@botbuddy/cli 1.25.0 → 1.27.0

package/src/wait.mjs

@@ -14,7 +14,7 @@
 // Run     botbuddy wait --help for the condition grammar.
 
 import { EXIT, parseConditions, parseSseFrames, runWaitLoop, normalizeSince, truncateReceipt, formatPrReviewSnapshotWarnings } from "./wait-core.mjs";
-import { resolveAgentProfile, getAgentProfile, findProfileName, findEnvProfile, withPrincipalReceipt, PROFILE_FILE } from "./wait-profile.mjs";
+import { readAgentBinding, withPrincipalReceipt } from "./wait-profile.mjs";
 import { VERSION } from "./version.mjs";
 import { fileURLToPath } from "node:url";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
@@ -32,8 +32,6 @@ import { AGENT_KEY_RE, readAgentKeyEnv } from "./agent-key.mjs";
 export const WAIT_PROTOCOL_VERSION = 3;
 const CLI_UPGRADE_COMMAND = latestPublicCliCommand("wait");
 const MIN_RECEIPT_MAX_BYTES = 512;
-// BOT-1554: identical to the server's session-id shape check.
-const SESSION_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 // BOT-1582: the server's session-token shape (bb_agent_ + 64 hex), plus the
 // BOT-1572 bb_sess_ legacy alias, both accepted for one release.
 const SESSION_TOKEN_RE = AGENT_KEY_RE;
@@ -226,31 +224,18 @@ function parseArgv(argv) {
 // {waitSessionId, cursorStart} on success. Profiled waits fail closed unless the
 // relay authenticates and attests their machine principal.
 async function registerWait(opts, conditions, deadlineIso) {
-  // BOT-1572: a session-token wait sends NO profile / expected_tenant /
-  // session_id — the relay derives all three from the token. Everything else
-  // (protocol-2 profile wait) is unchanged.
-  const registerBody = opts.useSessionToken
-    ? {
-      action: "register",
-      client_version: VERSION,
-      wait_protocol_version: WAIT_PROTOCOL_VERSION,
-      conditions,
-      deadline: deadlineIso,
-      mode: opts.mode,
-    }
-    : {
-      action: "register",
-      profile: opts.agentProfile.name,
-      expected_tenant: opts.agentProfile.tenant,
-      // BOT-1467: name the arming work-graph session so the relay resolves and attributes
-      // the wait to its agent (validated same-owner) instead of the profile agent.
-      ...(opts.sessionId ? { session_id: opts.sessionId } : {}),
-      client_version: VERSION,
-      wait_protocol_version: WAIT_PROTOCOL_VERSION,
-      conditions,
-      deadline: deadlineIso,
-      mode: opts.mode,
-    };
+  // BOT-1608: a relay wait authenticates from the per-session `bb_agent_` token
+  // ($BOTBUDDY_AGENT_KEY) — the relay derives agent, tenant, and session from it.
+  // The retired protocol-2 profile register (profile + expected_tenant) is gone
+  // with the profile bridge; runWait fails closed before here if no session token.
+  const registerBody = {
+    action: "register",
+    client_version: VERSION,
+    wait_protocol_version: WAIT_PROTOCOL_VERSION,
+    conditions,
+    deadline: deadlineIso,
+    mode: opts.mode,
+  };
   const res = await fetch(`${opts.url.replace(/\/$/, "")}/event-stream`, {
     method: "POST",
     headers: {
@@ -379,28 +364,14 @@ async function registerWait(opts, conditions, deadlineIso) {
     throw err;
   }
   const body = await res.json();
-  if (opts.useSessionToken) {
-    // BOT-1572: a session-token wait has no profile to attest; the relay instead
-    // returns the derived session_id + agent_id. Their absence means the relay
-    // did not honour the token as a session credential — fail closed.
-    if (typeof body.agent_id !== "string" || !body.agent_id ||
-        typeof body.session_id !== "string" || !body.session_id) {
-      const err = new Error("relay did not attest the session token");
-      err.auth = true;
-      err.errorCode = "session_token_not_enforced";
-      throw err;
-    }
-  } else if (body.profile !== opts.agentProfile.name || typeof body.agent_id !== "string" || !body.agent_id) {
-    const err = new Error("relay did not attest the tenant-bound agent profile");
+  // BOT-1572/1608: a session-token wait has no profile to attest; the relay
+  // returns the derived session_id + agent_id. Their absence means the relay did
+  // not honour the token as a session credential — fail closed.
+  if (typeof body.agent_id !== "string" || !body.agent_id ||
+      typeof body.session_id !== "string" || !body.session_id) {
+    const err = new Error("relay did not attest the session token");
     err.auth = true;
-    err.errorCode = "profile_not_enforced";
-    throw err;
-  } else if (body.session_tenant !== opts.agentProfile.tenant) {
-    const err = new Error(
-      `profile expects ${opts.agentProfile.tenant} but registration resolved ${body.session_tenant ?? "no tenant"}`,
-    );
-    err.auth = true;
-    err.errorCode = "profile_tenant_mismatch";
+    err.errorCode = "session_token_not_enforced";
     throw err;
   }
   return {
@@ -653,29 +624,6 @@ function emit(receipt, { versioned = false, maxBytes = null } = {}) {
   process.stdout.write(JSON.stringify(bounded) + "\n");
 }
 
-function profileRecovery(profile) {
-  return latestPublicCliCommand(`profile setup ${profile.name}`);
-}
-
-function typedProfileError(errorCode) {
-  switch (String(errorCode ?? "").toLowerCase()) {
-    case "agent_key_required": return "profile_agent_required";
-    case "agent_tenant_required": return "profile_credential_unbound";
-    case "profile_tenant_mismatch": return "profile_credential_wrong_tenant";
-    case "unauthorized": return "profile_credential_revoked";
-    default: return errorCode;
-  }
-}
-
-function profileErrorReceipt(profile, error) {
-  return withPrincipalReceipt({
-    schema_version: 1,
-    outcome: "error",
-    error,
-    recovery: profileCredentialRecovery(profile),
-  }, profile, { sessionTenant: profile.tenant, agentId: null });
-}
-
 // BOT-1590: canonical one-line recoveries for every setup/auth/parameter error.
 // Each names the exact command to run and the source of any missing/invalid
 // value, so an agent (or a human) can self-serve without opening the docs. The
@@ -696,32 +644,6 @@ const RECOVERY = Object.freeze({
   conditions: "check the condition grammar: botbuddy wait --help / docs/agent-wait.md",
 });
 
-const KNOWN_PROFILES = "botbuddy-dev, supplyguard-dev";
-
-// profile_required / unknown_profile: name the file, a minimal example, and the
-// known profile names so the fix is a single edit (AC-3).
-function profileResolutionRecovery(errorCode) {
-  return errorCode === "unknown_profile"
-    ? `set a known profile in ${PROFILE_FILE} or pass --profile <name> — known profiles: ${KNOWN_PROFILES}`
-    : `add ${PROFILE_FILE} ({"schema_version":1,"profile":"botbuddy-dev"}) or pass --profile <name> — known profiles: ${KNOWN_PROFILES}`;
-}
-
-// A profile-credential error (missing/revoked/wrong-tenant): name the exact
-// setup command and the credential's real source, then rule out human PATs,
-// which are never valid for waits (AC-4). `botbuddy profile setup` stores the
-// key in the macOS Keychain under the profile env-var's name (it REQUIRES the
-// Keychain — ensureProfileCredentialBackend); on a non-Keychain host the
-// supported path is exporting that same profile env var directly, which
-// resolveAgentProfile reads. (The 0600 config.json store is the owner login
-// token's, not a profile credential's — a wait cannot consume it.)
-// BOT-1582: $BOTBUDDY_AGENT_KEY is now the per-session token var (valid for
-// waits), so it is no longer named here; BOTBUDDY_AGENT_API_KEY remains a human
-// PAT that never authenticates a wait.
-const HUMAN_PAT_NOTE = "human PATs (e.g. BOTBUDDY_AGENT_API_KEY) are not valid for waits";
-function profileCredentialRecovery(profile) {
-  return `${profileRecovery(profile)} (stores $${profile.tokenEnv} in the macOS Keychain; on a non-Keychain host export $${profile.tokenEnv} directly); ${HUMAN_PAT_NOTE}`;
-}
-
 // BOT-1593: emit ONE secret-free sensor event per setup/auth/parameter failure,
 // so the maintainer can see which onboarding gap agents hit most (and whether the
 // BOT-1590 recovery copy is reducing repeats). Best-effort AND time-bounded — the
@@ -779,40 +701,26 @@ async function sendSetupErrorEvent(opts, { error, exitCode, conditions }, signal
   // P2). So only ever REUSE a token the main flow already resolved (opts.token) or
   // read the profile's env var directly — never a fresh Keychain lookup.
   //
-  // Discover the caller's profile — flag or .botbuddy-agent.json — INDEPENDENTLY of
-  // whether --token was supplied, so profile/tenant are attached for attribution and
-  // dual-member disambiguation even on the documented --token override (without it a
-  // multi-tenant bearer is rejected tenant_ambiguous and the event is lost) (Codex P2).
-  // The env-slot inference (findEnvProfile) applies ONLY when there is no explicit
-  // token — inferring a tenant for an explicit --token bearer could attach one it is
-  // not a member of (→ tenant_forbidden drop).
-  let profileName = opts.agentProfile?.name ?? opts.profile ?? null;
-  if (!profileName) {
-    try {
-      profileName = await findProfileName(process.cwd());
-    } catch {
-      profileName = null; // a malformed .botbuddy-agent.json → no profile
-    }
-    if (!profileName && !opts.token) profileName = findEnvProfile(process.env);
+  // BOT-1608: discover the worktree binding — .botbuddy-agent.json — INDEPENDENTLY
+  // of whether an explicit --agent-key was supplied, so the tenant is attached for
+  // attribution and dual-member disambiguation (without it a multi-tenant bearer is
+  // rejected tenant_ambiguous and the event is lost). Env-only credential read: no
+  // Keychain lookup on this fail-fast path (it could block/prompt past the 2 s bound).
+  let binding = null;
+  try {
+    binding = await readAgentBinding(process.cwd());
+  } catch {
+    binding = null; // a malformed / retired-shape .botbuddy-agent.json → no binding
   }
-  // Only a KNOWN profile contributes a name/tenant/env-var — an unknown/oversized/
-  // sensitive raw --profile value (which the token path never validates) must not
-  // ride the secret-free event, matching the wait path's getAgentProfile rejection
-  // (Codex P2).
-  const known = profileName ? getAgentProfile(profileName) : null;
   let token = opts.token;
-  if (!token && known) token = process.env[known.tokenEnv] || null;
+  if (!token && binding) token = process.env[binding.mcpEnv] || null;
   // The only unusable bearer is none at all. A credential the RELAY just rejected
   // (revoked/unauthorized) will 401 at ingest too and drop silently — best-effort, by
   // design; a valid-key failure (session_id_required, wait_actor_required, wrong-tenant)
   // authenticates and records (Codex P1: this is an accepted limitation, see docs).
   if (!token) return;
-  // "profile" auth path whenever a profile was discovered (flag/file/env slot), even
-  // with a --token override; "explicit_token" only for a bare --token, no profile.
-  const explicit = !!opts.token && !profileName;
-  const tenant = opts.agentProfile?.tenant ?? known?.tenant ?? null;
-  const safeProfile = known ? profileName : null;
-  // Omit the explicit tenant for a wrong-tenant credential: the profile's expected
+  const tenant = binding?.tenant ?? null;
+  // Omit the explicit tenant for a wrong-tenant credential: the binding's expected
   // tenant is NOT one the bearer belongs to, and sensor-ingest's resolveWriteTenant
   // rejects an unauthorized explicit tenant (tenant_forbidden) → the event would drop.
   // Without it the server resolves the bearer's ACTUAL tenant and the row records
@@ -831,8 +739,8 @@ async function sendSetupErrorEvent(opts, { error, exitCode, conditions }, signal
       error,
       exit_code: exitCode,
       condition_types: conditionTypes,
-      auth_path: explicit ? "explicit_token" : "profile",
-      profile: safeProfile,
+      auth_path: opts.token ? "explicit_token" : "binding",
+      profile: null,
       cli_version: VERSION,
     },
   };
@@ -910,11 +818,11 @@ export async function runWait(argv) {
   const deadlineMs = Date.now() + timeoutSec * 1000;
 
   const needsRelay = conditions.some((c) => c.type !== "timer");
-  // BOT-1572/1582: a $BOTBUDDY_AGENT_KEY authenticates the wait on its own. When
-  // present it supersedes the profile + --session-id path entirely: the relay
-  // derives agent, tenant, and session from the token. --profile / --session-id
-  // are simply ignored; a conflicting explicit --token (a DIFFERENT credential)
-  // is a contradiction and is rejected.
+  // BOT-1572/1582/1608: a relay wait authenticates from the per-session
+  // $BOTBUDDY_AGENT_KEY (bb_agent_) — the relay derives agent, tenant, and session
+  // from the token. The retired protocol-2 profile register (profile + --session-id
+  // + a tenant-bound carrier from `profile setup`) is gone with the profile bridge,
+  // so a relay wait with no session token now fails closed with an actionable fix.
   if (needsRelay && opts.sessionToken) {
     if (!SESSION_TOKEN_RE.test(opts.sessionToken)) {
       process.stderr.write(`botbuddy wait: $BOTBUDDY_AGENT_KEY must match bb_agent_<64 hex>; ${RECOVERY.sessionToken}\n`);
@@ -931,54 +839,20 @@ export async function runWait(argv) {
     opts.useSessionToken = true;
     opts.token = opts.sessionToken;
   } else if (needsRelay) {
-    // BOT-1554: a relay wait MUST name its arming work-graph session. Fail fast —
-    // before any profile resolution or network call — so a wait can never be filed
-    // under whatever credential the machine holds (the "/waits all Megan" bug). A
-    // timer-only wait needs no relay and no session id (handled by !needsRelay).
-    if (!opts.sessionId) {
-      process.stderr.write(
-        `botbuddy wait: --session-id is required (or set $BOTBUDDY_SESSION_ID) — the work-graph session id returned by register_agent; ${RECOVERY.sessionId}\n`,
-      );
-      emitReceipt({
-        schema_version: 1,
-        outcome: "error",
-        error: "session_id_required",
-        recovery: RECOVERY.sessionId,
-      });
-      await reportSetupError(opts, { error: "session_id_required", exitCode: EXIT.INVALID, conditions });
-      process.exit(EXIT.INVALID);
-    }
-    if (!SESSION_UUID.test(opts.sessionId)) {
-      process.stderr.write(`botbuddy wait: --session-id must be a uuid (got '${opts.sessionId}'); ${RECOVERY.sessionId}\n`);
-      emitReceipt({ schema_version: 1, outcome: "error", error: "invalid_session_agent", detail: "session_id must be a uuid", recovery: RECOVERY.sessionId });
-      await reportSetupError(opts, { error: "invalid_session_agent", exitCode: EXIT.INVALID, conditions });
-      process.exit(EXIT.INVALID);
-    }
-    try {
-      opts.agentProfile = await resolveAgentProfile({
-        explicitProfile: opts.profile,
-        explicitToken: opts.token,
-      });
-    } catch (err) {
-      const code = err.code || "invalid_profile";
-      const recovery = profileResolutionRecovery(code);
-      process.stderr.write(`bb-wait: ${err.message}; ${recovery}\n`);
-      emitReceipt({ schema_version: 1, outcome: "error", error: code, recovery });
-      await reportSetupError(opts, { error: code, exitCode: EXIT.INVALID, conditions });
-      process.exit(EXIT.INVALID);
-    }
-    opts.token = opts.agentProfile.token;
-    if (!opts.token) {
-      process.stderr.write(
-        `botbuddy wait: profile '${opts.agentProfile.name}' has no tenant-bound agent credential; run ${profileCredentialRecovery(opts.agentProfile)}\n`,
-      );
-      emitReceipt(profileErrorReceipt(opts.agentProfile, "profile_required"));
-      // No credential resolved (opts.token is null here), so reportSetupError has
-      // no bearer to authenticate with and self-skips — call it for allowlist
-      // symmetry; it is a no-op until a token exists.
-      await reportSetupError(opts, { error: "profile_required", exitCode: EXIT.AUTH, conditions });
-      process.exit(EXIT.AUTH);
-    }
+    // No session token → the wait has no credential. Fail fast (before any network
+    // call) so a wait is never filed under whatever machine credential is lying
+    // around. register_agent mints the token and the harness exports it.
+    process.stderr.write(
+      `botbuddy wait: a relay wait requires the per-session agent token — ${RECOVERY.sessionToken}, then: botbuddy wait '<condition>'\n`,
+    );
+    emitReceipt({
+      schema_version: 1,
+      outcome: "error",
+      error: "session_token_required",
+      recovery: `${RECOVERY.sessionToken}; then: botbuddy wait '<condition>'`,
+    });
+    await reportSetupError(opts, { error: "session_token_required", exitCode: EXIT.AUTH, conditions });
+    process.exit(EXIT.AUTH);
   }
 
   // A claim=true wait is meaningless without a tracked registration: the server
@@ -1085,8 +959,7 @@ export async function runWait(argv) {
       if (err && err.auth) {
         // BOT-1574 (AC4): the relay refused a wait armed by the per-machine client
         // key (or any owner/setup credential). The fix is never profile setup —
-        // register a work agent and export its session token. Handle it before the
-        // profile-recovery branches, which would dereference an absent agentProfile.
+        // register a work agent and export its session token.
         if (err.errorCode === "client_key_cannot_wait") {
           process.stderr.write(
             "botbuddy wait: a client key (botbuddy login) cannot arm a wait — register_agent, export BOTBUDDY_AGENT_KEY=<session_token>, then re-run\n",
@@ -1099,33 +972,11 @@ export async function runWait(argv) {
           });
           process.exit(EXIT.AUTH);
         }
-        // BOT-1572: a session-token failure (revoked/expired/rotated, or the relay
-        // refusing to honour the token) is fixed by RE-REGISTERING, not by profile
-        // setup. Lead with that, and never touch the (absent) agentProfile.
-        const SESSION_TOKEN_ERRORS = new Set([
-          "session_token_revoked", "session_token_expired", "session_token_not_enforced",
-        ]);
-        if (opts.useSessionToken || SESSION_TOKEN_ERRORS.has(err.errorCode)) {
-          process.stderr.write(
-            `botbuddy wait: session token rejected (${err.errorCode || "unauthorized"}) — re-register the agent and export the new $BOTBUDDY_AGENT_KEY\n`,
-          );
-          emitReceipt(withPrincipalReceipt({
-            schema_version: 1,
-            outcome: "error",
-            error: err.errorCode || "unauthorized",
-            recovery: "register_agent → export BOTBUDDY_AGENT_KEY=<session_token>",
-          }, opts.agentProfile, { sessionTenant, agentId: registeredAgentId, sessionId: registeredSessionId }));
-          // Session-token path → reportSetupError self-skips (a bb_sess_ bearer
-          // ingest cannot authenticate); called for allowlist symmetry.
-          await reportSetupError(opts, { error: err.errorCode || "unauthorized", exitCode: EXIT.AUTH, conditions });
-          process.exit(EXIT.AUTH);
-        }
-        // BOT-1554: these are all SESSION-IDENTITY failures — the supplied session id
-        // (or the credential behind it) is a shared service carrier, an
-        // ended/foreign session, or a wrong-tenant session. Re-running profile setup
-        // and retrying with the SAME $BOTBUDDY_SESSION_ID just repeats the 403 (that
-        // command can't replace the parent shell's session variable), so lead with the
-        // reliable fix: register a WORK agent and export its NEW session id.
+        // BOT-1554: SESSION-IDENTITY failures — the session token (or the session
+        // id it carries) is a shared service carrier, an ended/foreign session, or
+        // a wrong-tenant session. Retrying with the SAME identity just repeats the
+        // 403, so lead with the reliable fix: register a WORK agent and export its
+        // NEW session token/id.
         const SESSION_IDENTITY_ERRORS = new Set([
           "wait_actor_required", "session_agent_forbidden", "session_agent_tenant_mismatch",
         ]);
@@ -1133,25 +984,36 @@ export async function runWait(argv) {
           const cause = err.errorCode === "wait_actor_required"
             ? `the wait was armed by a shared service carrier (${err.carrierAgentId})`
             : err.errorCode === "session_agent_tenant_mismatch"
-              ? "the session id ($BOTBUDDY_SESSION_ID) resolves to a different tenant than this wait"
-              : "the session id ($BOTBUDDY_SESSION_ID) is not a live agent session you own";
+              ? "the session token resolves to a different tenant than this wait"
+              : "the session token is not a live agent session you own";
           process.stderr.write(
-            `botbuddy wait: ${cause}; register a work agent (register_agent) and export the returned id as $BOTBUDDY_SESSION_ID — re-running '${profileRecovery(opts.agentProfile)}' will not replace the shell's session variable\n`,
+            `botbuddy wait: ${cause}; register a work agent (register_agent) and export the returned $BOTBUDDY_AGENT_KEY (and $BOTBUDDY_SESSION_ID)\n`,
           );
           emitReceipt(withPrincipalReceipt({
             schema_version: 1,
             outcome: "error",
             error: err.errorCode,
             ...(err.carrierAgentId ? { carrier_agent_id: err.carrierAgentId } : {}),
-            recovery: "register_agent → export BOTBUDDY_SESSION_ID=<new session_id>",
-          }, opts.agentProfile, { sessionTenant: opts.agentProfile?.tenant ?? sessionTenant ?? null, agentId: null }));
+            recovery: "register_agent → export BOTBUDDY_AGENT_KEY=<session_token>",
+          }, null, { sessionTenant, agentId: null }));
           await reportSetupError(opts, { error: err.errorCode, exitCode: EXIT.AUTH, conditions });
           process.exit(EXIT.AUTH);
         }
-        const error = typedProfileError(err.errorCode);
-        process.stderr.write(`botbuddy wait: profile authentication failed (${error}); run ${profileCredentialRecovery(opts.agentProfile)}\n`);
-        emitReceipt(profileErrorReceipt(opts.agentProfile, error));
-        await reportSetupError(opts, { error, exitCode: EXIT.AUTH, conditions });
+        // Any other relay auth refusal (revoked/expired/rotated token, or the relay
+        // refusing to honour it) is fixed by RE-REGISTERING and exporting the new
+        // session token — the profile bridge and its recoveries are gone (BOT-1608).
+        process.stderr.write(
+          `botbuddy wait: session token rejected (${err.errorCode || "unauthorized"}) — re-register the agent and export the new $BOTBUDDY_AGENT_KEY\n`,
+        );
+        emitReceipt(withPrincipalReceipt({
+          schema_version: 1,
+          outcome: "error",
+          error: err.errorCode || "unauthorized",
+          recovery: "register_agent → export BOTBUDDY_AGENT_KEY=<session_token>",
+        }, null, { sessionTenant, agentId: registeredAgentId, sessionId: registeredSessionId }));
+        // Session-token path → reportSetupError self-skips (a bb_agent_ bearer
+        // ingest cannot authenticate); called for allowlist symmetry.
+        await reportSetupError(opts, { error: err.errorCode || "unauthorized", exitCode: EXIT.AUTH, conditions });
         process.exit(EXIT.AUTH);
       }
       if (err && err.cap) {
@@ -1169,7 +1031,7 @@ export async function runWait(argv) {
         // registration. Emit the typed receipt and a concrete exit: 4 (INVALID)
         // for a not-found key, 5 (BACKEND) for a retryable backend/config reason.
         const reason = err.hydration?.reason ?? (err.notFound ? "issue_not_found" : "unknown");
-        const tenant = opts.agentProfile?.tenant ?? "your-tenant";
+        const tenant = sessionTenant ?? "your-tenant";
         const fix = err.notFound
           ? "no Linear issue with that key exists in this workspace"
           : reason === "no_linear_api_key"
@@ -1206,14 +1068,14 @@ export async function runWait(argv) {
         emitReceipt({ schema_version: 1, outcome: "error", error: "claim_registration_failed" });
         process.exit(EXIT.INTERNAL);
       }
-      // BOT-1338: every non-timer wait is now a tenant-bound machine profile. If
-      // registration did not succeed, neither the server nor this client has verified
-      // that profile's tenant, so there is no safe untracked fallback for ANY condition.
-      process.stderr.write(`bb-wait: profiled wait-session registration failed (failing closed, not arming untracked): ${err && err.message || err}\n`);
+      // BOT-1338/1608: every non-timer wait is a relay-tracked, session-token wait.
+      // If registration did not succeed, neither the server nor this client has
+      // verified the session's tenant, so there is no safe untracked fallback.
+      process.stderr.write(`bb-wait: wait-session registration failed (failing closed, not arming untracked): ${err && err.message || err}\n`);
       emitReceipt(withPrincipalReceipt(
         { schema_version: 1, outcome: "error", error: "register_failed", detail: String(err && err.message || err) },
-        opts.agentProfile,
-        { sessionTenant: opts.agentProfile?.tenant ?? sessionTenant ?? null, agentId: null },
+        null,
+        { sessionTenant: sessionTenant ?? null, agentId: null },
       ));
       process.exit(EXIT.INTERNAL);
     }
@@ -1244,7 +1106,7 @@ export async function runWait(argv) {
     // Emit the wake receipt FIRST — it is the terminal result the harness reads.
     // Finalization is best-effort telemetry and must never gate or delay it.
     const terminalReceipt = truncateReceipt(
-      withClientIdentity(withPrincipalReceipt(receipt, opts.agentProfile, {
+      withClientIdentity(withPrincipalReceipt(receipt, null, {
         sessionTenant,
         agentId: registeredAgentId,
         sessionAgentId: registeredSessionAgentId,