@botbuddy/cli 1.63.13 → 1.63.15

package/src/stack.mjs

@@ -33,7 +33,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync } from "fs";
 import { open, unlink, readFile } from "fs/promises";
 import { homedir, tmpdir } from "os";
 import { basename, dirname, join, relative, isAbsolute } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID, createHash } from "crypto";
 import { fileURLToPath } from "url";
 import { callToolJson, CALL_AUTH_ERROR_CODES } from "./api.mjs";
 import { deepLinkNotice, safeWebUrl } from "./deep-link.mjs";
@@ -43,12 +43,16 @@ import { AGENT_KEY_RE, readAgentSessionTokenEnv } from "./agent-key.mjs";
 import { resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
 import { runDockerCommand, runDockerWorkflow, ADMITTED_DOCKER_VALIDATIONS } from "./docker-hygiene.mjs";
 import { acquireStackLock, lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
-import { LEASED_STACK_IDLE_RETENTION_SECS, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
+import { LEASED_STACK_IDLE_RETENTION_SECS, assertFreshRunStackAvailable, recordAdmissionRequest, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
+import { reserveRequesterOrigin } from "./stack-requester-origin.mjs";
+import { identifiedAdmissionAck, identifiedAdmissionDelivery, identifiedAdmissionRecovery } from "./stack-identified-admission.mjs";
+import { patchRequesterAuthOrigin } from "./stack-requester-origin-config.mjs";
 import { measureStackUsage } from "./stack-usage.mjs";
 import { checkReadoptedStackMounts } from "./stack-mount-health.mjs";
 import { machineUuid } from "./machine-id.mjs";
 import { DEFAULT_BUNDLE_MAX_BYTES, buildStackBundle, uploadStackBundle, validateBundleIncludePath } from "./stack-bundle.mjs";
 import { assertSshTarget, establishSshTunnel } from "./stack-tunnel.mjs";
+import { NATIVE_CALLBACK_TRANSPORT, openNativeCallbackTransport } from "./stack-native-callback.mjs";
 import { FORWARD_ATTESTATION_ENV, startForwardAttestation, readForwardAttestation } from "./stack-forward-attestation.mjs";
 import { stackServicesForForwards } from "./stack-service-discovery.mjs";
 import { ENGINE_PUBLISHES_BEYOND_LOOPBACK, engineSocketIsLocal, formatPublishIp, isLoopbackIp, publishIpFix, resolvePublishIp } from "./docker-publish-ip.mjs";
@@ -57,12 +61,28 @@ import { reportStackRunOutcome } from "./stack-run-outcome.mjs";
 
 export const STACK_SCHEMA_VERSION = 1;
 
+/**
+ * BOT-2780: only `stack run --remote --execution-ring beta --reap` reserves a requester
+ * origin and allocates through BOT-2499's identified admission. The origin cannot outlive
+ * its CLI, so the invocation must own cleanup; stable/auto/local and idle runs are unchanged.
+ */
+export const requesterOriginEnabled = (opts) => opts.execution === "remote" && opts.executionRing === "beta" && opts.reap === true;
+// Exact replays of one identified request after an uncertain answer (lost response, 5xx,
+// ADMISSION_UNCERTAIN, pending delivery). The same request_id can never create a second lease.
+const ADMISSION_REPLAY_DELAYS_MS = [1000, 2000, 4000];
+const ADMISSION_REPLAYABLE = new Set(["ADMISSION_UNCERTAIN", "RETRY_SAME_REQUEST", "HOST_ELIGIBILITY_BUSY"]);
+// The key already has a ledger row (or had one): never replay it blindly or treat it as unallocated.
+const ADMISSION_COMMITTED_UNCERTAIN = new Set(["REQUEST_IDENTITY_MISMATCH", "REQUEST_CLOSED", "ORIGINAL_LEASE_UNAVAILABLE"]);
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /**
  * Codex #1077 P1 / BOT-2184: an sshd with `GatewayPorts yes` binds a `-R` forward on every
  * interface. A remote lease with --callback-port therefore runs the pre-forward GatewayPorts
  * probe (`probeGatewayPorts` in stack-tunnel.mjs) before the real `-R` exists, and refuses
  * with exit 5 CALLBACK_NOT_LOOPBACK when the host would expose it. The code below is kept
  * only so older automation that matched on it still resolves; no path emits it any more.
+ * BOT-2775: an explicit beta remote callback skips the -R path and uses the verified native
+ * private route (stack-native-callback.mjs); stable/default remote callbacks keep the probe.
  */
 export const CALLBACK_PORT_UNSUPPORTED_REMOTE = "CALLBACK_PORT_UNSUPPORTED_REMOTE";
 export const DEFAULT_RECEIPT_MAX_BYTES = 10240;
@@ -119,6 +139,8 @@ export const STACK_HELP = `${bold("botbuddy stack")} — one command for a batch
 
 ${bold("USAGE")}
   botbuddy stack up [options]        Request a lease; park if the host is full; hold it active
+  botbuddy stack status --admission-request-id <uuid>
+                                    Read an identified admission after a lost response (BOT-2780)
   botbuddy stack status <lease_id>   Show a lease's state + connection; within a live remote run,
                                    include the owner's attested local/remote forwards
   botbuddy stack touch  <lease_id>   Bump the idle clock (and report measured use) so the reaper doesn't stop it
@@ -233,12 +255,23 @@ ${bold("run OPTIONS")}
                          else a remote host with capacity; the bundle digest is sent up front.
   --execution-ring R     Capacity rollout ring: stable (default) excludes beta daemon hosts.
                          beta is explicit opt-in and requires \`stack run --remote\`.
+                         With --remote --execution-ring beta --reap (BOT-2780), run reserves a
+                         loopback requester origin first and writes it as the private stack copy's
+                         [auth] external_url, so generated auth links (/auth/v1/verify…) reach the
+                         stack unchanged even when the SSH API forward is remapped; the child gets
+                         it as connection.requester_origin. The lease is requested through the
+                         identified admission (exact replay after a lost response, no fallback).
   --callback-port N      The caller runs a listener the stack calls back through
-                         host.docker.internal:N (e.g. 4600): sent as callback_port. On a REMOTE
-                         lease run first probes the host with a throwaway reverse forward and opens
-                         -R 127.0.0.1:N:127.0.0.1:N only when the host keeps it on loopback (sshd
-                         GatewayPorts no/clientspecified); otherwise exit 5 CALLBACK_NOT_LOOPBACK
-                         (BOT-2184).
+                         host.docker.internal:N (e.g. 4600): sent as callback_port. On a stable or
+                         auto REMOTE lease run first probes the host with a throwaway reverse forward
+                         and opens -R 127.0.0.1:N:127.0.0.1:N only when the host keeps it on loopback
+                         (sshd GatewayPorts no/clientspecified); otherwise exit 5
+                         CALLBACK_NOT_LOOPBACK (BOT-2184). With --remote --execution-ring beta it
+                         instead requires a Linux Go runtime with native callbacks (protocol 5): a
+                         private SSH Unix-socket route to a fixed requester gateway, renewed against
+                         current owned authorization (BOT-2775). Unknown/older hosts or a backend
+                         that does not acknowledge it fail HOST_CALLBACK_TRANSPORT_UNSUPPORTED; the
+                         child never receives the route capability.
   --bundle-max-mb N      Remote-lease bundle size cap in MB (default 50, compressed). The bundle
                          excludes .bb-stack.json, node_modules, supabase/.temp|.branches and
                          untracked-secret dotenv files (.env, .env.local, .env.*.local).
@@ -299,9 +332,15 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   4 STACK_EXECUTION_MODE_MISMATCH  the slot already holds a lease in another mode/host — stack done it first
   (the four codes above create NO lease)
   5 BUNDLE_UPLOAD_FAILED  the signed bundle upload failed (the lease is released first)
-  5 CALLBACK_NOT_LOOPBACK --callback-port: the GatewayPorts probe (before any real -R) or the
-                          post-forward check found the host's -R listener not loopback-only
+  5 CALLBACK_NOT_LOOPBACK --callback-port (stable/auto): the GatewayPorts probe (before any real -R)
+                          or the post-forward check found the host's -R listener not loopback-only
                           (sshd GatewayPorts yes), or could not check it (no lsof, no listener)
+  5 HOST_CALLBACK_TRANSPORT_UNSUPPORTED  --callback-port (beta remote): native callback transport is
+                          unavailable; needs the installed Linux Go runtime (protocol 5) and backend
+  5 CALLBACK_NOT_READY / CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE  the native route did not
+                          answer from the stack's own network before the child (lease reaped)
+  6 CALLBACK_TRANSPORT_LOST / CALLBACK_AUTHORIZATION_LOST  the native route or its current
+                          authorization closed; the child is stopped and the lease reaped
   5 CALLBACK_PORT_BUSY    --callback-port is already listening on the serving host (another run or
                           service), the host refused this run's -R because another run took the
                           port first, or another listener shares the port; this run holds no -R —
@@ -421,6 +460,7 @@ export function parseStackArgs(argv) {
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     switch (a) {
+      case "--admission-request-id": if (need(a, rest[i + 1])) opts.admissionRequestId = String(rest[++i]).toLowerCase(); break;
       case "--slot": if (need(a, rest[i + 1])) opts.slot = rest[++i]; break;
       case "--host": if (need(a, rest[i + 1])) opts.host = rest[++i]; break;
       case "--repo": if (need(a, rest[i + 1])) opts.repo = rest[++i]; break;
@@ -588,7 +628,11 @@ export function parseStackArgs(argv) {
     errors.push("--stack-path must be a non-empty relative path without '..'");
   }
   const leaseId = positionals[0] ?? null;
-  if (command && ["status", "touch", "done"].includes(command) && !leaseId) {
+  if (opts.admissionRequestId != null && (!UUID_RE.test(opts.admissionRequestId) ||
+      !((command === "status" && !leaseId) || (command === "done" && leaseId && opts.reap && opts.releasePortClaim)))) {
+    errors.push("--admission-request-id takes a request UUID with `status` (no <lease_id>) or `done <lease_id> --reap --release-port-claim`");
+  }
+  if (command && ["status", "touch", "done"].includes(command) && !leaseId && !(command === "status" && opts.admissionRequestId)) {
     errors.push(`${command} needs a <lease_id>`);
   }
   if (["up", "done"].includes(command) && opts.localExec && Boolean(opts.dockerContext) === Boolean(opts.dockerEndpoint)) {
@@ -865,6 +909,16 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
     }
     return execution;
   };
+  // BOT-2780: the requester origin is only for a fresh CLI-managed stack context. A
+  // prepared path, pinned host or fixed nonce could resume a stack whose generated links
+  // already name another invocation's listener.
+  const originRun = requesterOriginEnabled(opts);
+  if (originRun && (opts.host != null || opts.stackNonce != null || (opts.stackPath && opts.stackPath !== ".") ||
+      !UUID_RE.test(opts.admissionRequestId ?? "") || !opts.requesterMachineId)) {
+    const error = new Error("beta requester origins require a fresh CLI-managed stack context (no --host, --stack-path or fixed nonce)");
+    error.code = "REQUESTER_ORIGIN_CONTEXT_REFUSED";
+    throw error;
+  }
   // An explicitly prepared directory is the caller's to manage, but it is NOT
   // exempt from the isolation contract (BOT-1798, Codex #928 R8 P1): a copied root
   // config — same project_id, or merely the same ports — would make the Helper
@@ -930,15 +984,30 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
   const nonce = opts.stackNonce ?? (stableReusable(worktreeRoot, stableDir) ? null : randomUUID());
   const { projectId } = identity({ worktreeRoot, slot: opts.slot, ticket: opts.ticket, nonce });
   const held = await claimProjectLock(projectId, lock, `this batch's isolated stack (${projectId})`);
+  let requesterOrigin = null;
+  let originContext = null;
   try {
+    let configText;
+    if (originRun) {
+      // BOT-2780: refuse a retained slot context, then reserve the listener BEFORE the
+      // private config (and so the bundle digest) is derived. The source config is never
+      // changed; only the private materialized copy names the reserved origin.
+      assertFreshRunStackAvailable(worktreeRoot, opts.slot);
+      originContext = Object.freeze({ request_id: opts.admissionRequestId, worktree: worktreeRoot, slot: opts.slot, machine: opts.requesterMachineId });
+      requesterOrigin = await reserveRequesterOrigin({ context: originContext });
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- canonical realpath of the current worktree; fixed own source config, never a request-supplied path.
+      configText = await patchRequesterAuthOrigin(readFileSync(join(worktreeRoot, "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
+    }
     const execution = refuseRoot(resolveStackPath(cwd, materialize(
       cwd,
       { slot: opts.slot, repo: opts.repo, ticket: opts.ticket, nonce, idleTtlSecs: opts.idleTtl ?? undefined },
       // BOT-2403: a functions directory another writer replaced under this stack is reported.
-      { ...(portRegistryDir ? { portRegistryDir } : {}), warn },
+      { ...(portRegistryDir ? { portRegistryDir } : {}), warn, ...(configText !== undefined ? { configText } : {}) },
     )));
     return {
       ...execution,
+      ...(requesterOrigin ? { requesterOrigin, originContext, admissionRequestId: opts.admissionRequestId,
+        recordAdmission: (requestId) => recordAdmissionRequest(stackDirFor(execution), requestId, portRegistryDir ? { registryDir: portRegistryDir } : undefined) } : {}),
       bindLease: (leaseId) => bindLeasedStackClaim(stackDirFor(execution), leaseId, portRegistryDir ? { registryDir: portRegistryDir } : undefined),
       // Release is called once the batch's signed reap is done, so hand the host
       // its port block back immediately rather than holding it for the retention
@@ -951,6 +1020,7 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
       // BOT-2237 (Codex #1168 P2): returns the VERIFIED disposition — whether this stack's
       // claim is gone afterwards — so a failed unlink is never reported as released.
       release: ({ reaped = false } = {}) => {
+        void requesterOrigin?.close();
         const registry = portRegistryDir ? { registryDir: portRegistryDir } : undefined;
         let released = false;
         if (reaped) {
@@ -964,6 +1034,7 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
       },
     };
   } catch (error) {
+    await requesterOrigin?.close();
     held.release();
     throw error;
   }
@@ -2999,6 +3070,21 @@ export async function cmdStatus(leaseId, opts, {
 } = {}) {
   const auth = await rpc.init();
   if (!auth) return emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  if (opts.admissionRequestId) {
+    // BOT-2780: the owner-scoped identified-admission read. It never returns a connection or
+    // capability, and an unknown key is not proof that nothing was admitted.
+    const read = await rpc.call("get_stack_lease_admission", { request_id: opts.admissionRequestId });
+    const base = { command: "status", request_id: opts.admissionRequestId };
+    if (!read.ok) return emitResult(buildReceipt({ ...base, outcome: "error", error: read.error }), opts, read.auth ? EXIT.AUTH : EXIT.BACKEND);
+    const a = read.data ?? {};
+    if (a.success !== true) return emitResult(buildReceipt({ ...base, outcome: "error", code: a.code ?? null, error: a.code ?? "admission unreadable" }), opts, EXIT.BACKEND);
+    return emitResult(buildReceipt({
+      ...base, outcome: a.lease_status ?? "unknown", lease_id: a.lease_id ?? null, admission_kind: a.admission_kind ?? null,
+      job_binding: a.job_binding ?? null, provision_job_id: a.provision_job_id ?? null, lease_status: a.lease_status ?? null,
+      closed: a.closed === true, superseded: a.superseded === true, close_reason: a.close_reason ?? null,
+      cleanup_status: a.cleanup_status ?? null, cleanup_evidence: a.cleanup_evidence ?? null,
+    }), opts, 0);
+  }
   const got = await rpc.call("get_stack_lease", { lease_id: leaseId });
   if (!got.ok) return got.auth
     ? emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: got.error }), opts, EXIT.AUTH)
@@ -3345,9 +3431,19 @@ export async function cmdDone(leaseId, opts, {
           // provable (cleanup_verified strictly false), ends at once; a raw frame keeps waiting.
           (s, p) => (s === "reap_failed" && p?.cleanup_verified === true) || (s === "reaped" && p?.cleanup_verified === false),
           { timeoutSec: opts.reapTimeout ?? 300, auth: rpc.auth });
-        if (verified.woke && verified.cleanupEvidence) {
+        // BOT-2780: a claim bound only to an identified admission request is released only when
+        // the owner-scoped admission read proves that request named this exact lease.
+        let requestBinding = null;
+        if (opts.admissionRequestId) {
+          const admission = await call("get_stack_lease_admission", { request_id: opts.admissionRequestId });
+          requestBinding = admission?.ok && admission.data?.success === true && admission.data.superseded !== true && admission.data.lease_id === leaseId
+            ? { admission_request_id: opts.admissionRequestId } : false;
+        }
+        if (requestBinding === false) {
+          portBlock = { released: false, reason: `admission ${opts.admissionRequestId} does not name lease ${leaseId}; local claim retained` };
+        } else if (verified.woke && verified.cleanupEvidence) {
           state = "reaped";
-          portBlock = await recoverClaim({ ...current.data, lease_id: leaseId }, verified.cleanupEvidence);
+          portBlock = await recoverClaim({ ...current.data, lease_id: leaseId }, { ...verified.cleanupEvidence, ...(requestBinding ?? {}) });
         } else portBlock = { released: false, reason: "accepted cleanup proof is unavailable; local claim retained" };
       }
     } catch (error) {
@@ -3583,7 +3679,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   incidentBox.outcomeChannel = { get auth() { return rpc.auth; }, callTool: adapters.callTool ?? callToolJson };
   const api = adapters.api ?? {
     request: (args) => rpc.call("request_stack_lease", args),
-    get: (leaseId) => rpc.call("get_stack_lease", { lease_id: leaseId }),
+    // BOT-2780 (beta requester origin): BOT-2499's identified admission, never a fallback.
+    requestIdentified: (args) => rpc.call("request_stack_lease_identified", args),
+    getAdmission: (args) => rpc.call("get_stack_lease_admission", args),
+    get: (leaseId, { signal } = {}) => rpc.call("get_stack_lease", { lease_id: leaseId }, { signal }),
     // BOT-1803: a heartbeat carries the measured client use when there is one.
     touch: (leaseId, usage) => rpc.call("touch_stack_lease", { lease_id: leaseId, ...(usage ? { usage } : {}) }),
     // BOT-1803: `{ idle: true }` idles an ACTIVE lease instead of reaping it.
@@ -3651,6 +3750,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   const buildBundle = adapters.buildBundle ?? buildStackBundle;
   const uploadBundle = adapters.uploadBundle ?? uploadStackBundle;
   const openTunnel = adapters.openTunnel ?? ((args) => establishSshTunnel(args));
+  const openCallback = adapters.openNativeCallbackTransport ?? openNativeCallbackTransport;
   const clock = adapters.clock ?? { setInterval, clearInterval, setTimeout, clearTimeout };
   const signals = adapters.signals ?? process;
   const provisionTimeout = opts.provisionTimeout ?? opts.timeout;
@@ -3673,8 +3773,13 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let activeWaitAbort = null;
   // BOT-2142: the remote lease's forwards, and whether they died under a running child.
   let tunnel = null;
+  let nativeCallback = null;
+  let callbackLost = null;
+  let callbackCleanupError = null;
   let forwardAttestation = null;
   let tunnelLost = null;
+  // BOT-2780: the requester origin closed under a live run (SSH loss or forward failure).
+  let originLost = null;
   const placement = { mode: null, hostKey: null, requesterHost: null, transport: "none", forwards: null, bundle: null, placementReason: null, considered: null };
   incidentBox.execution = placement;
   // BOT-1803: idle-lease bookkeeping for the receipt.
@@ -3685,8 +3790,12 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let retainBlock = false;
   // BOT-1803: a heartbeat touch found the lease preempted under the running child.
   let preempted = null;
+  // BOT-2780: the requester listener never outlives the run, its tunnel or a reap request.
+  const closeOrigin = async () => { try { await execution?.requesterOrigin?.close(); } catch { /* closed either way */ } };
   const closeTunnel = async () => {
+    await closeOrigin();
     try {
+      if (nativeCallback) { const route = nativeCallback; nativeCallback = null; try { await route.close(); } catch { callbackCleanupError = "CALLBACK_CLEANUP_UNCERTAIN"; } }
       if (forwardAttestation) {
         const owner = forwardAttestation;
         forwardAttestation = null;
@@ -3711,6 +3820,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     if (!leaseId) return Promise.resolve({ ok: true, state: null });
     if (cleanupPromise) return cleanupPromise;
     cleanupPromise = (async () => {
+    await closeOrigin();
     if (!leaseId) return cleanupResult = { ok: true, state: null };
     const cleanupAbort = new AbortController();
     const cleanupTimer = clock.setTimeout(() => cleanupAbort.abort("reap-timeout"), opts.reapTimeout * 1000);
@@ -3799,6 +3909,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   };
 
   const stopChild = (signal = "SIGTERM", forcedCode = null) => {
+    void closeOrigin();
     if (!child || childResult) return;
     forcedStopCode ??= forcedCode;
     childGroupSignal(child, signal);
@@ -3834,14 +3945,21 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     const slot = deriveSlot(opts);
     // BOT-1798: never "." — materialize/validate an ISOLATED stack dir first.
     try {
-      execution = await resolveExecution({ ...opts, slot });
+      execution = await resolveExecution({ ...opts, slot,
+        // BOT-2780: one identified admission key per invocation, held through replays.
+        ...(requesterOriginEnabled(opts) ? { admissionRequestId: randomUUID(), requesterMachineId: hardwareUuid } : {}),
+      });
+      if (requesterOriginEnabled(opts) && (!execution.requesterOrigin || !execution.admissionRequestId || !execution.originContext)) {
+        await closeOrigin();
+        const error = new Error("requester origin context unavailable"); error.code = "REQUESTER_ORIGIN_CONTEXT_REFUSED"; throw error;
+      }
     } catch (error) {
       // A slot whose stack another live batch owns is a coordination refusal (the
       // same class as the server's duplicate-lease rejection), not bad arguments.
       const exitCode = error?.code === "stack_slot_busy" ? EXIT.BACKEND : EXIT.INVALID;
       // BOT-2490: retain listener/cooldown refusals in the existing public code field;
       // keep the exit mapping and unrelated local-error semantics unchanged.
-      const code = ["stack_port_census_failed", "stack_port_cooldown_failed"].includes(error?.code) ? error.code : null;
+      const code = ["stack_port_census_failed", "stack_port_cooldown_failed"].includes(error?.code) || String(error?.code ?? "").startsWith("REQUESTER_ORIGIN_") ? error.code : null;
       return { exitCode, outcome: "error", ...(code ? { code } : {}), error: String(error?.message ?? error) };
     }
     // BOT-1798 (Codex #928 R13 P2): the queue and provisioning waits can outlast the
@@ -3920,6 +4038,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         "an idle stack on this slot will be re-provisioned rather than reused.");
     }
     idleLease.stackDigest = stackDigest;
+    // Runtime-first rollout: only explicit beta callers activate the new transport.
+    const requireNativeCallback = opts.callbackPort != null && opts.executionRing === "beta" && executionRequest !== "local";
     const leaseArgs = {
       slot, host_key: opts.host || undefined, repo: opts.repo, ticket_id: opts.ticket,
       ticket_url: opts.ticketUrl || undefined, pr_id: opts.prId || undefined, pr_url: opts.prUrl || undefined,
@@ -3934,8 +4054,85 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       require_stack_digest: true,
       // BOT-2269: what the bundle carries beyond the defaults (paths, sha256, key NAMES).
       ...(bundle?.included?.length ? { bundle_included: bundle.included } : {}),
-      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort } : {}),
+      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort, ...(requireNativeCallback ? { callback_transport: NATIVE_CALLBACK_TRANSPORT } : {}) } : {}),
     };
+    // BOT-2780: the identified admission key and a digest of the immutable origin context.
+    // The intent (including the bundle digest that names the reserved origin) is fingerprinted
+    // server-side; replays of this exact request can never create a second lease.
+    let identifiedVerdict = null;
+    let requestIdentified = null;
+    if (execution.admissionRequestId) {
+      if (!stackDigest || !bundle?.sha256) {
+        return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_DIGEST_UNAVAILABLE", error: "the requester-origin bundle digest could not be computed; no lease was requested" };
+      }
+      leaseArgs.request_id = execution.admissionRequestId;
+      // Durable request-to-context association before any request can commit (recovery key).
+      try { execution.recordAdmission?.(leaseArgs.request_id); } catch (error) {
+        return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_CONTEXT_REFUSED", error: `could not record the admission request on this stack's claim (${error?.message ?? error}); no lease was requested` };
+      }
+      leaseArgs.origin_identity_sha256 = createHash("sha256")
+        .update(JSON.stringify({ context: execution.originContext, origin: execution.requesterOrigin.origin })).digest("hex");
+      const replayDelays = adapters.admissionReplayDelaysMs ?? ADMISSION_REPLAY_DELAYS_MS;
+      let replays = 0;
+      let mayHaveCommitted = false;
+      let ownedAck = null;
+      const settle = (code) => {
+        identifiedVerdict = ownedAck ? { kind: "owned", code, ack: ownedAck } : { kind: "uncertain", code, ack: null };
+      };
+      // Returns a legacy-shaped answer: the decorated delivery for a ready ACK, a definite
+      // refusal, or (with identifiedVerdict set) the original answer for the caller to retain.
+      requestIdentified = async () => {
+        for (;;) {
+          let res;
+          try { res = await api.requestIdentified(leaseArgs); } catch (error) { res = { ok: false, status: null, error: String(error?.message ?? error) }; }
+          let replayCode = null;
+          if (!res?.ok) {
+            // A rejected credential, or a readable JSON-RPC protocol error over HTTP 200, was refused
+            // before the tool handler ran: a definite refusal on a first answer. An unreadable body
+            // (`invalid_json`) may follow a commit, so it is replayed like a lost response.
+            if (!mayHaveCommitted && (res?.auth || (res?.status === 200 && res.error !== "invalid_json"))) return res;
+            replayCode = "ADMISSION_UNCERTAIN";
+          } else if (!mayHaveCommitted && typeof res.data?.raw === "string" && /^Unknown tool: request_stack_lease_identified\b/.test(res.data.raw)) {
+            // An older backend without BOT-2499's tool: nothing was admitted, and no fallback.
+            identifiedVerdict = { kind: "unsupported" };
+            return res;
+          } else if (res.data?.success !== true) {
+            const code = typeof res.data?.code === "string" ? res.data.code : "ADMISSION_UNCERTAIN";
+            if (ADMISSION_COMMITTED_UNCERTAIN.has(code)) { settle(code); return res; }
+            if (ADMISSION_REPLAYABLE.has(code)) replayCode = code;
+            // After an answer that may have committed, a later refusal is not proof of absence.
+            else if (mayHaveCommitted) { settle("ADMISSION_UNCERTAIN"); return res; }
+            // A definite, effect-free refusal never carries cleanup authority.
+            else return { ...res, data: { success: false, code, ...(res.data?.message ? { message: res.data.message } : {}),
+              ...(res.data?.phase ? { phase: res.data.phase } : {}), ...(res.data?.wait ? { wait: res.data.wait } : {}) } };
+          } else {
+            const ack = identifiedAdmissionAck(res.data, leaseArgs.request_id);
+            // A malformed or foreign ACK is untrusted: never cleanup authority, never adopted.
+            if (!ack || ack.admission_kind !== "created" || (ownedAck && ack.lease_id !== ownedAck.lease_id)) {
+              mayHaveCommitted = true;
+              if (ack && ownedAck && ack.lease_id !== ownedAck.lease_id) ownedAck = null; // two leases for one key: trust neither
+              settle(!ack || ack.admission_kind === "created" ? "ADMISSION_UNCERTAIN" : "ADMISSION_READOPTION_UNSUPPORTED");
+              return res;
+            }
+            const delivery = identifiedAdmissionDelivery(res.data, ack);
+            if (delivery) return { ...res, data: delivery };
+            if (ack.delivery_status === "ready") { mayHaveCommitted = true; settle("ADMISSION_UNCERTAIN"); return res; }
+            ownedAck = ack;
+            replayCode = "ADMISSION_DELIVERY_PENDING";
+          }
+          mayHaveCommitted = mayHaveCommitted || replayCode !== "HOST_ELIGIBILITY_BUSY";
+          if (replays >= replayDelays.length || receivedSignal) {
+            // Only effect-free busy answers so far: still a definite refusal, nothing to retain.
+            if (!mayHaveCommitted) return { ...res, data: { success: false, code: replayCode } };
+            settle(replayCode);
+            return res;
+          }
+          const delay = replayDelays[replays++];
+          stderrLine(`stack: identified admission ${leaseArgs.request_id} is ${replayCode} — replaying the same request in ${delay}ms`);
+          if (delay > 0) await new Promise((resolve) => { clock.setTimeout(resolve, delay); });
+        }
+      };
+    }
     // The retrying caller (api → rpc.call) transparently renews+retries the
     // FIRST auth rejection among any of request/get/touch/release.
     // BOT-2024: a stale-capacity refusal prints phase-aware guidance; with the opt-in
@@ -3948,11 +4145,51 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     let idleRetried = false;
     for (let attempt = 0; ; attempt++) {
       activeWaitAbort = new AbortController();
-      const admission = await requestWithCapacityWait(() => api.request(leaseArgs), opts, {
+      const admission = await requestWithCapacityWait(() => requestIdentified ? requestIdentified() : api.request(leaseArgs), opts, {
         waitCapacity: adapters.waitCapacity ?? defaultWaitCapacity, log: stderrLine, signal: activeWaitAbort.signal,
       });
       activeWaitAbort = null;
       request = admission.req;
+      if (identifiedVerdict) {
+        const verdict = identifiedVerdict;
+        if (verdict.kind === "unsupported") {
+          return { exitCode: EXIT.BACKEND, outcome: "error", code: "IDENTIFIED_ADMISSION_UNSUPPORTED",
+            error: "this backend has no identified stack-lease admission (request_stack_lease_identified); a beta requester-origin run never falls back to the legacy allocator" };
+        }
+        if (verdict.kind === "owned") {
+          // The exact ACK proves this lease is ours, but it never became deliverable: reap it.
+          leaseId = verdict.ack.lease_id;
+          leaseProvisioned = true;
+          execution.bindLease?.(leaseId);
+          const cleanup = await requestCleanup();
+          return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED,
+            outcome: receivedSignal ? "interrupted" : "error", code: verdict.code, leaseId, cleanup,
+            error: `identified admission ${leaseArgs.request_id} committed lease ${leaseId} but its delivery never became ready; it was released` };
+        }
+        // Possibly committed with no trustworthy ACK. One owner-scoped admission read can still
+        // prove which lease this exact request created: then it is ours to reap normally.
+        let observed = null;
+        try { observed = await api.getAdmission?.({ request_id: leaseArgs.request_id }); } catch { observed = null; }
+        const named = observed?.ok && observed.data?.success === true && observed.data.superseded !== true &&
+          typeof observed.data.lease_id === "string" && UUID_RE.test(observed.data.lease_id) ? observed.data.lease_id : null;
+        if (named) {
+          leaseId = named;
+          leaseProvisioned = true;
+          execution.bindLease?.(leaseId);
+          const cleanup = await requestCleanup();
+          return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED,
+            outcome: receivedSignal ? "interrupted" : "error", code: verdict.code, leaseId, cleanup,
+            error: `identified admission ${leaseArgs.request_id} was uncertain; its owner-scoped read names lease ${leaseId}, which was released` };
+        }
+        // Still unknown: keep the port claim (bound to this request) and hand back the key.
+        retainBlock = true;
+        leaseProvisioned = true;
+        return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : EXIT.BACKEND, outcome: receivedSignal ? "interrupted" : "error", code: verdict.code,
+          allocationRecovery: identifiedAdmissionRecovery(leaseArgs, null, verdict.ack),
+          error: `identified admission ${leaseArgs.request_id} may have committed; its port claim is retained. Read it with ` +
+            `\`bb stack status --admission-request-id ${leaseArgs.request_id}\`, then release any lease it names with ` +
+            `\`bb stack done <lease-id> --reap --release-port-claim --admission-request-id ${leaseArgs.request_id}\`` };
+      }
 
       // Interrupted DURING the capacity park: the refused request created no lease, so
       // there is nothing to release. (A signal during a request that DID admit falls
@@ -4139,6 +4376,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     placement.mode = request.data.execution_mode ?? null;
     placement.hostKey = request.data.host_key ?? null;
     placement.requesterHost = request.data.requester_host ?? null;
+    if (remoteLease && requireNativeCallback && request.data.callback_transport !== NATIVE_CALLBACK_TRANSPORT) {
+      const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: "HOST_CALLBACK_TRANSPORT_UNSUPPORTED", leaseId, error: "backend did not acknowledge required remote callback transport", cleanup };
+    }
     // BOT-2207: why the server placed (or queued) it there, and every host it weighed.
     placement.placementReason = request.data.placement_reason ?? null;
     placement.considered = Array.isArray(request.data.considered) ? request.data.considered : null;
@@ -4267,7 +4508,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // BOT-2400 (item 1): the park deadline never gives the queue place up. Hold the lease
         // for the owner's next run (which re-attaches to it) and exit PARK_DEADLINE; only
         // `stack cancel` / `stack done` or the owner's death releases it.
-        const queueHold = holdPlace ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
+        // BOT-2780: a requester-origin run cannot be resumed by a later invocation (its stack
+        // names this CLI's listener, which closes now), so it releases instead of holding a place.
+        const queueHold = holdPlace && !execution.requesterOrigin ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
         if (queueHold) {
           // A refused/lost hold reply is not an owner cancellation: it may have
           // committed before the reply was lost, or the queued lease may have
@@ -4406,11 +4649,30 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // BOT-2142: forward every stack port over ONE ssh and hand the child the local ports.
       sshTarget = current.data.connection?.ssh_target ?? current.data.ssh_target ?? sshTarget;
       try {
-        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: opts.callbackPort ?? null });
+        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: requireNativeCallback ? null : opts.callbackPort,
+          ...(requireNativeCallback ? { reserveLocalPorts: [opts.callbackPort] } : {}) });
       } catch (error) {
         const cleanup = await requestCleanup();
         return { exitCode: EXIT.BACKEND, outcome: "error", code: error?.code ?? "REMOTE_UNREACHABLE", leaseId, error: String(error?.message ?? error), cleanup };
       }
+      if (requireNativeCallback) {
+        try {
+          nativeCallback = await openCallback({ current: current.data, leaseId, hostKey: placement.hostKey, callbackPort: opts.callbackPort, requesterMachineId: machineUuidFn(), sshTarget,
+            readCurrent: async (signal) => { let observed; try { observed = await api.get(leaseId, { signal }); } catch (error) { throw Object.assign(new Error(`current callback status unreadable (${error?.message ?? error})`), { transient: true }); } if (!observed?.ok) {
+              // Only an unanswered read is transient (transport, 5xx, 408/429, unreadable body). A 401/403
+              // that survived the auth refresh or a typed JSON-RPC refusal is a definitive answer.
+              const transient = !observed?.auth && (observed?.status == null || observed.status >= 500 || observed.status === 408 || observed.status === 429 || observed.error === "invalid_json");
+              throw Object.assign(new Error(transient ? "current callback status unreadable" : "current callback authorization refused"), transient ? { transient: true } : { code: "CALLBACK_AUTHORIZATION_LOST" });
+            }
+            if (observed.data?.success !== true) throw Object.assign(new Error("current callback authorization unavailable"), { code: "CALLBACK_AUTHORIZATION_LOST" });
+            return observed.data; },
+          });
+          nativeCallback.onExit((exit) => { if (childResult) return; callbackLost = exit; fencing = true; stopChild("SIGTERM", EXIT.LEASE_FAILED); });
+        } catch (error) {
+          await closeTunnel(); const cleanup = await requestCleanup();
+          return { exitCode: cleanup.ok && !callbackCleanupError && error?.code !== "CALLBACK_CLEANUP_UNCERTAIN" ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "CALLBACK_NOT_READY", leaseId, error: String(error?.message ?? "callback transport unavailable"), cleanup };
+        }
+      }
       placement.transport = "ssh-forward";
       placement.forwards = tunnel.forwards.map(({ name, remote, local }) => ({ name, remote, local }));
       for (const f of tunnel.forwards.filter((x) => x.remapped)) stderrLine(`stack: forward ${f.name} remapped: local ${f.local} → ${placement.hostKey ?? "remote"} ${f.remote}`);
@@ -4425,6 +4687,28 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         leaseId, sshTarget, forwards: placement.forwards,
         isLive: () => Boolean(tunnel && !tunnelLost && !receivedSignal && tunnel.isLive()),
       });
+      if (execution.requesterOrigin) {
+        // BOT-2780: bind the reserved listener to exactly this lease's API forward. It is not
+        // another SSH forward: connection.api_url/ports/attestation stay physical-only.
+        try {
+          execution.requesterOrigin.onLost((loss) => { originLost = loss; if (!receivedSignal && !childResult) stopChild("SIGTERM", EXIT.LEASE_FAILED); });
+          execution.requesterOrigin.activate({
+            context: execution.originContext, leaseId, projectId: current.data.connection.project_id, sshTarget,
+            remoteConnection: current.data.connection, forwardedConnection: tunnel.connection, forwards: placement.forwards,
+            isLive: () => Boolean(tunnel && forwardAttestation && !tunnelLost && !receivedSignal && tunnel.isLive()),
+            watchLoss: (callback) => tunnel.onExit(callback),
+          });
+        } catch (error) {
+          await closeTunnel();
+          const cleanup = await requestCleanup();
+          return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "REQUESTER_ORIGIN_FORWARD_REFUSED", leaseId, error: String(error?.message ?? error), cleanup };
+        }
+        placement.requesterOrigin = execution.requesterOrigin.origin;
+        stderrLine(`stack: requester origin ${execution.requesterOrigin.origin} → ${placement.hostKey ?? "remote"} API (generated auth links use it unchanged)`);
+        childConnection = { ...childConnection, requester_origin: execution.requesterOrigin.origin };
+      }
+    } else if (execution.requesterOrigin) {
+      await closeOrigin();
     }
     connectionFile = await writeConnection(safeConnectionPath(opts.connectionFile, leaseId), childConnection);
     if (receivedSignal) {
@@ -4461,6 +4745,16 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // there would fail on a missing package.json AFTER the stack was provisioned.
     // The child therefore always runs in the (canonicalised) worktree root.
     const childCwd = execution.worktreeRoot;
+    if (!tunnelLost && execution.requesterOrigin && servedRemote && (originLost || !execution.requesterOrigin.isLive())) {
+      await closeTunnel();
+      const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: originLost?.code ?? "REQUESTER_ORIGIN_TUNNEL_LOST", leaseId, cleanup,
+        error: "the requester origin closed before the child started; the lease was released" };
+    }
+    if (callbackLost || nativeCallback && !nativeCallback.isLive()) {
+      await closeTunnel(); const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: "CALLBACK_TRANSPORT_LOST", leaseId, error: "callback transport closed before child start", cleanup };
+    }
     if (tunnelLost) {
       // The forwards died between being verified and the child starting.
       await closeTunnel();
@@ -4512,7 +4806,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // BOT-1803: a run that ended on its own (the child exited, success or not) leaves its
     // lease IDLE for the next run on this slot — no reap wait. `--reap`, a signal, the
     // hard TTL, a fenced/preempted heartbeat and a lost tunnel keep the eager signed reap.
-    const idleOnEnd = !opts.reap && !receivedSignal && !fencing && !tunnelLost && forcedStopCode == null;
+    const idleOnEnd = !opts.reap && !receivedSignal && !fencing && !tunnelLost && !callbackCleanupError && forcedStopCode == null;
     const cleanup = await requestCleanup({ idle: idleOnEnd });
     if (cleanup?.idle) {
       // The stack is still running: keep its directory and host port block reserved well
@@ -4521,6 +4815,13 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       try { execution.renew?.({ idleTtlSecs: LEASED_STACK_IDLE_RETENTION_SECS, idleRetained: true }); } catch { /* advisory */ }
       stderrLine(`stack: lease ${leaseId} is idle${cleanup.idle_since ? ` since ${cleanup.idle_since}` : ""} — its stack keeps running for the next run on this slot (\`bb stack done ${leaseId} --reap\` tears it down)`);
     }
+    if (originLost && !tunnelLost && !receivedSignal) {
+      return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: originLost.code, leaseId, childExitCode: childResult.code, cleanup, fenced: true,
+        error: "the requester origin closed while the child was running, so the child was stopped and the lease released" };
+    }
+    if (callbackLost && !receivedSignal) {
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: callbackLost.reason === "callback_authorization_lost" ? "CALLBACK_AUTHORIZATION_LOST" : "CALLBACK_TRANSPORT_LOST", leaseId, childExitCode: childResult.code, cleanup, fenced: true, error: "callback transport authorization or runtime context was lost; child stopped" };
+    }
     if (tunnelLost && !receivedSignal) {
       return tunnelLostResult(tunnelLost, { leaseId, cleanup, childExitCode: childResult.code, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) });
     }
@@ -4532,8 +4833,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         ...(parkIncident ? { incident: parkIncident } : {}),
       };
     }
-    const exitCode = receivedSignal ? SIGNAL_EXIT[receivedSignal] : forcedStopCode ?? (childResult.code !== 0 ? childResult.code : !cleanup.ok ? EXIT.CLEANUP_FAILED : 0);
-    return { exitCode, outcome: exitCode === 0 ? "completed" : "failed", leaseId, childExitCode: childResult.code, cleanup, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) };
+    const exitCode = receivedSignal ? SIGNAL_EXIT[receivedSignal] : callbackCleanupError ? EXIT.CLEANUP_FAILED : forcedStopCode ?? (childResult.code !== 0 ? childResult.code : callbackCleanupError || !cleanup.ok ? EXIT.CLEANUP_FAILED : 0);
+    return { exitCode, outcome: exitCode === 0 ? "completed" : "failed", leaseId, childExitCode: childResult.code, cleanup, ...(callbackCleanupError ? { code: callbackCleanupError } : {}), fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) };
   } catch (error) {
     const cleanup = await requestCleanup();
     // BOT-1750 (Codex R10 P2): a thrown auth/self-heal failure (e.g. a refresh that
@@ -4617,6 +4918,9 @@ export function runReceiptFields(result) {
     execution_host_key: result.execution?.hostKey ?? null,
     requester_host: result.execution?.requesterHost ?? null,
     transport: result.execution?.transport ?? "none",
+    // BOT-2780: the reserved requester origin generated auth links name (never a credential).
+    ...(result.execution?.requesterOrigin ? { requester_origin: result.execution.requesterOrigin } : {}),
+    ...(result.allocationRecovery ? { allocation_recovery: result.allocationRecovery } : {}),
     ...(result.execution?.forwards ? { forwards: result.execution.forwards } : {}),
     ...(result.execution?.bundle ? { bundle: result.execution.bundle } : {}),
     // BOT-2269: the opted-in files that shipped in that bundle — paths, sha256, key names.