@botbuddy/cli 1.63.14 → 1.63.16

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.14",
-  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
-  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
+  "release_version": "1.63.16",
+  "source_commit": "1b763461c5262553e1214f40d1c1da94f6761b9a",
+  "source_sha256": "9925e4a7e228d64aee885a9334ca45684b8ff6f423441ddf4825a30ad878723e",
   "target": "darwin-arm64",
-  "sha256": "eb7aba5ff1ca0c551f02b1e0ce7e3d136e000443577d4494160da94e3a8ecb68"
+  "sha256": "8516955d8e25a9430f715bdeb3afca7ee9df991f0f4a97ed504ed81b204ae4c6"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.14",
-  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
-  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
+  "release_version": "1.63.16",
+  "source_commit": "1b763461c5262553e1214f40d1c1da94f6761b9a",
+  "source_sha256": "9925e4a7e228d64aee885a9334ca45684b8ff6f423441ddf4825a30ad878723e",
   "target": "linux-x64",
-  "sha256": "fe9452d4139a7db72844293109e0494605853e8cd3f9603043207b6cd892e990"
+  "sha256": "a6d5ffb7686b855ed77819c58343122bcb906c1d6fcb3431d34cf3862525e7e1"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.14",
-  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
-  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
+  "release_version": "1.63.16",
+  "source_commit": "1b763461c5262553e1214f40d1c1da94f6761b9a",
+  "source_sha256": "9925e4a7e228d64aee885a9334ca45684b8ff6f423441ddf4825a30ad878723e",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "eb7aba5ff1ca0c551f02b1e0ce7e3d136e000443577d4494160da94e3a8ecb68",
+      "sha256": "8516955d8e25a9430f715bdeb3afca7ee9df991f0f4a97ed504ed81b204ae4c6",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "fe9452d4139a7db72844293109e0494605853e8cd3f9603043207b6cd892e990",
+      "sha256": "a6d5ffb7686b855ed77819c58343122bcb906c1d6fcb3431d34cf3862525e7e1",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.14",
+  "version": "1.63.16",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/daemon/callback-release.mjs

@@ -0,0 +1,50 @@
+// BOT-2775: authenticate an older installed runtime against its exact published
+// npm package. Only archive data are read; no downloaded code is executed.
+import {createHash} from 'node:crypto';
+import {execFile as execFileCallback} from 'node:child_process';
+import {promisify} from 'node:util';
+import {mkdtemp,lstat,readFile,mkdir,writeFile,rm} from 'node:fs/promises';
+import {join} from 'node:path';
+import {tmpdir} from 'node:os';
+import {validateDaemonRelease} from './release.mjs';
+const execFile=promisify(execFileCallback),MAX_ARCHIVE=128*1024*1024,MAX_BINARY=64*1024*1024;
+const fail=reason=>{throw Error('callback_release_'+reason)};
+const matches=(r,v,c,s)=>r.releaseVersion===v&&r.sourceCommit===c&&r.sha256===s;
+async function metadataJSON(response){
+ if(!response.ok||!response.body)fail('metadata');let size=0;const chunks=[];
+ for await(const chunk of response.body){size+=chunk.length;if(size>65536)fail('metadata_size');chunks.push(chunk)}
+ try{return JSON.parse(Buffer.concat(chunks).toString('utf8'))}catch{fail('metadata')}
+}
+export async function verifiedCallbackRelease({version,sourceCommit,sha256,releaseRoot,run=execFile,fetchImpl=fetch,validateRelease=validateDaemonRelease}={}){
+ if(!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)||!/^[0-9a-f]{40}$/.test(sourceCommit)||!/^[0-9a-f]{64}$/.test(sha256))fail('identity');
+ try{const current=await validateRelease({releaseRoot},{platform:'linux',arch:'x64'});if(matches(current,version,sourceCommit,sha256))return current}catch{}
+ const controller=new AbortController(),deadline=setTimeout(()=>controller.abort(),60_000);deadline.unref();
+ let root;
+ try{
+  const metadata=await metadataJSON(await fetchImpl('https://registry.npmjs.org/@botbuddy%2fcli/'+encodeURIComponent(version),{signal:controller.signal,redirect:'error'}));
+  const integrity=metadata?.dist?.integrity;
+  if(metadata?.name!=='@botbuddy/cli'||metadata.version!==version||metadata.dist?.tarball!==`https://registry.npmjs.org/@botbuddy/cli/-/cli-${version}.tgz`||typeof integrity!=='string'||!/^sha512-[A-Za-z0-9+/]{86}==$/.test(integrity))fail('metadata');
+  root=await mkdtemp(join(tmpdir(),'botbuddy-callback-release-'));
+  const packed=await run('npm',['pack','@botbuddy/cli@'+version,'--ignore-scripts','--json','--pack-destination',root,'--registry=https://registry.npmjs.org','--fetch-retries=0','--fetch-timeout=30000'],{signal:controller.signal,timeout:45_000,maxBuffer:65536,encoding:'utf8'});
+  let result;try{result=JSON.parse(packed.stdout)}catch{fail('pack')}
+  if(!Array.isArray(result)||result.length!==1||result[0].name!=='@botbuddy/cli'||result[0].version!==version||result[0].integrity!==integrity||!/^[-A-Za-z0-9.]+\.tgz$/.test(result[0].filename))fail('pack');
+  const archive=join(root,result[0].filename),stat=await lstat(archive);
+  if(!stat.isFile()||stat.isSymbolicLink()||stat.size>MAX_ARCHIVE)fail('archive');
+  if('sha512-'+createHash('sha512').update(await readFile(archive)).digest('base64')!==integrity)fail('integrity');
+  const tar=async(args,maxBuffer)=>run('tar',args,{signal:controller.signal,timeout:10_000,maxBuffer,encoding:'buffer'});
+  const names=(await tar(['-tzf',archive],4*1024*1024)).stdout.toString('utf8').trimEnd().split('\n');
+  const details=(await tar(['-tvzf',archive],8*1024*1024)).stdout.toString('utf8').trimEnd().split('\n');
+  if(names.length!==details.length||new Set(names).size!==names.length||names.some((name,i)=>!/^package\//.test(name)||/[\\\x00-\x20\x7f]/.test(name)||name.split('/').some(part=>part==='..'||part==='.')||!['-','d'].includes(details[i][0])))fail('archive_entries');
+  const entries=['package/package.json','package/daemon-release/manifest.json','package/daemon/bin/linux-x64/botbuddy-daemon'];
+  if(entries.some(name=>!names.includes(name)||details[names.indexOf(name)][0]!=='-'))fail('archive_entries');
+  const buffers=[];for(const name of entries)buffers.push((await tar(['-xOzf',archive,'--',name],name.endsWith('botbuddy-daemon')?MAX_BINARY:65536)).stdout);
+  let pkg;try{pkg=JSON.parse(buffers[0])}catch{fail('package')}
+  if(pkg.name!=='@botbuddy/cli'||pkg.version!==version)fail('package');
+  const verifiedRoot=join(root,'verified');await mkdir(join(verifiedRoot,'daemon-release'),{recursive:true,mode:0o700});await mkdir(join(verifiedRoot,'daemon/bin/linux-x64'),{recursive:true,mode:0o700});
+  await writeFile(join(verifiedRoot,'daemon-release/manifest.json'),buffers[1],{mode:0o600});await writeFile(join(verifiedRoot,'daemon/bin/linux-x64/botbuddy-daemon'),buffers[2],{mode:0o755});
+  const release=await validateDaemonRelease({releaseRoot:verifiedRoot},{platform:'linux',arch:'x64'});
+  if(!matches(release,version,sourceCommit,sha256))fail('identity');
+  // No path or payload escapes the temporary verification scope.
+  return Object.freeze({releaseVersion:release.releaseVersion,sourceCommit:release.sourceCommit,sha256:release.sha256,target:release.target});
+ }finally{clearTimeout(deadline);controller.abort();if(root)await rm(root,{recursive:true,force:true})}
+}

package/src/daemon/installer.mjs

@@ -436,3 +436,33 @@ export async function serviceStatus({ platform, host, exec = execFile } = {}) {
     throw error;
   }
 }
+
+// BOT-2775 uses the same immutable release layout, root ancestry and external
+// checksum checks as installation before invoking a producer-published mode.
+// This read-only check runs as the already-authorized SSH/service user, no sudo.
+export const remoteVerifyInstalledCallbackScript = String.raw`set -eu
+binary=$1
+digest=$2
+service_uid=$3
+test "$(uname -s)" = Linux
+test "$(id -u)" = "$service_uid"
+parent=$(dirname "$binary")
+while :; do
+  test ! -L "$parent"
+  test -d "$parent"
+  test "$(stat -c '%u' "$parent")" = 0
+  mode=$(stat -c '%a' "$parent")
+  case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+  test "$parent" != / || break
+  parent=$(dirname "$parent")
+done
+test ! -L "$binary"
+test -f "$binary"
+test -x "$binary"
+test "$(stat -c '%u' "$binary")" = 0
+mode=$(stat -c '%a' "$binary")
+case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+actual=$(sha256sum "$binary" | awk '{print $1}')
+test "$actual" = "$digest"
+printf '%s\n' '{"verified":true}'
+`;

package/src/fixtures/bot2775-callback-contract.json

@@ -0,0 +1,32 @@
+{
+  "fixture_scope": "Synthetic contract fixture only; not an actual installed producer receipt.",
+  "callback_transport": "native_origin_v1",
+  "callback_current_authorization": true,
+  "callback_context": {
+    "owner": "operator@example.test",
+    "tenant_id": "botbuddy",
+    "requester_machine_id": "30000000-0000-4000-8000-000000000001",
+    "descriptor": {
+      "protocol": 1,
+      "binary_path": "/opt/botbuddy/daemon/releases/1.99.0/linux-x64/botbuddy-daemon",
+      "artifact_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "config_path": "/home/botbuddy/.botbuddy-daemon/runtime.json",
+      "service_uid": 1001,
+      "runtime_version": "1.99.0",
+      "runtime_git_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "runtime_target": "linux-amd64",
+      "host_key": "bbh-cccccccccccccccccccccccc",
+      "machine_id": "exact-linux-machine-id-spelling",
+      "engine_id": "engine-fixture",
+      "lease_id": "10000000-0000-4000-8000-000000000001",
+      "job_id": "20000000-0000-4000-8000-000000000001",
+      "attempt": 1,
+      "tenant_id": "botbuddy",
+      "project_id": "bbbot2775fixture",
+      "callback_port": 4600,
+      "producer_pid": 4242,
+      "producer_start_ticks": "100000",
+      "producer_boot_id": "70000000-0000-4000-8000-000000000001"
+    }
+  }
+}

package/src/fixtures/bot2779-handler-status-2026-10-27.json

@@ -0,0 +1,47 @@
+{
+  "provenance": {
+    "captured_at": "2026-10-27",
+    "source": "BOT-2779 actual isolated get_stack_lease handler/SQL fixture run 1afcb247",
+    "producer_descriptor": "synthetic, not a native producer receipt",
+    "projection": "sanitized by backend test owner; only context/project metadata"
+  },
+  "response": {
+    "lease_id": "74704da2-d98a-45c2-9dcc-f3d69e901d24",
+    "state": "active",
+    "host_key": "bbh-09093a8a9efa4f45691a61e7",
+    "execution_mode": "remote",
+    "callback_port": 4600,
+    "callback_transport": "native_origin_v1",
+    "callback_current_authorization": true,
+    "callback_context": {
+      "owner": "jono@bot-buddy.ai",
+      "tenant_id": "botbuddy",
+      "requester_machine_id": "e0c36c64-5055-4456-9df8-5c1d1b60fa43",
+      "descriptor": {
+        "protocol": 1,
+        "binary_path": "/opt/botbuddy/daemon/releases/1.99.0/linux-x64/botbuddy-daemon",
+        "artifact_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "config_path": "/home/botbuddy/.botbuddy-daemon/runtime.json",
+        "service_uid": 1001,
+        "runtime_version": "1.99.0",
+        "runtime_git_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "runtime_target": "linux-amd64",
+        "host_key": "bbh-09093a8a9efa4f45691a61e7",
+        "machine_id": "57d36d8c-a574-4971-98d1-3bea0def5a6f",
+        "engine_id": "engine-fixture",
+        "lease_id": "74704da2-d98a-45c2-9dcc-f3d69e901d24",
+        "job_id": "098b322e-d162-49d9-8f5a-44d31441d88f",
+        "attempt": 1,
+        "tenant_id": "botbuddy",
+        "project_id": "bb214530925b62",
+        "callback_port": 4600,
+        "producer_pid": 4242,
+        "producer_start_ticks": "100000",
+        "producer_boot_id": "70000000-0000-4000-8000-000000000001"
+      }
+    },
+    "connection": {
+      "project_id": "bb214530925b62"
+    }
+  }
+}

package/src/stack-callback-gateway.mjs

@@ -0,0 +1,44 @@
+// BOT-2775: private requester gateway for one same-owner SSH callback generation.
+// The caller supplies only a binding from the authenticated CURRENT lease read.
+import {createServer, request} from 'node:http';
+import {createHash,createHmac, timingSafeEqual} from 'node:crypto';
+import {Transform} from 'node:stream';
+export const CALLBACK_CAP_HEADER='x-botbuddy-callback-capability';
+const digest=value=>createHash('sha256').update(value).digest();
+export const CALLBACK_MAX_STREAM_BYTES=32*1024*1024;
+const sameBinding=(a,b)=>b&&typeof b==='object'&&Object.keys(a).length===Object.keys(b).length&&Object.keys(a).every(key=>a[key]===b[key]);
+export async function openCallbackGateway({callbackPort,binding,capability,lifetimeMs=30_000,now=Date.now,activate=true,readinessNonce=null}){
+ if(!Number.isInteger(callbackPort)||callbackPort<1024||callbackPort>65535||!binding||typeof binding!=='object'||!Object.isFrozen(binding)||typeof capability!=='string'||!/^[0-9a-f]{64}$/.test(capability)||lifetimeMs<1||lifetimeMs>30_000)throw Error('callback gateway admission refused');
+ if(readinessNonce!==null&&!/^[0-9a-f]{32}$/.test(readinessNonce))throw Error('callback readiness identity refused');
+ const bootstrapDeadline=now()+30_000,readinessPath=readinessNonce?'/.botbuddy/callback-ready/'+readinessNonce:null;
+ const readinessProof=readinessNonce?createHmac('sha256',Buffer.from(capability,'hex')).update('native_origin_v1/readiness/'+readinessNonce).digest('hex'):null;
+ const expected=digest(capability),active=new Set(),closeListeners=new Set();let deadline=0,timer,closed=false;
+ const server=createServer((incoming,outgoing)=>{
+  const presented=incoming.headers[CALLBACK_CAP_HEADER];
+  const readiness=readinessPath&&incoming.method==='HEAD'&&incoming.url===readinessPath;
+  if(closed||(now()>=deadline&&!(readiness&&deadline===0&&now()<bootstrapDeadline))||typeof presented!=='string'||!/^[0-9a-f]{64}$/.test(presented)||!timingSafeEqual(digest(presented),expected)||!incoming.url?.startsWith('/')||incoming.url.startsWith('//')||incoming.method==='TRACE'||incoming.headers.upgrade){outgoing.writeHead(403);outgoing.end('CALLBACK_REFUSED');return;}
+  if(readiness){outgoing.writeHead(204,{'x-botbuddy-callback-ready':readinessNonce,'x-botbuddy-callback-proof':readinessProof});outgoing.end();return;}
+  if(Number(incoming.headers['content-length'])>CALLBACK_MAX_STREAM_BYTES){outgoing.writeHead(413,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT');return;}
+  const headers={...incoming.headers,host:'127.0.0.1:'+callbackPort};delete headers[CALLBACK_CAP_HEADER];delete headers['x-botbuddy-callback-ready'];delete headers['x-botbuddy-callback-proof'];delete headers['proxy-authorization'];delete headers['proxy-connection'];
+  const abort=new AbortController();active.add(abort);let limited=false;
+  const finish=()=>{active.delete(abort);abort.abort();};outgoing.once('close',finish);incoming.once('aborted',finish);
+  const limitStream=()=>{let bytes=0;return new Transform({transform(chunk,_encoding,done){bytes+=chunk.length;if(bytes>CALLBACK_MAX_STREAM_BYTES)done(Error('CALLBACK_STREAM_LIMIT'));else done(null,chunk);}});};
+  const upstream=request({host:'127.0.0.1',port:callbackPort,path:incoming.url,method:incoming.method,headers,signal:abort.signal},response=>{
+   const responseHeaders={...response.headers};delete responseHeaders[CALLBACK_CAP_HEADER];delete responseHeaders['x-botbuddy-callback-ready'];delete responseHeaders['x-botbuddy-callback-proof'];
+   if(incoming.method!=='HEAD'&&Number(response.headers['content-length'])>CALLBACK_MAX_STREAM_BYTES){limited=true;response.destroy();outgoing.writeHead(502,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT');return;}
+   const counter=limitStream();counter.on('error',()=>{limited=true;response.destroy();outgoing.destroy();finish();});
+   response.on('error',()=>outgoing.destroy());outgoing.writeHead(response.statusCode,responseHeaders);response.pipe(counter).pipe(outgoing);
+  });
+  upstream.on('error',()=>{if(limited)return;if(!outgoing.headersSent){outgoing.writeHead(503);outgoing.end('CALLBACK_UPSTREAM_UNAVAILABLE');}else outgoing.destroy();});
+  // Count both streaming directions without buffering. Application auth and
+  // HMAC/body bytes are preserved; a stream over32MiB is aborted.
+  const counter=limitStream();counter.on('error',()=>{limited=true;upstream.destroy();incoming.unpipe(counter);if(!outgoing.headersSent){outgoing.writeHead(413,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT',()=>incoming.destroy());}else outgoing.destroy();finish();});incoming.pipe(counter).pipe(upstream);
+ });
+ server.maxConnections=64;server.maxHeadersCount=100;server.headersTimeout=10_000;server.requestTimeout=0;
+ const denySocket=(_req,socket)=>socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');server.on('connect',denySocket);server.on('upgrade',denySocket);
+ let closePromise;const close=()=>{if(closePromise)return closePromise;closed=true;clearTimeout(timer);for(const controller of active)controller.abort();active.clear();server.closeAllConnections();closePromise=new Promise(resolve=>server.close(resolve));for(const listener of closeListeners)listener();return closePromise;};
+ const refresh=(current,validForMs=lifetimeMs)=>{let matches=false;try{matches=sameBinding(binding,current)}catch{}if(closed||!matches||!Number.isFinite(validForMs)||validForMs<=0||validForMs>lifetimeMs){close();throw Error('callback binding changed');}deadline=now()+validForMs;clearTimeout(timer);timer=setTimeout(close,validForMs);timer.unref();};
+ await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(0,'127.0.0.1',resolve);});
+ if(activate)refresh(binding);else{timer=setTimeout(close,30_000);timer.unref();}
+ return {port:server.address().port,refresh,close,onClose(listener){closeListeners.add(listener);if(closed)listener()},isLive:()=>!closed&&now()<deadline};
+}

package/src/stack-native-callback.mjs

@@ -0,0 +1,126 @@
+// BOT-2775 same-owner, required native HTTP callback transport. No child capability.
+import {execFile as execFileCallback,spawn} from 'node:child_process';
+import {promisify} from 'node:util';
+import {randomBytes,randomUUID} from 'node:crypto';
+import {createInterface} from 'node:readline';
+import {posix} from 'node:path';
+import {isIP as netIsIP} from 'node:net';
+import {fileURLToPath} from 'node:url';
+import {validateDaemonRelease} from './daemon/release.mjs';
+import {verifiedCallbackRelease} from './daemon/callback-release.mjs';
+import {assertSshTarget,SSH_FORWARD_OPTIONS} from './stack-tunnel.mjs';
+import {installedBinaryPath,remoteVerifyInstalledCallbackScript} from './daemon/installer.mjs';
+import {openCallbackGateway} from './stack-callback-gateway.mjs';
+export const NATIVE_CALLBACK_TRANSPORT='native_origin_v1';
+const execFile=promisify(execFileCallback),uuid=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const safePath=value=>typeof value==='string'&&value.startsWith('/')&&!/[\x00-\x1f\x7f]/.test(value)&&posix.normalize(value)===value;
+const text=value=>typeof value==='string'&&value.length>0&&value.length<=512&&!/[\x00-\x20\x7f]/.test(value);
+const version=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const fields=['protocol','binary_path','artifact_sha256','config_path','service_uid','runtime_version','runtime_git_sha','runtime_target','host_key','machine_id','engine_id','lease_id','job_id','attempt','tenant_id','project_id','callback_port','producer_pid','producer_start_ticks','producer_boot_id'];
+const fail=(code,message)=>{throw Object.assign(Error(message),{code});};
+const quote=value=>"'"+String(value).replaceAll("'","'\\''")+"'";
+const canonicalMachine=value=>typeof value==='string'&&/^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.test(value)?value.replaceAll('-','').toLowerCase():null;
+
+export function validatedCallbackDescriptor(value){
+ if(!value||typeof value!=='object'||Array.isArray(value)||Object.keys(value).length!==fields.length||fields.some(field=>!(field in value)))fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','native callback descriptor missing or unknown');
+ const d=Object.fromEntries(fields.map(field=>[field,value[field]]));
+ if(d.protocol!==1||typeof d.runtime_version!=='string'||!version.test(d.runtime_version)||d.runtime_target!=='linux-amd64'||d.binary_path!==installedBinaryPath({releaseVersion:d.runtime_version,target:'linux-x64'})||!safePath(d.config_path)||!/^sha256:[0-9a-f]{64}$/.test(d.artifact_sha256)||!Number.isSafeInteger(d.service_uid)||d.service_uid<1||!Number.isSafeInteger(d.producer_pid)||d.producer_pid<=1||typeof d.producer_start_ticks!=='string'||!/^[1-9][0-9]*$/.test(d.producer_start_ticks)||!uuid.test(d.producer_boot_id)||!text(d.host_key)||!text(d.machine_id)||!text(d.engine_id)||!uuid.test(d.lease_id)||!uuid.test(d.job_id)||!Number.isSafeInteger(d.attempt)||d.attempt<1||!text(d.tenant_id)||typeof d.project_id!=='string'||!/^[a-z0-9][a-z0-9_-]{1,62}$/.test(d.project_id)||!Number.isInteger(d.callback_port)||d.callback_port<1024||d.callback_port>65535||!/^[0-9a-f]{40}$/.test(d.runtime_git_sha))fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','native callback runtime identity refused');
+ return Object.freeze(d);
+}
+
+export function currentCallbackBinding(current,{leaseId,hostKey,callbackPort,requesterMachineId,routeGeneration}){
+ if(current?.callback_transport!==NATIVE_CALLBACK_TRANSPORT)fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','backend did not acknowledge required callback transport');
+ if(current.callback_current_authorization!==true||current.state!=='active'||current.execution_mode!=='remote')fail('CALLBACK_AUTHORIZATION_LOST','current callback authorization unavailable');
+ const context=current.callback_context,d=validatedCallbackDescriptor(context?.descriptor);
+ if(current.lease_id!==leaseId||current.host_key!==hostKey||d.lease_id!==leaseId||d.host_key!==hostKey||d.callback_port!==callbackPort||current.callback_port!==callbackPort||d.project_id!==current.connection?.project_id||!context||context.tenant_id!==d.tenant_id||!text(context.owner)||!uuid.test(context.requester_machine_id)||canonicalMachine(requesterMachineId)!==canonicalMachine(context.requester_machine_id)||!uuid.test(routeGeneration))fail('CALLBACK_AUTHORIZATION_LOST','current callback context changed');
+ return Object.freeze({owner:context.owner,tenant_id:context.tenant_id,requester_machine_id:context.requester_machine_id,route_generation:routeGeneration,origin:'requester_http',descriptor:d});
+}
+
+export async function verifyInstalledCallbackRuntime({descriptor,sshTarget,sshBin='ssh',run=execFile,env=process.env,releaseRoot=fileURLToPath(new URL('../',import.meta.url)),validateRelease=validateDaemonRelease,resolveRelease=verifiedCallbackRelease}){
+ const d=validatedCallbackDescriptor(descriptor),target=assertSshTarget(sshTarget);
+ let release;try{release=await resolveRelease({version:d.runtime_version,sourceCommit:d.runtime_git_sha,sha256:d.artifact_sha256.slice(7),releaseRoot,validateRelease});}catch{fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','verified callback release unavailable');}
+ if(release.releaseVersion!==d.runtime_version||release.sourceCommit!==d.runtime_git_sha||'sha256:'+release.sha256!==d.artifact_sha256)fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','callback runtime differs from verified release');
+ const command='sh -c '+quote(remoteVerifyInstalledCallbackScript)+' sh '+[d.binary_path,d.artifact_sha256.slice(7),d.service_uid].map(quote).join(' ');
+ let result;try{result=await run(sshBin,['-T','-o','BatchMode=yes','-o','ControlMaster=no','-o','ControlPath=none','--',target,command],{env,timeout:15_000,maxBuffer:4096});}catch{fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','installed callback executable verification failed');}
+ if(result.stdout.trim()!=='{"verified":true}')fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','installed callback executable was not verified');
+ return d;
+}
+
+const privateIPv4=value=>netIsIP(value)===4&&(value.startsWith('10.')||value.startsWith('192.168.')||/^172\.(?:1[6-9]|2[0-9]|3[01])\./.test(value));
+function callbackReadiness(value,callbackPort){
+ let url;try{url=new URL(value.callback_url)}catch{fail('CALLBACK_NOT_READY','native callback readiness refused');}
+ if(value.ready!==true||url.protocol!=='http:'||!privateIPv4(url.hostname)||Number(url.port)!==callbackPort||url.pathname!=='/'||url.search||url.hash||url.username||url.password||!privateIPv4(value.peer_ip)||!['container_id','network_id','endpoint_id'].every(key=>/^[0-9a-f]{64}$/.test(value[key]??'')))fail('CALLBACK_NOT_READY','native callback endpoint refused');
+ return url.origin;
+}
+
+// Renewal cadence and acknowledgement budgets. The first renewal also runs the relay's
+// consuming-namespace probe (validation + docker exec), so it gets the larger budget.
+const GENERATION_MS=30_000,RENEW_INTERVAL_MS=10_000,FIRST_ACK_MS=15_000,RENEW_ACK_MS=6_000,STATUS_DEADLINE_MS=5_000,TRANSIENT_RETRY_MS=1_000;
+// A transient status read is retried after TRANSIENT_RETRY_MS only while that retry (read +
+// acknowledgement) can still land inside the current 30 s generation; otherwise the route closes.
+const TRANSIENT_GRACE_MS=GENERATION_MS-TRANSIENT_RETRY_MS-STATUS_DEADLINE_MS-RENEW_ACK_MS;
+export async function openNativeCallbackTransport({current,leaseId,hostKey,callbackPort,requesterMachineId,sshTarget,readCurrent,sshBin='ssh',env=process.env,run=execFile,spawnImpl=spawn,verifyRuntime=verifyInstalledCallbackRuntime,openGateway=openCallbackGateway,renewIntervalMs=RENEW_INTERVAL_MS,firstAckMs=FIRST_ACK_MS,renewAckMs=RENEW_ACK_MS,statusDeadlineMs=STATUS_DEADLINE_MS,transientRetryMs=TRANSIENT_RETRY_MS,transientGraceMs=TRANSIENT_GRACE_MS}){
+ if(typeof readCurrent!=='function')fail('CALLBACK_AUTHORIZATION_LOST','current callback status reader required');
+ const routeGeneration=randomUUID(),options={leaseId,hostKey,callbackPort,requesterMachineId,routeGeneration};
+ const binding=currentCallbackBinding(current,options),snapshot=JSON.stringify(binding),target=assertSshTarget(sshTarget),d=binding.descriptor;
+ await verifyRuntime({descriptor:d,sshTarget:target,sshBin,env,run});
+ const capability=randomBytes(32).toString('hex'),readinessNonce=randomBytes(16).toString('hex'),directory='/tmp/bb-callback-'+randomUUID(),socket=directory+'/callback.sock';
+ const sshArgs=['-T','-o','BatchMode=yes','-o','ControlMaster=no','-o','ControlPath=none','--',target];
+ let gateway,child,terminal,refreshTimer,statusAbort,pendingReady,pendingAck,closed=false,refreshing=false,cleanupPromise,exitResult;const exits=new Set();
+ const reportExit=exit=>{exitResult=exit;for(const listener of exits)listener(exit)};
+ const remote=async command=>{try{return await run(sshBin,[...sshArgs,command],{env,timeout:15_000,maxBuffer:4096})}catch{fail('CALLBACK_REMOTE_OPERATION_FAILED','owned callback operation failed');}};
+ const retire=async()=>{
+  // Every check tolerates the relay's own EXIT trap removing the socket/directory concurrently
+  // (a SIGKILLed local ssh): absence is success, anything present must be exactly ours.
+  const command=`set -eu; directory=${quote(directory)}; socket=${quote(socket)}; gone(){ [ ! -e "$directory" ] && [ ! -L "$directory" ]; }; if gone; then exit 0; fi; test ! -L "$directory"; if ! mode=$(stat -c '%u:%a' "$directory" 2>/dev/null); then gone; exit 0; fi; if [ ! -d "$directory" ]; then gone; exit 0; fi; test "$mode" = ${quote(d.service_uid+':700')}; if [ -e "$socket" ] || [ -L "$socket" ]; then test ! -L "$socket"; if smode=$(stat -c '%u:%a' "$socket" 2>/dev/null); then if [ -e "$socket" ]; then test -S "$socket"; fi; test "$smode" = ${quote(d.service_uid+':600')}; fi; rm -f -- "$socket"; fi; rmdir -- "$directory" 2>/dev/null || gone`;
+  await remote(command);
+ };
+ const close=()=>cleanupPromise??=(async()=>{
+  closed=true;clearInterval(refreshTimer);statusAbort?.abort();pendingReady?.reject(Error('callback closed'));pendingAck?.reject(Error('callback closed'));await gateway?.close();
+  if(child){child.stdin.end();const term=setTimeout(()=>child.kill('SIGTERM'),3000);const kill=setTimeout(()=>child.kill('SIGKILL'),6000);term.unref();kill.unref();try{await terminal}finally{clearTimeout(term);clearTimeout(kill)}}
+  try{await retire()}catch{fail('CALLBACK_CLEANUP_UNCERTAIN','owned callback cleanup could not be verified');}
+ })();
+ try{
+  await remote(`set -eu; test "$(id -u)" = ${quote(d.service_uid)}; umask 077; mkdir -- ${quote(directory)}; chmod 0700 -- ${quote(directory)}`);
+  gateway=await openGateway({callbackPort,binding:Object.freeze({snapshot}),capability,activate:false,readinessNonce});
+  const command=`set -eu; relayPid=; cleanup(){ trap - EXIT HUP INT TERM; if [ -n "$relayPid" ]; then kill -TERM "$relayPid" 2>/dev/null || :; wait "$relayPid" 2>/dev/null || :; fi; rm -f -- ${quote(socket)}; rmdir -- ${quote(directory)}; }; trap cleanup EXIT HUP INT TERM; ${quote(d.binary_path)} --callback-relay --config ${quote(d.config_path)} <&0 & relayPid=$!; status=0; wait "$relayPid" || status=$?; relayPid=; exit "$status"`;
+  child=spawnImpl(sshBin,[...SSH_FORWARD_OPTIONS.filter(arg=>arg!=='-N'),'-o','StreamLocalBindMask=0177','-R',socket+':127.0.0.1:'+gateway.port,'--',target,command],{env,stdio:['pipe','pipe','pipe']});
+  child.stdin.on('error',()=>{});child.stderr.on('data',()=>{});
+  let spawnError=false;child.once('error',()=>{spawnError=true});terminal=new Promise(resolve=>child.once('close',(code,signal)=>resolve({code,signal,reason:spawnError?'callback_process_error':'callback_process_exit'})));
+  terminal.then(exit=>{if(!closed){reportExit(exit);void close().catch(()=>reportExit({code:null,reason:'callback_cleanup_uncertain'}))}});
+  const lines=createInterface({input:child.stdout});
+  lines.on('line',line=>{try{const event=JSON.parse(line);if(event.refused===true&&event.code==='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE'&&pendingAck){const waiter=pendingAck;pendingAck=undefined;const refusal=Error('consuming namespace callback probe failed');refusal.code='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE';waiter.reject(refusal);}else if(pendingReady){const waiter=pendingReady;pendingReady=undefined;waiter.resolve(event);}else if(pendingAck&&event.renewed===true&&event.route_generation===routeGeneration&&Number.isFinite(Date.parse(event.expires_at))){const waiter=pendingAck;pendingAck=undefined;waiter.resolve(event);}else throw Error('unexpected callback frame');}catch{reportExit({code:null,reason:'callback_protocol_error'});void close().catch(()=>{})}});
+  terminal.then(()=>{lines.close();pendingReady?.reject(Error('callback process ended'));pendingAck?.reject(Error('callback process ended'));});
+  const ready=await new Promise((resolve,reject)=>{
+   const timeout=setTimeout(()=>reject(Object.assign(Error('callback readiness deadline'),{code:'CALLBACK_NOT_READY'})),20_000);timeout.unref();
+   pendingReady={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};
+   child.stdin.write(JSON.stringify({binding,capability,socket_path:socket,readiness_nonce:readinessNonce})+'\n');
+  });
+  const callbackUrl=callbackReadiness(ready,callbackPort);
+  gateway.onClose(()=>{if(!closed){reportExit({code:null,reason:'callback_gateway_closed'});void close().catch(()=>{})}});
+  let renewedAt=null;
+  const refresh=async(first=false)=>{
+   if(closed||refreshing)return;refreshing=true;
+   try{
+    statusAbort=new AbortController();let statusTimeout,status;
+    try{status=await new Promise((resolve,reject)=>{statusTimeout=setTimeout(()=>{statusAbort.abort();reject(Object.assign(Error('callback status deadline'),{transient:true}));},statusDeadlineMs);statusTimeout.unref();Promise.resolve().then(()=>readCurrent(statusAbort.signal)).then(resolve,reject).finally(()=>clearTimeout(statusTimeout));});}
+    catch(error){
+     // A failed status READ is not an authorization answer: keep the live generation (relay and
+     // gateway still expire it at 30 s) and retry on the next tick while inside the grace window.
+     if(!first&&error?.transient===true&&renewedAt!==null&&performance.now()-renewedAt<transientGraceMs){const retry=setTimeout(()=>{void refresh()},transientRetryMs);retry.unref();return;}
+     throw error;
+    }
+    if(closed)return;const renewed=currentCallbackBinding(status,options);if(JSON.stringify(renewed)!==snapshot)fail('CALLBACK_AUTHORIZATION_LOST','callback context changed');
+    const sentAt=performance.now();
+    await new Promise((resolve,reject)=>{const timeout=setTimeout(()=>reject(Error('callback renewal acknowledgement deadline')),first?firstAckMs:renewAckMs);timeout.unref();pendingAck={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};child.stdin.write(JSON.stringify({binding:renewed,renew:true})+'\n');});
+    if(closed)return;renewedAt=sentAt;gateway.refresh(Object.freeze({snapshot}),30_000-(performance.now()-sentAt));
+   }
+   // The first renewal carries the consuming-namespace probe: its uncoded failure is readiness.
+   catch(error){if(!closed){reportExit({code:null,reason:'callback_authorization_lost',...(error.code?{code:error.code}:first?{code:'CALLBACK_NOT_READY'}:{})});void close().catch(()=>{});}}
+   finally{refreshing=false}
+  };
+  await refresh(true);if(closed||!gateway.isLive())fail(exitResult?.code??'CALLBACK_NOT_READY','callback route not ready after readiness');
+  refreshTimer=setInterval(refresh,renewIntervalMs);refreshTimer.unref();
+  return{callbackUrl,close,isLive:()=>!closed&&gateway.isLive(),onExit(listener){exits.add(listener);if(exitResult)listener(exitResult)}};
+ }catch(error){try{await close()}catch{fail('CALLBACK_CLEANUP_UNCERTAIN','owned callback cleanup could not be verified');}throw error;}
+}

package/src/stack-tunnel.mjs

@@ -469,7 +469,7 @@ export async function probeGatewayPorts({
  * @returns {{ forwards, connection, argv, attempts, onExit, close, pid }}
  */
 export async function establishSshTunnel({
-  connection, sshTarget, hostKey = null, callbackPort = null, sshBin = null, env = process.env,
+  connection, sshTarget, hostKey = null, callbackPort = null, reserveLocalPorts = [], sshBin = null, env = process.env,
   attempts = 3, readyTimeoutMs = DEFAULT_TUNNEL_READY_MS, isFree = isLocalPortFree, pickFree = pickFreeLocalPort, spawnImpl = spawn,
   runRemote = spawnSync, probe = probeGatewayPorts, probeReadyTimeoutMs = DEFAULT_PROBE_READY_MS,
 }) {
@@ -500,7 +500,9 @@ export async function establishSshTunnel({
   }
   // Codex #1134 P2: a remapped stack forward must never take the callback port locally; ssh
   // would bind it before the caller's callback service and the -R traffic would loop into it.
-  let avoid = new Set(callbackPort != null ? [Number(callbackPort)] : []);
+  // BOT-2775 (Codex #1402 P2): a native-callback run opens no -R, but its child still serves the
+  // callback on that requester port, so the planner keeps it reserved via reserveLocalPorts.
+  let avoid = new Set([...(callbackPort != null ? [Number(callbackPort)] : []), ...reserveLocalPorts.map(Number)]);
   let lastError = null;
   for (let attempt = 1; attempt <= attempts; attempt++) {
     const forwards = await planForwards(remotePorts, { isFree, pickFree, avoid });

package/src/stack.mjs

@@ -52,6 +52,7 @@ import { checkReadoptedStackMounts } from "./stack-mount-health.mjs";
 import { machineUuid } from "./machine-id.mjs";
 import { DEFAULT_BUNDLE_MAX_BYTES, buildStackBundle, uploadStackBundle, validateBundleIncludePath } from "./stack-bundle.mjs";
 import { assertSshTarget, establishSshTunnel } from "./stack-tunnel.mjs";
+import { NATIVE_CALLBACK_TRANSPORT, openNativeCallbackTransport } from "./stack-native-callback.mjs";
 import { FORWARD_ATTESTATION_ENV, startForwardAttestation, readForwardAttestation } from "./stack-forward-attestation.mjs";
 import { stackServicesForForwards } from "./stack-service-discovery.mjs";
 import { ENGINE_PUBLISHES_BEYOND_LOOPBACK, engineSocketIsLocal, formatPublishIp, isLoopbackIp, publishIpFix, resolvePublishIp } from "./docker-publish-ip.mjs";
@@ -80,6 +81,8 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  * probe (`probeGatewayPorts` in stack-tunnel.mjs) before the real `-R` exists, and refuses
  * with exit 5 CALLBACK_NOT_LOOPBACK when the host would expose it. The code below is kept
  * only so older automation that matched on it still resolves; no path emits it any more.
+ * BOT-2775: an explicit beta remote callback skips the -R path and uses the verified native
+ * private route (stack-native-callback.mjs); stable/default remote callbacks keep the probe.
  */
 export const CALLBACK_PORT_UNSUPPORTED_REMOTE = "CALLBACK_PORT_UNSUPPORTED_REMOTE";
 export const DEFAULT_RECEIPT_MAX_BYTES = 10240;
@@ -259,11 +262,16 @@ ${bold("run OPTIONS")}
                          it as connection.requester_origin. The lease is requested through the
                          identified admission (exact replay after a lost response, no fallback).
   --callback-port N      The caller runs a listener the stack calls back through
-                         host.docker.internal:N (e.g. 4600): sent as callback_port. On a REMOTE
-                         lease run first probes the host with a throwaway reverse forward and opens
-                         -R 127.0.0.1:N:127.0.0.1:N only when the host keeps it on loopback (sshd
-                         GatewayPorts no/clientspecified); otherwise exit 5 CALLBACK_NOT_LOOPBACK
-                         (BOT-2184).
+                         host.docker.internal:N (e.g. 4600): sent as callback_port. On a stable or
+                         auto REMOTE lease run first probes the host with a throwaway reverse forward
+                         and opens -R 127.0.0.1:N:127.0.0.1:N only when the host keeps it on loopback
+                         (sshd GatewayPorts no/clientspecified); otherwise exit 5
+                         CALLBACK_NOT_LOOPBACK (BOT-2184). With --remote --execution-ring beta it
+                         instead requires a Linux Go runtime with native callbacks (protocol 5): a
+                         private SSH Unix-socket route to a fixed requester gateway, renewed against
+                         current owned authorization (BOT-2775). Unknown/older hosts or a backend
+                         that does not acknowledge it fail HOST_CALLBACK_TRANSPORT_UNSUPPORTED; the
+                         child never receives the route capability.
   --bundle-max-mb N      Remote-lease bundle size cap in MB (default 50, compressed). The bundle
                          excludes .bb-stack.json, node_modules, supabase/.temp|.branches and
                          untracked-secret dotenv files (.env, .env.local, .env.*.local).
@@ -324,9 +332,15 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   4 STACK_EXECUTION_MODE_MISMATCH  the slot already holds a lease in another mode/host — stack done it first
   (the four codes above create NO lease)
   5 BUNDLE_UPLOAD_FAILED  the signed bundle upload failed (the lease is released first)
-  5 CALLBACK_NOT_LOOPBACK --callback-port: the GatewayPorts probe (before any real -R) or the
-                          post-forward check found the host's -R listener not loopback-only
+  5 CALLBACK_NOT_LOOPBACK --callback-port (stable/auto): the GatewayPorts probe (before any real -R)
+                          or the post-forward check found the host's -R listener not loopback-only
                           (sshd GatewayPorts yes), or could not check it (no lsof, no listener)
+  5 HOST_CALLBACK_TRANSPORT_UNSUPPORTED  --callback-port (beta remote): native callback transport is
+                          unavailable; needs the installed Linux Go runtime (protocol 5) and backend
+  5 CALLBACK_NOT_READY / CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE  the native route did not
+                          answer from the stack's own network before the child (lease reaped)
+  6 CALLBACK_TRANSPORT_LOST / CALLBACK_AUTHORIZATION_LOST  the native route or its current
+                          authorization closed; the child is stopped and the lease reaped
   5 CALLBACK_PORT_BUSY    --callback-port is already listening on the serving host (another run or
                           service), the host refused this run's -R because another run took the
                           port first, or another listener shares the port; this run holds no -R —
@@ -3668,7 +3682,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // BOT-2780 (beta requester origin): BOT-2499's identified admission, never a fallback.
     requestIdentified: (args) => rpc.call("request_stack_lease_identified", args),
     getAdmission: (args) => rpc.call("get_stack_lease_admission", args),
-    get: (leaseId) => rpc.call("get_stack_lease", { lease_id: leaseId }),
+    get: (leaseId, { signal } = {}) => rpc.call("get_stack_lease", { lease_id: leaseId }, { signal }),
     // BOT-1803: a heartbeat carries the measured client use when there is one.
     touch: (leaseId, usage) => rpc.call("touch_stack_lease", { lease_id: leaseId, ...(usage ? { usage } : {}) }),
     // BOT-1803: `{ idle: true }` idles an ACTIVE lease instead of reaping it.
@@ -3736,6 +3750,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   const buildBundle = adapters.buildBundle ?? buildStackBundle;
   const uploadBundle = adapters.uploadBundle ?? uploadStackBundle;
   const openTunnel = adapters.openTunnel ?? ((args) => establishSshTunnel(args));
+  const openCallback = adapters.openNativeCallbackTransport ?? openNativeCallbackTransport;
   const clock = adapters.clock ?? { setInterval, clearInterval, setTimeout, clearTimeout };
   const signals = adapters.signals ?? process;
   const provisionTimeout = opts.provisionTimeout ?? opts.timeout;
@@ -3758,6 +3773,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let activeWaitAbort = null;
   // BOT-2142: the remote lease's forwards, and whether they died under a running child.
   let tunnel = null;
+  let nativeCallback = null;
+  let callbackLost = null;
+  let callbackCleanupError = null;
   let forwardAttestation = null;
   let tunnelLost = null;
   // BOT-2780: the requester origin closed under a live run (SSH loss or forward failure).
@@ -3777,6 +3795,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   const closeTunnel = async () => {
     await closeOrigin();
     try {
+      if (nativeCallback) { const route = nativeCallback; nativeCallback = null; try { await route.close(); } catch { callbackCleanupError = "CALLBACK_CLEANUP_UNCERTAIN"; } }
       if (forwardAttestation) {
         const owner = forwardAttestation;
         forwardAttestation = null;
@@ -4019,6 +4038,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         "an idle stack on this slot will be re-provisioned rather than reused.");
     }
     idleLease.stackDigest = stackDigest;
+    // Runtime-first rollout: only explicit beta callers activate the new transport.
+    const requireNativeCallback = opts.callbackPort != null && opts.executionRing === "beta" && executionRequest !== "local";
     const leaseArgs = {
       slot, host_key: opts.host || undefined, repo: opts.repo, ticket_id: opts.ticket,
       ticket_url: opts.ticketUrl || undefined, pr_id: opts.prId || undefined, pr_url: opts.prUrl || undefined,
@@ -4033,7 +4054,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       require_stack_digest: true,
       // BOT-2269: what the bundle carries beyond the defaults (paths, sha256, key NAMES).
       ...(bundle?.included?.length ? { bundle_included: bundle.included } : {}),
-      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort } : {}),
+      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort, ...(requireNativeCallback ? { callback_transport: NATIVE_CALLBACK_TRANSPORT } : {}) } : {}),
     };
     // BOT-2780: the identified admission key and a digest of the immutable origin context.
     // The intent (including the bundle digest that names the reserved origin) is fingerprinted
@@ -4355,6 +4376,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     placement.mode = request.data.execution_mode ?? null;
     placement.hostKey = request.data.host_key ?? null;
     placement.requesterHost = request.data.requester_host ?? null;
+    if (remoteLease && requireNativeCallback && request.data.callback_transport !== NATIVE_CALLBACK_TRANSPORT) {
+      const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: "HOST_CALLBACK_TRANSPORT_UNSUPPORTED", leaseId, error: "backend did not acknowledge required remote callback transport", cleanup };
+    }
     // BOT-2207: why the server placed (or queued) it there, and every host it weighed.
     placement.placementReason = request.data.placement_reason ?? null;
     placement.considered = Array.isArray(request.data.considered) ? request.data.considered : null;
@@ -4624,11 +4649,30 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // BOT-2142: forward every stack port over ONE ssh and hand the child the local ports.
       sshTarget = current.data.connection?.ssh_target ?? current.data.ssh_target ?? sshTarget;
       try {
-        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: opts.callbackPort ?? null });
+        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: requireNativeCallback ? null : opts.callbackPort,
+          ...(requireNativeCallback ? { reserveLocalPorts: [opts.callbackPort] } : {}) });
       } catch (error) {
         const cleanup = await requestCleanup();
         return { exitCode: EXIT.BACKEND, outcome: "error", code: error?.code ?? "REMOTE_UNREACHABLE", leaseId, error: String(error?.message ?? error), cleanup };
       }
+      if (requireNativeCallback) {
+        try {
+          nativeCallback = await openCallback({ current: current.data, leaseId, hostKey: placement.hostKey, callbackPort: opts.callbackPort, requesterMachineId: machineUuidFn(), sshTarget,
+            readCurrent: async (signal) => { let observed; try { observed = await api.get(leaseId, { signal }); } catch (error) { throw Object.assign(new Error(`current callback status unreadable (${error?.message ?? error})`), { transient: true }); } if (!observed?.ok) {
+              // Only an unanswered read is transient (transport, 5xx, 408/429, unreadable body). A 401/403
+              // that survived the auth refresh or a typed JSON-RPC refusal is a definitive answer.
+              const transient = !observed?.auth && (observed?.status == null || observed.status >= 500 || observed.status === 408 || observed.status === 429 || observed.error === "invalid_json");
+              throw Object.assign(new Error(transient ? "current callback status unreadable" : "current callback authorization refused"), transient ? { transient: true } : { code: "CALLBACK_AUTHORIZATION_LOST" });
+            }
+            if (observed.data?.success !== true) throw Object.assign(new Error("current callback authorization unavailable"), { code: "CALLBACK_AUTHORIZATION_LOST" });
+            return observed.data; },
+          });
+          nativeCallback.onExit((exit) => { if (childResult) return; callbackLost = exit; fencing = true; stopChild("SIGTERM", EXIT.LEASE_FAILED); });
+        } catch (error) {
+          await closeTunnel(); const cleanup = await requestCleanup();
+          return { exitCode: cleanup.ok && !callbackCleanupError && error?.code !== "CALLBACK_CLEANUP_UNCERTAIN" ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "CALLBACK_NOT_READY", leaseId, error: String(error?.message ?? "callback transport unavailable"), cleanup };
+        }
+      }
       placement.transport = "ssh-forward";
       placement.forwards = tunnel.forwards.map(({ name, remote, local }) => ({ name, remote, local }));
       for (const f of tunnel.forwards.filter((x) => x.remapped)) stderrLine(`stack: forward ${f.name} remapped: local ${f.local} → ${placement.hostKey ?? "remote"} ${f.remote}`);
@@ -4707,6 +4751,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: originLost?.code ?? "REQUESTER_ORIGIN_TUNNEL_LOST", leaseId, cleanup,
         error: "the requester origin closed before the child started; the lease was released" };
     }
+    if (callbackLost || nativeCallback && !nativeCallback.isLive()) {
+      await closeTunnel(); const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: "CALLBACK_TRANSPORT_LOST", leaseId, error: "callback transport closed before child start", cleanup };
+    }
     if (tunnelLost) {
       // The forwards died between being verified and the child starting.
       await closeTunnel();
@@ -4758,7 +4806,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // BOT-1803: a run that ended on its own (the child exited, success or not) leaves its
     // lease IDLE for the next run on this slot — no reap wait. `--reap`, a signal, the
     // hard TTL, a fenced/preempted heartbeat and a lost tunnel keep the eager signed reap.
-    const idleOnEnd = !opts.reap && !receivedSignal && !fencing && !tunnelLost && forcedStopCode == null;
+    const idleOnEnd = !opts.reap && !receivedSignal && !fencing && !tunnelLost && !callbackCleanupError && forcedStopCode == null;
     const cleanup = await requestCleanup({ idle: idleOnEnd });
     if (cleanup?.idle) {
       // The stack is still running: keep its directory and host port block reserved well
@@ -4771,6 +4819,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: originLost.code, leaseId, childExitCode: childResult.code, cleanup, fenced: true,
         error: "the requester origin closed while the child was running, so the child was stopped and the lease released" };
     }
+    if (callbackLost && !receivedSignal) {
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: callbackLost.reason === "callback_authorization_lost" ? "CALLBACK_AUTHORIZATION_LOST" : "CALLBACK_TRANSPORT_LOST", leaseId, childExitCode: childResult.code, cleanup, fenced: true, error: "callback transport authorization or runtime context was lost; child stopped" };
+    }
     if (tunnelLost && !receivedSignal) {
       return tunnelLostResult(tunnelLost, { leaseId, cleanup, childExitCode: childResult.code, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) });
     }
@@ -4782,8 +4833,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         ...(parkIncident ? { incident: parkIncident } : {}),
       };
     }
-    const exitCode = receivedSignal ? SIGNAL_EXIT[receivedSignal] : forcedStopCode ?? (childResult.code !== 0 ? childResult.code : !cleanup.ok ? EXIT.CLEANUP_FAILED : 0);
-    return { exitCode, outcome: exitCode === 0 ? "completed" : "failed", leaseId, childExitCode: childResult.code, cleanup, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) };
+    const exitCode = receivedSignal ? SIGNAL_EXIT[receivedSignal] : callbackCleanupError ? EXIT.CLEANUP_FAILED : forcedStopCode ?? (childResult.code !== 0 ? childResult.code : callbackCleanupError || !cleanup.ok ? EXIT.CLEANUP_FAILED : 0);
+    return { exitCode, outcome: exitCode === 0 ? "completed" : "failed", leaseId, childExitCode: childResult.code, cleanup, ...(callbackCleanupError ? { code: callbackCleanupError } : {}), fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) };
   } catch (error) {
     const cleanup = await requestCleanup();
     // BOT-1750 (Codex R10 P2): a thrown auth/self-heal failure (e.g. a refresh that