@ashlr/hub 3.2.7 → 3.3.0

package/dist/core/daemon/activation-permit.js

@@ -1,15 +1,69 @@
-import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
-import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, fsyncSync, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, unlinkSync, writeSync, } from 'node:fs';
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify, } from 'node:crypto';
+import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, fsyncSync, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
 import { homedir, hostname } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { readBuildIdentity } from '../build-identity.js';
 import { acquireLocalStoreLock, releaseLocalStoreLock, } from '../fleet/local-store-lock.js';
+import { audit } from '../sandbox/audit.js';
 import { killSwitchOn, readEnrollmentRegistry } from '../sandbox/policy.js';
 import { fsyncDirectory } from '../util/durability.js';
 import { assurePrivateStoragePath } from '../util/private-storage.js';
 import { diagnoseGuardHealth } from './guard-health.js';
+/**
+ * M461 → M470 daemon activation authority.
+ *
+ * The default for anyone who has not explicitly run `ashlr activation init`
+ * is EXACTLY today's behavior: every guard denies, with the same reasons as
+ * before. Authority only exists once an operator:
+ *
+ *   1. Runs `ashlr activation init` — generates an Ed25519 keypair on this
+ *      machine (private key never leaves it) and registers the public half
+ *      as a trust root in ~/.ashlr/activation/trust-roots.json (0600, dir
+ *      0700, owned by the operator's uid — checked on every read).
+ *   2. Runs `ashlr activation grant <scope...>` — signs and mints either a
+ *      single-use activation PERMIT (scopes: once, resident) consumed by
+ *      `daemon start`, or a standing, expiring GRANT (scopes: residentStanding,
+ *      conductor, install, automerge, repair, deploy) checked on every call to
+ *      the corresponding guard.
+ *
+ * `resident` is grantable BOTH ways, and both forms remain live:
+ *   - one-shot `resident` permit: fixed 2-minute window, requires a human to
+ *     run `grant` immediately before `daemon start`. Unusable after a reboot
+ *     with nobody present.
+ *   - standing `residentStanding` grant: up to the normal 30-day cap, checked
+ *     at resident-daemon startup instead of requiring a fresh permit — this is
+ *     what lets a launchd/systemd/Task-Scheduler-triggered restart authorize
+ *     itself with no human in the loop. `daemon start` (resident mode) tries
+ *     the standing grant first and falls back to the one-shot permit path
+ *     unchanged, so an operator who never grants `residentStanding` sees
+ *     EXACTLY today's one-shot-only behavior.
+ *
+ * Both permits and grants are Ed25519-signed, scoped, expiring, and
+ * independently revocable (`ashlr activation revoke`). Every init / grant /
+ * revoke / consume / denial writes an audit row via ../sandbox/audit.js so
+ * an operator can answer "who activated this fleet, when, with what scope."
+ *
+ * Revocation of a standing grant is file-based: it stops the NEXT
+ * authorization check, immediately. For `residentStanding` specifically it is
+ * stronger than that — because standing grants are not single-use (unlike the
+ * one-shot capability, which a resident loop must consume exactly once, see
+ * `tick()`'s `activationScope` handling in ../loop.ts), a resident daemon that
+ * started off a standing grant re-checks it on every tick and stops at the
+ * next one if the grant is revoked, expired, or its trust root is revoked —
+ * not just at the next `daemon start`. It cannot interrupt a tick already in
+ * flight.
+ *
+ * File loading fails CLOSED on every ambiguity: missing, unreadable, wrong
+ * permissions, wrong owner, symlinked, malformed, or non-canonically
+ * encoded trust-root/grant/permit files are all treated as "no authority" —
+ * never as "trust everything." Windows is denied outright: node:fs chmod()
+ * on Windows does not restrict per-user read access on NTFS (it only
+ * toggles the read-only attribute), so the "reject world/group-readable
+ * private files" invariant this module depends on cannot be enforced there.
+ */
 const POLICY_VERSION = 'm461-proposal-once-v1';
 const SIGNING_DOMAIN = 'ashlr:daemon-activation-permit:m461:v1\0';
+const GRANT_SIGNING_DOMAIN = 'ashlr:daemon-activation-grant:v1\0';
 const MAX_PERMIT_BYTES = 32 * 1024;
 const MAX_VALIDITY_MS = 120_000;
 const MAX_FUTURE_SKEW_MS = 30_000;
@@ -19,18 +73,51 @@ const PRIVATE_FILE_MODE = 0o600;
 const DIGEST_RE = /^[a-f0-9]{64}$/u;
 const ID_RE = /^[a-f0-9]{32}$/u;
 const KEY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const MAX_TRUST_STORE_BYTES = 256 * 1024;
+const MAX_GRANTS_BYTES = 512 * 1024;
+const MAX_LABEL_LENGTH = 200;
+/** Hard cap on any standing grant's validity window (30 days). */
+export const MAX_STANDING_GRANT_VALIDITY_MS = 30 * 24 * 60 * 60 * 1000;
+/** Default TTL `ashlr activation grant` uses when --ttl is not given (24h). */
+export const DEFAULT_STANDING_GRANT_VALIDITY_MS = 24 * 60 * 60 * 1000;
 const capabilityBrand = Symbol('ashlr.daemon-activation-capability');
-/**
- * Provisioning a production trust root requires a reviewed source change.
- * No environment variable, config field, CLI argument, or writable trust file
- * can add authority at runtime.
- */
-export const DAEMON_ACTIVATION_TRUST_ROOTS = Object.freeze([]);
+/** Every independently grantable scope key, in canonical order. Used by the CLI to validate `grant`/status output. */
+export const DAEMON_ACTIVATION_SCOPE_KEYS = [
+    'once',
+    'resident',
+    'residentStanding',
+    'conductor',
+    'automerge',
+    'repair',
+    'deploy',
+    'install',
+    'proposalOnly',
+];
+const SCOPE_KEYS = DAEMON_ACTIVATION_SCOPE_KEYS;
+/** All-false scope — the base every CLI `grant` invocation flips bits on top of. */
+export const EMPTY_DAEMON_ACTIVATION_SCOPE = Object.freeze({
+    once: false,
+    resident: false,
+    residentStanding: false,
+    conductor: false,
+    automerge: false,
+    repair: false,
+    deploy: false,
+    install: false,
+    proposalOnly: false,
+});
+/** Preserves pre-M470 test/caller behavior when `buildDaemonActivationPermitPayload` omits `scope`. */
+const LEGACY_ONCE_PROPOSAL_SCOPE = Object.freeze({
+    ...EMPTY_DAEMON_ACTIVATION_SCOPE,
+    once: true,
+    proposalOnly: true,
+});
 const validCapabilities = new WeakMap();
-function mintCapability(permitId, validateAtClaim) {
+function mintCapability(permitId, scope, validateAtClaim) {
     const capability = Object.freeze({
         kind: 'proposal-once',
         permitId,
+        scope: Object.freeze({ ...scope }),
         [capabilityBrand]: true,
     });
     validCapabilities.set(capability, validateAtClaim);
@@ -52,14 +139,6 @@ export function isDaemonActivationCapability(value) {
         return false;
     }
 }
-/**
- * Goal and simple conductors have broader authority than M461's one-item
- * proposal profile. They remain dormant until a separately reviewed permit
- * contract exists for those entry points.
- */
-export function liveConductorActivationAuthorized() {
-    return false;
-}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -166,33 +245,43 @@ function validFileBinding(value) {
         && DIGEST_RE.test(String(value['sha256']));
 }
 function validScope(value) {
-    if (!isRecord(value) || !hasExactKeys(value, [
-        'action',
-        'once',
-        'dryRun',
-        'resident',
-        'drain',
-        'drainLimit',
-        'proposalOnly',
-        'automerge',
-        'repair',
-        'deploy',
-        'install',
-        'selfTarget',
-    ]))
+    if (!isRecord(value) || !hasExactKeys(value, SCOPE_KEYS))
         return false;
-    return value['action'] === 'daemon-proposal-once'
-        && value['once'] === true
-        && value['dryRun'] === false
-        && value['resident'] === false
-        && value['drain'] === false
-        && value['drainLimit'] === null
-        && value['proposalOnly'] === true
-        && value['automerge'] === false
-        && value['repair'] === false
-        && value['deploy'] === false
-        && value['install'] === false
-        && value['selfTarget'] === false;
+    return SCOPE_KEYS.every((key) => typeof value[key] === 'boolean');
+}
+/**
+ * Loading a STANDING GRANT record from disk needs a more forgiving check
+ * than minting a new one: `validScope` requires every currently-defined
+ * scope key to be present, but a standing grant can live for up to 30 days
+ * — long enough to span an `npm`/build upgrade that adds a new key to
+ * `DAEMON_ACTIVATION_SCOPE_KEYS` (exactly what `residentStanding` is). A
+ * strict exact-key check on LOAD would make `hasExactKeys` reject that one
+ * older-format record — and `loadGrantStore()` fails the WHOLE store, not
+ * just that record, on any single invalid one, which would silently deny
+ * every OTHER still-valid standing grant (conductor/install/etc.) too.
+ *
+ * This accepts any subset of the current scope keys (no unrecognized keys,
+ * every present key boolean) and leaves absent keys simply absent. Every
+ * read site treats `record.scope[key] !== true` / falsy the same way
+ * `undefined` would, so an old record's missing new-generation keys read as
+ * "not granted" — never widened, never silently trusted. Signature
+ * verification is unaffected: `grantSigningBytes` canonicalizes whatever
+ * `scope` object the record actually contains, i.e. exactly what was
+ * originally signed, not a backfilled/padded version — so an old record's
+ * signature still verifies against its original (smaller) scope shape.
+ */
+function validStoredScope(value) {
+    if (!isRecord(value))
+        return false;
+    for (const key of Object.keys(value)) {
+        if (!SCOPE_KEYS.includes(key))
+            return false;
+    }
+    for (const key of SCOPE_KEYS) {
+        if (key in value && typeof value[key] !== 'boolean')
+            return false;
+    }
+    return true;
 }
 function validBindings(value) {
     if (!isRecord(value) || !hasExactKeys(value, [
@@ -285,6 +374,11 @@ function trustRootMap(roots) {
 function equalCanonical(left, right) {
     return canonicalizeDaemonActivationValue(left) === canonicalizeDaemonActivationValue(right);
 }
+/** Which top-level binding fields differ, field by field — never a single opaque yes/no. */
+function bindingFieldMismatches(actual, expected) {
+    const keys = Object.keys(expected);
+    return keys.filter((key) => !equalCanonical(actual[key], expected[key]));
+}
 export function verifyDaemonActivationPermit(value, context, trustRoots) {
     if (trustRoots.length === 0)
         return { ok: false, reason: 'no-trusted-activation-roots' };
@@ -333,7 +427,11 @@ export function verifyDaemonActivationPermit(value, context, trustRoots) {
         guardHealth: 'healthy',
     };
     if (!equalCanonical(envelope.payload.bindings, expectedBindings)) {
-        return { ok: false, reason: 'permit-runtime-binding-mismatch' };
+        return {
+            ok: false,
+            reason: 'permit-runtime-binding-mismatch',
+            mismatchedBindings: bindingFieldMismatches(envelope.payload.bindings, expectedBindings),
+        };
     }
     const publicKey = trusted.get(envelope.payload.keyId);
     if (!publicKey)
@@ -357,6 +455,7 @@ export function verifyDaemonActivationPermit(value, context, trustRoots) {
     };
 }
 export function buildDaemonActivationPermitPayload(input) {
+    const scope = input.scope ?? LEGACY_ONCE_PROPOSAL_SCOPE;
     const payload = {
         schemaVersion: 1,
         policyVersion: POLICY_VERSION,
@@ -365,20 +464,7 @@ export function buildDaemonActivationPermitPayload(input) {
         keyId: input.keyId,
         issuedAt: input.issuedAt,
         expiresAt: input.expiresAt,
-        scope: {
-            action: 'daemon-proposal-once',
-            once: true,
-            dryRun: false,
-            resident: false,
-            drain: false,
-            drainLimit: null,
-            proposalOnly: true,
-            automerge: false,
-            repair: false,
-            deploy: false,
-            install: false,
-            selfTarget: false,
-        },
+        scope: { ...scope },
         bindings: {
             configDigest: input.context.configDigest,
             buildIdentity: { ...input.context.buildIdentity },
@@ -410,6 +496,12 @@ function safeOwnedFile(stat) {
     const privateMode = process.platform === 'win32' || (stat.mode & 63n) === 0n;
     return stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1n && owned && privateMode;
 }
+function safeOwnedDirectory(stat) {
+    const owned = process.platform === 'win32' || typeof process.getuid !== 'function'
+        || stat.uid === BigInt(process.getuid());
+    const privateMode = process.platform === 'win32' || (stat.mode & 63n) === 0n;
+    return stat.isDirectory() && !stat.isSymbolicLink() && owned && privateMode;
+}
 function sameFileSnapshot(left, right) {
     return left.dev === right.dev
         && left.ino === right.ino
@@ -620,7 +712,26 @@ function hashStableReleaseTree(entrypointPath) {
 export function daemonActivationReleaseTreeBinding(entrypointPath) {
     return hashStableReleaseTree(entrypointPath);
 }
-function currentAuthorityStateDigest() {
+/**
+ * Fingerprints "this authority store instance" — the ~/.ashlr directory a
+ * permit is bound to — so a permit can't be replayed against a different
+ * store (e.g. copied to another machine, or after a full delete+recreate).
+ *
+ * Deliberately uses dev+ino, NOT mtime. ~/.ashlr's own mtime changes every
+ * time a direct child is created or removed — and ordinary `daemon start`
+ * does exactly that before it ever reaches this check: acquireDaemonLock()
+ * (src/core/daemon/state.ts) creates ~/.ashlr/daemon.lock via
+ * `writeFileSync(..., {flag:'wx'})`, a brand-new direct child of ~/.ashlr.
+ * Binding to mtime meant every freshly minted permit was invalidated by the
+ * daemon's own startup lock-file creation, 100% reproducibly, before it
+ * could ever be consumed — a self-inflicted permit-runtime-binding-mismatch,
+ * not a real "different store" signal. dev+ino uniquely and STABLY identify
+ * the directory's inode: they survive ordinary child churn (locks, control
+ * files, receipts) and change only if ~/.ashlr is deleted and recreated (or
+ * moved to a different filesystem) — exactly the case this binding exists
+ * to catch.
+ */
+export function daemonActivationAuthorityStateDigest() {
     const home = realpathSync(resolve(homedir()));
     const ashlrHome = realpathSync(join(home, '.ashlr'));
     const state = lstatSync(ashlrHome, { bigint: true });
@@ -639,7 +750,6 @@ function currentAuthorityStateDigest() {
             path: ashlrHome,
             dev: state.dev.toString(),
             ino: state.ino.toString(),
-            mtimeNs: state.mtimeNs.toString(),
         },
         enrollment: [...enrollment.repos].sort(),
     }));
@@ -656,7 +766,7 @@ function collectRuntimeContext(cfg) {
         executable: hashStableFile(process.execPath),
         entrypoint: hashStableFile(entrypoint),
         releaseTree: daemonActivationReleaseTreeBinding(entrypoint),
-        authorityStateDigest: currentAuthorityStateDigest(),
+        authorityStateDigest: daemonActivationAuthorityStateDigest(),
         killSwitchOff: !killSwitchOn(),
         guardHealthHealthy: !guard.blocked,
     };
@@ -674,7 +784,734 @@ function daemonActivationNonceReceiptPath(nonceDigest) {
         throw new Error('invalid daemon activation nonce digest');
     return join(homedir(), '.ashlr', 'control', 'activation-receipts', 'by-nonce', `${nonceDigest}.json`);
 }
-function activationReadiness(state, reason, trustRootCount) {
+// ---------------------------------------------------------------------------
+// Operator authority store — trust roots + standing grants.
+//
+// Root of trust is OS-level file ownership/permissions on the operator's own
+// machine (mirrors the one-shot permit's existing safety model), not a
+// central registry. Every store read fails CLOSED to "no authority" on any
+// ambiguity: missing file, unreadable, wrong owner, wrong permissions,
+// symlinked path, malformed JSON, non-canonical encoding, or duplicate ids.
+// ---------------------------------------------------------------------------
+export function daemonActivationDirPath() {
+    return join(homedir(), '.ashlr', 'activation');
+}
+export function daemonActivationTrustRootsPath() {
+    return join(daemonActivationDirPath(), 'trust-roots.json');
+}
+export function daemonActivationGrantsPath() {
+    return join(daemonActivationDirPath(), 'grants.json');
+}
+export function daemonActivationOperatorKeyPath() {
+    return join(daemonActivationDirPath(), 'operator-private-key.pem');
+}
+function daemonActivationStoreLockPath() {
+    return join(daemonActivationDirPath(), 'activation-store.lock');
+}
+function pathEntryPresent(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Safe, non-consuming read of a canonical-JSON-array operator store file. */
+function safeReadOwnedJsonArray(path, anchorPath, maxBytes) {
+    if (process.platform === 'win32') {
+        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    let dirStat;
+    try {
+        dirStat = lstatSync(dirname(path), { bigint: true });
+    }
+    catch (error) {
+        return { ok: false, reason: error.code === 'ENOENT' ? 'missing' : 'stat-failed' };
+    }
+    if (!safeOwnedDirectory(dirStat))
+        return { ok: false, reason: 'unsafe-directory' };
+    const dirAssurance = assurePrivateStoragePath(dirname(path), 'directory', 'inspect-owned', { anchorPath });
+    if (!dirAssurance.ok)
+        return { ok: false, reason: `unsafe-directory:${dirAssurance.reason}` };
+    // Open first, then validate the fd — the check (owner/mode/regular-file/
+    // size) and the read below share one file description, so there is no
+    // window between "checked" and "used" for an attacker to swap the path.
+    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        return { ok: false, reason: error.code === 'ENOENT' ? 'missing' : 'open-failed' };
+    }
+    try {
+        const opened = fstatSync(fd, { bigint: true });
+        if (!safeOwnedFile(opened) || opened.size <= 0n || opened.size > BigInt(maxBytes)) {
+            return { ok: false, reason: 'unsafe-file' };
+        }
+        const size = Number(opened.size);
+        const bytes = Buffer.alloc(size);
+        let offset = 0;
+        while (offset < size) {
+            const count = readSync(fd, bytes, offset, size - offset, offset);
+            if (count <= 0)
+                return { ok: false, reason: 'short-read' };
+            offset += count;
+        }
+        const after = fstatSync(fd, { bigint: true });
+        if (!sameFileSnapshot(opened, after))
+            return { ok: false, reason: 'changed-during-read' };
+        const text = bytes.toString('utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            return { ok: false, reason: 'invalid-json' };
+        }
+        if (`${canonicalizeDaemonActivationValue(parsed)}\n` !== text) {
+            return { ok: false, reason: 'noncanonical-encoding' };
+        }
+        if (!Array.isArray(parsed))
+            return { ok: false, reason: 'not-an-array' };
+        const fileAssurance = assurePrivateStoragePath(path, 'file', 'inspect-owned', { anchorPath });
+        if (!fileAssurance.ok)
+            return { ok: false, reason: `unsafe-file:${fileAssurance.reason}` };
+        return { ok: true, value: parsed };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Atomically replace a canonical-JSON-array operator store file (temp write + rename). */
+function writeCanonicalJsonArrayFileAtomic(path, value, anchorPath) {
+    assurePrivateDirectory(dirname(path), anchorPath);
+    const tmpPath = `${path}.tmp-${randomBytes(8).toString('hex')}`;
+    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+    let fd;
+    try {
+        fd = openSync(tmpPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
+        const initial = fstatSync(fd, { bigint: true });
+        if (!safeOwnedFile(initial) || initial.size !== 0n)
+            throw new Error('unsafe-activation-store-temp-file');
+        fchmodSync(fd, PRIVATE_FILE_MODE);
+        const bytes = Buffer.from(`${canonicalizeDaemonActivationValue(value)}\n`, 'utf8');
+        writeAll(fd, bytes);
+        fsyncSync(fd);
+        const written = fstatSync(fd, { bigint: true });
+        if (!safeOwnedFile(written) || written.size !== BigInt(bytes.length)) {
+            throw new Error('activation-store-temp-file-changed-during-write');
+        }
+        closeSync(fd);
+        fd = undefined;
+        renameSync(tmpPath, path);
+        const assurance = assurePrivateStoragePath(path, 'file', 'secure-created', { anchorPath });
+        if (!assurance.ok)
+            throw new Error(`unsafe-activation-store-path:${assurance.reason}`);
+        fsyncDirectory(dirname(path));
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best-effort */ }
+        }
+        try {
+            if (existsSync(tmpPath))
+                unlinkSync(tmpPath);
+        }
+        catch { /* best-effort cleanup */ }
+    }
+}
+function withActivationStoreLock(fn) {
+    const home = resolve(homedir());
+    // Two single-level creates: ~/.ashlr may not exist yet on a machine where
+    // `activation init` is the very first ashlr command ever run.
+    assurePrivateDirectory(join(homedir(), '.ashlr'), home);
+    assurePrivateDirectory(daemonActivationDirPath(), home);
+    const lock = acquireLocalStoreLock(daemonActivationStoreLockPath(), LOCK_WAIT_MS, {
+        anchorPath: home,
+        exactPrivateStorage: true,
+    });
+    if (!lock)
+        throw new Error('activation-store-lock-unavailable');
+    let result;
+    try {
+        result = fn();
+    }
+    catch (error) {
+        releaseLocalStoreLock(lock);
+        throw error;
+    }
+    if (!releaseLocalStoreLock(lock))
+        throw new Error('activation-store-lock-release-failed');
+    return result;
+}
+function readOperatorPrivateKeyPem() {
+    const path = daemonActivationOperatorKeyPath();
+    const home = resolve(homedir());
+    // Open first, then validate the fd. The owner/mode/size check and the read
+    // below run against the same file description, so the path cannot be
+    // swapped between "checked" and "used".
+    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+    const fd = openSync(path, fsConstants.O_RDONLY | noFollow);
+    try {
+        const opened = fstatSync(fd, { bigint: true });
+        if (!safeOwnedFile(opened) || opened.size <= 0n || opened.size > BigInt(MAX_PERMIT_BYTES)) {
+            throw new Error('unsafe-operator-key-file');
+        }
+        const size = Number(opened.size);
+        const bytes = Buffer.alloc(size);
+        let offset = 0;
+        while (offset < size) {
+            const count = readSync(fd, bytes, offset, size - offset, offset);
+            if (count <= 0)
+                throw new Error('short-operator-key-read');
+            offset += count;
+        }
+        const after = fstatSync(fd, { bigint: true });
+        if (!sameFileSnapshot(opened, after))
+            throw new Error('operator-key-changed-during-read');
+        const assurance = assurePrivateStoragePath(path, 'file', 'inspect-owned', { anchorPath: home });
+        if (!assurance.ok)
+            throw new Error(`unsafe-operator-key-path:${assurance.reason}`);
+        return bytes.toString('utf8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function validTrustRootRecord(value) {
+    if (!isRecord(value) || !hasExactKeys(value, ['keyId', 'publicKeyPem', 'createdAt', 'revokedAt', 'label'])) {
+        return false;
+    }
+    if (typeof value['keyId'] !== 'string' || !KEY_ID_RE.test(value['keyId']))
+        return false;
+    if (typeof value['publicKeyPem'] !== 'string')
+        return false;
+    try {
+        const key = createPublicKey(value['publicKeyPem']);
+        if (key.asymmetricKeyType !== 'ed25519')
+            return false;
+    }
+    catch {
+        return false;
+    }
+    if (!validIsoTimestamp(value['createdAt']))
+        return false;
+    if (value['revokedAt'] !== null && !validIsoTimestamp(value['revokedAt']))
+        return false;
+    if (typeof value['label'] !== 'string' || value['label'].length > MAX_LABEL_LENGTH)
+        return false;
+    return true;
+}
+function loadTrustRootStore() {
+    const read = safeReadOwnedJsonArray(daemonActivationTrustRootsPath(), resolve(homedir()), MAX_TRUST_STORE_BYTES);
+    if (!read.ok) {
+        if (read.reason === 'missing')
+            return { ok: true, records: [] };
+        return { ok: false, reason: read.reason };
+    }
+    const records = [];
+    const seen = new Set();
+    for (const entry of read.value) {
+        if (!validTrustRootRecord(entry) || seen.has(entry.keyId)) {
+            return { ok: false, reason: 'invalid-trust-root-store' };
+        }
+        seen.add(entry.keyId);
+        records.push(entry);
+    }
+    return { ok: true, records };
+}
+/**
+ * The ONLY source of production trust roots: an operator-owned, protected
+ * file the operator populates via `ashlr activation init`. Missing, unsafe,
+ * or malformed → []  — identical denial to before this file loading existed.
+ */
+export function loadDaemonActivationTrustRoots() {
+    const loaded = loadTrustRootStore();
+    if (!loaded.ok)
+        return [];
+    return loaded.records
+        .filter((record) => record.revokedAt === null)
+        .map((record) => ({ keyId: record.keyId, publicKeyPem: record.publicKeyPem }));
+}
+/** Full trust-root status (incl. revoked history) for `ashlr activation status`. */
+export function daemonActivationTrustRootStatus() {
+    return loadTrustRootStore();
+}
+function activeTrustRootKeyMap() {
+    const loaded = loadTrustRootStore();
+    if (!loaded.ok)
+        return null;
+    const active = loaded.records
+        .filter((record) => record.revokedAt === null)
+        .map((record) => ({ keyId: record.keyId, publicKeyPem: record.publicKeyPem }));
+    return trustRootMap(active);
+}
+function validGrantRecord(value) {
+    if (!isRecord(value) || !hasExactKeys(value, [
+        'schemaVersion', 'grantId', 'keyId', 'issuedAt', 'expiresAt', 'scope', 'signature', 'revokedAt',
+    ]))
+        return false;
+    if (value['schemaVersion'] !== 1)
+        return false;
+    if (typeof value['grantId'] !== 'string' || !ID_RE.test(value['grantId']))
+        return false;
+    if (typeof value['keyId'] !== 'string' || !KEY_ID_RE.test(value['keyId']))
+        return false;
+    if (!validIsoTimestamp(value['issuedAt']) || !validIsoTimestamp(value['expiresAt']))
+        return false;
+    // validStoredScope (not validScope): a persisted STANDING grant may
+    // predate a newly-added scope key by up to 30 days — see its doc comment.
+    if (!validStoredScope(value['scope']))
+        return false;
+    if (typeof value['signature'] !== 'string')
+        return false;
+    try {
+        const sig = Buffer.from(value['signature'], 'base64');
+        if (sig.length !== 64 || sig.toString('base64') !== value['signature'])
+            return false;
+    }
+    catch {
+        return false;
+    }
+    if (value['revokedAt'] !== null && !validIsoTimestamp(value['revokedAt']))
+        return false;
+    return true;
+}
+function loadGrantStore() {
+    const read = safeReadOwnedJsonArray(daemonActivationGrantsPath(), resolve(homedir()), MAX_GRANTS_BYTES);
+    if (!read.ok) {
+        if (read.reason === 'missing')
+            return { ok: true, records: [] };
+        return { ok: false, reason: read.reason };
+    }
+    const records = [];
+    const seen = new Set();
+    for (const entry of read.value) {
+        if (!validGrantRecord(entry) || seen.has(entry.grantId)) {
+            return { ok: false, reason: 'invalid-grant-store' };
+        }
+        seen.add(entry.grantId);
+        records.push(entry);
+    }
+    return { ok: true, records };
+}
+/** Full standing-grant status (incl. revoked/expired history) for `ashlr activation status`. */
+export function daemonActivationGrantStatus() {
+    return loadGrantStore();
+}
+function grantSigningCore(record) {
+    return {
+        schemaVersion: record.schemaVersion,
+        grantId: record.grantId,
+        keyId: record.keyId,
+        issuedAt: record.issuedAt,
+        expiresAt: record.expiresAt,
+        scope: record.scope,
+    };
+}
+function grantSigningBytes(core) {
+    return Buffer.from(`${GRANT_SIGNING_DOMAIN}${canonicalizeDaemonActivationValue(core)}`, 'utf8');
+}
+export function signDaemonActivationGrant(input) {
+    const core = grantSigningCore({
+        schemaVersion: 1,
+        grantId: input.grantId,
+        keyId: input.keyId,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        scope: { ...input.scope },
+    });
+    const key = typeof input.privateKey === 'string' ? createPrivateKey(input.privateKey) : input.privateKey;
+    if (key.type !== 'private' || key.asymmetricKeyType !== 'ed25519') {
+        throw new Error('daemon activation grants require an Ed25519 private key');
+    }
+    const signature = sign(null, grantSigningBytes(core), key).toString('base64');
+    const record = { ...core, signature, revokedAt: null };
+    if (!validGrantRecord(record))
+        throw new Error('invalid daemon activation grant record');
+    return record;
+}
+function auditActivationEvent(action, summary, result) {
+    audit({ action, repo: null, sandboxId: null, summary, result });
+}
+/**
+ * Checks whether ANY non-revoked, non-expired, validly-signed standing grant
+ * (from a non-revoked trust root) currently grants `scopeKey`. Unlike the
+ * one-shot permit, standing grants are NOT bound to exact executable/
+ * entrypoint/release-tree hashes — they must remain valid across routine
+ * rebuilds within their expiry window. They ARE bound to kill-switch-off,
+ * guard-health-healthy, and a non-revoked trust root, and always expire.
+ */
+/**
+ * Shared core of `daemonActivationScopeGranted`. Returns the matched grant
+ * RECORD (not just a boolean) so callers that need to act on it — currently
+ * only the resident-standing startup path — can read its scope and grantId
+ * without a second, redundant store read. Same checks, same order, as the
+ * pre-refactor inline body of `daemonActivationScopeGranted`.
+ */
+function findGrantedRecord(scopeKey) {
+    if (process.platform === 'win32') {
+        return { granted: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    if (killSwitchOn())
+        return { granted: false, reason: 'kill-switch-is-on' };
+    let guardHealthy;
+    try {
+        guardHealthy = !diagnoseGuardHealth().blocked;
+    }
+    catch {
+        return { granted: false, reason: 'guard-health-check-failed' };
+    }
+    if (!guardHealthy)
+        return { granted: false, reason: 'guard-health-degraded' };
+    const trusted = activeTrustRootKeyMap();
+    if (!trusted || trusted.size === 0)
+        return { granted: false, reason: 'no-trusted-activation-roots' };
+    const grants = loadGrantStore();
+    if (!grants.ok)
+        return { granted: false, reason: `activation-grant-store-${grants.reason}` };
+    const nowMs = Date.now();
+    for (const record of grants.records) {
+        if (record.revokedAt !== null)
+            continue;
+        if (record.scope[scopeKey] !== true)
+            continue;
+        const publicKey = trusted.get(record.keyId);
+        if (!publicKey)
+            continue;
+        if (Date.parse(record.expiresAt) <= nowMs)
+            continue;
+        let signature;
+        try {
+            signature = Buffer.from(record.signature, 'base64');
+        }
+        catch {
+            continue;
+        }
+        if (!verify(null, grantSigningBytes(grantSigningCore(record)), publicKey, signature))
+            continue;
+        return { granted: true, record };
+    }
+    return { granted: false, reason: 'no-matching-standing-grant' };
+}
+export function daemonActivationScopeGranted(scopeKey) {
+    const found = findGrantedRecord(scopeKey);
+    return found.granted
+        ? { granted: true, reason: `granted-by-${found.record.grantId}` }
+        : { granted: false, reason: found.reason };
+}
+/**
+ * The goal and simple conductors consult this every cycle. Real, gated,
+ * revocable authority: granted only after `ashlr activation init` +
+ * `ashlr activation grant conductor`. Default (no grant) is denied, exactly
+ * as before this mechanism existed. Every check is audited.
+ */
+export function liveConductorActivationAuthorized() {
+    const check = daemonActivationScopeGranted('conductor');
+    auditActivationEvent('daemon-activation:conductor-check', `conductor activation ${check.granted ? 'authorized' : 'denied'}: ${check.reason}`, check.granted ? 'ok' : 'refused');
+    return check.granted;
+}
+// ---------------------------------------------------------------------------
+// Operator authority mutation — init / grant / revoke. Called from
+// `src/cli/activation.ts`; kept here so all signing/writing stays alongside
+// the verification it must satisfy.
+// ---------------------------------------------------------------------------
+export function generateDaemonActivationOperatorKeypair() {
+    const pair = generateKeyPairSync('ed25519');
+    return {
+        privateKeyPem: pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+        publicKeyPem: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+    };
+}
+function sanitizeKeyId(candidate) {
+    const cleaned = candidate.replace(/[^A-Za-z0-9._-]/gu, '-').slice(0, 55);
+    const seeded = cleaned.length > 0 && /^[A-Za-z0-9]/u.test(cleaned) ? cleaned : `k${cleaned}`;
+    return seeded.slice(0, 63) || 'operator';
+}
+/**
+ * Generates an Ed25519 keypair on THIS machine (private key never leaves it,
+ * written 0600 under an 0700 directory) and registers the public half as a
+ * new active trust root. Refuses to silently clobber an existing active
+ * root or key file unless `force` is set (key rotation: the new root is
+ * ADDED, not swapped in place, so grants signed by an older still-active
+ * root keep working until explicitly revoked).
+ */
+export function daemonActivationInit(input) {
+    if (process.platform === 'win32') {
+        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    return withActivationStoreLock(() => {
+        const existing = loadTrustRootStore();
+        if (!existing.ok)
+            return { ok: false, reason: existing.reason };
+        const activeCount = existing.records.filter((record) => record.revokedAt === null).length;
+        if (activeCount > 0 && input.force !== true) {
+            return { ok: false, reason: 'trust-root-already-initialized' };
+        }
+        const keyPath = daemonActivationOperatorKeyPath();
+        if (pathEntryPresent(keyPath) && input.force !== true) {
+            return { ok: false, reason: 'operator-key-file-already-exists' };
+        }
+        const { privateKeyPem, publicKeyPem } = generateDaemonActivationOperatorKeypair();
+        const keyId = sanitizeKeyId(`${hostname()}-${randomBytes(4).toString('hex')}`);
+        const now = new Date().toISOString();
+        const record = {
+            keyId,
+            publicKeyPem,
+            createdAt: now,
+            revokedAt: null,
+            label: (input.label ?? '').slice(0, MAX_LABEL_LENGTH),
+        };
+        const home = resolve(homedir());
+        assurePrivateDirectory(daemonActivationDirPath(), home);
+        const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+        let fd;
+        try {
+            if (pathEntryPresent(keyPath))
+                unlinkSync(keyPath);
+            fd = openSync(keyPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
+            const initial = fstatSync(fd, { bigint: true });
+            if (!safeOwnedFile(initial) || initial.size !== 0n)
+                throw new Error('unsafe-operator-key-file');
+            fchmodSync(fd, PRIVATE_FILE_MODE);
+            writeAll(fd, Buffer.from(privateKeyPem, 'utf8'));
+            fsyncSync(fd);
+            closeSync(fd);
+            fd = undefined;
+            const keyAssurance = assurePrivateStoragePath(keyPath, 'file', 'secure-created', { anchorPath: home });
+            if (!keyAssurance.ok)
+                throw new Error(`unsafe-operator-key-path:${keyAssurance.reason}`);
+            fsyncDirectory(dirname(keyPath));
+        }
+        catch (error) {
+            return { ok: false, reason: error.message || 'operator-key-write-failed' };
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* best-effort */ }
+            }
+        }
+        writeCanonicalJsonArrayFileAtomic(daemonActivationTrustRootsPath(), [...existing.records, record], home);
+        auditActivationEvent('daemon-activation:init', `trust root registered: keyId=${keyId} label=${JSON.stringify(record.label)} rotated=${activeCount > 0}`, 'ok');
+        return { ok: true, keyId, publicKeyPem, rotated: activeCount > 0 };
+    });
+}
+export function daemonActivationRevokeTrustRoot(keyId) {
+    if (!KEY_ID_RE.test(keyId))
+        return { ok: false, reason: 'invalid-key-id' };
+    return withActivationStoreLock(() => {
+        const existing = loadTrustRootStore();
+        if (!existing.ok)
+            return { ok: false, reason: existing.reason };
+        const index = existing.records.findIndex((record) => record.keyId === keyId);
+        if (index === -1)
+            return { ok: false, reason: 'trust-root-not-found' };
+        if (existing.records[index].revokedAt !== null) {
+            auditActivationEvent('daemon-activation:revoke-root', `trust root already revoked: keyId=${keyId}`, 'ok');
+            return { ok: true };
+        }
+        const revokedAt = new Date().toISOString();
+        const updated = existing.records.map((record, i) => (i === index ? { ...record, revokedAt } : record));
+        writeCanonicalJsonArrayFileAtomic(daemonActivationTrustRootsPath(), updated, resolve(homedir()));
+        auditActivationEvent('daemon-activation:revoke-root', `trust root revoked: keyId=${keyId}`, 'ok');
+        return { ok: true };
+    });
+}
+export function daemonActivationRevokeGrant(grantId) {
+    if (!ID_RE.test(grantId))
+        return { ok: false, reason: 'invalid-grant-id' };
+    return withActivationStoreLock(() => {
+        const existing = loadGrantStore();
+        if (!existing.ok)
+            return { ok: false, reason: existing.reason };
+        const index = existing.records.findIndex((record) => record.grantId === grantId);
+        if (index === -1)
+            return { ok: false, reason: 'grant-not-found' };
+        if (existing.records[index].revokedAt !== null) {
+            auditActivationEvent('daemon-activation:revoke-grant', `standing grant already revoked: grantId=${grantId}`, 'ok');
+            return { ok: true };
+        }
+        const revokedAt = new Date().toISOString();
+        const updated = existing.records.map((record, i) => (i === index ? { ...record, revokedAt } : record));
+        writeCanonicalJsonArrayFileAtomic(daemonActivationGrantsPath(), updated, resolve(homedir()));
+        auditActivationEvent('daemon-activation:revoke-grant', `standing grant revoked: grantId=${grantId}`, 'ok');
+        return { ok: true };
+    });
+}
+/** Mints a signed, expiring standing grant (conductor/automerge/repair/deploy/install/proposalOnly). */
+export function daemonActivationMintStandingGrant(input) {
+    if (process.platform === 'win32') {
+        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0 || input.ttlMs > MAX_STANDING_GRANT_VALIDITY_MS) {
+        return { ok: false, reason: 'invalid-grant-ttl' };
+    }
+    if (!validScope(input.scope))
+        return { ok: false, reason: 'invalid-grant-scope' };
+    return withActivationStoreLock(() => {
+        const trustStore = loadTrustRootStore();
+        if (!trustStore.ok)
+            return { ok: false, reason: trustStore.reason };
+        const active = trustStore.records.filter((record) => record.revokedAt === null);
+        if (active.length === 0)
+            return { ok: false, reason: 'no-trusted-activation-roots' };
+        if (active.length > 1)
+            return { ok: false, reason: 'ambiguous-signing-key-run-activation-status' };
+        const root = active[0];
+        let privateKeyPem;
+        try {
+            privateKeyPem = readOperatorPrivateKeyPem();
+        }
+        catch (error) {
+            return { ok: false, reason: error.message || 'operator-key-unreadable' };
+        }
+        const existingGrants = loadGrantStore();
+        if (!existingGrants.ok)
+            return { ok: false, reason: existingGrants.reason };
+        const now = Date.now();
+        const record = signDaemonActivationGrant({
+            grantId: randomBytes(16).toString('hex'),
+            keyId: root.keyId,
+            issuedAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + input.ttlMs).toISOString(),
+            scope: input.scope,
+            privateKey: privateKeyPem,
+        });
+        writeCanonicalJsonArrayFileAtomic(daemonActivationGrantsPath(), [...existingGrants.records, record], resolve(homedir()));
+        auditActivationEvent('daemon-activation:grant', `standing grant minted: grantId=${record.grantId} keyId=${root.keyId} `
+            + `scope=${canonicalizeDaemonActivationValue(record.scope)} expiresAt=${record.expiresAt}`, 'ok');
+        return { ok: true, record };
+    });
+}
+/**
+ * Mints and pins a single-use activation permit (once/resident scopes) to
+ * daemonActivationPermitPath(), ready for `ashlr daemon start` to consume.
+ * Signs against THIS exact machine's current build (executable/entrypoint/
+ * release-tree hashes) — an operator runs this locally, immediately before
+ * starting the daemon it authorizes.
+ */
+export function daemonActivationMintOneShotPermit(input) {
+    if (process.platform === 'win32') {
+        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    if (!validScope(input.scope))
+        return { ok: false, reason: 'invalid-grant-scope' };
+    return withActivationStoreLock(() => {
+        const trustStore = loadTrustRootStore();
+        if (!trustStore.ok)
+            return { ok: false, reason: trustStore.reason };
+        const active = trustStore.records.filter((record) => record.revokedAt === null);
+        if (active.length === 0)
+            return { ok: false, reason: 'no-trusted-activation-roots' };
+        if (active.length > 1)
+            return { ok: false, reason: 'ambiguous-signing-key-run-activation-status' };
+        const root = active[0];
+        let privateKeyPem;
+        try {
+            privateKeyPem = readOperatorPrivateKeyPem();
+        }
+        catch (error) {
+            return { ok: false, reason: error.message || 'operator-key-unreadable' };
+        }
+        let configSnapshot;
+        try {
+            configSnapshot = strictConfigSnapshot(input.cfg);
+        }
+        catch {
+            return { ok: false, reason: 'activation-config-not-strict-json' };
+        }
+        // Cheap, context-independent check first: no point collecting a full
+        // runtime context (file hashing, release-tree walk) if there is already
+        // a pending permit occupying the single fixed path.
+        const permitPath = daemonActivationPermitPath();
+        if (pathEntryPresent(permitPath))
+            return { ok: false, reason: 'activation-permit-already-pending' };
+        let context;
+        try {
+            context = collectRuntimeContext(configSnapshot);
+        }
+        catch (error) {
+            return { ok: false, reason: `runtime-context-unavailable:${error.message}` };
+        }
+        if (!context.killSwitchOff)
+            return { ok: false, reason: 'kill-switch-is-on' };
+        if (!context.guardHealthHealthy)
+            return { ok: false, reason: 'guard-health-degraded' };
+        if (!validBuildIdentity(context.buildIdentity)) {
+            // Most commonly: a `git` provenance build with a dirty working tree
+            // (dist/ was built from uncommitted changes). Fail closed — a permit
+            // bound to an untrusted build identity would never verify anyway.
+            return { ok: false, reason: 'runtime-build-identity-untrusted' };
+        }
+        const now = Date.now();
+        const permitId = randomBytes(16).toString('hex');
+        let payload;
+        let envelope;
+        try {
+            payload = buildDaemonActivationPermitPayload({
+                permitId,
+                nonce: randomBytes(32).toString('hex'),
+                keyId: root.keyId,
+                issuedAt: new Date(now).toISOString(),
+                expiresAt: new Date(now + MAX_VALIDITY_MS).toISOString(),
+                scope: input.scope,
+                context,
+            });
+            envelope = signDaemonActivationPermit(payload, privateKeyPem);
+        }
+        catch (error) {
+            return { ok: false, reason: error.message || 'activation-permit-build-failed' };
+        }
+        const home = resolve(homedir());
+        assurePrivateDirectory(dirname(permitPath), home);
+        const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+        let fd;
+        try {
+            fd = openSync(permitPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
+            const initial = fstatSync(fd, { bigint: true });
+            if (!safeOwnedFile(initial) || initial.size !== 0n)
+                throw new Error('unsafe-activation-permit-file');
+            fchmodSync(fd, PRIVATE_FILE_MODE);
+            const bytes = Buffer.from(`${canonicalizeDaemonActivationValue(envelope)}\n`, 'utf8');
+            writeAll(fd, bytes);
+            fsyncSync(fd);
+            closeSync(fd);
+            fd = undefined;
+            const assurance = assurePrivateStoragePath(permitPath, 'file', 'secure-created', { anchorPath: home });
+            if (!assurance.ok)
+                throw new Error(`unsafe-activation-permit-path:${assurance.reason}`);
+            fsyncDirectory(dirname(permitPath));
+        }
+        catch (error) {
+            return { ok: false, reason: error.message || 'activation-permit-write-failed' };
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* best-effort */ }
+            }
+        }
+        auditActivationEvent('daemon-activation:grant', `one-shot permit minted: permitId=${permitId} keyId=${root.keyId} `
+            + `scope=${canonicalizeDaemonActivationValue(input.scope)} expiresAt=${payload.expiresAt}`, 'ok');
+        return { ok: true, permitId, permitPath, expiresAt: payload.expiresAt };
+    });
+}
+// ---------------------------------------------------------------------------
+// One-shot permit inspection / consumption — `ashlr daemon start` [--once].
+// ---------------------------------------------------------------------------
+function activationReadiness(state, reason, trustRootCount, extra) {
     return {
         schemaVersion: 1,
         policyVersion: POLICY_VERSION,
@@ -682,112 +1519,234 @@ function activationReadiness(state, reason, trustRootCount) {
         sourceState: state === 'degraded' ? 'degraded' : 'healthy',
         state,
         commandEligible: state === 'ready',
-        requestedShape: 'proposal-once',
+        requestedShape: extra?.requestedShape ?? 'proposal-once',
         trustRootCount,
-        residentAuthorized: false,
-        installAuthorized: false,
-        repairAuthorized: false,
+        residentAuthorized: extra?.residentAuthorized ?? false,
+        residentStandingAuthorized: extra?.residentStandingAuthorized ?? false,
+        installAuthorized: extra?.installAuthorized ?? false,
+        repairAuthorized: extra?.repairAuthorized ?? false,
         reason,
     };
 }
-function pathEntryPresent(path) {
+/** Maps the internal scope-key shape to the DaemonActivationReadiness label. */
+function requestedShapeLabel(shape) {
+    return shape === 'once' ? 'proposal-once' : 'resident';
+}
+/**
+ * What activation shape (if any) `opts` is structurally eligible to have
+ * authorized at all — independent of whether any permit/trust root exists.
+ * `null` means "denied before ever reading a permit," matching the pre-M470
+ * behavior for drain modes and any dry-run other than {once:true,dryRun:true}.
+ */
+function requestedActivationShape(opts) {
+    if (opts.drain !== undefined || opts.drainLimit !== undefined)
+        return null;
+    if (opts.dryRun === true)
+        return null;
+    if (opts.once === true)
+        return 'once';
+    if (opts.once === false)
+        return 'resident';
+    return null;
+}
+function needsPermit(opts) {
+    return !(opts.once === true && opts.dryRun === true);
+}
+/**
+ * Read-only diagnostic (never authorizes, never consumes) for `ashlr
+ * activation status`: peeks the pending one-shot permit, recomputes the
+ * current runtime context, and reports exactly which binding field(s)
+ * differ and what the two values were. `permit-runtime-binding-mismatch`
+ * alone can't tell an operator what to fix — this can.
+ */
+export function daemonActivationDiagnosePendingPermitBindings(cfg) {
+    const permitPath = daemonActivationPermitPath();
+    if (process.platform === 'win32') {
+        return { ok: false, reason: 'activation-permit-v1-unsupported-on-windows' };
+    }
+    let pinned;
     try {
-        lstatSync(path);
-        return true;
+        pinned = openPinnedPermit(permitPath, resolve(homedir()));
     }
     catch (error) {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
+        return {
+            ok: false,
+            reason: error.code === 'ENOENT'
+                ? 'activation-permit-missing'
+                : 'activation-permit-inspection-failed',
+        };
+    }
+    try {
+        let envelope;
+        try {
+            envelope = JSON.parse(pinned.text);
+        }
+        catch {
+            return { ok: false, reason: 'invalid-permit-json' };
+        }
+        const parsed = parseEnvelope(envelope);
+        if (!parsed)
+            return { ok: false, reason: 'invalid-permit-schema' };
+        let configSnapshot;
+        try {
+            configSnapshot = strictConfigSnapshot(cfg);
+        }
+        catch {
+            return { ok: false, reason: 'activation-config-not-strict-json' };
+        }
+        let context;
+        try {
+            context = collectRuntimeContext(configSnapshot);
+        }
+        catch (error) {
+            return { ok: false, reason: `runtime-context-unavailable:${error.message}` };
+        }
+        if (!context.killSwitchOff)
+            return { ok: false, reason: 'kill-switch-is-on' };
+        if (!context.guardHealthHealthy)
+            return { ok: false, reason: 'guard-health-degraded' };
+        const expectedBindings = {
+            configDigest: context.configDigest,
+            buildIdentity: context.buildIdentity,
+            executable: context.executable,
+            entrypoint: context.entrypoint,
+            releaseTree: context.releaseTree,
+            authorityStateDigest: context.authorityStateDigest,
+            killSwitch: 'off',
+            guardHealth: 'healthy',
+        };
+        const mismatchedKeys = bindingFieldMismatches(parsed.payload.bindings, expectedBindings);
+        if (mismatchedKeys.length === 0)
+            return { ok: true, reason: 'bindings-match' };
+        const mismatches = {};
+        for (const key of mismatchedKeys) {
+            mismatches[key] = { signed: parsed.payload.bindings[key], current: expectedBindings[key] };
+        }
+        return { ok: false, reason: 'permit-runtime-binding-mismatch', mismatches };
+    }
+    finally {
+        try {
+            closeSync(pinned.fd);
+        }
+        catch { /* diagnostic-only; best-effort close */ }
     }
 }
-function inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext) {
+function inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext, requestedShape, standingAuth) {
+    const shapeLabel = requestedShapeLabel(requestedShape);
+    const extraBase = {
+        requestedShape: shapeLabel,
+        installAuthorized: standingAuth.install,
+        repairAuthorized: standingAuth.repair,
+        residentStandingAuthorized: standingAuth.residentStanding,
+    };
     let envelope;
     try {
         envelope = JSON.parse(pinned.text);
     }
     catch {
-        return activationReadiness('degraded', 'invalid-permit-json', trustRoots.length);
+        return activationReadiness('degraded', 'invalid-permit-json', trustRoots.length, extraBase);
     }
     if (`${canonicalizeDaemonActivationValue(envelope)}\n` !== pinned.text) {
-        return activationReadiness('degraded', 'noncanonical-permit-encoding', trustRoots.length);
+        return activationReadiness('degraded', 'noncanonical-permit-encoding', trustRoots.length, extraBase);
     }
     const parsed = parseEnvelope(envelope);
     if (!parsed) {
-        return activationReadiness('degraded', 'invalid-permit-schema', trustRoots.length);
+        return activationReadiness('degraded', 'invalid-permit-schema', trustRoots.length, extraBase);
     }
     let configSnapshot;
     try {
         configSnapshot = strictConfigSnapshot(cfg);
     }
     catch {
-        return activationReadiness('degraded', 'activation-config-not-strict-json', trustRoots.length);
+        return activationReadiness('degraded', 'activation-config-not-strict-json', trustRoots.length, extraBase);
     }
     const context = suppliedContext ?? collectRuntimeContext(configSnapshot);
     if (context.configDigest !== daemonActivationConfigDigest(configSnapshot)) {
-        return activationReadiness('blocked', 'runtime-config-digest-mismatch', trustRoots.length);
+        return activationReadiness('blocked', 'runtime-config-digest-mismatch', trustRoots.length, extraBase);
     }
     const verification = verifyDaemonActivationPermit(parsed, context, trustRoots);
     if (!verification.ok || !verification.permitId) {
-        return activationReadiness('blocked', verification.reason, trustRoots.length);
+        return activationReadiness('blocked', verification.reason, trustRoots.length, extraBase);
+    }
+    const residentAuthorized = parsed.payload.scope.resident === true;
+    if (parsed.payload.scope[requestedShape] !== true) {
+        return activationReadiness('blocked', 'activation-permit-scope-does-not-grant-requested-shape', trustRoots.length, { ...extraBase, residentAuthorized });
     }
     const nonceDigest = sha256(parsed.payload.nonce);
     if (pathEntryPresent(daemonActivationReceiptPath(verification.permitId))
         || pathEntryPresent(daemonActivationNonceReceiptPath(nonceDigest))) {
-        return activationReadiness('blocked', 'activation-permit-already-consumed', trustRoots.length);
+        return activationReadiness('blocked', 'activation-permit-already-consumed', trustRoots.length, { ...extraBase, residentAuthorized });
     }
     const openedAfterInspection = fstatSync(pinned.fd, { bigint: true });
     const namedAfterInspection = lstatSync(permitPath, { bigint: true });
     if (!sameFileSnapshot(pinned.stat, openedAfterInspection)
         || !sameFileSnapshot(openedAfterInspection, namedAfterInspection)) {
-        return activationReadiness('degraded', 'activation-permit-changed-during-inspection', trustRoots.length);
+        return activationReadiness('degraded', 'activation-permit-changed-during-inspection', trustRoots.length, { ...extraBase, residentAuthorized });
     }
-    return activationReadiness('ready', 'valid-proposal-once-permit', trustRoots.length);
+    const readyReason = requestedShape === 'once' ? 'valid-proposal-once-permit' : 'valid-resident-permit';
+    return activationReadiness('ready', readyReason, trustRoots.length, { ...extraBase, residentAuthorized });
 }
 function inspectWithAuthority(cfg, opts, trustRoots, suppliedContext, platform = process.platform) {
+    const standingAuth = {
+        install: daemonActivationScopeGranted('install').granted,
+        repair: daemonActivationScopeGranted('repair').granted,
+        residentStanding: daemonActivationScopeGranted('residentStanding').granted,
+    };
+    const standingAuthorizedFields = {
+        installAuthorized: standingAuth.install,
+        repairAuthorized: standingAuth.repair,
+        residentStandingAuthorized: standingAuth.residentStanding,
+    };
     if (!needsPermit(opts)) {
-        return activationReadiness('ready', 'dry-run-once-does-not-require-activation-permit', trustRoots.length);
+        return activationReadiness('ready', 'dry-run-once-does-not-require-activation-permit', trustRoots.length, standingAuthorizedFields);
     }
-    if (!supportedProposalOnceShape(opts)) {
-        return activationReadiness('blocked', 'activation-permit-cannot-authorize-requested-start-shape', trustRoots.length);
+    const requestedShape = requestedActivationShape(opts);
+    if (!requestedShape) {
+        return activationReadiness('blocked', 'activation-permit-cannot-authorize-requested-start-shape', trustRoots.length, standingAuthorizedFields);
     }
+    const shapeLabel = requestedShapeLabel(requestedShape);
     if (trustRoots.length === 0) {
-        return activationReadiness('blocked', 'no-trusted-activation-roots', 0);
+        return activationReadiness('blocked', 'no-trusted-activation-roots', 0, {
+            requestedShape: shapeLabel,
+            ...standingAuthorizedFields,
+        });
     }
     if (platform === 'win32') {
-        return activationReadiness('blocked', 'activation-permit-v1-unsupported-on-windows', trustRoots.length);
+        return activationReadiness('blocked', 'activation-permit-v1-unsupported-on-windows', trustRoots.length, { requestedShape: shapeLabel, ...standingAuthorizedFields });
+    }
+    // A valid standing `residentStanding` grant means `daemon start` (resident)
+    // would succeed RIGHT NOW without ever touching the one-shot permit file —
+    // report that directly instead of inspecting a possibly-stale/unreadable
+    // one-shot permit that resident no longer depends on. This is the fix for
+    // status previously showing `resident: degraded
+    // (activation-permit-inspection-failed)` when a stale one-shot permit file
+    // was lying around: that inspection is simply skipped once a standing grant
+    // covers it.
+    if (requestedShape === 'resident' && standingAuth.residentStanding) {
+        return activationReadiness('ready', 'ready-via-standing-resident-grant', trustRoots.length, { requestedShape: shapeLabel, residentAuthorized: true, ...standingAuthorizedFields });
     }
     const permitPath = daemonActivationPermitPath();
     let pinned;
     let result;
     try {
         pinned = openPinnedPermit(permitPath, resolve(homedir()));
-        result = inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext);
+        result = inspectPinnedActivationPermit(pinned, permitPath, cfg, trustRoots, suppliedContext, requestedShape, standingAuth);
     }
     catch (error) {
         result = activationReadiness(error.code === 'ENOENT' ? 'blocked' : 'degraded', error.code === 'ENOENT'
             ? 'activation-permit-missing'
-            : 'activation-permit-inspection-failed', trustRoots.length);
+            : 'activation-permit-inspection-failed', trustRoots.length, { requestedShape: shapeLabel, installAuthorized: standingAuth.install, repairAuthorized: standingAuth.repair });
     }
     if (pinned) {
         try {
             closeSync(pinned.fd);
         }
         catch {
-            return activationReadiness('degraded', 'activation-permit-close-failed', trustRoots.length);
+            return activationReadiness('degraded', 'activation-permit-close-failed', trustRoots.length, { requestedShape: shapeLabel, installAuthorized: standingAuth.install, repairAuthorized: standingAuth.repair });
         }
     }
     return result;
 }
-function needsPermit(opts) {
-    return !(opts.once === true && opts.dryRun === true);
-}
-function supportedProposalOnceShape(opts) {
-    return opts.once === true
-        && opts.dryRun !== true
-        && opts.drain === undefined
-        && opts.drainLimit === undefined;
-}
 function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterReceiptPersisted, mayMintCapability) {
     if (!needsPermit(opts)) {
         return {
@@ -796,7 +1755,8 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
             reason: 'dry-run-once-does-not-require-activation-permit',
         };
     }
-    if (!supportedProposalOnceShape(opts)) {
+    const requestedShape = requestedActivationShape(opts);
+    if (!requestedShape) {
         return {
             authorized: false,
             required: true,
@@ -868,6 +1828,15 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
             result = { authorized: false, required: true, reason: 'invalid-permit-schema' };
             return result;
         }
+        if (parsed.payload.scope[requestedShape] !== true) {
+            result = {
+                authorized: false,
+                required: true,
+                reason: 'activation-permit-scope-does-not-grant-requested-shape',
+                permitId: verification.permitId,
+            };
+            return result;
+        }
         const receiptsDir = dirname(daemonActivationReceiptPath(verification.permitId));
         assurePrivateDirectory(receiptsDir, home);
         const receiptPath = daemonActivationReceiptPath(verification.permitId);
@@ -949,12 +1918,12 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
         result = {
             authorized: true,
             required: true,
-            reason: 'proposal-once-activation-authorized',
+            reason: requestedShape === 'once' ? 'proposal-once-activation-authorized' : 'resident-activation-authorized',
             permitId: verification.permitId,
             receiptPath,
             ...(mayMintCapability
                 ? {
-                    capability: mintCapability(verification.permitId, () => {
+                    capability: mintCapability(verification.permitId, parsed.payload.scope, () => {
                         const claimContext = collectRuntimeContext(configSnapshot);
                         return verifyDaemonActivationPermit(parsed, claimContext, trustRoots).ok;
                     }),
@@ -992,18 +1961,54 @@ function consumeWithAuthority(cfg, opts, trustRoots, suppliedContext, afterRecei
     }
 }
 /**
- * Runtime entrypoint. Its immutable repository-owned roots are the only path
- * that can mint an in-process activation capability.
+ * Runtime entrypoint. Trust roots come ONLY from the operator-owned store
+ * (see loadDaemonActivationTrustRoots); an npm consumer who never runs
+ * `ashlr activation init` sees the store as empty and gets today's exact
+ * denial. Every consume attempt — authorized or refused — is audited.
  */
 export function consumeDaemonActivationPermit(cfg, opts) {
-    return consumeWithAuthority(cfg, opts, DAEMON_ACTIVATION_TRUST_ROOTS, undefined, undefined, true);
+    // A resident start tries the standing `residentStanding` grant FIRST. This
+    // is what makes an unattended, launchd/systemd/Task-Scheduler-triggered
+    // restart after reboot possible: there is nobody present to mint a fresh
+    // one-shot permit, but a still-valid, still-signed, non-revoked standing
+    // grant needs no human in the loop. It goes through every check
+    // `daemonActivationScopeGranted` does (platform, kill switch, guard health,
+    // trust root, expiry, revocation, signature) — deliberately NOT the
+    // one-shot permit's build-identity binding, matching every other standing
+    // grant (conductor/install/automerge/repair/deploy), because a standing
+    // grant must keep working across routine rebuilds within its expiry
+    // window. If no standing grant matches, this falls through to the
+    // one-shot permit path unchanged — an operator who has only ever granted
+    // the one-shot form (or nothing) sees EXACTLY today's behavior.
+    if (requestedActivationShape(opts) === 'resident') {
+        const standing = findGrantedRecord('residentStanding');
+        if (standing.granted) {
+            const result = {
+                authorized: true,
+                required: true,
+                reason: `resident-standing-activation-authorized:${standing.record.grantId}`,
+                scope: standing.record.scope,
+                grantId: standing.record.grantId,
+            };
+            auditActivationEvent('daemon-activation:consume', `daemon activation consume authorized: ${result.reason}`, 'ok');
+            return result;
+        }
+        auditActivationEvent('daemon-activation:resident-standing-check', `resident standing grant unavailable (${standing.reason}); falling back to one-shot permit`, 'refused');
+    }
+    const result = consumeWithAuthority(cfg, opts, loadDaemonActivationTrustRoots(), undefined, undefined, true);
+    // The dry-run-once bypass (`required: false`) never touches a permit or
+    // any authority state — it is not a consume attempt, so nothing is audited.
+    if (result.required) {
+        auditActivationEvent('daemon-activation:consume', `daemon activation consume ${result.authorized ? 'authorized' : 'refused'}: ${result.reason}`, result.authorized ? 'ok' : 'refused');
+    }
+    return result;
 }
 /**
  * Read-only advisory inspection. A ready result is never authority: daemon
  * start must still reopen, revalidate, durably consume, and mint a capability.
  */
 export function inspectDaemonActivationPermit(cfg, opts) {
-    return inspectWithAuthority(cfg, opts, DAEMON_ACTIVATION_TRUST_ROOTS, undefined);
+    return inspectWithAuthority(cfg, opts, loadDaemonActivationTrustRoots(), undefined);
 }
 /** Test-only inspection with injected roots/context; it cannot mint authority. */
 export function inspectDaemonActivationPermitForVerification(cfg, opts, options) {