@byollm/protocol 0.1.0-alpha.14 → 0.1.0-alpha.16

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.14`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.16`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/protocol@alpha`.
 >
@@ -11,7 +11,34 @@
 > npm assigns `latest` on a first publish and won't let it be removed, so a
 > bare install resolves here too. This notice is the only guard — deliberately
 > not an npm deprecation, which would read as *abandoned* rather than *early*.
-> Ask for `@alpha` explicitly so your lockfile records that you meant to.
+> Ask for `@alpha` explicitly so your lockfile records that you meant to.>
+> **`alpha.15` is a breaking wire change, and it breaks daemons and relays —
+> not app authors.** If you call `app.enqueue(...)` and read results, nothing
+> in your code changes. If you run a daemon or an upstream, every package must
+> move together: a mixed pair refuses on both sides, because both ends parse
+> `.strict()`.
+>
+> What moved, all of it reconciling the frozen `byollm_009` with its code:
+> `JobStub` gains `site` (the site's identity key id) and loses
+> `audienceAllow`; `ResultRequest` gains `leaseId`; `HeartbeatResponse` loses
+> `leases`, which nothing read; `WireErrorCode` gains `not-ready`,
+> `clock-skew` and `forbidden`, and `403` is `forbidden` rather than
+> `unauthorized`. `RESULT_PROVENANCE` is superseded by
+> `PROVENANCE_NAMES_DEVICE`. See `byollm_009` Amendment A.>
+> **`alpha.16` is a breaking wire change — daemons and relays again, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together: both ends parse `.strict()`, so a mixed pair
+> refuses.
+>
+> What moved, all of it Tier 2 of `cloud_008`: `model`, `backendClass` and
+> `durationMs` come off `ResultRequest` and are sealed **inside** the result
+> envelope as `SealedOutcome = { outcome, ran }` — so a daemon can no longer
+> declare a model it did not sign, and a relay carries neither.
+> `HeartbeatResponse` loses `leases` (nothing read it) and now reports real
+> cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
+> for 403, leaving `unauthorized` at exactly 401. The relay gained a
+> site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
+> `stub.audience`, and remembers a refusal.
 >
 > **`alpha.3` is a breaking change.** `BackendDescriptor.account` is gone —
 > read `cost` (`free` / `metered` / `subscription`) instead. Four new MUSTs

package/dist/index.d.ts

@@ -515,7 +515,7 @@ type ClaimedJob = z.infer<typeof ClaimedJob>;
  *
  * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
  * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
  */
 declare const ResultProvenance: z.ZodObject<{
     audience: z.ZodEnum<{
@@ -544,6 +544,30 @@ declare function provenanceFor(input: {
     backendClass: BackendClass;
     model: string;
 }): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
 declare const JobResultOk: z.ZodObject<{
     outcome: z.ZodLiteral<"ok">;
@@ -574,6 +598,37 @@ declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
     outcome: z.ZodLiteral<"canceled">;
 }, z.core.$strict>], "outcome">;
 type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
 /** A completed job as delivered to the app, provenance attached. */
 declare const DeliveredResult: z.ZodObject<{
     jobId: z.ZodString;
@@ -676,6 +731,7 @@ declare const JobStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
         self: "self";
         named: "named";
@@ -699,6 +755,7 @@ declare const ClaimedStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
         self: "self";
         named: "named";
@@ -1125,7 +1182,7 @@ declare const MUSTS: Readonly<{
     readonly TTL_EXPIRY: Must;
     readonly NO_RUNNER_SIGNAL: Must;
     readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
     readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
     readonly NO_SHELL_INTERPOLATION: Must;
     readonly NO_PAYLOAD_ROUTING: Must;
@@ -1133,11 +1190,18 @@ declare const MUSTS: Readonly<{
     readonly HTTP_BASE_URL_SAFE: Must;
     readonly OUTPUT_INERT: Must;
     readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
 }>;
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
@@ -1485,6 +1549,7 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
             self: "self";
             named: "named";
@@ -1557,10 +1622,6 @@ type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
     revoked: z.ZodBoolean;
     cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
-        jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
-    }, z.core.$strict>>;
     lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
 }, z.core.$strict>;
@@ -1587,6 +1648,7 @@ declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
+    leaseId: z.ZodString;
     envelope: z.ZodObject<{
         ciphertext: z.ZodString;
         recipientKeyId: z.ZodString;
@@ -1602,12 +1664,6 @@ declare const ResultRequest: z.ZodObject<{
         error: "error";
         canceled: "canceled";
     }>;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
@@ -1648,7 +1704,10 @@ declare const WireErrorCode: z.ZodEnum<{
     revoked: "revoked";
     "bad-request": "bad-request";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
@@ -1659,12 +1718,17 @@ declare const WireError: z.ZodObject<{
         revoked: "revoked";
         "bad-request": "bad-request";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
@@ -1690,4 +1754,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith };

package/dist/index.js

@@ -411,6 +411,13 @@ function provenanceFor(input) {
     untrusted: input.audience !== "self"
   };
 }
+var RunMetadata = z4.object({
+  /** Which model actually served it. */
+  model: z4.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z4.number().int().nonnegative()
+}).strict();
 var JobResultOk = z4.object({
   outcome: z4.literal("ok"),
   text: z4.string(),
@@ -432,6 +439,7 @@ var JobOutcome = z4.discriminatedUnion("outcome", [
   JobResultError,
   JobResultCanceled
 ]);
+var SealedOutcome = z4.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
 var DeliveredResult = z4.object({
   jobId: z4.string().min(1),
   state: JobState,
@@ -458,6 +466,30 @@ var JobStub = z4.object({
   kind: JobKind,
   /** The app's id for the user who enqueued it. */
   owner: z4.string().min(1),
+  /**
+   * Which site this job belongs to — byollm_009 Amendment A §A.3.
+   *
+   * **The site's identity key id**, not an id somebody assigned it. §6 has
+   * listed `site` since this spec was frozen; the schema never carried it,
+   * which is the drift the amendment closes.
+   *
+   * A key id rather than an opaque handle for one reason above the others:
+   * it makes the stub *self-describing* instead of a pointer into somebody
+   * else's table. A daemon holds this key id already, from pinning, so it
+   * can check `stub.site` against the payload envelope's `senderKeyId`
+   * without a lookup and without trusting the party that routed it. An
+   * opaque id can only be believed.
+   *
+   * It also avoids inventing a second namespace for a thing that has a
+   * canonical one — the shape of finding 41 (two owner namespaces compared
+   * for equality) and of finding fourteen before it.
+   *
+   * Rotation is a designed transition rather than a cost: a site publishes a
+   * new identity signed by the outgoing one, both are valid through an
+   * overlap window, and a daemon re-keys its own map by verifying that
+   * signature against the key it already pinned (§A.3.1).
+   */
+  site: z4.string().min(1),
   audience: Audience,
   // `audienceAllow` is **not** here, and its absence is the enforcement —
   // cloud_008 §0.2.
@@ -1020,12 +1052,12 @@ var MUSTS = Object.freeze({
     verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.4"
   }),
-  RESULT_PROVENANCE: must({
-    id: "RESULT_PROVENANCE",
-    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
     enforcedBy: "server",
     verifiedBy: "conformance",
-    source: "byollm_003 Rev 1 \xA7Return-trip"
+    source: "byollm_009 \xA711"
   }),
   // ---- The trust surface -------------------------------------------------
   INGRESS_LOGGED_BEFORE_EXECUTION: must({
@@ -1077,8 +1109,92 @@ var MUSTS = Object.freeze({
     enforcedBy: "daemon",
     verifiedBy: "adversarial",
     source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
   })
 });
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
+});
 var MUST_IDS = Object.freeze(Object.keys(MUSTS));
 function mustsVerifiedBy(kind) {
   return MUST_IDS.filter((id) => MUSTS[id].verifiedBy === kind);
@@ -1233,13 +1349,26 @@ var HeartbeatResponse = z8.object({
    * in-flight backend calls and reports them `canceled`.
    */
   cancel: z8.array(z8.string().min(1)),
-  /** Jobs whose leases were renewed, with their new expiry. */
-  leases: z8.array(
-    z8.object({
-      jobId: z8.string().min(1),
-      expiresAt: z8.number().int().positive()
-    }).strict()
-  ),
+  // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
+  //
+  // It carried "these leases were renewed, and here is the new expiry", and
+  // **no daemon ever read it.** A mutation returning an empty list while
+  // renewing correctly survived every test, which is what made it visible.
+  //
+  // It is neither a class nor membership, so Amendment A's rule does not
+  // decide it — the older test does: nothing reads it, so it is dead wire.
+  // §6's exhaustiveness is a commitment about what an upstream can see, and
+  // it applies to every message rather than only to the stub.
+  //
+  // `lost` is the actionable signal and always was: a daemon stops work on
+  // a lease it no longer holds. "Renewed" was the same question answered a
+  // second time, and a second answer can only agree or contradict.
+  //
+  // Renewal itself is untouched — the upstream still extends the grants a
+  // heartbeat names, which is what §0.6 fixed. What ended is telling the
+  // daemon about it in a field it ignored. If an upstream ever needs to
+  // push lease decisions, that is a new field with a reader, added on
+  // purpose.
   /**
    * Jobs the daemon thinks it holds but the server has reassigned or
    * expired. The daemon must stop work on these and not report results.
@@ -1253,6 +1382,29 @@ var ResultRequest = z8.object({
   protocolVersion: z8.literal(PROTOCOL_VERSION),
   runnerId: z8.string().min(1),
   jobId: z8.string().min(1),
+  /**
+   * The grant this result was produced under — cloud_008 §1.4a.
+   *
+   * `fetch` has always named its lease, with the reasoning written beside
+   * it: a request that names only the job would be answerable for whatever
+   * lease exists when it arrives. **The operation that writes the result did
+   * not**, on either plane, and checked only the runner id — which survives
+   * a claim-release-reclaim cycle, so a device whose grant had been swept
+   * and reissued could still land a result for a job it no longer held.
+   *
+   * Found by tracing a mutation that survived in §0.6: the lease lapsed, the
+   * sweep requeued, the daemon re-claimed under a new grant, and the
+   * original run finished and posted anyway. The relay marked the job done
+   * with a result the site cannot open — it verifies the envelope against
+   * the *current* holder's device, so the crypto contains the substitution —
+   * and then refused the real holder's result as a replay. A lost job, in
+   * silence.
+   *
+   * `LEASE_HONORED` is a statement about a lease *instance*. That was
+   * learned once already, when a replayed release yanked a later grant, and
+   * it applies here for the same reason.
+   */
+  leaseId: z8.string().min(1),
   /**
    * The outcome, sealed to the site and signed by the device.
    *
@@ -1268,12 +1420,21 @@ var ResultRequest = z8.object({
    * fact: believing it unverified would let a daemon mark a job `ok` while
    * sealing an error, and only the app would ever find out.
    */
-  disposition: ResultDisposition,
-  /** Which model actually served it, for the result's provenance. */
-  model: z8.string().min(1),
-  backendClass: BackendClass,
-  /** Wall-clock milliseconds the backend call took. */
-  durationMs: z8.number().int().nonnegative()
+  disposition: ResultDisposition
+  // `model`, `backendClass` and `durationMs` are **inside the envelope** —
+  // cloud_008 §2.5. See {@link RunMetadata}.
+  //
+  // They were here, in the clear, and that was two problems wearing one
+  // coat. On the direct plane the site recorded unauthenticated fields
+  // beside an authenticated answer: a daemon could seal one result and
+  // declare a different model, and only the unsigned half would reach the
+  // app. Through a relay they reached a third party that acts on none of
+  // them — `model` in particular being the sort of detail Amendment A's
+  // rule keeps off the wire.
+  //
+  // `disposition` stays, and the difference is the test: a relay *routes*
+  // on it, so it is a class a routing party consumes. Nobody between the
+  // two ends consumes these.
 }).strict();
 var ResultResponse = z8.object({
   /**
@@ -1315,9 +1476,40 @@ var ReleaseResponse = z8.object({
 var WireErrorCode = z8.enum([
   "bad-request",
   "unsupported-protocol-version",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
   "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
   "revoked",
   "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
   "rate-limited",
   "server-error"
 ]);
@@ -1325,14 +1517,46 @@ var WireError = z8.object({
   error: WireErrorCode,
   message: z8.string().min(1),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z8.number().int().nonnegative().optional()
-}).strict();
+  retryAfter: z8.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z8.number().int().positive().optional(),
+  maxSkewMs: z8.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+});
 var ERROR_STATUS = Object.freeze({
   "bad-request": 400,
   "unsupported-protocol-version": 400,
   unauthorized: 401,
+  forbidden: 403,
   revoked: 403,
   "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
   "rate-limited": 429,
   "server-error": 500
 });
@@ -1421,9 +1645,11 @@ export {
   ResultProvenance,
   ResultRequest,
   ResultResponse,
+  RunMetadata,
   SIZE_CLASS_LIMITS,
   SUPPORTED_PROTOCOL_VERSIONS,
   SealedEnvelope,
+  SealedOutcome,
   SizeClass,
   StoredKeys,
   TERMINAL_STATES,