@byollm/conformance 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/{chunk-EXNALQ5D.js → chunk-OPJBI7WK.js}

@@ -29,7 +29,6 @@ import {
   signRequest
 } from "@byollm/protocol";
 import {
-  Allowlist,
   Budgets,
   IngressLog,
   SpendLedger,
@@ -41,6 +40,13 @@ import {
   DaemonConfig
 } from "byollm";
 var EchoBackend = class {
+  /* The conformance kit's own backend, answering the question every adapter
+     must — byollm_021. It echoes rather than generating, so there is no
+     model ceiling to hit and nothing to read. */
+  stopReasons = {
+    kind: "unavailable",
+    why: "the conformance echo backend generates nothing, so no model ever stops early"
+  };
   id = "openai-http";
   class = "http";
   /** Prompts this backend was asked to run, in order. */
@@ -76,7 +82,6 @@ var EchoBackend = class {
           ok: false,
           code: "canceled",
           message: "the job was canceled",
-          retryable: false,
           durationMs: Date.now() - started
         };
       }
@@ -94,9 +99,11 @@ function daemonConfig(options) {
   const baseUrl = metered ? metered.baseUrl : options.subscription ? void 0 : "http://127.0.0.1:11434/v1";
   return resolveConfig(
     DaemonConfig.parse({
-      backends: {
+      services: {
         primary: {
-          backend: backendId,
+          model: "echo-model",
+          kinds: ["llm.generate", "llm.chat"],
+          type: backendId,
           ...baseUrl === void 0 ? {} : { baseUrl },
           offer: options.offer,
           ...metered === void 0 ? {} : {
@@ -107,10 +114,6 @@ function daemonConfig(options) {
           }
         }
       },
-      routes: {
-        "llm.generate": { backend: "primary", model: "echo-model" },
-        "llm.chat": { backend: "primary", model: "echo-model" }
-      },
       concurrency: 4
     })
   );
@@ -118,12 +121,10 @@ function daemonConfig(options) {
 async function pairDaemon(target, options) {
   const home = await mkdtemp(join(tmpdir(), "byollm-conformance-"));
   const loaded = daemonConfig({
-    offer: options.offer ?? "self",
+    offer: options.offer,
     subscription: options.subscription ?? false,
     ...options.metered === void 0 ? {} : { metered: options.metered }
   });
-  const allowlist = new Allowlist(join(home, "allow.json"));
-  await allowlist.load();
   const budgets = new Budgets(
     join(home, "budgets.json"),
     loaded.config.community
@@ -140,6 +141,7 @@ async function pairDaemon(target, options) {
   const fetchImpl = (input, init) => target.fetch(new Request(input, init));
   const capabilities = loaded.routes.map((route) => ({
     kind: route.kind,
+    service: route.service,
     backendId: route.backendId,
     backendClass: route.backendClass,
     model: route.model,
@@ -203,12 +205,13 @@ async function pairDaemon(target, options) {
     owner: result.pairing.owner,
     identity: {
       keys: () => deviceIdentity.load(Date.now()),
-      // Pinned at pairing, exactly as a real daemon does.
-      sitePinned: result.pairing.site
+      // Pinned at pairing, exactly as a real daemon does — the set the
+      // upstream answered with, keyed by each site's identity key id
+      // (cloud_009 §5). A direct site is one entry.
+      sites: new Map(Object.entries(result.pairing.sites))
     },
     daemonVersion: "conformance",
     loaded,
-    allowlist,
     budgets,
     spend,
     ingress,
@@ -217,13 +220,11 @@ async function pairDaemon(target, options) {
   return {
     runner,
     backend,
-    allowlist,
     runnerId: result.pairing.runnerId,
     owner: result.pairing.owner,
-    token: result.pairing.token,
     keys: await deviceIdentity.load(Date.now()),
     identityKeys: () => deviceIdentity.load(Date.now()),
-    sitePinned: result.pairing.site,
+    sitePinned: Object.values(result.pairing.sites)[0],
     home,
     ingress,
     spend,
@@ -309,6 +310,37 @@ async function claimOne(target, daemon) {
   if (!job) throw new Error("claim returned no jobs");
   return job;
 }
+async function claimRaw(target, daemon, capabilityOverride) {
+  const capabilities = capabilityOverride ?? await daemon.runner.detectCapabilities();
+  const body = JSON.stringify({
+    protocolVersion: PROTOCOL_VERSION,
+    runnerId: daemon.runnerId,
+    capabilities,
+    max: 10
+  });
+  const signature = signRequest(daemon.keys, {
+    endpoint: "claim",
+    runnerId: daemon.runnerId,
+    issuedAt: Date.now(),
+    body
+  });
+  const response = await target.fetch(
+    new Request(`${target.origin}/byollm/claim`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-byollm-runner": signature.runnerId,
+        "x-byollm-issued-at": String(signature.issuedAt),
+        "x-byollm-signature": signature.signature
+      },
+      body
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`claim answered ${String(response.status)}`);
+  }
+  return (await response.json()).jobs;
+}
 async function releaseLease(target, daemon, jobId, leaseId) {
   const body = JSON.stringify({
     protocolVersion: PROTOCOL_VERSION,
@@ -383,7 +415,11 @@ async function postResult(target, daemon, input) {
   const keys = await daemon.identityKeys();
   const sealer = input.sealWith ?? keys;
   const envelope = await seal({
-    plaintext: JSON.stringify(input.outcome),
+    // `{ outcome, ran }` — cloud_008 §2.5.
+    plaintext: JSON.stringify({
+      outcome: input.outcome,
+      ran: { model: "test-model", backendClass: "http", durationMs: 1 }
+    }),
     senderKeys: sealer,
     recipientEncryptionPublic: daemon.sitePinned.encryption,
     context: {
@@ -401,11 +437,9 @@ async function postResult(target, daemon, input) {
     protocolVersion: PROTOCOL_VERSION,
     runnerId: daemon.runnerId,
     jobId: input.jobId,
+    leaseId: input.leaseId,
     envelope,
-    disposition: input.disposition ?? input.outcome.outcome,
-    model: "conformance-model",
-    backendClass: "http",
-    durationMs: 1
+    disposition: input.disposition ?? input.outcome.outcome
   });
   const signature = signRequest(daemon.keys, {
     endpoint: "result",
@@ -445,7 +479,7 @@ async function fetchGenuine(target, daemon, owner = "alice") {
     // The target's own name for the user, not the id it mapped that to —
     // passing a mapped id back in addresses a user the target never made.
     owner,
-    audience: "self"
+    audience: "private"
   });
   for (let attempt = 0; attempt < 20; attempt += 1) {
     try {
@@ -475,13 +509,19 @@ var CHECKS = [
     title: "a runner token is bound to exactly the approving user",
     musts: ["PAIR_ONE_USER", "PAIR_INTERACTIVE"],
     async run(target) {
-      const alice = await pairDaemon(target, { owner: "alice" });
+      const alice = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         assert(
           alice.owner === await ownerIdFor(target, "alice"),
           `runner was bound to "${alice.owner}", not to the approving user`
         );
-        const bob = await pairDaemon(target, { owner: "bob" });
+        const bob = await pairDaemon(target, {
+          owner: "bob",
+          offer: "private"
+        });
         assert(
           bob.owner !== alice.owner,
           "two different approvers produced the same runner owner"
@@ -491,7 +531,7 @@ var CHECKS = [
             kind: "llm.generate",
             payload: prompt("alice's private prompt"),
             owner: "alice",
-            audience: "self"
+            audience: "private"
           });
           await bob.runner.tick();
           await sleep(50);
@@ -513,7 +553,10 @@ var CHECKS = [
     title: "an enqueued job runs on the owner's daemon and the result comes back",
     musts: ["CLAIM_REQUIRES_CAPABILITY", "RESULT_IDEMPOTENT"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
@@ -543,7 +586,10 @@ var CHECKS = [
     title: "a daemon is never handed a kind it did not advertise",
     musts: ["KIND_TYPED_ONLY", "CLAIM_REQUIRES_CAPABILITY"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.chat",
@@ -562,6 +608,25 @@ var CHECKS = [
           daemon.backend.seen.length > before,
           "the advertised kind never reached the backend"
         );
+        const chat = await target.enqueue({
+          kind: "llm.chat",
+          payload: { messages: [{ role: "user", content: "not for you" }] },
+          owner: "alice"
+        });
+        const generateOnly = await claimRaw(target, daemon, [
+          {
+            kind: "llm.generate",
+            service: "local",
+            backendId: "openai-http",
+            backendClass: "http",
+            model: "echo-model",
+            offerScope: "private"
+          }
+        ]);
+        assert(
+          !generateOnly.some((offered) => offered.id === chat.id),
+          "a server offered `llm.chat` to a claim advertising only `llm.generate`"
+        );
       } finally {
         await daemon.dispose();
       }
@@ -572,14 +637,18 @@ var CHECKS = [
     title: "a job whose runner vanished is offered again, losing nothing",
     musts: ["LEASE_RECLAIMABLE", "LEASE_HONORED"],
     async run(target) {
-      const dead = await pairDaemon(target, { owner: "alice", label: "dead" });
+      const dead = await pairDaemon(target, {
+        owner: "alice",
+        label: "dead",
+        offer: "private"
+      });
       const job = await target.enqueue({
         kind: "llm.generate",
         payload: prompt("work"),
         owner: "alice"
       });
       dead.backend.hangMs = 6e4;
-      await dead.runner.tick();
+      const firstLease = await claimOne(target, dead);
       await waitFor(
         async () => {
           const state = await target.job(job.id);
@@ -591,35 +660,61 @@ var CHECKS = [
       await advance(target, target.leaseMs + 500);
       const alive = await pairDaemon(target, {
         owner: "alice",
-        label: "alive"
+        label: "alive",
+        offer: "private"
       });
       try {
-        await alive.runner.tick();
-        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
-          what: "the reclaimed job to complete"
+        const reclaimed = await claimOne(target, alive);
+        assert(
+          reclaimed.id === job.id,
+          "the reclaiming daemon did not get the job"
+        );
+        const late = await postResult(target, dead, {
+          jobId: job.id,
+          leaseId: firstLease.lease.id,
+          outcome: { outcome: "ok", text: "from the machine that vanished" }
+        });
+        const lateBody = await late.json().catch(() => ({}));
+        assert(
+          lateBody.accepted !== true,
+          "a site accepted a result from a runner whose lease had lapsed"
+        );
+        const midflight = await target.job(job.id);
+        assert(
+          !midflight?.outcome,
+          "a lapsed holder's result was recorded over a live grant"
+        );
+        const proper = await postResult(target, alive, {
+          jobId: job.id,
+          leaseId: reclaimed.lease.id,
+          outcome: { outcome: "ok", text: "from the machine that took over" }
         });
+        assert(
+          proper.status === 200,
+          `the reclaiming daemon could not finish the job (${String(proper.status)})`
+        );
+        const final = await target.job(job.id);
+        assert(
+          final?.outcome?.text === "from the machine that took over",
+          "the reclaimed job did not record the current holder's result"
+        );
       } finally {
         await alive.dispose();
+        await dead.dispose();
       }
     }
   },
   {
     id: "C005_AUDIENCE_MATRIX",
-    title: "all nine audience \xD7 offer-scope combinations behave as specified",
+    title: "all four audience x offer-scope combinations behave as specified",
     musts: ["AUDIENCE_BOTH_SIDES", "NAMED_LOCAL_ALLOWLIST"],
     async run(target) {
       const expected = {
-        "self:self": false,
-        "self:named": false,
-        "self:public": false,
-        "named:self": false,
-        "named:named": false,
-        // refused locally — allowlist is empty
-        "named:public": true,
-        "public:self": false,
-        "public:named": false,
-        // refused locally — allowlist is empty
-        "public:public": true
+        "private:private": false,
+        "private:team": false,
+        "team:private": false,
+        "team:team": false
+        // refused locally — nothing admits alice
       };
       for (const audience of AUDIENCES) {
         for (const offer of OFFER_SCOPES) {
@@ -650,16 +745,30 @@ var CHECKS = [
   },
   {
     id: "C006_NAMED_LOCAL_ALLOWLIST",
-    title: "a named job runs only once the daemon's own allowlist admits it",
+    /**
+     * Renamed with the release that made the sentence true — Amendment G, B2.
+     *
+     * The old title read "a named job runs only once the daemon's own
+     * allowlist admits it", which was true only under a generous reading of
+     * "own": the list was per-person and local, and a team member had to be
+     * enrolled on every machine by hand.
+     *
+     * The id does not change, per the id-stability law. What changes is the
+     * sentence, and it now names all three of the things a reader would
+     * otherwise take on faith — that the list is local, that its authority was
+     * established out of band, and that admission is a property of the asker
+     * rather than of the request.
+     */
+    title: "a team job is refused by a device whose upstream cannot say who the asker is, and is not offered to it again",
     musts: ["NAMED_LOCAL_ALLOWLIST", "REFUSAL_NOT_REOFFERED"],
     async run(target) {
-      const bob = await pairDaemon(target, { owner: "bob", offer: "named" });
+      const bob = await pairDaemon(target, { owner: "bob", offer: "team" });
       try {
         const refused = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("before"),
           owner: "alice",
-          audience: "named"
+          audience: "team"
         });
         await bob.runner.tick();
         await sleep(80);
@@ -667,27 +776,10 @@ var CHECKS = [
           (await target.job(refused.id))?.state !== "ok",
           "a named job ran without the daemon's local allowlist admitting it"
         );
-        const before = bob.backend.seen.length;
-        await bob.runner.tick();
-        await sleep(50);
+        const reoffered = await claimRaw(target, bob);
         assert(
-          bob.backend.seen.length === before,
-          "a refused job was re-offered to the runner that refused it"
-        );
-        await bob.allowlist.add(
-          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
-          Date.now()
-        );
-        const allowed = await target.enqueue({
-          kind: "llm.generate",
-          payload: prompt("after"),
-          owner: "alice",
-          audience: "named"
-        });
-        await bob.runner.tick();
-        await waitFor(
-          async () => (await target.job(allowed.id))?.state === "ok",
-          { what: "the allowed named job to run" }
+          !reoffered.some((job) => job.id === refused.id),
+          "a server re-offered a job to the runner that refused it"
         );
       } finally {
         await bob.dispose();
@@ -701,19 +793,15 @@ var CHECKS = [
     async run(target) {
       const bob = await pairDaemon(target, {
         owner: "bob",
-        offer: "public",
+        offer: "team",
         subscription: true
       });
       try {
-        await bob.allowlist.add(
-          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
-          Date.now()
-        );
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("someone else's work"),
           owner: "alice",
-          audience: "public"
+          audience: "team"
         });
         await bob.runner.tick();
         await sleep(80);
@@ -730,7 +818,7 @@ var CHECKS = [
           kind: "llm.generate",
           payload: prompt("my own work"),
           owner: "bob",
-          audience: "self"
+          audience: "private"
         });
         await bob.runner.tick();
         await waitFor(async () => (await target.job(own.id))?.state === "ok", {
@@ -744,9 +832,17 @@ var CHECKS = [
   {
     id: "C008_REVOCATION",
     title: "a revoked daemon stops mid-queue",
-    musts: ["REVOCATION_HONORED"],
+    // Both halves, and this check already proved both: the daemon learns it
+    // is revoked (`REVOCATION_HONORED`), *and* the upstream leaves the job
+    // queued rather than granting it (`REVOCATION_IMMEDIATE`). The second
+    // assertion was here and cited nothing — which is how a MUST comes to be
+    // declared in a spec, absent from the registry, and tested all along.
+    musts: ["REVOCATION_HONORED", "REVOCATION_IMMEDIATE"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         await target.revokeRunner(daemon.runnerId);
         const job = await target.enqueue({
@@ -774,7 +870,10 @@ var CHECKS = [
     title: "cancel aborts a running job's backend call",
     musts: ["CANCEL_HONORED"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         daemon.backend.hangMs = 3e4;
         const job = await target.enqueue({
@@ -802,39 +901,73 @@ var CHECKS = [
     title: "the first terminal outcome wins",
     musts: ["RESULT_IDEMPOTENT"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("once"),
           owner: "alice"
         });
-        await daemon.runner.tick();
-        await waitFor(async () => (await target.job(job.id))?.state === "ok", {
-          what: "the job to complete"
+        const claimed = await claimOne(target, daemon);
+        assert(claimed.id === job.id, "the harness could not claim its job");
+        const first = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "the answer that counts" }
         });
-        const first = await target.job(job.id);
-        const response = await target.fetch(
-          new Request(`${target.origin}/byollm/result`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({
-              protocolVersion: "0",
-              runnerId: daemon.runnerId,
-              jobId: job.id,
-              outcome: { outcome: "ok", text: "SECOND ANSWER" },
-              model: "echo-model",
-              backendClass: "http",
-              durationMs: 1
-            })
-          })
+        assert(
+          first.status === 200,
+          `a site refused the first result (${String(first.status)})`
+        );
+        const replay = await postResult(target, daemon, {
+          jobId: job.id,
+          leaseId: claimed.lease.id,
+          outcome: { outcome: "ok", text: "SECOND ANSWER" }
+        });
+        assert(
+          replay.status === 200,
+          `a replayed result was rejected rather than ignored (${String(replay.status)})`
+        );
+        const body = await replay.json();
+        assert(
+          body.accepted === false,
+          "a site reported a replayed result as newly accepted"
+        );
+        assert(
+          body.duplicate === true,
+          "a replay from the device that finished the job was not called a duplicate"
         );
-        void response;
         const after = await target.job(job.id);
         assert(
-          after?.outcome?.text === first?.outcome?.text,
-          "a second result overwrote the first"
+          after?.outcome?.text === "the answer that counts",
+          `a second result overwrote the first (${String(after?.outcome?.text)})`
         );
+        const stranger = await pairDaemon(target, {
+          owner: "alice",
+          offer: "private"
+        });
+        try {
+          const foreign = await postResult(target, stranger, {
+            jobId: job.id,
+            leaseId: claimed.lease.id,
+            outcome: { outcome: "ok", text: "not this device's to answer" }
+          });
+          const foreignBody = await foreign.json().catch(() => ({}));
+          assert(
+            foreignBody["duplicate"] !== true,
+            "a site told a device that never held this job it was a duplicate"
+          );
+          const stillFirst = await target.job(job.id);
+          assert(
+            stillFirst?.outcome?.text === "the answer that counts",
+            "a stranger's result overwrote a terminal job"
+          );
+        } finally {
+          await stranger.dispose();
+        }
       } finally {
         await daemon.dispose();
       }
@@ -845,20 +978,23 @@ var CHECKS = [
     title: "a dependent job waits for its dependency, across two daemons",
     musts: ["DEPENDS_ON_GATING", "TTL_EXPIRY"],
     async run(target) {
-      const alice = await pairDaemon(target, { owner: "alice" });
-      const bob = await pairDaemon(target, { owner: "bob" });
+      const alice = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
+      const bob = await pairDaemon(target, { owner: "bob", offer: "private" });
       try {
         const first = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("step one"),
           owner: "bob",
-          audience: "self"
+          audience: "private"
         });
         const second = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("step two"),
           owner: "alice",
-          audience: "self",
+          audience: "private",
           dependsOn: [first.id]
         });
         await alice.runner.tick();
@@ -919,7 +1055,10 @@ var CHECKS = [
     title: "a dependent job's TTL starts when it becomes claimable, not at enqueue",
     musts: ["TTL_EXPIRY"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         daemon.backend.hangMs = target.ttlMs * 2;
         const first = await target.enqueue({
@@ -949,35 +1088,19 @@ var CHECKS = [
   {
     id: "C014_RESULT_PROVENANCE",
     title: "a community result arrives marked untrusted, a self result does not",
-    musts: ["RESULT_PROVENANCE"],
+    // `PROVENANCE_NAMES_DEVICE` supersedes `RESULT_PROVENANCE` — a
+    // strengthening rather than a rename. C030 is the other half: a label
+    // means nothing unless a result whose signature does not verify against
+    // the granted device is refused rather than recorded.
+    musts: ["PROVENANCE_NAMES_DEVICE"],
     async run(target) {
-      const bob = await pairDaemon(target, { owner: "bob", offer: "public" });
+      const bob = await pairDaemon(target, { owner: "bob", offer: "team" });
       try {
-        const community = await target.enqueue({
-          kind: "llm.generate",
-          payload: prompt("run this anywhere"),
-          owner: "alice",
-          audience: "public"
-        });
-        await bob.runner.tick();
-        await waitFor(
-          async () => (await target.job(community.id))?.state === "ok",
-          { what: "the community job to complete" }
-        );
-        const delivered = await target.job(community.id);
-        assert(
-          delivered?.provenance?.untrusted === true,
-          "a public result was not marked untrusted"
-        );
-        assert(
-          delivered.provenance.runnerOwner === "bob",
-          "the result did not carry the runner's owner"
-        );
         const own = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("my own"),
           owner: "bob",
-          audience: "self"
+          audience: "private"
         });
         await bob.runner.tick();
         await waitFor(async () => (await target.job(own.id))?.state === "ok", {
@@ -997,7 +1120,10 @@ var CHECKS = [
     title: "every executed prompt is in the ingress log before it runs",
     musts: ["INGRESS_LOGGED_BEFORE_EXECUTION"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       let ticking = Promise.resolve();
       try {
         daemon.backend.hangMs = 3e4;
@@ -1031,7 +1157,13 @@ var CHECKS = [
   {
     id: "C016_UNAUTHENTICATED_REFUSED",
     title: "the protocol endpoints refuse an unknown token",
-    musts: ["PAIR_ONE_USER"],
+    // `CONSENT_BEFORE_ROUTE` on this plane. A relay has a consent record; a
+    // direct site has pairing, and it is the same obligation — an upstream
+    // routes to a device it has a record binding, and there is no discovery
+    // path by which an unbound device receives work. Every endpoint is
+    // checked rather than just `claim`, which is what makes it the absence
+    // of a path rather than the absence of one door.
+    musts: ["PAIR_ONE_USER", "CONSENT_BEFORE_ROUTE"],
     async run(target) {
       for (const endpoint of ["claim", "heartbeat", "result", "release"]) {
         const response = await target.fetch(
@@ -1041,7 +1173,7 @@ var CHECKS = [
               "content-type": "application/json",
               authorization: "Bearer definitely-not-a-real-token"
             },
-            body: JSON.stringify({ protocolVersion: "0" })
+            body: JSON.stringify({ protocolVersion: PROTOCOL_VERSION2 })
           })
         );
         assert(
@@ -1054,11 +1186,19 @@ var CHECKS = [
   {
     id: "C017_METERED_DEFAULTS_SELF",
     title: "a paid backend is not shared until its owner says so, with a ceiling",
-    musts: ["METERED_DEFAULTS_SELF", "COST_NOT_CONFIGURABLE"],
+    // `EFFECTIVE_OFFER_ONLY` too: bob asks for `public`, what reaches the
+    // server is `self`, and the server acts on what it was told rather than
+    // on what was wanted. That *is* the effective-offer rule, proved here
+    // without being named.
+    musts: [
+      "METERED_DEFAULTS_SELF",
+      "COST_NOT_CONFIGURABLE",
+      "EFFECTIVE_OFFER_ONLY"
+    ],
     async run(target) {
       const bob = await pairDaemon(target, {
         owner: "bob",
-        offer: "public",
+        offer: "team",
         // Pointed at localhost — which changes nothing, because a named
         // provider's cost comes from the registry, not from an address
         // ({@link MUSTS.COST_NOT_CONFIGURABLE}).
@@ -1066,22 +1206,18 @@ var CHECKS = [
       });
       try {
         assert(
-          bob.loaded.routes.every((route) => route.offerScope === "self"),
+          bob.loaded.routes.every((route) => route.offerScope === "private"),
           "a metered backend was advertised beyond its owner without consent"
         );
         assert(
           bob.loaded.routes.every((route) => route.cost === "metered"),
           "a metered provider was read as free because of its base URL"
         );
-        await bob.allowlist.add(
-          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
-          Date.now()
-        );
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("spend someone else's money"),
           owner: "alice",
-          audience: "public"
+          audience: "team"
         });
         await bob.runner.tick();
         await sleep(80);
@@ -1097,7 +1233,7 @@ var CHECKS = [
         const availability = await target.runnerAvailability({
           kind: "llm.generate",
           owner: "alice",
-          audience: "public"
+          audience: "team"
         });
         assert(
           !availability.available,
@@ -1107,7 +1243,7 @@ var CHECKS = [
           kind: "llm.generate",
           payload: prompt("my own work"),
           owner: "bob",
-          audience: "self"
+          audience: "private"
         });
         await bob.runner.tick();
         await waitFor(async () => (await target.job(own.id))?.state === "ok", {
@@ -1125,7 +1261,7 @@ var CHECKS = [
     async run(target) {
       const bob = await pairDaemon(target, {
         owner: "bob",
-        offer: "public",
+        offer: "team",
         metered: {
           // The generic backend pointed at a remote address. No registry entry
           // says what this costs; it is metered because of where it goes
@@ -1142,30 +1278,15 @@ var CHECKS = [
           "a remote backend was treated as free"
         );
         assert(
-          bob.loaded.routes.every((route) => route.offerScope === "public"),
+          bob.loaded.routes.every((route) => route.offerScope === "team"),
           "a deliberately shared metered backend was narrowed anyway"
         );
-        await bob.allowlist.add(
-          { origin: target.origin, owner: await ownerIdFor(target, "alice") },
-          Date.now()
-        );
-        const first = await target.enqueue({
-          kind: "llm.generate",
-          payload: prompt("work bob agreed to pay for"),
-          owner: "alice",
-          audience: "public"
-        });
-        await bob.runner.tick();
-        await waitFor(
-          async () => (await target.job(first.id))?.state === "ok",
-          { what: "a consented metered job to run" }
-        );
         await bob.spend.record("primary", 900, Date.now());
         const second = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("work past the ceiling"),
           owner: "alice",
-          audience: "public"
+          audience: "team"
         });
         const seenBefore = bob.backend.seen.length;
         await bob.runner.tick();
@@ -1183,7 +1304,7 @@ var CHECKS = [
           kind: "llm.generate",
           payload: prompt("my own work, my own key"),
           owner: "bob",
-          audience: "self"
+          audience: "private"
         });
         await bob.runner.tick();
         await waitFor(async () => (await target.job(own.id))?.state === "ok", {
@@ -1199,14 +1320,22 @@ var CHECKS = [
     title: "two runners racing one job \u2014 exactly one gets it",
     musts: ["CLAIM_ATOMIC"],
     async run(target) {
-      const a = await pairDaemon(target, { owner: "alice", label: "laptop" });
-      const b = await pairDaemon(target, { owner: "alice", label: "desktop" });
+      const a = await pairDaemon(target, {
+        owner: "alice",
+        label: "laptop",
+        offer: "private"
+      });
+      const b = await pairDaemon(target, {
+        owner: "alice",
+        label: "desktop",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("only once, please"),
           owner: "alice",
-          audience: "self"
+          audience: "private"
         });
         await Promise.all([a.runner.tick(), b.runner.tick()]);
         await waitFor(async () => (await target.job(job.id))?.state === "ok", {
@@ -1281,7 +1410,10 @@ var CHECKS = [
     title: "a runner advertises only what is installed and healthy",
     musts: ["CAPABILITY_IS_DETECTED"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         daemon.backend.healthy = false;
         const advertised = await daemon.runner.detectCapabilities();
@@ -1319,7 +1451,10 @@ var CHECKS = [
     // check does not establish.
     musts: ["KIND_NO_CODE"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       const SMUGGLED = ["command", "argv", "model", "baseUrl"];
       try {
         let refused = false;
@@ -1334,7 +1469,7 @@ var CHECKS = [
               baseUrl: "http://evil.test/v1"
             },
             owner: "alice",
-            audience: "self"
+            audience: "private"
           });
         } catch {
           refused = true;
@@ -1364,7 +1499,7 @@ var CHECKS = [
           kind: "llm.generate",
           payload: prompt("ordinary text"),
           owner: "alice",
-          audience: "self"
+          audience: "private"
         });
         await daemon.runner.tick();
         await waitFor(async () => (await target.job(ok.id))?.state === "ok", {
@@ -1471,7 +1606,7 @@ var CHECKS = [
       };
       const pending = await poll();
       assert(
-        pending["site"] === void 0,
+        pending["sites"] === void 0,
         "a pending poll disclosed the site's keys before anyone approved"
       );
       await target.approvePairing(pairing.userCode, "alice");
@@ -1480,8 +1615,19 @@ var CHECKS = [
         approved["status"] === "approved",
         `poll after approval said "${String(approved["status"])}"`
       );
-      const site = PublicIdentity.safeParse(approved["site"]);
-      assert(site.success, "the approval carried no usable site identity");
+      const offered = approved["sites"];
+      assert(
+        typeof offered === "object" && offered !== null,
+        "the approval carried no sites to pin"
+      );
+      const parsed = Object.values(offered).map(
+        (value) => PublicIdentity.safeParse(value)
+      );
+      assert(
+        parsed.length > 0 && parsed.every((entry) => entry.success),
+        "the approval carried no usable site identity"
+      );
+      const site = parsed[0];
       assert(
         verifyPublicIdentity(site.data),
         "the site's encryption key is not signed by the identity it presented"
@@ -1493,7 +1639,10 @@ var CHECKS = [
     title: "authentication is a signature over the request, not a secret",
     musts: ["REQUESTS_SIGNED_NOT_BEARER"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const body = JSON.stringify({
           protocolVersion: PROTOCOL_VERSION2,
@@ -1565,13 +1714,16 @@ var CHECKS = [
     title: "a release acts on the lease it names, not whatever lease exists",
     musts: ["LEASE_SCOPED_BY_GRANT"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt("run me once"),
           owner: "alice",
-          audience: "self"
+          audience: "private"
         });
         const first = await claimOne(target, daemon);
         assert(
@@ -1605,13 +1757,16 @@ var CHECKS = [
     title: "a claim carries routing metadata and no work",
     musts: ["STUB_METADATA_EXHAUSTIVE"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         await target.enqueue({
           kind: "llm.generate",
           payload: prompt("this must not appear in a claim response"),
           owner: "alice",
-          audience: "self"
+          audience: "private"
         });
         const stub = await claimOne(target, daemon);
         const asRecord = stub;
@@ -1670,13 +1825,16 @@ var CHECKS = [
     musts: ["ENVELOPE_SEALED_AND_SIGNED"],
     async run(target) {
       const secret = "a prompt nobody should read from storage";
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
           payload: prompt(secret),
           owner: "alice",
-          audience: "self"
+          audience: "private"
         });
         const stored = await target.job(job.id);
         assert(
@@ -1709,7 +1867,10 @@ var CHECKS = [
     title: "a daemon refuses work not signed by the site it pinned",
     musts: ["ENVELOPE_SEALED_AND_SIGNED"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const keys = await daemon.identityKeys();
         const relay = generateKeys(Date.now());
@@ -1754,9 +1915,16 @@ var CHECKS = [
   {
     id: "C030_SITE_REFUSES_UNSIGNED_RESULTS",
     title: "a site refuses a result not signed by the device that ran it",
-    musts: ["ENVELOPE_SEALED_AND_SIGNED"],
+    // The proof-of-possession half of `PROVENANCE_NAMES_DEVICE`: attribution
+    // by a signature that verifies against the device the lease was granted
+    // to, rather than by a key id carried beside the result. Carrying an id
+    // is not proving possession, and a forger writes whatever it likes.
+    musts: ["ENVELOPE_SEALED_AND_SIGNED", "PROVENANCE_NAMES_DEVICE"],
     async run(target) {
-      const daemon = await pairDaemon(target, { owner: "alice" });
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
       try {
         const job = await target.enqueue({
           kind: "llm.generate",
@@ -1768,6 +1936,7 @@ var CHECKS = [
         const relay = generateKeys(Date.now());
         const forged = await postResult(target, daemon, {
           jobId: job.id,
+          leaseId: claimed.lease.id,
           outcome: { outcome: "ok", text: "an answer the device never gave" },
           sealWith: relay
         });
@@ -1782,6 +1951,7 @@ var CHECKS = [
         );
         const real = await postResult(target, daemon, {
           jobId: job.id,
+          leaseId: claimed.lease.id,
           outcome: { outcome: "ok", text: "the genuine answer" }
         });
         assert(
@@ -1790,6 +1960,7 @@ var CHECKS = [
         );
         const lying = await postResult(target, daemon, {
           jobId: job.id,
+          leaseId: claimed.lease.id,
           outcome: {
             outcome: "error",
             code: "backend-error",
@@ -1806,11 +1977,101 @@ var CHECKS = [
         await daemon.dispose();
       }
     }
+  },
+  {
+    id: "C032_SERVER_REFUSES_TO_OFFER",
+    title: "a claim is not answered with work the claimer may not run",
+    musts: ["AUDIENCE_BOTH_SIDES"],
+    async run(target) {
+      const bob = await pairDaemon(target, { owner: "bob", offer: "team" });
+      try {
+        const priv = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("alice's own machines only"),
+          owner: "alice",
+          audience: "private"
+        });
+        const offered = await claimRaw(target, bob);
+        assert(
+          !offered.some((job) => job.id === priv.id),
+          "a server offered a `self` job to a device its owner does not own"
+        );
+        const shared = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("anyone may run this"),
+          owner: "alice",
+          audience: "team"
+        });
+        const second = await claimRaw(target, bob);
+        assert(
+          second.some((job) => job.id === shared.id),
+          "a server withheld a `public` job from a public-offering device"
+        );
+      } finally {
+        await bob.dispose();
+      }
+    }
+  },
+  {
+    id: "C031_ROSTER_NOT_DISCLOSED",
+    title: "a claimed stub carries no list of who may run the job",
+    musts: ["ROSTER_NOT_DISCLOSED"],
+    async run(target) {
+      const daemon = await pairDaemon(target, {
+        owner: "alice",
+        offer: "private"
+      });
+      try {
+        const job = await target.enqueue({
+          kind: "llm.generate",
+          payload: prompt("who else is on this roster"),
+          owner: "alice",
+          audience: "team",
+          // The site restricts the job to people who are not this daemon's
+          // owner. A stub that carried the list would be handing a routing
+          // party the membership of alice's group.
+          audienceAllow: ["alice", "carol", "erin"]
+        });
+        const claimed = await claimOne(target, daemon);
+        assert(
+          claimed.id === job.id,
+          "the harness could not claim its own named job"
+        );
+        const asRecord = claimed;
+        assert(
+          asRecord["audienceAllow"] === void 0,
+          "a claimed stub carried audienceAllow"
+        );
+        const parsed = ClaimedStub.safeParse(claimed);
+        assert(
+          parsed.success,
+          "the claim response is not a valid stub, so its fields prove nothing"
+        );
+        const wire = JSON.stringify(claimed);
+        for (const member of ["carol", "erin"]) {
+          assert(
+            !wire.includes(member),
+            `a claimed stub disclosed roster member "${member}"`
+          );
+        }
+        assert(
+          claimed.audience === "team",
+          "the stub lost the audience routing decides on"
+        );
+        assert(
+          typeof claimed.owner === "string" && claimed.owner.length > 0,
+          "the stub lost the owner"
+        );
+      } finally {
+        await daemon.dispose();
+      }
+    }
   }
 ];
 
 // src/certify.ts
 import {
+  kindsOf,
   MUSTS,
   MUST_IDS,
   mustsVerifiedBy
@@ -1854,7 +2115,7 @@ function uncoveredMusts(checks = CHECKS) {
   return mustsVerifiedBy("conformance").filter((id) => !covered.has(id));
 }
 function miscoveredMusts(checks = CHECKS) {
-  return [...new Set(checks.flatMap((check) => check.musts))].filter((id) => MUSTS[id].verifiedBy !== "conformance").sort();
+  return [...new Set(checks.flatMap((check) => check.musts))].filter((id) => !kindsOf(MUSTS[id]).includes("conformance")).sort();
 }
 var VERIFICATION_NOTE = "(`adversarial` = proved by the reference daemon's own suites; `construction` = true by code shape; `operator` = a deployment claim, verifiable only by audit or source. None is asserted by this run.)";
 function formatReport(report) {
@@ -1882,13 +2143,13 @@ function formatReport(report) {
     }
   }
   const elsewhere = MUST_IDS.filter(
-    (id) => MUSTS[id].verifiedBy !== "conformance"
+    (id) => !kindsOf(MUSTS[id]).includes("conformance")
   );
   if (elsewhere.length > 0) {
     lines.push("");
     lines.push("  Verified elsewhere, not by this kit:");
     for (const kind of ["adversarial", "construction", "operator"]) {
-      const ids = elsewhere.filter((id) => MUSTS[id].verifiedBy === kind);
+      const ids = elsewhere.filter((id) => kindsOf(MUSTS[id]).includes(kind));
       if (ids.length === 0) continue;
       lines.push(`    ${kind}: ${ids.join(", ")}`);
     }
@@ -1911,4 +2172,4 @@ export {
   miscoveredMusts,
   formatReport
 };
-//# sourceMappingURL=chunk-EXNALQ5D.js.map
+//# sourceMappingURL=chunk-OPJBI7WK.js.map