@byollm/protocol 0.1.0-alpha.2 → 0.1.0-alpha.20

package/dist/index.js

@@ -2,23 +2,166 @@
 import { z as z2 } from "zod";
 
 // src/backends.ts
+import { isIP } from "net";
 import { z } from "zod";
 var BackendClass = z.enum(["http", "process"]);
-var BackendAccount = z.enum(["open", "subscription"]);
+var BackendCost = z.enum(["free", "metered", "subscription"]);
 var backend = (b) => Object.freeze(b);
 var BACKENDS = Object.freeze({
+  // -- free: local compute, costs electricity ------------------------------
+  ollama: backend({
+    id: "ollama",
+    label: "Ollama (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:11434/v1"
+  }),
+  mlx: backend({
+    id: "mlx",
+    label: "MLX (mlx_lm.server, local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:8080/v1"
+  }),
+  llamacpp: backend({
+    id: "llamacpp",
+    label: "llama.cpp server (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:8080/v1"
+  }),
+  vllm: backend({
+    id: "vllm",
+    label: "vLLM (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:8000/v1"
+  }),
+  lmstudio: backend({
+    id: "lmstudio",
+    label: "LM Studio (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:1234/v1"
+  }),
+  jan: backend({
+    id: "jan",
+    label: "Jan (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:1337/v1"
+  }),
+  localai: backend({
+    id: "localai",
+    label: "LocalAI (local)",
+    class: "http",
+    cost: "free",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "http://127.0.0.1:8080/v1"
+  }),
+  // -- metered: the owner's money, per token -------------------------------
+  /**
+   * Note the pair: `anthropic` and {@link BACKENDS."claude-cli"} reach the
+   * same vendor and land in different cost classes. That is not an
+   * inconsistency — it is the axis working. One bills a key per token, the
+   * other runs under a personal plan whose terms cover one person's work. Who
+   * pays and under what terms is the question; which company is not.
+   */
+  anthropic: backend({
+    id: "anthropic",
+    label: "Anthropic (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.anthropic.com/v1"
+  }),
+  openai: backend({
+    id: "openai",
+    label: "OpenAI (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.openai.com/v1"
+  }),
+  gemini: backend({
+    id: "gemini",
+    label: "Google Gemini (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://generativelanguage.googleapis.com/v1beta/openai"
+  }),
+  grok: backend({
+    id: "grok",
+    label: "xAI Grok (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.x.ai/v1"
+  }),
+  groq: backend({
+    id: "groq",
+    label: "Groq (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.groq.com/openai/v1"
+  }),
+  openrouter: backend({
+    id: "openrouter",
+    label: "OpenRouter (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://openrouter.ai/api/v1"
+  }),
+  together: backend({
+    id: "together",
+    label: "Together AI (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.together.xyz/v1"
+  }),
+  deepseek: backend({
+    id: "deepseek",
+    label: "DeepSeek (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.deepseek.com/v1"
+  }),
+  mistral: backend({
+    id: "mistral",
+    label: "Mistral (your API key)",
+    class: "http",
+    cost: "metered",
+    adversarialCorpus: "http",
+    defaultBaseUrl: "https://api.mistral.ai/v1"
+  }),
+  // -- the escape hatch ----------------------------------------------------
   "openai-http": backend({
     id: "openai-http",
-    label: "OpenAI-compatible HTTP server (Ollama, MLX, llama.cpp, vLLM)",
+    label: "Any OpenAI-compatible server",
     class: "http",
-    account: "open",
+    // Unknown until the base URL is known: local means free, remote means
+    // metered, and the owner does not get to say otherwise
+    // ({@link MUSTS.REMOTE_IS_NEVER_FREE}).
+    cost: null,
     adversarialCorpus: "http"
   }),
+  // -- subscription: someone else's terms ----------------------------------
   "claude-cli": backend({
     id: "claude-cli",
     label: "Claude CLI (your subscription)",
     class: "process",
-    account: "subscription",
+    cost: "subscription",
     adversarialCorpus: "process"
   })
 });
@@ -32,6 +175,30 @@ function isBackendId(value) {
 function backendDescriptor(id) {
   return BACKENDS[id];
 }
+function isLocalHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  const version = isIP(host);
+  if (version === 0) return false;
+  if (version === 6) {
+    if (host === "::1") return true;
+    return /^f[cd]/.test(host);
+  }
+  if (host.startsWith("127.")) return true;
+  if (host.startsWith("10.")) return true;
+  if (host.startsWith("192.168.")) return true;
+  return /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+function resolveCost(id, baseUrl) {
+  const declared = BACKENDS[id].cost;
+  if (declared !== null) return declared;
+  if (baseUrl === void 0) return "metered";
+  try {
+    return isLocalHost(new URL(baseUrl).hostname) ? "free" : "metered";
+  } catch {
+    return "metered";
+  }
+}
 
 // src/audience.ts
 var Audience = z2.enum(["self", "named", "public"]);
@@ -50,12 +217,18 @@ var MatchRefusal = z2.enum([
   /** The backend offers only `self` and the job belongs to someone else. */
   "offer-scope-too-narrow",
   /** The matched backend is subscription-class, which is locked to `self`. */
-  "subscription-self-lock"
+  "subscription-self-lock",
+  /** The backend spends the owner's money and they have not agreed to share it. */
+  "metered-no-spend-consent",
+  /** The backend is shared but has spent its ceiling for now. */
+  "metered-ceiling-reached"
 ]);
 var ALLOWED = Object.freeze({ ok: true });
 var refuse = (refusal) => Object.freeze({ ok: false, refusal });
-function effectiveOfferScope(configured, account) {
-  return account === "subscription" ? "self" : configured;
+function effectiveOfferScope(configured, cost, spend) {
+  if (cost === "subscription") return "self";
+  if (cost === "metered" && spend?.acknowledged !== true) return "self";
+  return configured;
 }
 function matchAudience(job, daemon) {
   const sameOwner = job.owner === daemon.owner;
@@ -65,13 +238,25 @@ function matchAudience(job, daemon) {
   if (job.audience === "named" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
     return refuse("not-in-server-allowlist");
   }
-  const scope = effectiveOfferScope(daemon.offerScope, daemon.account);
+  const scope = effectiveOfferScope(
+    daemon.offerScope,
+    daemon.cost,
+    daemon.spend
+  );
   if (sameOwner) {
     return ALLOWED;
   }
-  if (daemon.account === "subscription") {
+  if (daemon.cost === "subscription") {
     return refuse("subscription-self-lock");
   }
+  if (daemon.cost === "metered") {
+    if (daemon.spend?.acknowledged !== true) {
+      return refuse("metered-no-spend-consent");
+    }
+    if (daemon.spend.ceilingReached === true) {
+      return refuse("metered-ceiling-reached");
+    }
+  }
   switch (scope) {
     case "self":
       return refuse("offer-scope-too-narrow");
@@ -87,7 +272,9 @@ var REFUSAL_MESSAGES = Object.freeze({
   "not-locally-allowed": "the job's owner is not on this machine's allowlist (byollm allow <server> <user>)",
   "not-in-server-allowlist": "the app restricted this job to named runners and this machine is not one of them",
   "offer-scope-too-narrow": "this backend is offered to its owner only (byollm offer <backend> named|public to widen)",
-  "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting"
+  "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting",
+  "metered-no-spend-consent": "this backend bills its owner per token, and they have not agreed to spend it on other people's work",
+  "metered-ceiling-reached": "this backend is shared but has reached the spend ceiling its owner set"
 });
 
 // src/kinds.ts
@@ -167,6 +354,21 @@ function canTransition(from, to) {
   return TRANSITIONS[from].includes(to);
 }
 var Lease = z4.object({
+  /**
+   * Identifies *this* grant, not just its holder.
+   *
+   * A runner can hold a job, release it, and claim it again — three leases,
+   * one runner id. Without an id for the grant itself, a lease-scoped request
+   * names a mutable target ambiguously, and a replayed release from the first
+   * grant lands on the third: the job returns to the queue while the daemon
+   * is mid-execution, and the work runs twice on the owner's hardware.
+   *
+   * That was a live hole, found in review after signed requests shipped. The
+   * signature scheme's replay argument rests on endpoints being idempotent —
+   * and release *is*, per lease, but not across leases, because nothing in
+   * the request said which one.
+   */
+  id: z4.string().min(1),
   /** The runner holding the lease. */
   runnerId: z4.string().min(1),
   /** Epoch milliseconds after which the claim is void. */
@@ -180,8 +382,6 @@ var ClaimedJob = z4.object({
   audience: Audience,
   /** The app's id for the user who enqueued it. */
   owner: z4.string().min(1),
-  /** Runner owners the app restricted a `named` job to, if any. */
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
   lease: Lease
 }).strict();
 var ResultProvenance = z4.object({
@@ -211,6 +411,13 @@ function provenanceFor(input) {
     untrusted: input.audience !== "self"
   };
 }
+var RunMetadata = z4.object({
+  /** Which model actually served it. */
+  model: z4.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z4.number().int().nonnegative()
+}).strict();
 var JobResultOk = z4.object({
   outcome: z4.literal("ok"),
   text: z4.string(),
@@ -232,12 +439,398 @@ var JobOutcome = z4.discriminatedUnion("outcome", [
   JobResultError,
   JobResultCanceled
 ]);
+var SealedOutcome = z4.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
 var DeliveredResult = z4.object({
   jobId: z4.string().min(1),
   state: JobState,
   outcome: JobOutcome.optional(),
   provenance: ResultProvenance.optional()
 }).strict();
+var SizeClass = z4.enum(["small", "medium", "large", "unbounded"]);
+var SIZE_CLASS_LIMITS = Object.freeze({
+  small: 4e3,
+  medium: 64e3,
+  large: Number.POSITIVE_INFINITY
+});
+function sizeClassCeiling(sizeClass) {
+  if (sizeClass === "unbounded") return Number.POSITIVE_INFINITY;
+  return SIZE_CLASS_LIMITS[sizeClass];
+}
+function sizeClassOf(textChars) {
+  if (textChars <= SIZE_CLASS_LIMITS.small) return "small";
+  if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
+  return "large";
+}
+var JobStub = z4.object({
+  id: z4.string().min(1),
+  kind: JobKind,
+  /** The app's id for the user who enqueued it. */
+  owner: z4.string().min(1),
+  /**
+   * Which site this job belongs to — byollm_009 Amendment A §A.3.
+   *
+   * **The site's identity key id**, not an id somebody assigned it. §6 has
+   * listed `site` since this spec was frozen; the schema never carried it,
+   * which is the drift the amendment closes.
+   *
+   * A key id rather than an opaque handle for one reason above the others:
+   * it makes the stub *self-describing* instead of a pointer into somebody
+   * else's table. A daemon holds this key id already, from pinning, so it
+   * can check `stub.site` against the payload envelope's `senderKeyId`
+   * without a lookup and without trusting the party that routed it. An
+   * opaque id can only be believed.
+   *
+   * It also avoids inventing a second namespace for a thing that has a
+   * canonical one — the shape of finding 41 (two owner namespaces compared
+   * for equality) and of finding fourteen before it.
+   *
+   * Rotation is a designed transition rather than a cost: a site publishes a
+   * new identity signed by the outgoing one, both are valid through an
+   * overlap window, and a daemon re-keys its own map by verifying that
+   * signature against the key it already pinned (§A.3.1).
+   */
+  site: z4.string().min(1),
+  audience: Audience,
+  // `audienceAllow` is **not** here, and its absence is the enforcement —
+  // cloud_008 §0.2.
+  //
+  // It was a list of the people who may run a job, travelling to every
+  // routing party on every `named` job. byollm_001 Rev 1 §B settled who
+  // decides that long before this schema existed: *the daemon's own list
+  // decides, not the server's*, and `allowlist.predicateFor(origin)` is the
+  // enforcement in both lanes. So this was a second answer to a question the
+  // daemon already owned — able only to agree, in which case it was
+  // redundant, or to disagree, in which case nothing said which wins.
+  //
+  // The rule it leaves behind, which decides the next field too: **a class
+  // the router acts on may travel; membership never does.** `audience` stays
+  // for exactly that reason — the relay narrows on it. A roster does not
+  // travel, so `ROSTER_NOT_DISCLOSED` holds here by absence, which is the
+  // strongest way for a MUST to hold.
+  //
+  // The site keeps its own copy on `JobRecord` and still filters candidates
+  // with it before offering. That is server-internal, where the party
+  // holding the list authored it.
+  sizeClass: SizeClass,
+  /** Reserved for byollm_006. False until streaming exists. */
+  streaming: z4.boolean(),
+  /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
+  deadlineAt: z4.number().int().positive()
+}).strict();
+var ClaimedStub = JobStub.extend({ lease: Lease }).strict();
+
+// src/envelope.ts
+import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
+import sodium from "libsodium-wrappers";
+import { z as z6 } from "zod";
+
+// src/keys.ts
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify
+} from "crypto";
+import { z as z5 } from "zod";
+var PublicIdentity = z5.object({
+  /** Raw Ed25519 public key. The pinned one. */
+  identity: z5.string().min(1),
+  /** Raw X25519 public key, for sealing to this party. */
+  encryption: z5.string().min(1),
+  /**
+   * Ed25519 signature over the encryption key, by the identity key.
+   *
+   * This is what stops an upstream substituting an encryption key of its
+   * own while relaying a genuine identity: the receiver pins the identity
+   * and refuses any encryption key not signed by it.
+   */
+  encryptionSig: z5.string().min(1)
+}).strict();
+var StoredKeys = z5.object({
+  version: z5.literal(1),
+  identityPublic: z5.string().min(1),
+  identityPrivate: z5.string().min(1),
+  encryptionPublic: z5.string().min(1),
+  encryptionPrivate: z5.string().min(1),
+  encryptionSig: z5.string().min(1),
+  createdAt: z5.number().int().positive()
+}).strict();
+var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
+function rawPublic(key) {
+  const jwk = key.export({ format: "jwk" });
+  const x = jwk.x;
+  if (typeof x !== "string") throw new Error("key has no raw public component");
+  return x;
+}
+function importPublic(raw, crv) {
+  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
+}
+function importPrivate(stored) {
+  return createPrivateKey({
+    key: Buffer.from(stored, "base64"),
+    type: "pkcs8",
+    format: "der"
+  });
+}
+var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
+function generateKeys(now) {
+  const identity = generateKeyPairSync("ed25519");
+  const encryption = generateKeyPairSync("x25519");
+  const encryptionPublic = rawPublic(encryption.publicKey);
+  return {
+    version: 1,
+    identityPublic: rawPublic(identity.publicKey),
+    identityPrivate: exportPrivate(identity.privateKey),
+    encryptionPublic,
+    encryptionPrivate: exportPrivate(encryption.privateKey),
+    encryptionSig: sign(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
+      identity.privateKey
+    ).toString("base64url"),
+    createdAt: now
+  };
+}
+function publicIdentityOf(keys) {
+  return {
+    identity: keys.identityPublic,
+    encryption: keys.encryptionPublic,
+    encryptionSig: keys.encryptionSig
+  };
+}
+function verifyPublicIdentity(identity) {
+  try {
+    return verify(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
+      importPublic(identity.identity, "Ed25519"),
+      Buffer.from(identity.encryptionSig, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
+    "base64url"
+  );
+}
+function verifyWith(identityPublic, data, signature) {
+  try {
+    return verify(
+      null,
+      data,
+      importPublic(identityPublic, "Ed25519"),
+      Buffer.from(signature, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function fingerprint(identityPublic) {
+  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of digest.subarray(0, 15)) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET.charAt(value >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  const groups = out.match(/.{1,4}/g) ?? [];
+  return `BYOLLM-${groups.join("-")}`;
+}
+var keyId = (identityPublic) => fingerprint(identityPublic);
+
+// src/envelope.ts
+var readied;
+async function cryptoReady() {
+  readied ??= sodium.ready;
+  await readied;
+}
+var ENVELOPE_MAX_AGE_MS = 24 * 60 * 6e4;
+var EnvelopeDirection = z6.enum(["payload", "result"]);
+var SealedEnvelope = z6.object({
+  /** Base64url `crypto_box_seal` output over the signed plaintext. */
+  ciphertext: z6.string().min(1),
+  /** Who this was sealed to — the recipient checks it is them. */
+  recipientKeyId: z6.string().min(1),
+  /** Who signed it — the recipient checks this against its pin. */
+  senderKeyId: z6.string().min(1),
+  direction: EnvelopeDirection,
+  /**
+   * When this ciphertext stops being worth keeping.
+   *
+   * Carried *on* the envelope rather than recomputed by the opener. An
+   * earlier version derived it from the job's creation time, which meant
+   * two systems had to agree on a timestamp to the millisecond — and they
+   * did not, once a real database rounded it. A bound value that has to be
+   * reconstructed is a bound value that eventually is not.
+   *
+   * Not trusted as written: it is also inside the signature, so a changed
+   * deadline fails to verify.
+   */
+  deadlineAt: z6.number().int().positive()
+}).strict();
+function signedBody(context, plaintext) {
+  return Buffer.from(
+    JSON.stringify({
+      v: "byollm/v1/envelope",
+      jobId: context.jobId,
+      senderKeyId: context.senderKeyId,
+      recipientKeyId: context.recipientKeyId,
+      deadlineAt: context.deadlineAt,
+      direction: context.direction,
+      plaintext
+    }),
+    "utf8"
+  );
+}
+var rawX25519 = (key, part) => {
+  const jwk = key.export({ format: "jwk" });
+  const value = part === "x" ? jwk.x : jwk.d;
+  if (typeof value !== "string") throw new Error("not an X25519 key");
+  return new Uint8Array(Buffer.from(value, "base64url"));
+};
+async function seal(input) {
+  await cryptoReady();
+  const body = signedBody(input.context, input.plaintext);
+  const signature = signWith(input.senderKeys, body);
+  const inner = JSON.stringify({ body: body.toString("base64url"), signature });
+  const recipient = new Uint8Array(
+    Buffer.from(input.recipientEncryptionPublic, "base64url")
+  );
+  const ciphertext = sodium.crypto_box_seal(
+    new Uint8Array(Buffer.from(inner, "utf8")),
+    recipient
+  );
+  return {
+    ciphertext: Buffer.from(ciphertext).toString("base64url"),
+    recipientKeyId: input.context.recipientKeyId,
+    senderKeyId: input.context.senderKeyId,
+    direction: input.context.direction,
+    deadlineAt: input.context.deadlineAt
+  };
+}
+async function open(input) {
+  await cryptoReady();
+  const { envelope, expected } = input;
+  if (envelope.recipientKeyId !== expected.recipientKeyId || envelope.senderKeyId !== expected.senderKeyId || envelope.direction !== expected.direction) {
+    return { ok: false, reason: "not-for-us" };
+  }
+  let inner;
+  try {
+    const priv = createPrivateKey2({
+      key: Buffer.from(input.recipientKeys.encryptionPrivate, "base64"),
+      type: "pkcs8",
+      format: "der"
+    });
+    const pub = createPublicKey2(priv);
+    const opened = sodium.crypto_box_seal_open(
+      new Uint8Array(Buffer.from(envelope.ciphertext, "base64url")),
+      rawX25519(pub, "x"),
+      rawX25519(priv, "d")
+    );
+    inner = Buffer.from(opened).toString("utf8");
+  } catch {
+    return { ok: false, reason: "unopenable" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(inner);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (typeof parsed.body !== "string" || typeof parsed.signature !== "string") {
+    return { ok: false, reason: "malformed" };
+  }
+  const body = Buffer.from(parsed.body, "base64url");
+  if (!verifyWith(input.senderIdentityPublic, body, parsed.signature)) {
+    return { ok: false, reason: "bad-signature" };
+  }
+  let claims;
+  try {
+    claims = JSON.parse(body.toString("utf8"));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (claims["jobId"] !== expected.jobId || claims["senderKeyId"] !== expected.senderKeyId || claims["recipientKeyId"] !== expected.recipientKeyId || claims["deadlineAt"] !== envelope.deadlineAt || claims["direction"] !== expected.direction) {
+    return { ok: false, reason: "context-mismatch" };
+  }
+  if (typeof claims["plaintext"] !== "string") {
+    return { ok: false, reason: "malformed" };
+  }
+  return { ok: true, plaintext: claims["plaintext"] };
+}
+
+// src/signing.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z7 } from "zod";
+var MAX_CLOCK_SKEW_MS = 12e4;
+var RequestSignature = z7.object({
+  /** Which runner is calling. The server looks up its pinned identity. */
+  runnerId: z7.string().min(1),
+  /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
+  issuedAt: z7.number().int().positive(),
+  /** Base64url Ed25519 signature over {@link canonicalRequest}. */
+  signature: z7.string().min(1)
+}).strict();
+function canonicalRequest(input) {
+  const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
+  return Buffer.from(
+    [
+      "byollm/v1/request",
+      input.endpoint,
+      input.runnerId,
+      String(input.issuedAt),
+      digest
+    ].join("\n"),
+    "utf8"
+  );
+}
+function signRequest(keys, input) {
+  return {
+    runnerId: input.runnerId,
+    issuedAt: input.issuedAt,
+    signature: signWith(keys, canonicalRequest(input))
+  };
+}
+function signSiteRequest(keys, input) {
+  return signRequest(keys, {
+    endpoint: siteEndpoint(input.endpoint),
+    runnerId: input.siteId,
+    issuedAt: input.issuedAt,
+    body: input.body
+  });
+}
+function verifySiteRequest(input) {
+  return verifyRequest({
+    ...input,
+    endpoint: siteEndpoint(input.endpoint)
+  });
+}
+var siteEndpoint = (endpoint) => `site/${endpoint}`;
+function verifyRequest(input) {
+  const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
+  if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
+  const ok = verifyWith(
+    input.identityPublic,
+    canonicalRequest({
+      endpoint: input.endpoint,
+      runnerId: input.signature.runnerId,
+      issuedAt: input.signature.issuedAt,
+      body: input.body
+    }),
+    input.signature.signature
+  );
+  return ok ? null : "bad-signature";
+}
 
 // src/musts.ts
 var must = (m) => Object.freeze(m);
@@ -247,31 +840,78 @@ var MUSTS = Object.freeze({
     id: "PAIR_ONE_USER",
     statement: "A runner token MUST be bound to exactly one user; a daemon MUST refuse work not attributable to its paired user.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   PAIR_INTERACTIVE: must({
     id: "PAIR_INTERACTIVE",
     statement: "Pairing MUST be interactive (device-code approval in the app's own session); a long-lived pasted secret MUST NOT be accepted as pairing.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.1"
   }),
   PAIR_CODE_EXPIRES: must({
     id: "PAIR_CODE_EXPIRES",
     statement: "An unapproved device code MUST expire and MUST NOT be redeemable after expiry.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.1"
   }),
   // ---- Typed job kinds --------------------------------------------------
+  VERSION_HANDSHAKE_REQUIRED: must({
+    id: "VERSION_HANDSHAKE_REQUIRED",
+    statement: "Every protocol request MUST declare a protocol version, and a server MUST refuse an absent or unsupported one with a structured error naming what it supports \u2014 never a generic parse failure.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74"
+  }),
+  KEYS_EXCHANGED_AT_CONSENT: must({
+    id: "KEYS_EXCHANGED_AT_CONSENT",
+    statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA75"
+  }),
+  REQUESTS_SIGNED_NOT_BEARER: must({
+    id: "REQUESTS_SIGNED_NOT_BEARER",
+    statement: "Every authenticated request MUST be signed by the calling device's pinned identity key, over the endpoint, the runner id, a timestamp and the exact request body. A server MUST NOT accept a bearer credential in place of a signature.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  LEASE_SCOPED_BY_GRANT: must({
+    id: "LEASE_SCOPED_BY_GRANT",
+    statement: "A lease-scoped request MUST name the lease it acts on, and a server MUST apply it only to that lease. Naming the job and the runner is not sufficient: both survive a claim-release-reclaim cycle.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  STUB_METADATA_EXHAUSTIVE: must({
+    id: "STUB_METADATA_EXHAUSTIVE",
+    statement: "A claim MUST answer with stubs carrying exactly the enumerated fields and no payload. An endpoint MUST NOT emit a stub carrying others, and an upstream MUST NOT require any.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
+  ENVELOPE_SEALED_AND_SIGNED: must({
+    id: "ENVELOPE_SEALED_AND_SIGNED",
+    statement: "A stored payload MUST be sealed, and MUST be signed by the sender's identity key. An endpoint MUST refuse an envelope whose signature does not verify against the identity it pinned.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
   KIND_TYPED_ONLY: must({
     id: "KIND_TYPED_ONLY",
     statement: "Job kinds MUST resolve against handlers baked into the daemon. A daemon MUST refuse an unknown kind rather than guess.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Jobs are typed data"
   }),
   KIND_NO_CODE: must({
     id: "KIND_NO_CODE",
     statement: "A server MUST NOT be able to convey code, a shell string, or a path to execute; payloads are data handed to a model only.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Jobs are typed data; byollm_004 \xA71"
   }),
   // ---- Capability and claiming -----------------------------------------
@@ -279,18 +919,21 @@ var MUSTS = Object.freeze({
     id: "CLAIM_REQUIRES_CAPABILITY",
     statement: "A daemon MUST NOT be given a job whose kind is absent from its advertised capability matrix.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   CAPABILITY_IS_DETECTED: must({
     id: "CAPABILITY_IS_DETECTED",
     statement: "An advertised capability matrix MUST be the intersection of owner config and detected, healthy reality \u2014 never config alone.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_002 \xA7Routing"
   }),
   CLAIM_ATOMIC: must({
     id: "CLAIM_ATOMIC",
     statement: "Claiming MUST be atomic: a job MUST NOT be handed to two runners concurrently.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.2"
   }),
   // ---- Leases -----------------------------------------------------------
@@ -298,12 +941,14 @@ var MUSTS = Object.freeze({
     id: "LEASE_HONORED",
     statement: "A daemon MUST stop work on a job whose lease it has failed to renew, and MUST NOT report a result for an expired lease it no longer holds.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   LEASE_RECLAIMABLE: must({
     id: "LEASE_RECLAIMABLE",
     statement: "A lease that expires un-renewed MUST make its job claimable again with no loss of the job.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.2"
   }),
   // ---- Audience and offer scope ----------------------------------------
@@ -311,24 +956,56 @@ var MUSTS = Object.freeze({
     id: "AUDIENCE_BOTH_SIDES",
     statement: "A job MUST run on a daemon only if the daemon's offer scope admits the job's owner AND the job's audience admits the daemon's owner.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7The audience model"
   }),
   SUBSCRIPTION_SELF_LOCK: must({
     id: "SUBSCRIPTION_SELF_LOCK",
     statement: "A subscription-class backend's offer scope MUST be 'self' and MUST NOT be widened by configuration.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7The audience model"
   }),
+  METERED_DEFAULTS_SELF: must({
+    id: "METERED_DEFAULTS_SELF",
+    statement: "A metered backend's effective offer scope MUST be 'self' unless the owner has explicitly acknowledged spending money on others' work.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA74"
+  }),
+  METERED_REQUIRES_CEILING: must({
+    id: "METERED_REQUIRES_CEILING",
+    statement: "A widened metered backend MUST carry a spend ceiling, and the daemon MUST refuse community work once it is reached.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA74"
+  }),
+  COST_NOT_CONFIGURABLE: must({
+    id: "COST_NOT_CONFIGURABLE",
+    statement: "A built-in provider's cost class MUST NOT be overridable by configuration.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA72"
+  }),
+  REMOTE_IS_NEVER_FREE: must({
+    id: "REMOTE_IS_NEVER_FREE",
+    statement: "A generic HTTP backend whose base URL is not loopback or private MUST be treated as metered.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA72"
+  }),
   NAMED_LOCAL_ALLOWLIST: must({
     id: "NAMED_LOCAL_ALLOWLIST",
     statement: "A 'named' job MUST be admitted only by the daemon's own local (server origin, user id) allowlist \u2014 never on the server's assertion alone.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B"
   }),
   REFUSAL_NOT_REOFFERED: must({
     id: "REFUSAL_NOT_REOFFERED",
     statement: "A server MUST NOT re-offer a job to a runner that released it with reason 'refused'.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B (loop resolved in build review)"
   }),
   // ---- Revocation and cancel -------------------------------------------
@@ -336,12 +1013,14 @@ var MUSTS = Object.freeze({
     id: "REVOCATION_HONORED",
     statement: "A revoked daemon MUST stop claiming and MUST abandon in-flight work by the next heartbeat at the latest.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   CANCEL_HONORED: must({
     id: "CANCEL_HONORED",
     statement: "A job id in a heartbeat response's cancel list MUST abort that job's in-flight backend call and be reported as 'canceled'.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7C"
   }),
   // ---- Lifecycle, dependencies, delivery -------------------------------
@@ -349,37 +1028,43 @@ var MUSTS = Object.freeze({
     id: "DEPENDS_ON_GATING",
     statement: "A job MUST NOT be claimable until every job in its dependsOn set has reached the 'ok' state.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7E"
   }),
   TTL_EXPIRY: must({
     id: "TTL_EXPIRY",
     statement: "An unclaimed job MUST become 'expired' once its TTL elapses, and the TTL clock MUST start when the job becomes claimable, not at enqueue.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7D (TTL clock resolved in build review)"
   }),
   NO_RUNNER_SIGNAL: must({
     id: "NO_RUNNER_SIGNAL",
     statement: "A server MUST surface noRunnerAvailable when no runner with matching capability has heartbeated within the liveness window, and MUST NOT raise it for a job still blocked on dependencies.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7D"
   }),
   RESULT_IDEMPOTENT: must({
     id: "RESULT_IDEMPOTENT",
     statement: "Result submission MUST be idempotent by job id; the first terminal outcome wins and later submissions MUST NOT change it.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.4"
   }),
-  RESULT_PROVENANCE: must({
-    id: "RESULT_PROVENANCE",
-    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
     enforcedBy: "server",
-    source: "byollm_003 Rev 1 \xA7Return-trip"
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
   }),
   // ---- The trust surface -------------------------------------------------
   INGRESS_LOGGED_BEFORE_EXECUTION: must({
     id: "INGRESS_LOGGED_BEFORE_EXECUTION",
     statement: "Every executed prompt MUST be appended to the local ingress log before execution begins.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   // ---- Execution isolation (byollm_004) ---------------------------------
@@ -387,178 +1072,420 @@ var MUSTS = Object.freeze({
     id: "NO_SHELL_INTERPOLATION",
     statement: "Process-class backends MUST be invoked with a fixed argv array and the payload delivered on stdin; payload text MUST NOT reach a command line.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   NO_PAYLOAD_ROUTING: must({
     id: "NO_PAYLOAD_ROUTING",
     statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   STRIPPED_CHILD_ENV: must({
     id: "STRIPPED_CHILD_ENV",
     statement: "Process-class children MUST spawn with an allowlisted environment, a scratch cwd, no inherited descriptors beyond std streams, and hard timeout and output-size caps.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   HTTP_BASE_URL_SAFE: must({
     id: "HTTP_BASE_URL_SAFE",
     statement: "HTTP-class backends MUST send requests only to the owner-configured base URL and MUST refuse base URLs resolving to cloud-metadata or link-local addresses.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 Rev 1 \xA7Backend taxonomy"
   }),
   OUTPUT_INERT: must({
     id: "OUTPUT_INERT",
     statement: "Returned text MUST be treated as inert bytes: never evaluated, never written to a payload-named path, never interpolated into a shell or into terminal control sequences when logged.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   COMMUNITY_BUDGETS: must({
     id: "COMMUNITY_BUDGETS",
     statement: "Jobs whose owner is not the daemon's owner MUST be subject to the owner's rate limits, daily cap, and resource budget.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
   })
 });
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
+});
 var MUST_IDS = Object.freeze(Object.keys(MUSTS));
+function mustsVerifiedBy(kind) {
+  return MUST_IDS.filter((id) => MUSTS[id].verifiedBy === kind);
+}
 
 // src/wire.ts
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 var PROTOCOL_VERSION = "0";
+var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
+  PROTOCOL_VERSION
+]);
+var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
+function checkProtocolVersion(body) {
+  const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
+  if (typeof declared !== "string" || declared.length === 0) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  return null;
+}
+var UPGRADE_COMMAND = "npm i -g byollm@latest";
 var PROTOCOL_PREFIX = "/byollm";
 var ENDPOINTS = Object.freeze([
   "pair",
   "claim",
+  "fetch",
   "heartbeat",
   "result",
   "release"
 ]);
-var Capability = z5.object({
+var Capability = z8.object({
   kind: JobKind,
   backendId: BackendIdSchema,
   backendClass: BackendClass,
-  model: z5.string().min(1),
+  model: z8.string().min(1),
   offerScope: OfferScope
 }).strict();
-var CapabilityMatrix = z5.array(Capability);
-var PairStartRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  action: z5.literal("start"),
-  daemon: z5.object({
-    version: z5.string().min(1),
+var CapabilityMatrix = z8.array(Capability);
+var PairStartRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  action: z8.literal("start"),
+  daemon: z8.object({
+    version: z8.string().min(1),
     /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z5.string().min(1).max(120),
-    platform: z5.enum(["darwin", "linux", "win32"])
+    label: z8.string().min(1).max(120),
+    platform: z8.enum(["darwin", "linux", "win32"])
   }),
+  /**
+   * This machine's public keys (byollm_009 §5).
+   *
+   * Pairing is where the two parties learn each other's identities, because
+   * it is the one moment a human is already deciding to trust: the approval
+   * click. A key exchanged anywhere else would be a key nobody chose.
+   */
+  device: PublicIdentity,
   capabilities: CapabilityMatrix
 }).strict();
-var PairStartResponse = z5.object({
+var PairStartResponse = z8.object({
   /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z5.string().min(20),
+  deviceCode: z8.string().min(20),
   /** Short code the user reads and confirms in the browser. */
-  userCode: z5.string().min(4).max(16),
+  userCode: z8.string().min(4).max(16),
   /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z5.url(),
+  verificationUrl: z8.url(),
   /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z5.number().int().positive(),
+  expiresAt: z8.number().int().positive(),
   /** How often the daemon may poll. */
-  pollIntervalMs: z5.number().int().min(500).max(6e4)
+  pollIntervalMs: z8.number().int().min(500).max(6e4)
 }).strict();
-var PairPollRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  action: z5.literal("poll"),
-  deviceCode: z5.string().min(20)
+var PairPollRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  action: z8.literal("poll"),
+  deviceCode: z8.string().min(20)
 }).strict();
-var PairPollResponse = z5.discriminatedUnion("status", [
-  z5.object({ status: z5.literal("pending") }).strict(),
-  z5.object({ status: z5.literal("denied") }).strict(),
-  z5.object({ status: z5.literal("expired") }).strict(),
-  z5.object({
-    status: z5.literal("approved"),
-    /** Bearer token for every later call. Scoped to exactly one user. */
-    runnerToken: z5.string().min(20),
-    runnerId: z5.string().min(1),
+var PairPollResponse = z8.discriminatedUnion("status", [
+  z8.object({ status: z8.literal("pending") }).strict(),
+  z8.object({ status: z8.literal("denied") }).strict(),
+  z8.object({ status: z8.literal("expired") }).strict(),
+  z8.object({
+    status: z8.literal("approved"),
+    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
+    //
+    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
+    // the daemon's pairings file, and then **never sent, never looked up
+    // and never compared**. `getRunnerByTokenHash` existed on both stores
+    // and was called by nothing but a test asserting it returns null.
+    //
+    // Not merely dead wire, which is what `audienceAllow` and
+    // `HeartbeatResponse.leases` were. This was a *secret*: minted,
+    // transmitted, and written to two disks at rest, for nothing. A
+    // credential with no purpose is a liability rather than clutter,
+    // because the only thing it can ever do is leak.
+    //
+    // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
+    // enforced — every authenticated call is signed by the device's pinned
+    // identity key. This removes the thing the MUST is named after.
+    runnerId: z8.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z5.string().min(1),
+    owner: z8.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z5.string().optional()
+    ownerLabel: z8.string().optional(),
+    /**
+     * The site's public keys, for the daemon to pin (byollm_009 §5).
+     *
+     * Returned only on approval — a pending or denied poll learns nothing,
+     * so an unapproved code cannot be used to enumerate a site's keys.
+     */
+    site: PublicIdentity
   }).strict()
 ]);
-var PairRequest = z5.discriminatedUnion("action", [
+var PairRequest = z8.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
+var ClaimRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z5.number().int().min(1).max(64)
+  max: z8.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z5.object({
-  jobs: z5.array(ClaimedJob),
+var ClaimResponse = z8.object({
+  /**
+   * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
+   * device claimed — see {@link JobStub} for the exhaustive metadata list.
+   */
+  jobs: z8.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z5.number().int().positive()
+  leaseMs: z8.number().int().positive()
 }).strict();
-var HeartbeatRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  daemonVersion: z5.string().min(1),
+var HeartbeatRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  daemonVersion: z8.string().min(1),
   capabilities: CapabilityMatrix,
-  /** Jobs this daemon believes it holds; the server renews their leases. */
-  activeJobIds: z5.array(z5.string().min(1)),
+  /**
+   * Leases this daemon believes it holds; the server renews exactly these.
+   *
+   * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
+   * grant the runner no longer holds — see {@link Lease.id}.
+   */
+  activeLeases: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  ),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z5.boolean()
+  paused: z8.boolean()
 }).strict();
-var HeartbeatResponse = z5.object({
+var HeartbeatResponse = z8.object({
   /** Once true, the daemon stops claiming and abandons in-flight work. */
-  revoked: z5.boolean(),
+  revoked: z8.boolean(),
   /**
    * Per-job cancel (byollm_001 Rev 1 §C). The daemon aborts these jobs'
    * in-flight backend calls and reports them `canceled`.
    */
-  cancel: z5.array(z5.string().min(1)),
-  /** Jobs whose leases were renewed, with their new expiry. */
-  leases: z5.array(
-    z5.object({
-      jobId: z5.string().min(1),
-      expiresAt: z5.number().int().positive()
-    }).strict()
-  ),
+  cancel: z8.array(z8.string().min(1)),
+  // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
+  //
+  // It carried "these leases were renewed, and here is the new expiry", and
+  // **no daemon ever read it.** A mutation returning an empty list while
+  // renewing correctly survived every test, which is what made it visible.
+  //
+  // It is neither a class nor membership, so Amendment A's rule does not
+  // decide it — the older test does: nothing reads it, so it is dead wire.
+  // §6's exhaustiveness is a commitment about what an upstream can see, and
+  // it applies to every message rather than only to the stub.
+  //
+  // `lost` is the actionable signal and always was: a daemon stops work on
+  // a lease it no longer holds. "Renewed" was the same question answered a
+  // second time, and a second answer can only agree or contradict.
+  //
+  // Renewal itself is untouched — the upstream still extends the grants a
+  // heartbeat names, which is what §0.6 fixed. What ended is telling the
+  // daemon about it in a field it ignored. If an upstream ever needs to
+  // push lease decisions, that is a new field with a reader, added on
+  // purpose.
   /**
    * Jobs the daemon thinks it holds but the server has reassigned or
    * expired. The daemon must stop work on these and not report results.
    */
-  lost: z5.array(z5.string().min(1)),
+  lost: z8.array(z8.string().min(1)),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z5.number().int().positive()
+  serverTime: z8.number().int().positive()
 }).strict();
-var ResultRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  jobId: z5.string().min(1),
-  outcome: JobOutcome,
-  /** Which model actually served it, for the result's provenance. */
-  model: z5.string().min(1),
-  backendClass: BackendClass,
-  /** Wall-clock milliseconds the backend call took. */
-  durationMs: z5.number().int().nonnegative()
+var ResultDisposition = z8.enum(["ok", "error", "canceled"]);
+var ResultRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  jobId: z8.string().min(1),
+  /**
+   * The grant this result was produced under — cloud_008 §1.4a.
+   *
+   * `fetch` has always named its lease, with the reasoning written beside
+   * it: a request that names only the job would be answerable for whatever
+   * lease exists when it arrives. **The operation that writes the result did
+   * not**, on either plane, and checked only the runner id — which survives
+   * a claim-release-reclaim cycle, so a device whose grant had been swept
+   * and reissued could still land a result for a job it no longer held.
+   *
+   * Found by tracing a mutation that survived in §0.6: the lease lapsed, the
+   * sweep requeued, the daemon re-claimed under a new grant, and the
+   * original run finished and posted anyway. The relay marked the job done
+   * with a result the site cannot open — it verifies the envelope against
+   * the *current* holder's device, so the crypto contains the substitution —
+   * and then refused the real holder's result as a replay. A lost job, in
+   * silence.
+   *
+   * `LEASE_HONORED` is a statement about a lease *instance*. That was
+   * learned once already, when a replayed release yanked a later grant, and
+   * it applies here for the same reason.
+   */
+  leaseId: z8.string().min(1),
+  /**
+   * The outcome, sealed to the site and signed by the device.
+   *
+   * The return leg of the payload envelope, and sealed for the same reason:
+   * a model's answer is as sensitive as the prompt that produced it, and an
+   * intermediary that cannot read one must not be handed the other.
+   */
+  envelope: SealedEnvelope,
+  /**
+   * The sealed outcome's discriminator, in the clear.
+   *
+   * Checked against the envelope once opened. It is a routing hint, not a
+   * fact: believing it unverified would let a daemon mark a job `ok` while
+   * sealing an error, and only the app would ever find out.
+   */
+  disposition: ResultDisposition
+  // `model`, `backendClass` and `durationMs` are **inside the envelope** —
+  // cloud_008 §2.5. See {@link RunMetadata}.
+  //
+  // They were here, in the clear, and that was two problems wearing one
+  // coat. On the direct plane the site recorded unauthenticated fields
+  // beside an authenticated answer: a daemon could seal one result and
+  // declare a different model, and only the unsigned half would reach the
+  // app. Through a relay they reached a third party that acts on none of
+  // them — `model` in particular being the sort of detail Amendment A's
+  // rule keeps off the wire.
+  //
+  // `disposition` stays, and the difference is the test: a relay *routes*
+  // on it, so it is a class a routing party consumes. Nobody between the
+  // two ends consumes these.
 }).strict();
-var ResultResponse = z5.object({
+var ResultResponse = z8.object({
   /**
-   * False when the submission lost an idempotency race or the lease was
-   * already gone — the daemon should discard, not retry
-   * ({@link MUSTS.RESULT_IDEMPOTENT}).
+   * False when this submission wrote nothing — the daemon should discard,
+   * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z5.boolean(),
+  accepted: z8.boolean(),
+  /**
+   * True when this device had already recorded this job's result.
+   *
+   * The difference between "already recorded" and "you no longer hold this"
+   * — cloud_008 §3.6. A daemon whose acknowledgment was lost is in the first
+   * case and needs to hear it: its answer is safely on disk. Reporting a
+   * stale lease instead invents a worry about a result that is already
+   * stored, and sends its owner looking for a routing problem.
+   *
+   * Set only for the device that finished the job. A different device gets
+   * the same refusal it would get for a job that is *not* terminal, so a job
+   * id cannot be used as a terminality probe.
+   */
+  duplicate: z8.boolean().optional(),
   /** The job's state after this submission. */
-  state: z5.string().min(1)
+  state: z8.string().min(1)
 }).strict();
-var ReleaseRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  jobIds: z5.array(z5.string().min(1)),
+var ReleaseRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  /**
+   * Which leases to release — the grant, not just the job.
+   *
+   * A release naming only a job id releases whatever lease exists at the
+   * moment it arrives, which for a replayed request is not the lease the
+   * daemon meant. See {@link Lease.id}.
+   */
+  leases: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  ),
   /**
    * Why, so the app's runner list can say something true.
    *
@@ -568,42 +1495,129 @@ var ReleaseRequest = z5.object({
    * stop offering that job to that runner, or the pair would spin between
    * claim and release forever.
    */
-  reason: z5.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  reason: z8.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseResponse = z5.object({
-  released: z5.array(z5.string().min(1))
+var ReleaseResponse = z8.object({
+  released: z8.array(z8.string().min(1))
 }).strict();
-var WireErrorCode = z5.enum([
+var WireErrorCode = z8.enum([
   "bad-request",
   "unsupported-protocol-version",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
   "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
   "revoked",
   "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
   "rate-limited",
   "server-error"
 ]);
-var WireError = z5.object({
+var WireError = z8.object({
   error: WireErrorCode,
-  message: z5.string().min(1),
+  message: z8.string().min(1),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z5.number().int().nonnegative().optional()
-}).strict();
+  retryAfter: z8.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z8.number().int().positive().optional(),
+  maxSkewMs: z8.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+});
 var ERROR_STATUS = Object.freeze({
   "bad-request": 400,
   "unsupported-protocol-version": 400,
   unauthorized: 401,
+  forbidden: 403,
   revoked: 403,
   "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
   "rate-limited": 429,
   "server-error": 500
 });
+var FetchRequest = z8.object({
+  protocolVersion: z8.string().min(1),
+  runnerId: z8.string().min(1),
+  jobId: z8.string().min(1),
+  /**
+   * The grant this daemon holds.
+   *
+   * Named, not inferred: a fetch is lease-scoped, and a request that names
+   * only the job would be answerable for whatever lease exists when it
+   * arrives ({@link Lease.id}).
+   */
+  leaseId: z8.string().min(1)
+}).strict();
+var FetchResponse = z8.object({
+  /**
+   * The work, sealed to the device that claimed it — byollm_009 §6.
+   *
+   * Not plaintext. The site opens its own at-rest envelope and re-seals to
+   * the claiming device's key, signed by the site's identity, so the work
+   * is readable only by the machine that took it and only if it came from
+   * the site that machine pinned.
+   */
+  envelope: SealedEnvelope
+}).strict();
 export {
   AUDIENCES,
   Audience,
   BACKENDS,
   BACKEND_IDS,
-  BackendAccount,
   BackendClass,
+  BackendCost,
   BackendIdSchema,
   Capability,
   CapabilityMatrix,
@@ -612,9 +1626,14 @@ export {
   ClaimRequest,
   ClaimResponse,
   ClaimedJob,
+  ClaimedStub,
   DeliveredResult,
   ENDPOINTS,
+  ENVELOPE_MAX_AGE_MS,
   ERROR_STATUS,
+  EnvelopeDirection,
+  FetchRequest,
+  FetchResponse,
   GeneratePayload,
   HeartbeatRequest,
   HeartbeatResponse,
@@ -626,8 +1645,11 @@ export {
   JobResultError,
   JobResultOk,
   JobState,
+  JobStub,
   KindedPayload,
   Lease,
+  MAX_CLOCK_SKEW_MS,
+  MIN_PROTOCOL_VERSION,
   MUSTS,
   MUST_IDS,
   MatchRefusal,
@@ -641,23 +1663,54 @@ export {
   PairRequest,
   PairStartRequest,
   PairStartResponse,
+  PublicIdentity,
   REFUSAL_MESSAGES,
   ReleaseRequest,
   ReleaseResponse,
+  RequestSignature,
+  ResultDisposition,
   ResultProvenance,
   ResultRequest,
   ResultResponse,
+  RunMetadata,
+  SIZE_CLASS_LIMITS,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  SealedEnvelope,
+  SealedOutcome,
+  SizeClass,
+  StoredKeys,
   TERMINAL_STATES,
   WireError,
   WireErrorCode,
   backendDescriptor,
   canTransition,
+  canonicalRequest,
+  checkProtocolVersion,
+  cryptoReady,
   effectiveOfferScope,
+  fingerprint,
+  generateKeys,
   isBackendId,
   isJobKind,
+  isLocalHost,
   isTerminal,
+  keyId,
   matchAudience,
+  mustsVerifiedBy,
+  open,
   payloadTextLength,
-  provenanceFor
+  provenanceFor,
+  publicIdentityOf,
+  resolveCost,
+  seal,
+  signRequest,
+  signSiteRequest,
+  signWith,
+  sizeClassCeiling,
+  sizeClassOf,
+  verifyPublicIdentity,
+  verifyRequest,
+  verifySiteRequest,
+  verifyWith
 };
 //# sourceMappingURL=index.js.map