@byollm/protocol 0.1.0-alpha.3 → 0.1.0-alpha.30

package/dist/index.js

@@ -2,6 +2,7 @@
 import { z as z2 } from "zod";
 
 // src/backends.ts
+import { isIP } from "net";
 import { z } from "zod";
 var BackendClass = z.enum(["http", "process"]);
 var BackendCost = z.enum(["free", "metered", "subscription"]);
@@ -177,13 +178,16 @@ function backendDescriptor(id) {
 function isLocalHost(hostname) {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
   if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (host === "::1") return true;
+  const version = isIP(host);
+  if (version === 0) return false;
+  if (version === 6) {
+    if (host === "::1") return true;
+    return /^f[cd]/.test(host);
+  }
   if (host.startsWith("127.")) return true;
   if (host.startsWith("10.")) return true;
   if (host.startsWith("192.168.")) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (/^f[cd]/.test(host)) return true;
-  return false;
+  return /^172\.(1[6-9]|2\d|3[01])\./.test(host);
 }
 function resolveCost(id, baseUrl) {
   const declared = BACKENDS[id].cost;
@@ -290,11 +294,21 @@ var ChatMessage = z3.object({
 var GeneratePayload = z3.object({
   prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.prompt.length + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var ChatPayload = z3.object({
   messages: z3.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.messages.reduce((sum, m) => sum + m.content.length, 0) + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var JobKind = z3.enum(["llm.generate", "llm.chat"]);
 var JOB_KINDS = Object.freeze(JobKind.options);
 var KindedPayload = z3.discriminatedUnion("kind", [
@@ -350,6 +364,21 @@ function canTransition(from, to) {
   return TRANSITIONS[from].includes(to);
 }
 var Lease = z4.object({
+  /**
+   * Identifies *this* grant, not just its holder.
+   *
+   * A runner can hold a job, release it, and claim it again — three leases,
+   * one runner id. Without an id for the grant itself, a lease-scoped request
+   * names a mutable target ambiguously, and a replayed release from the first
+   * grant lands on the third: the job returns to the queue while the daemon
+   * is mid-execution, and the work runs twice on the owner's hardware.
+   *
+   * That was a live hole, found in review after signed requests shipped. The
+   * signature scheme's replay argument rests on endpoints being idempotent —
+   * and release *is*, per lease, but not across leases, because nothing in
+   * the request said which one.
+   */
+  id: z4.string().min(1),
   /** The runner holding the lease. */
   runnerId: z4.string().min(1),
   /** Epoch milliseconds after which the claim is void. */
@@ -363,8 +392,19 @@ var ClaimedJob = z4.object({
   audience: Audience,
   /** The app's id for the user who enqueued it. */
   owner: z4.string().min(1),
-  /** Runner owners the app restricted a `named` job to, if any. */
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
+  /**
+   * Which site's job — V1-3.
+   *
+   * The stub has always carried it; the opened job did not, so everything
+   * downstream of the payload — the ingress line above all — recorded a job
+   * id that belongs to a site without saying which. Two sites can choose
+   * the same id, and the meter is the product.
+   *
+   * Optional so a caller assembling a job by hand is not forced to invent
+   * one, and so this reads as what it is: a fact about where the work came
+   * from, not a second copy of the routing key.
+   */
+  site: z4.string().min(1).optional(),
   lease: Lease
 }).strict();
 var ResultProvenance = z4.object({
@@ -394,6 +434,13 @@ function provenanceFor(input) {
     untrusted: input.audience !== "self"
   };
 }
+var RunMetadata = z4.object({
+  /** Which model actually served it. */
+  model: z4.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z4.number().int().nonnegative()
+}).strict();
 var JobResultOk = z4.object({
   outcome: z4.literal("ok"),
   text: z4.string(),
@@ -415,14 +462,403 @@ var JobOutcome = z4.discriminatedUnion("outcome", [
   JobResultError,
   JobResultCanceled
 ]);
+var SealedOutcome = z4.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
 var DeliveredResult = z4.object({
   jobId: z4.string().min(1),
   state: JobState,
   outcome: JobOutcome.optional(),
   provenance: ResultProvenance.optional()
 }).strict();
+var SizeClass = z4.enum(["small", "medium", "large", "unbounded"]);
+var SIZE_CLASS_LIMITS = Object.freeze({
+  small: 4e3,
+  medium: 64e3,
+  large: Number.POSITIVE_INFINITY
+});
+function sizeClassCeiling(sizeClass) {
+  if (sizeClass === "unbounded") return Number.POSITIVE_INFINITY;
+  return SIZE_CLASS_LIMITS[sizeClass];
+}
+function sizeClassOf(textChars) {
+  if (textChars <= SIZE_CLASS_LIMITS.small) return "small";
+  if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
+  return "large";
+}
+var JobStub = z4.object({
+  id: z4.string().min(1),
+  kind: JobKind,
+  /** The app's id for the user who enqueued it. */
+  owner: z4.string().min(1),
+  /**
+   * Which site this job belongs to — byollm_009 Amendment A §A.3.
+   *
+   * **The site's identity key id**, not an id somebody assigned it. §6 has
+   * listed `site` since this spec was frozen; the schema never carried it,
+   * which is the drift the amendment closes.
+   *
+   * A key id rather than an opaque handle for one reason above the others:
+   * it makes the stub *self-describing* instead of a pointer into somebody
+   * else's table. A daemon holds this key id already, from pinning, so it
+   * can check `stub.site` against the payload envelope's `senderKeyId`
+   * without a lookup and without trusting the party that routed it. An
+   * opaque id can only be believed.
+   *
+   * It also avoids inventing a second namespace for a thing that has a
+   * canonical one — the shape of finding 41 (two owner namespaces compared
+   * for equality) and of finding fourteen before it.
+   *
+   * Rotation is a designed transition rather than a cost: a site publishes a
+   * new identity signed by the outgoing one, both are valid through an
+   * overlap window, and a daemon re-keys its own map by verifying that
+   * signature against the key it already pinned (§A.3.1).
+   */
+  site: z4.string().min(1),
+  audience: Audience,
+  // `audienceAllow` is **not** here, and its absence is the enforcement —
+  // cloud_008 §0.2.
+  //
+  // It was a list of the people who may run a job, travelling to every
+  // routing party on every `named` job. byollm_001 Rev 1 §B settled who
+  // decides that long before this schema existed: *the daemon's own list
+  // decides, not the server's*, and `allowlist.predicateFor(origin)` is the
+  // enforcement in both lanes. So this was a second answer to a question the
+  // daemon already owned — able only to agree, in which case it was
+  // redundant, or to disagree, in which case nothing said which wins.
+  //
+  // The rule it leaves behind, which decides the next field too: **a class
+  // the router acts on may travel; membership never does.** `audience` stays
+  // for exactly that reason — the relay narrows on it. A roster does not
+  // travel, so `ROSTER_NOT_DISCLOSED` holds here by absence, which is the
+  // strongest way for a MUST to hold.
+  //
+  // The site keeps its own copy on `JobRecord` and still filters candidates
+  // with it before offering. That is server-internal, where the party
+  // holding the list authored it.
+  sizeClass: SizeClass,
+  /** Reserved for byollm_006. False until streaming exists. */
+  streaming: z4.boolean(),
+  /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
+  deadlineAt: z4.number().int().positive()
+}).strict();
+var ClaimedStub = JobStub.extend({ lease: Lease }).strict();
+
+// src/envelope.ts
+import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
+import sodium from "libsodium-wrappers";
+import { z as z6 } from "zod";
+
+// src/keys.ts
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify
+} from "crypto";
+import { z as z5 } from "zod";
+var PublicIdentity = z5.object({
+  /** Raw Ed25519 public key. The pinned one. */
+  identity: z5.string().min(1),
+  /** Raw X25519 public key, for sealing to this party. */
+  encryption: z5.string().min(1),
+  /**
+   * Ed25519 signature over the encryption key, by the identity key.
+   *
+   * This is what stops an upstream substituting an encryption key of its
+   * own while relaying a genuine identity: the receiver pins the identity
+   * and refuses any encryption key not signed by it.
+   */
+  encryptionSig: z5.string().min(1)
+}).strict();
+var StoredKeys = z5.object({
+  version: z5.literal(1),
+  identityPublic: z5.string().min(1),
+  identityPrivate: z5.string().min(1),
+  encryptionPublic: z5.string().min(1),
+  encryptionPrivate: z5.string().min(1),
+  encryptionSig: z5.string().min(1),
+  createdAt: z5.number().int().positive()
+}).strict();
+var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
+function rawPublic(key) {
+  const jwk = key.export({ format: "jwk" });
+  const x = jwk.x;
+  if (typeof x !== "string") throw new Error("key has no raw public component");
+  return x;
+}
+function importPublic(raw, crv) {
+  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
+}
+function importPrivate(stored) {
+  return createPrivateKey({
+    key: Buffer.from(stored, "base64"),
+    type: "pkcs8",
+    format: "der"
+  });
+}
+var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
+function generateKeys(now) {
+  const identity = generateKeyPairSync("ed25519");
+  const encryption = generateKeyPairSync("x25519");
+  const encryptionPublic = rawPublic(encryption.publicKey);
+  return {
+    version: 1,
+    identityPublic: rawPublic(identity.publicKey),
+    identityPrivate: exportPrivate(identity.privateKey),
+    encryptionPublic,
+    encryptionPrivate: exportPrivate(encryption.privateKey),
+    encryptionSig: sign(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
+      identity.privateKey
+    ).toString("base64url"),
+    createdAt: now
+  };
+}
+function publicIdentityOf(keys) {
+  return {
+    identity: keys.identityPublic,
+    encryption: keys.encryptionPublic,
+    encryptionSig: keys.encryptionSig
+  };
+}
+function verifyPublicIdentity(identity) {
+  try {
+    return verify(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
+      importPublic(identity.identity, "Ed25519"),
+      Buffer.from(identity.encryptionSig, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
+    "base64url"
+  );
+}
+function verifyWith(identityPublic, data, signature) {
+  try {
+    return verify(
+      null,
+      data,
+      importPublic(identityPublic, "Ed25519"),
+      Buffer.from(signature, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function fingerprint(identityPublic) {
+  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of digest.subarray(0, 15)) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET.charAt(value >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  const groups = out.match(/.{1,4}/g) ?? [];
+  return `BYOLLM-${groups.join("-")}`;
+}
+var keyId = (identityPublic) => fingerprint(identityPublic);
+
+// src/envelope.ts
+var readied;
+async function cryptoReady() {
+  readied ??= sodium.ready;
+  await readied;
+}
+var ENVELOPE_MAX_AGE_MS = 24 * 60 * 6e4;
+var EnvelopeDirection = z6.enum(["payload", "result"]);
+var SealedEnvelope = z6.object({
+  /** Base64url `crypto_box_seal` output over the signed plaintext. */
+  ciphertext: z6.string().min(1),
+  /** Who this was sealed to — the recipient checks it is them. */
+  recipientKeyId: z6.string().min(1),
+  /** Who signed it — the recipient checks this against its pin. */
+  senderKeyId: z6.string().min(1),
+  direction: EnvelopeDirection,
+  /**
+   * When this ciphertext stops being worth keeping.
+   *
+   * Carried *on* the envelope rather than recomputed by the opener. An
+   * earlier version derived it from the job's creation time, which meant
+   * two systems had to agree on a timestamp to the millisecond — and they
+   * did not, once a real database rounded it. A bound value that has to be
+   * reconstructed is a bound value that eventually is not.
+   *
+   * Not trusted as written: it is also inside the signature, so a changed
+   * deadline fails to verify.
+   */
+  deadlineAt: z6.number().int().positive()
+}).strict();
+function signedBody(context, plaintext) {
+  return Buffer.from(
+    JSON.stringify({
+      v: "byollm/v1/envelope",
+      jobId: context.jobId,
+      senderKeyId: context.senderKeyId,
+      recipientKeyId: context.recipientKeyId,
+      deadlineAt: context.deadlineAt,
+      direction: context.direction,
+      plaintext
+    }),
+    "utf8"
+  );
+}
+var rawX25519 = (key, part) => {
+  const jwk = key.export({ format: "jwk" });
+  const value = part === "x" ? jwk.x : jwk.d;
+  if (typeof value !== "string") throw new Error("not an X25519 key");
+  return new Uint8Array(Buffer.from(value, "base64url"));
+};
+async function seal(input) {
+  await cryptoReady();
+  const body = signedBody(input.context, input.plaintext);
+  const signature = signWith(input.senderKeys, body);
+  const inner = JSON.stringify({ body: body.toString("base64url"), signature });
+  const recipient = new Uint8Array(
+    Buffer.from(input.recipientEncryptionPublic, "base64url")
+  );
+  const ciphertext = sodium.crypto_box_seal(
+    new Uint8Array(Buffer.from(inner, "utf8")),
+    recipient
+  );
+  return {
+    ciphertext: Buffer.from(ciphertext).toString("base64url"),
+    recipientKeyId: input.context.recipientKeyId,
+    senderKeyId: input.context.senderKeyId,
+    direction: input.context.direction,
+    deadlineAt: input.context.deadlineAt
+  };
+}
+async function open(input) {
+  await cryptoReady();
+  const { envelope, expected } = input;
+  if (envelope.recipientKeyId !== expected.recipientKeyId || envelope.senderKeyId !== expected.senderKeyId || envelope.direction !== expected.direction) {
+    return { ok: false, reason: "not-for-us" };
+  }
+  let inner;
+  try {
+    const priv = createPrivateKey2({
+      key: Buffer.from(input.recipientKeys.encryptionPrivate, "base64"),
+      type: "pkcs8",
+      format: "der"
+    });
+    const pub = createPublicKey2(priv);
+    const opened = sodium.crypto_box_seal_open(
+      new Uint8Array(Buffer.from(envelope.ciphertext, "base64url")),
+      rawX25519(pub, "x"),
+      rawX25519(priv, "d")
+    );
+    inner = Buffer.from(opened).toString("utf8");
+  } catch {
+    return { ok: false, reason: "unopenable" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(inner);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (typeof parsed.body !== "string" || typeof parsed.signature !== "string") {
+    return { ok: false, reason: "malformed" };
+  }
+  const body = Buffer.from(parsed.body, "base64url");
+  if (!verifyWith(input.senderIdentityPublic, body, parsed.signature)) {
+    return { ok: false, reason: "bad-signature" };
+  }
+  let claims;
+  try {
+    claims = JSON.parse(body.toString("utf8"));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (claims["jobId"] !== expected.jobId || claims["senderKeyId"] !== expected.senderKeyId || claims["recipientKeyId"] !== expected.recipientKeyId || claims["deadlineAt"] !== envelope.deadlineAt || claims["direction"] !== expected.direction) {
+    return { ok: false, reason: "context-mismatch" };
+  }
+  if (typeof claims["plaintext"] !== "string") {
+    return { ok: false, reason: "malformed" };
+  }
+  return { ok: true, plaintext: claims["plaintext"] };
+}
+
+// src/signing.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z7 } from "zod";
+var MAX_CLOCK_SKEW_MS = 12e4;
+var RequestSignature = z7.object({
+  /** Which runner is calling. The server looks up its pinned identity. */
+  runnerId: z7.string().min(1),
+  /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
+  issuedAt: z7.number().int().positive(),
+  /** Base64url Ed25519 signature over {@link canonicalRequest}. */
+  signature: z7.string().min(1)
+}).strict();
+function canonicalRequest(input) {
+  const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
+  return Buffer.from(
+    [
+      "byollm/v1/request",
+      input.endpoint,
+      input.runnerId,
+      String(input.issuedAt),
+      digest
+    ].join("\n"),
+    "utf8"
+  );
+}
+function signRequest(keys, input) {
+  return {
+    runnerId: input.runnerId,
+    issuedAt: input.issuedAt,
+    signature: signWith(keys, canonicalRequest(input))
+  };
+}
+function signSiteRequest(keys, input) {
+  return signRequest(keys, {
+    endpoint: siteEndpoint(input.endpoint),
+    runnerId: input.siteId,
+    issuedAt: input.issuedAt,
+    body: input.body
+  });
+}
+function verifySiteRequest(input) {
+  return verifyRequest({
+    ...input,
+    endpoint: siteEndpoint(input.endpoint)
+  });
+}
+var siteEndpoint = (endpoint) => `site/${endpoint}`;
+function verifyRequest(input) {
+  const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
+  if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
+  const ok = verifyWith(
+    input.identityPublic,
+    canonicalRequest({
+      endpoint: input.endpoint,
+      runnerId: input.signature.runnerId,
+      issuedAt: input.signature.issuedAt,
+      body: input.body
+    }),
+    input.signature.signature
+  );
+  return ok ? null : "bad-signature";
+}
 
 // src/musts.ts
+function kindsOf(must2) {
+  return typeof must2.verifiedBy === "string" ? [must2.verifiedBy] : must2.verifiedBy;
+}
 var must = (m) => Object.freeze(m);
 var MUSTS = Object.freeze({
   // ---- Pairing and identity -------------------------------------------
@@ -430,31 +866,108 @@ var MUSTS = Object.freeze({
     id: "PAIR_ONE_USER",
     statement: "A runner token MUST be bound to exactly one user; a daemon MUST refuse work not attributable to its paired user.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   PAIR_INTERACTIVE: must({
     id: "PAIR_INTERACTIVE",
     statement: "Pairing MUST be interactive (device-code approval in the app's own session); a long-lived pasted secret MUST NOT be accepted as pairing.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.1"
   }),
   PAIR_CODE_EXPIRES: must({
     id: "PAIR_CODE_EXPIRES",
     statement: "An unapproved device code MUST expire and MUST NOT be redeemable after expiry.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.1"
   }),
   // ---- Typed job kinds --------------------------------------------------
+  VERSION_HANDSHAKE_REQUIRED: must({
+    id: "VERSION_HANDSHAKE_REQUIRED",
+    statement: "Every protocol request MUST declare a protocol version, and a server MUST refuse an absent or unsupported one with a structured error naming what it supports \u2014 never a generic parse failure.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74"
+  }),
+  SITE_KEY_BY_STUB: must({
+    id: "SITE_KEY_BY_STUB",
+    statement: "A daemon MUST verify a job's payload against the pinned key of the site the stub names, and MUST refuse a job naming a site it has not pinned. It MUST NOT fall back to another pinned key, and MUST refuse an envelope whose declared sender disagrees with the stub's site.",
+    enforcedBy: "daemon",
+    // Adversarial, and the reason is the finding that produced it: the
+    // honest paths pass with every site check deleted, because `open`
+    // refuses a signature from the wrong key anyway. What distinguishes an
+    // enforced rule from a coincidence here is a hostile pairing of stub and
+    // envelope, which no conformance client would ever send.
+    verifiedBy: "adversarial",
+    source: "byollm_009 \xA7A.3"
+  }),
+  SITES_LOCALLY_APPROVED: must({
+    id: "SITES_LOCALLY_APPROVED",
+    statement: "A daemon MUST NOT run work for a site it has not approved on the machine itself. An upstream may propose a site set; a site the daemon has never approved MUST be offered to its owner and served nothing until they approve it. A key that has changed for an already-approved id MUST be refused for the life of the pairing, including after that id has left the set and returned.",
+    enforcedBy: "daemon",
+    // Two kinds, and the second is the one that matters — V1-1.
+    //
+    // `construction`: the daemon cannot serve a site that is not in its
+    // pinned map, and admission refuses before a payload is fetched, so the
+    // ordinary path cannot reach a site nobody approved.
+    //
+    // `adversarial`: the property that survives is about a *sequence* —
+    // remove the id, re-offer it under a different key — which no honest
+    // upstream sends and which the fence above does not see. That was the
+    // bypass: the pin was deleted with the id, so the comparison had nothing
+    // to compare against and the substitution arrived as a stranger.
+    verifiedBy: ["construction", "adversarial"],
+    source: "byollm_009 \xA7B.2"
+  }),
+  KEYS_EXCHANGED_AT_CONSENT: must({
+    id: "KEYS_EXCHANGED_AT_CONSENT",
+    statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA75"
+  }),
+  REQUESTS_SIGNED_NOT_BEARER: must({
+    id: "REQUESTS_SIGNED_NOT_BEARER",
+    statement: "Every authenticated request MUST be signed by the calling device's pinned identity key, over the endpoint, the runner id, a timestamp and the exact request body. A server MUST NOT accept a bearer credential in place of a signature.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  LEASE_SCOPED_BY_GRANT: must({
+    id: "LEASE_SCOPED_BY_GRANT",
+    statement: "A lease-scoped request MUST name the lease it acts on, and a server MUST apply it only to that lease. Naming the job and the runner is not sufficient: both survive a claim-release-reclaim cycle.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  STUB_METADATA_EXHAUSTIVE: must({
+    id: "STUB_METADATA_EXHAUSTIVE",
+    statement: "A claim MUST answer with stubs carrying exactly the enumerated fields and no payload. An endpoint MUST NOT emit a stub carrying others, and an upstream MUST NOT require any.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
+  ENVELOPE_SEALED_AND_SIGNED: must({
+    id: "ENVELOPE_SEALED_AND_SIGNED",
+    statement: "A stored payload MUST be sealed, and MUST be signed by the sender's identity key. An endpoint MUST refuse an envelope whose signature does not verify against the identity it pinned.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
   KIND_TYPED_ONLY: must({
     id: "KIND_TYPED_ONLY",
     statement: "Job kinds MUST resolve against handlers baked into the daemon. A daemon MUST refuse an unknown kind rather than guess.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Jobs are typed data"
   }),
   KIND_NO_CODE: must({
     id: "KIND_NO_CODE",
     statement: "A server MUST NOT be able to convey code, a shell string, or a path to execute; payloads are data handed to a model only.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Jobs are typed data; byollm_004 \xA71"
   }),
   // ---- Capability and claiming -----------------------------------------
@@ -462,18 +975,21 @@ var MUSTS = Object.freeze({
     id: "CLAIM_REQUIRES_CAPABILITY",
     statement: "A daemon MUST NOT be given a job whose kind is absent from its advertised capability matrix.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   CAPABILITY_IS_DETECTED: must({
     id: "CAPABILITY_IS_DETECTED",
     statement: "An advertised capability matrix MUST be the intersection of owner config and detected, healthy reality \u2014 never config alone.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_002 \xA7Routing"
   }),
   CLAIM_ATOMIC: must({
     id: "CLAIM_ATOMIC",
     statement: "Claiming MUST be atomic: a job MUST NOT be handed to two runners concurrently.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.2"
   }),
   // ---- Leases -----------------------------------------------------------
@@ -481,12 +997,14 @@ var MUSTS = Object.freeze({
     id: "LEASE_HONORED",
     statement: "A daemon MUST stop work on a job whose lease it has failed to renew, and MUST NOT report a result for an expired lease it no longer holds.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   LEASE_RECLAIMABLE: must({
     id: "LEASE_RECLAIMABLE",
     statement: "A lease that expires un-renewed MUST make its job claimable again with no loss of the job.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.2"
   }),
   // ---- Audience and offer scope ----------------------------------------
@@ -494,48 +1012,56 @@ var MUSTS = Object.freeze({
     id: "AUDIENCE_BOTH_SIDES",
     statement: "A job MUST run on a daemon only if the daemon's offer scope admits the job's owner AND the job's audience admits the daemon's owner.",
     enforcedBy: "both",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7The audience model"
   }),
   SUBSCRIPTION_SELF_LOCK: must({
     id: "SUBSCRIPTION_SELF_LOCK",
     statement: "A subscription-class backend's offer scope MUST be 'self' and MUST NOT be widened by configuration.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7The audience model"
   }),
   METERED_DEFAULTS_SELF: must({
     id: "METERED_DEFAULTS_SELF",
     statement: "A metered backend's effective offer scope MUST be 'self' unless the owner has explicitly acknowledged spending money on others' work.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_007 \xA74"
   }),
   METERED_REQUIRES_CEILING: must({
     id: "METERED_REQUIRES_CEILING",
     statement: "A widened metered backend MUST carry a spend ceiling, and the daemon MUST refuse community work once it is reached.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_007 \xA74"
   }),
   COST_NOT_CONFIGURABLE: must({
     id: "COST_NOT_CONFIGURABLE",
     statement: "A built-in provider's cost class MUST NOT be overridable by configuration.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_007 \xA72"
   }),
   REMOTE_IS_NEVER_FREE: must({
     id: "REMOTE_IS_NEVER_FREE",
     statement: "A generic HTTP backend whose base URL is not loopback or private MUST be treated as metered.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_007 \xA72"
   }),
   NAMED_LOCAL_ALLOWLIST: must({
     id: "NAMED_LOCAL_ALLOWLIST",
     statement: "A 'named' job MUST be admitted only by the daemon's own local (server origin, user id) allowlist \u2014 never on the server's assertion alone.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B"
   }),
   REFUSAL_NOT_REOFFERED: must({
     id: "REFUSAL_NOT_REOFFERED",
     statement: "A server MUST NOT re-offer a job to a runner that released it with reason 'refused'.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B (loop resolved in build review)"
   }),
   // ---- Revocation and cancel -------------------------------------------
@@ -543,12 +1069,14 @@ var MUSTS = Object.freeze({
     id: "REVOCATION_HONORED",
     statement: "A revoked daemon MUST stop claiming and MUST abandon in-flight work by the next heartbeat at the latest.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   CANCEL_HONORED: must({
     id: "CANCEL_HONORED",
     statement: "A job id in a heartbeat response's cancel list MUST abort that job's in-flight backend call and be reported as 'canceled'.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7C"
   }),
   // ---- Lifecycle, dependencies, delivery -------------------------------
@@ -556,37 +1084,43 @@ var MUSTS = Object.freeze({
     id: "DEPENDS_ON_GATING",
     statement: "A job MUST NOT be claimable until every job in its dependsOn set has reached the 'ok' state.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7E"
   }),
   TTL_EXPIRY: must({
     id: "TTL_EXPIRY",
     statement: "An unclaimed job MUST become 'expired' once its TTL elapses, and the TTL clock MUST start when the job becomes claimable, not at enqueue.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7D (TTL clock resolved in build review)"
   }),
   NO_RUNNER_SIGNAL: must({
     id: "NO_RUNNER_SIGNAL",
     statement: "A server MUST surface noRunnerAvailable when no runner with matching capability has heartbeated within the liveness window, and MUST NOT raise it for a job still blocked on dependencies.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7D"
   }),
   RESULT_IDEMPOTENT: must({
     id: "RESULT_IDEMPOTENT",
     statement: "Result submission MUST be idempotent by job id; the first terminal outcome wins and later submissions MUST NOT change it.",
     enforcedBy: "server",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.4"
   }),
-  RESULT_PROVENANCE: must({
-    id: "RESULT_PROVENANCE",
-    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
     enforcedBy: "server",
-    source: "byollm_003 Rev 1 \xA7Return-trip"
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
   }),
   // ---- The trust surface -------------------------------------------------
   INGRESS_LOGGED_BEFORE_EXECUTION: must({
     id: "INGRESS_LOGGED_BEFORE_EXECUTION",
     statement: "Every executed prompt MUST be appended to the local ingress log before execution begins.",
     enforcedBy: "daemon",
+    verifiedBy: "conformance",
     source: "byollm_001 \xA7MUSTs"
   }),
   // ---- Execution isolation (byollm_004) ---------------------------------
@@ -594,178 +1128,484 @@ var MUSTS = Object.freeze({
     id: "NO_SHELL_INTERPOLATION",
     statement: "Process-class backends MUST be invoked with a fixed argv array and the payload delivered on stdin; payload text MUST NOT reach a command line.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   NO_PAYLOAD_ROUTING: must({
     id: "NO_PAYLOAD_ROUTING",
     statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   STRIPPED_CHILD_ENV: must({
     id: "STRIPPED_CHILD_ENV",
     statement: "Process-class children MUST spawn with an allowlisted environment, a scratch cwd, no inherited descriptors beyond std streams, and hard timeout and output-size caps.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   HTTP_BASE_URL_SAFE: must({
     id: "HTTP_BASE_URL_SAFE",
     statement: "HTTP-class backends MUST send requests only to the owner-configured base URL and MUST refuse base URLs resolving to cloud-metadata or link-local addresses.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 Rev 1 \xA7Backend taxonomy"
   }),
   OUTPUT_INERT: must({
     id: "OUTPUT_INERT",
     statement: "Returned text MUST be treated as inert bytes: never evaluated, never written to a payload-named path, never interpolated into a shell or into terminal control sequences when logged.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
   COMMUNITY_BUDGETS: must({
     id: "COMMUNITY_BUDGETS",
     statement: "Jobs whose owner is not the daemon's owner MUST be subject to the owner's rate limits, daily cap, and resource budget.",
     enforcedBy: "daemon",
+    verifiedBy: "adversarial",
     source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
   })
 });
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
+});
 var MUST_IDS = Object.freeze(Object.keys(MUSTS));
+function mustsVerifiedBy(kind) {
+  return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
+}
 
 // src/wire.ts
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 var PROTOCOL_VERSION = "0";
+var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
+  PROTOCOL_VERSION
+]);
+var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
+function declaredVersion(input) {
+  const { body, query } = input;
+  if (typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion")) {
+    return body.protocolVersion;
+  }
+  return query?.get("protocolVersion") ?? void 0;
+}
+function checkProtocolVersion(body) {
+  const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
+  if (typeof declared !== "string" || declared.length === 0) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  return null;
+}
+var UPGRADE_COMMAND = "npm i -g byollm@latest";
 var PROTOCOL_PREFIX = "/byollm";
 var ENDPOINTS = Object.freeze([
   "pair",
   "claim",
+  "fetch",
   "heartbeat",
   "result",
   "release"
 ]);
-var Capability = z5.object({
+var Capability = z8.object({
   kind: JobKind,
   backendId: BackendIdSchema,
   backendClass: BackendClass,
-  model: z5.string().min(1),
+  model: z8.string().min(1),
   offerScope: OfferScope
 }).strict();
-var CapabilityMatrix = z5.array(Capability);
-var PairStartRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  action: z5.literal("start"),
-  daemon: z5.object({
-    version: z5.string().min(1),
+var CapabilityMatrix = z8.array(Capability);
+var PairStartRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  action: z8.literal("start"),
+  daemon: z8.object({
+    version: z8.string().min(1),
     /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z5.string().min(1).max(120),
-    platform: z5.enum(["darwin", "linux", "win32"])
+    label: z8.string().min(1).max(120),
+    platform: z8.enum(["darwin", "linux", "win32"])
   }),
+  /**
+   * This machine's public keys (byollm_009 §5).
+   *
+   * Pairing is where the two parties learn each other's identities, because
+   * it is the one moment a human is already deciding to trust: the approval
+   * click. A key exchanged anywhere else would be a key nobody chose.
+   */
+  device: PublicIdentity,
   capabilities: CapabilityMatrix
 }).strict();
-var PairStartResponse = z5.object({
+var PairStartResponse = z8.object({
   /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z5.string().min(20),
+  deviceCode: z8.string().min(20),
   /** Short code the user reads and confirms in the browser. */
-  userCode: z5.string().min(4).max(16),
+  userCode: z8.string().min(4).max(16),
   /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z5.url(),
+  verificationUrl: z8.url(),
   /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z5.number().int().positive(),
+  expiresAt: z8.number().int().positive(),
   /** How often the daemon may poll. */
-  pollIntervalMs: z5.number().int().min(500).max(6e4)
+  pollIntervalMs: z8.number().int().min(500).max(6e4)
 }).strict();
-var PairPollRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  action: z5.literal("poll"),
-  deviceCode: z5.string().min(20)
+var PairPollRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  action: z8.literal("poll"),
+  deviceCode: z8.string().min(20)
 }).strict();
-var PairPollResponse = z5.discriminatedUnion("status", [
-  z5.object({ status: z5.literal("pending") }).strict(),
-  z5.object({ status: z5.literal("denied") }).strict(),
-  z5.object({ status: z5.literal("expired") }).strict(),
-  z5.object({
-    status: z5.literal("approved"),
-    /** Bearer token for every later call. Scoped to exactly one user. */
-    runnerToken: z5.string().min(20),
-    runnerId: z5.string().min(1),
+var PairPollResponse = z8.discriminatedUnion("status", [
+  z8.object({ status: z8.literal("pending") }).strict(),
+  z8.object({ status: z8.literal("denied") }).strict(),
+  z8.object({ status: z8.literal("expired") }).strict(),
+  z8.object({
+    status: z8.literal("approved"),
+    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
+    //
+    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
+    // the daemon's pairings file, and then **never sent, never looked up
+    // and never compared**. `getRunnerByTokenHash` existed on both stores
+    // and was called by nothing but a test asserting it returns null.
+    //
+    // Not merely dead wire, which is what `audienceAllow` and
+    // `HeartbeatResponse.leases` were. This was a *secret*: minted,
+    // transmitted, and written to two disks at rest, for nothing. A
+    // credential with no purpose is a liability rather than clutter,
+    // because the only thing it can ever do is leak.
+    //
+    // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
+    // enforced — every authenticated call is signed by the device's pinned
+    // identity key. This removes the thing the MUST is named after.
+    runnerId: z8.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z5.string().min(1),
+    owner: z8.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z5.string().optional()
+    ownerLabel: z8.string().optional(),
+    /**
+     * The sites this pairing covers, for the daemon to pin (byollm_009 §5),
+     * keyed by each site's identity key id — cloud_009 §5.
+     *
+     * Returned only on approval: a pending or denied poll learns nothing,
+     * so an unapproved code cannot be used to enumerate a site's keys.
+     *
+     * **One pairing per upstream, not one per site.** A user who connects a
+     * site on a web dashboard has no reason to go back to a laptop and run
+     * a command, so which sites a pairing covers is a projection of consent
+     * — refreshed on the heartbeat — rather than something frozen at
+     * pairing. A direct site answers with exactly one entry, which is the
+     * same shape and not a special case.
+     *
+     * Keyed by the id `stub.site` carries (Amendment A §A.3), so the
+     * runner's lookup is a map read rather than a join across two
+     * namespaces.
+     */
+    sites: z8.record(z8.string().min(1), PublicIdentity)
   }).strict()
 ]);
-var PairRequest = z5.discriminatedUnion("action", [
+var PairRequest = z8.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
+var ClaimRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z5.number().int().min(1).max(64)
+  max: z8.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z5.object({
-  jobs: z5.array(ClaimedJob),
+var ClaimResponse = z8.object({
+  /**
+   * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
+   * device claimed — see {@link JobStub} for the exhaustive metadata list.
+   */
+  jobs: z8.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z5.number().int().positive()
+  leaseMs: z8.number().int().positive()
 }).strict();
-var HeartbeatRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  daemonVersion: z5.string().min(1),
+var HeartbeatRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  daemonVersion: z8.string().min(1),
   capabilities: CapabilityMatrix,
-  /** Jobs this daemon believes it holds; the server renews their leases. */
-  activeJobIds: z5.array(z5.string().min(1)),
+  /**
+   * Leases this daemon believes it holds; the server renews exactly these.
+   *
+   * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
+   * grant the runner no longer holds — see {@link Lease.id}.
+   */
+  activeLeases: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  ),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z5.boolean()
+  paused: z8.boolean()
 }).strict();
-var HeartbeatResponse = z5.object({
-  /** Once true, the daemon stops claiming and abandons in-flight work. */
-  revoked: z5.boolean(),
+var HeartbeatResponse = z8.object({
+  /**
+   * The sites this daemon may serve, right now — cloud_008 finding 59.
+   *
+   * Revocation used to be a boolean, and it was device-wide: the daemon
+   * plane refused every call when the (owner, hub-site) consent was gone,
+   * heartbeat answered `revoked: true` with `lost: all`, and the daemon
+   * dropped its whole pairing by origin. Under a hub that is one site's
+   * revocation ending a machine's relationship with every other site it
+   * served — the amplification finding 48 warned about, arriving through
+   * the one field nobody thought of as tenancy.
+   *
+   * So the answer is the set. A site that leaves it is revoked *for that
+   * site*: the daemon drops that pin and keeps the rest. An empty set is
+   * what "revoked" used to mean, and the daemon can see that for itself
+   * rather than being told a second time — two fields for one fact is how
+   * they drift.
+   */
+  sites: z8.record(z8.string().min(1), PublicIdentity),
   /**
    * Per-job cancel (byollm_001 Rev 1 §C). The daemon aborts these jobs'
    * in-flight backend calls and reports them `canceled`.
+   *
+   * **The grant, not the id** — V1-3. Job ids are chosen per site, so two
+   * sites may pick the same one, and a bare id told a daemon holding both
+   * to abort whichever it happened to have filed under that name. The lease
+   * is the unique grant and the daemon already keys its work by it; this is
+   * the same shape `activeLeases` sends in the other direction.
    */
-  cancel: z5.array(z5.string().min(1)),
-  /** Jobs whose leases were renewed, with their new expiry. */
-  leases: z5.array(
-    z5.object({
-      jobId: z5.string().min(1),
-      expiresAt: z5.number().int().positive()
-    }).strict()
+  cancel: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) }).strict()
   ),
+  // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
+  //
+  // It carried "these leases were renewed, and here is the new expiry", and
+  // **no daemon ever read it.** A mutation returning an empty list while
+  // renewing correctly survived every test, which is what made it visible.
+  //
+  // It is neither a class nor membership, so Amendment A's rule does not
+  // decide it — the older test does: nothing reads it, so it is dead wire.
+  // §6's exhaustiveness is a commitment about what an upstream can see, and
+  // it applies to every message rather than only to the stub.
+  //
+  // `lost` is the actionable signal and always was: a daemon stops work on
+  // a lease it no longer holds. "Renewed" was the same question answered a
+  // second time, and a second answer can only agree or contradict.
+  //
+  // Renewal itself is untouched — the upstream still extends the grants a
+  // heartbeat names, which is what §0.6 fixed. What ended is telling the
+  // daemon about it in a field it ignored. If an upstream ever needs to
+  // push lease decisions, that is a new field with a reader, added on
+  // purpose.
   /**
    * Jobs the daemon thinks it holds but the server has reassigned or
    * expired. The daemon must stop work on these and not report results.
+   *
+   * Named by grant rather than by id, for V1-3's reason: a bare id is
+   * ambiguous across sites, and "the lease you no longer hold" is exactly
+   * what this field means anyway.
    */
-  lost: z5.array(z5.string().min(1)),
+  lost: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) }).strict()
+  ),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z5.number().int().positive()
+  serverTime: z8.number().int().positive(),
+  /**
+   * Sites whose disclosure the user must read again before work moves —
+   * cloud_008 finding 48, named rather than counted.
+   *
+   * A **subset of `sites`**, deliberately: a paused site keeps its pin, so
+   * re-consenting never costs a re-pair. The daemon can say which site is
+   * waiting and the user can go and read it, which is the difference
+   * between a machine that is quietly idle and one that says why.
+   *
+   * Not `revoked`, which is a human ending a relationship, and not
+   * `paused`, which on the request side already means "this daemon's
+   * operator stopped it" — one word with two subjects on two halves of one
+   * exchange is a confusion nobody untangles from a log.
+   */
+  awaitingConsent: z8.array(z8.string().min(1))
 }).strict();
-var ResultRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  jobId: z5.string().min(1),
-  outcome: JobOutcome,
-  /** Which model actually served it, for the result's provenance. */
-  model: z5.string().min(1),
-  backendClass: BackendClass,
-  /** Wall-clock milliseconds the backend call took. */
-  durationMs: z5.number().int().nonnegative()
+var ResultDisposition = z8.enum(["ok", "error", "canceled"]);
+var ResultRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  jobId: z8.string().min(1),
+  /**
+   * The grant this result was produced under — cloud_008 §1.4a.
+   *
+   * `fetch` has always named its lease, with the reasoning written beside
+   * it: a request that names only the job would be answerable for whatever
+   * lease exists when it arrives. **The operation that writes the result did
+   * not**, on either plane, and checked only the runner id — which survives
+   * a claim-release-reclaim cycle, so a device whose grant had been swept
+   * and reissued could still land a result for a job it no longer held.
+   *
+   * Found by tracing a mutation that survived in §0.6: the lease lapsed, the
+   * sweep requeued, the daemon re-claimed under a new grant, and the
+   * original run finished and posted anyway. The relay marked the job done
+   * with a result the site cannot open — it verifies the envelope against
+   * the *current* holder's device, so the crypto contains the substitution —
+   * and then refused the real holder's result as a replay. A lost job, in
+   * silence.
+   *
+   * `LEASE_HONORED` is a statement about a lease *instance*. That was
+   * learned once already, when a replayed release yanked a later grant, and
+   * it applies here for the same reason.
+   */
+  leaseId: z8.string().min(1),
+  /**
+   * The outcome, sealed to the site and signed by the device.
+   *
+   * The return leg of the payload envelope, and sealed for the same reason:
+   * a model's answer is as sensitive as the prompt that produced it, and an
+   * intermediary that cannot read one must not be handed the other.
+   */
+  envelope: SealedEnvelope,
+  /**
+   * The sealed outcome's discriminator, in the clear.
+   *
+   * Checked against the envelope once opened. It is a routing hint, not a
+   * fact: believing it unverified would let a daemon mark a job `ok` while
+   * sealing an error, and only the app would ever find out.
+   */
+  disposition: ResultDisposition
+  // `model`, `backendClass` and `durationMs` are **inside the envelope** —
+  // cloud_008 §2.5. See {@link RunMetadata}.
+  //
+  // They were here, in the clear, and that was two problems wearing one
+  // coat. On the direct plane the site recorded unauthenticated fields
+  // beside an authenticated answer: a daemon could seal one result and
+  // declare a different model, and only the unsigned half would reach the
+  // app. Through a relay they reached a third party that acts on none of
+  // them — `model` in particular being the sort of detail Amendment A's
+  // rule keeps off the wire.
+  //
+  // `disposition` stays, and the difference is the test: a relay *routes*
+  // on it, so it is a class a routing party consumes. Nobody between the
+  // two ends consumes these.
 }).strict();
-var ResultResponse = z5.object({
+var ResultResponse = z8.object({
   /**
-   * False when the submission lost an idempotency race or the lease was
-   * already gone — the daemon should discard, not retry
-   * ({@link MUSTS.RESULT_IDEMPOTENT}).
+   * False when this submission wrote nothing — the daemon should discard,
+   * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z5.boolean(),
+  accepted: z8.boolean(),
+  /**
+   * True when this device had already recorded this job's result.
+   *
+   * The difference between "already recorded" and "you no longer hold this"
+   * — cloud_008 §3.6. A daemon whose acknowledgment was lost is in the first
+   * case and needs to hear it: its answer is safely on disk. Reporting a
+   * stale lease instead invents a worry about a result that is already
+   * stored, and sends its owner looking for a routing problem.
+   *
+   * Set only for the device that finished the job. A different device gets
+   * the same refusal it would get for a job that is *not* terminal, so a job
+   * id cannot be used as a terminality probe.
+   */
+  duplicate: z8.boolean().optional(),
   /** The job's state after this submission. */
-  state: z5.string().min(1)
+  state: z8.string().min(1)
 }).strict();
-var ReleaseRequest = z5.object({
-  protocolVersion: z5.literal(PROTOCOL_VERSION),
-  runnerId: z5.string().min(1),
-  jobIds: z5.array(z5.string().min(1)),
+var ReleaseRequest = z8.object({
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  /**
+   * Which leases to release — the grant, not just the job.
+   *
+   * A release naming only a job id releases whatever lease exists at the
+   * moment it arrives, which for a replayed request is not the lease the
+   * daemon meant. See {@link Lease.id}.
+   */
+  leases: z8.array(
+    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  ),
   /**
    * Why, so the app's runner list can say something true.
    *
@@ -775,35 +1615,172 @@ var ReleaseRequest = z5.object({
    * stop offering that job to that runner, or the pair would spin between
    * claim and release forever.
    */
-  reason: z5.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  reason: z8.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseResponse = z5.object({
-  released: z5.array(z5.string().min(1))
+var ReleaseResponse = z8.object({
+  released: z8.array(z8.string().min(1))
 }).strict();
-var WireErrorCode = z5.enum([
+var WireErrorCode = z8.enum([
   "bad-request",
   "unsupported-protocol-version",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
   "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
   "revoked",
   "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  /**
+   * The job is over, and this call is about a job — V1-6, and the code the
+   * site plane has been serving without one (V1-13).
+   *
+   * Distinct from `not-found`, which says "no such job", and from
+   * `not-ready`, which says "not yet, keep asking". This one says "yes, and
+   * it finished" — so a daemon must stop rather than retry, and a replayed
+   * request must not be able to reopen it.
+   */
+  "too-late",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
   "rate-limited",
   "server-error"
 ]);
-var WireError = z5.object({
+var WireError = z8.object({
   error: WireErrorCode,
-  message: z5.string().min(1),
+  message: z8.string().min(1),
+  /**
+   * What this server speaks, on `unsupported-protocol-version` — §B.4.
+   *
+   * The refusal has carried these since the version handshake existed and
+   * the enumeration did not model them, so the one error that exists to be
+   * *acted on* was the one that failed to parse as a wire error. Found by
+   * the relay's own suite the day the relay started sending it: a refusal
+   * outside the enumerated shape is a refusal a client cannot branch on,
+   * which is the whole reason §1.4 enumerates them.
+   *
+   * Modelled the way `clock-skew`'s two fields already are — code-specific
+   * extras, refused on any other code by the refinement below.
+   */
+  supported: z8.array(z8.string().min(1)).optional(),
+  minimum: z8.string().min(1).optional(),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z5.number().int().nonnegative().optional()
-}).strict();
+  retryAfter: z8.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z8.number().int().positive().optional(),
+  maxSkewMs: z8.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+  const version = error.error === "unsupported-protocol-version";
+  const versionFields = error.supported !== void 0 || error.minimum !== void 0;
+  if (version && !versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: "unsupported-protocol-version must carry supported and minimum"
+    });
+  }
+  if (!version && versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry supported or minimum`
+    });
+  }
+});
 var ERROR_STATUS = Object.freeze({
   "bad-request": 400,
   "unsupported-protocol-version": 400,
   unauthorized: 401,
+  forbidden: 403,
   revoked: 403,
   "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // The same 409 as `not-ready` and the opposite instruction: that one says
+  // keep asking, this one says stop. The status is the class of the
+  // problem — a request that does not fit the resource's state — and the
+  // code is what a caller acts on.
+  "too-late": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
   "rate-limited": 429,
   "server-error": 500
 });
+var FetchRequest = z8.object({
+  // `literal`, like every other request — V1-17. This one said
+  // `string().min(1)`, so a daemon speaking a version this server does not
+  // know got past the handshake on the one endpoint that hands over a
+  // sealed payload. The version check exists so that a mismatch is a named
+  // refusal rather than a schema failure three fields later; here it was
+  // neither.
+  protocolVersion: z8.literal(PROTOCOL_VERSION),
+  runnerId: z8.string().min(1),
+  jobId: z8.string().min(1),
+  /**
+   * The grant this daemon holds.
+   *
+   * Named, not inferred: a fetch is lease-scoped, and a request that names
+   * only the job would be answerable for whatever lease exists when it
+   * arrives ({@link Lease.id}).
+   */
+  leaseId: z8.string().min(1)
+}).strict();
+var FetchResponse = z8.object({
+  /**
+   * The work, sealed to the device that claimed it — byollm_009 §6.
+   *
+   * Not plaintext. The site opens its own at-rest envelope and re-seals to
+   * the claiming device's key, signed by the site's identity, so the work
+   * is readable only by the machine that took it and only if it came from
+   * the site that machine pinned.
+   */
+  envelope: SealedEnvelope
+}).strict();
 export {
   AUDIENCES,
   Audience,
@@ -819,9 +1796,15 @@ export {
   ClaimRequest,
   ClaimResponse,
   ClaimedJob,
+  ClaimedStub,
   DeliveredResult,
+  ENCRYPTION_KEY_CONTEXT,
   ENDPOINTS,
+  ENVELOPE_MAX_AGE_MS,
   ERROR_STATUS,
+  EnvelopeDirection,
+  FetchRequest,
+  FetchResponse,
   GeneratePayload,
   HeartbeatRequest,
   HeartbeatResponse,
@@ -833,8 +1816,11 @@ export {
   JobResultError,
   JobResultOk,
   JobState,
+  JobStub,
   KindedPayload,
   Lease,
+  MAX_CLOCK_SKEW_MS,
+  MIN_PROTOCOL_VERSION,
   MUSTS,
   MUST_IDS,
   MatchRefusal,
@@ -848,25 +1834,56 @@ export {
   PairRequest,
   PairStartRequest,
   PairStartResponse,
+  PublicIdentity,
   REFUSAL_MESSAGES,
   ReleaseRequest,
   ReleaseResponse,
+  RequestSignature,
+  ResultDisposition,
   ResultProvenance,
   ResultRequest,
   ResultResponse,
+  RunMetadata,
+  SIZE_CLASS_LIMITS,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  SealedEnvelope,
+  SealedOutcome,
+  SizeClass,
+  StoredKeys,
   TERMINAL_STATES,
   WireError,
   WireErrorCode,
   backendDescriptor,
   canTransition,
+  canonicalRequest,
+  checkProtocolVersion,
+  cryptoReady,
+  declaredVersion,
   effectiveOfferScope,
+  fingerprint,
+  generateKeys,
   isBackendId,
   isJobKind,
   isLocalHost,
   isTerminal,
+  keyId,
+  kindsOf,
   matchAudience,
+  mustsVerifiedBy,
+  open,
   payloadTextLength,
   provenanceFor,
-  resolveCost
+  publicIdentityOf,
+  resolveCost,
+  seal,
+  signRequest,
+  signSiteRequest,
+  signWith,
+  sizeClassCeiling,
+  sizeClassOf,
+  verifyPublicIdentity,
+  verifyRequest,
+  verifySiteRequest,
+  verifyWith
 };
 //# sourceMappingURL=index.js.map