch (error) {
+                    // A pre-existing non-private directory may still hold ordinary identities;
+                    // only a store that carries host admission must be protected.
+                    if ([...identities.values()].some(record => record.hostAdmission))
+                        throw error;
+                    saveExecutorIdentityStore(this.identityStore, identityPath);
+                }
+            }
+            else if (!persisted.untrustedHostBound.size) {
+                // No host admission lives here: keep the legacy ordinary identity store.
+                saveExecutorIdentityStore(this.identityStore, identityPath);
+            }
+            else
+                throw new Error('host registration store is not protected');
+        }
+        else
+            saveExecutorIdentityStore(this.identityStore, identityPath);
         // Emit event (for dashboard SSE, etc.)
         this.emit('executor:registered', { executorId, name: req.name });
         return {
@@ -278,6 +542,7 @@ export class ExecutorRegistry extends EventEmitter {
         const executor = this.executors.get(executorId);
         if (!executor)
             return false;
+        this.revokeHostAdmissionAuthority(executorId);
         // Close WS if open
         if (executor.wsConn && executor.wsConn.readyState <= 1) {
             try {
@@ -295,10 +560,21 @@ export class ExecutorRegistry extends EventEmitter {
     authenticate(executorId, token) {
         const executor = this.executors.get(executorId);
         if (executor)
-            return executor.token === token;
+            return executorTokensEqual(executor.token, token);
+        // A host-bound ID authenticates only against the protected host record,
+        // never the environment/project-selectable identity store (#2923 review).
+        const view = this.hostView();
+        if (!view.trusted && this.isUntrustedHostBound(view, executorId))
+            return false; // unverifiable host-bound id fails closed
+        if (!view.trusted && [...this.admissionAuthorities.values()].some(entry => entry.executorId === executorId))
+            return false;
+        const hostRecord = view.identities.get(executorId);
+        if (hostRecord?.hostAdmission || [...this.admissionAuthorities.values()].some(entry => entry.executorId === executorId)) {
+            return executorTokensEqual(hostRecord?.token, token);
+        }
         // Fall back to identity store for executors that registered in a prior server run
         const stored = this.identityStore.get(executorId);
-        return stored !== undefined && stored.token === token;
+        return executorTokensEqual(stored?.token, token);
     }
     /**
      * Mark the WS event stream as connected or disconnected.
@@ -695,6 +971,7 @@ export class ExecutorRegistry extends EventEmitter {
                 catch { /* ignore */ }
             }
         }
+        this.admissionAuthorities.clear();
         this.executors.clear();
         this.missions.clear();
         this.removeAllListeners();

package/dist/src/serve/executor-token.d.mts

@@ -0,0 +1 @@
+export function executorTokensEqual(expected: string | undefined | null, presented: string | undefined | null): boolean;

package/dist/src/serve/executor-token.mjs

@@ -0,0 +1,8 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+
+/** Compare bearer tokens using fixed-size digests, including unequal-length input. */
+export function executorTokensEqual(expected, presented) {
+  if (typeof expected !== 'string' || !expected || typeof presented !== 'string' || !presented) return false;
+  const digest = value => createHash('sha256').update(value, 'utf8').digest();
+  return timingSafeEqual(digest(expected), digest(presented));
+}