@byollm/protocol 0.1.0-alpha.5 → 0.1.0-alpha.50

package/dist/index.js

@@ -2,6 +2,7 @@
 import { z as z2 } from "zod";
 
 // src/backends.ts
+import { isIP } from "net";
 import { z } from "zod";
 var BackendClass = z.enum(["http", "process"]);
 var BackendCost = z.enum(["free", "metered", "subscription"]);
@@ -162,6 +163,24 @@ var BACKENDS = Object.freeze({
     class: "process",
     cost: "subscription",
     adversarialCorpus: "process"
+  }),
+  /**
+   * OpenAI's Codex CLI, on a ChatGPT plan — byollm_016 stage 3.
+   *
+   * `subscription`, so `SUBSCRIPTION_SELF_LOCK` pins it to its owner's own
+   * work whatever the config says. That is load-bearing here in a way it is
+   * not for `claude-cli`: Codex is an *agent*, and its default feature set
+   * includes a shell tool, browser control and computer use. The daemon
+   * disables every one of them, verified against the shipped binary rather
+   * than assumed — see `codex-cli.ts` — but the self-lock is the floor under
+   * that verification rather than a duplicate of it.
+   */
+  "codex-cli": backend({
+    id: "codex-cli",
+    label: "Codex CLI (your ChatGPT plan)",
+    class: "process",
+    cost: "subscription",
+    adversarialCorpus: "process"
   })
 });
 var BACKEND_IDS = Object.freeze(Object.keys(BACKENDS));
@@ -177,17 +196,24 @@ function backendDescriptor(id) {
 function isLocalHost(hostname) {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
   if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (host === "::1") return true;
+  const version = isIP(host);
+  if (version === 0) return false;
+  if (version === 6) {
+    if (host === "::1") return true;
+    return /^f[cd]/.test(host);
+  }
   if (host.startsWith("127.")) return true;
   if (host.startsWith("10.")) return true;
   if (host.startsWith("192.168.")) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (/^f[cd]/.test(host)) return true;
-  return false;
+  return /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+function isCloudTaggedModel(model) {
+  return /:[^:]*cloud$/.test(model);
 }
-function resolveCost(id, baseUrl) {
+function resolveCost(id, baseUrl, model) {
   const declared = BACKENDS[id].cost;
   if (declared !== null) return declared;
+  if (model !== void 0 && isCloudTaggedModel(model)) return "metered";
   if (baseUrl === void 0) return "metered";
   try {
     return isLocalHost(new URL(baseUrl).hostname) ? "free" : "metered";
@@ -197,8 +223,8 @@ function resolveCost(id, baseUrl) {
 }
 
 // src/audience.ts
-var Audience = z2.enum(["self", "named", "public"]);
-var OfferScope = z2.enum(["self", "named", "public"]);
+var Audience = z2.enum(["private", "team", "public"]);
+var OfferScope = z2.enum(["private", "team", "public"]);
 var AUDIENCES = Object.freeze(Audience.options);
 var OFFER_SCOPES = Object.freeze(OfferScope.options);
 var MatchRefusal = z2.enum([
@@ -222,16 +248,16 @@ var MatchRefusal = z2.enum([
 var ALLOWED = Object.freeze({ ok: true });
 var refuse = (refusal) => Object.freeze({ ok: false, refusal });
 function effectiveOfferScope(configured, cost, spend) {
-  if (cost === "subscription") return "self";
-  if (cost === "metered" && spend?.acknowledged !== true) return "self";
+  if (cost === "subscription") return "private";
+  if (cost === "metered" && spend?.acknowledged !== true) return "private";
   return configured;
 }
 function matchAudience(job, daemon) {
   const sameOwner = job.owner === daemon.owner;
-  if (job.audience === "self" && !sameOwner) {
+  if (job.audience === "private" && !sameOwner) {
     return refuse("audience-self-other-owner");
   }
-  if (job.audience === "named" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
+  if (job.audience === "team" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
     return refuse("not-in-server-allowlist");
   }
   const scope = effectiveOfferScope(
@@ -254,19 +280,19 @@ function matchAudience(job, daemon) {
     }
   }
   switch (scope) {
-    case "self":
+    case "private":
       return refuse("offer-scope-too-narrow");
-    case "named":
+    case "team":
       return daemon.locallyAllows(job.owner) ? ALLOWED : refuse("not-locally-allowed");
     case "public":
       return ALLOWED;
   }
 }
 var REFUSAL_MESSAGES = Object.freeze({
-  "no-capability": "no backend on this machine is configured and healthy for that job kind",
-  "audience-self-other-owner": "the job is private to its owner and this machine is paired to someone else",
-  "not-locally-allowed": "the job's owner is not on this machine's allowlist (byollm allow <server> <user>)",
-  "not-in-server-allowlist": "the app restricted this job to named runners and this machine is not one of them",
+  "no-capability": "no backend on this device is configured and healthy for that job kind",
+  "audience-self-other-owner": "the job is private to its owner and this device is paired to someone else",
+  "not-locally-allowed": "the job's owner is not on this device's allowlist (byollm allow <server> <user>)",
+  "not-in-server-allowlist": "the app restricted this job to named runners and this device is not one of them",
   "offer-scope-too-narrow": "this backend is offered to its owner only (byollm offer <backend> named|public to widen)",
   "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting",
   "metered-no-spend-consent": "this backend bills its owner per token, and they have not agreed to spend it on other people's work",
@@ -290,11 +316,21 @@ var ChatMessage = z3.object({
 var GeneratePayload = z3.object({
   prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.prompt.length + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var ChatPayload = z3.object({
   messages: z3.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.messages.reduce((sum, m) => sum + m.content.length, 0) + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var JobKind = z3.enum(["llm.generate", "llm.chat"]);
 var JOB_KINDS = Object.freeze(JobKind.options);
 var KindedPayload = z3.discriminatedUnion("kind", [
@@ -378,8 +414,19 @@ var ClaimedJob = z4.object({
   audience: Audience,
   /** The app's id for the user who enqueued it. */
   owner: z4.string().min(1),
-  /** Runner owners the app restricted a `named` job to, if any. */
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
+  /**
+   * Which site's job — V1-3.
+   *
+   * The stub has always carried it; the opened job did not, so everything
+   * downstream of the payload — the ingress line above all — recorded a job
+   * id that belongs to a site without saying which. Two sites can choose
+   * the same id, and the meter is the product.
+   *
+   * Optional so a caller assembling a job by hand is not forced to invent
+   * one, and so this reads as what it is: a fact about where the work came
+   * from, not a second copy of the routing key.
+   */
+  site: z4.string().min(1).optional(),
   lease: Lease
 }).strict();
 var ResultProvenance = z4.object({
@@ -406,9 +453,16 @@ function provenanceFor(input) {
     runnerOwner: input.runnerOwner,
     backendClass: input.backendClass,
     model: input.model,
-    untrusted: input.audience !== "self"
+    untrusted: input.audience !== "private"
   };
 }
+var RunMetadata = z4.object({
+  /** Which model actually served it. */
+  model: z4.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z4.number().int().nonnegative()
+}).strict();
 var JobResultOk = z4.object({
   outcome: z4.literal("ok"),
   text: z4.string(),
@@ -430,11 +484,88 @@ var JobOutcome = z4.discriminatedUnion("outcome", [
   JobResultError,
   JobResultCanceled
 ]);
+var RefusalReason = z4.enum([
+  /**
+   * A selection this requester cannot be served — byollm_016 Phase B.
+   *
+   * **One value for two causes, and the collapse is the security property.**
+   * A named service may be unknown to this owner, or known and not offered to
+   * this requester. Those are different facts and the requester may learn
+   * neither, because telling them apart turns refusal wording into an
+   * inventory oracle: probe names, sort the answers, and enumerate a device
+   * you were never offered. The finer cause lives owner-side, where the person
+   * reading it already owns the machine — see {@link SelectionFailure}.
+   *
+   * The first draft of this enum had both causes on the wire with a comment
+   * claiming they disclosed identically. They did not; the comment described a
+   * property the code lacked, which is the more dangerous half of that mistake.
+   */
+  "select-unavailable",
+  /**
+   * Two or more services answer this kind and the owner has named no default,
+   * so the kind is withheld. Nobody may pick on the owner's behalf — the wrong
+   * guess is the metered one.
+   *
+   * Not collapsed into the value above, and the reason is that a kind is not
+   * probeable. There are two kinds; a requester asking about one is not
+   * enumerating a namespace, and learns nothing they could not learn by
+   * looking at what the device advertises. It is also already what a roster
+   * member sees on the devices page — `awaitingDefault` carries exactly this,
+   * by kind, for exactly this reason.
+   */
+  "default-ambiguity",
+  /**
+   * A default exists and this requester can never use it — byollm_016's
+   * defaults-meet-audiences corner.
+   *
+   * The specimen: an owner's default for `llm.chat` is their Claude
+   * subscription, self-locked by `SUBSCRIPTION_SELF_LOCK`. A team member's
+   * unselected job resolves to it and can never be served by it. That must be
+   * a refusal on the spot, not a wait that expires an hour later looking like
+   * nobody was online.
+   *
+   * Bounded like the value above and probeable for the same reason it is not:
+   * the requester named nothing, so there is no name space to walk.
+   */
+  "default-unusable"
+]);
+var JobRefused = z4.object({
+  outcome: z4.literal("refused"),
+  reason: RefusalReason,
+  /** Plain words for a human reading a log, never parsed. */
+  message: z4.string().min(1)
+}).strict();
+var REFUSAL_TEXT = Object.freeze({
+  "select-unavailable": "that service is not available to you on this device",
+  "default-ambiguity": "this device serves that kind from more than one service and its owner has not chosen which",
+  "default-unusable": "this device's default for that kind cannot run work for you"
+});
+var REFUSED_SELECTION = Object.freeze({
+  outcome: "refused",
+  reason: "select-unavailable",
+  message: REFUSAL_TEXT["select-unavailable"]
+});
+var SealedOutcome = z4.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
 var DeliveredResult = z4.object({
   jobId: z4.string().min(1),
   state: JobState,
   outcome: JobOutcome.optional(),
-  provenance: ResultProvenance.optional()
+  provenance: ResultProvenance.optional(),
+  /**
+   * Present, and always `true`, when this did not come from a runner —
+   * {@link MUSTS.FALLBACK_LABELED}.
+   *
+   * The app's own `onNoRunner` value produced it: a hosted model, a cached
+   * answer, an apology. It never travels on the wire, because nothing on
+   * the wire produced it; it exists so that a result which did not come
+   * from the user's own compute cannot be reported as though it did.
+   *
+   * A literal rather than a boolean, so `fallback: false` is not a
+   * spelling anybody can reach for. The absence of this field means a
+   * runner ran the job, and the *server* stamps it — an app cannot supply
+   * a substitute that hides what it is.
+   */
+  fallback: z4.literal(true).optional()
 }).strict();
 var SizeClass = z4.enum(["small", "medium", "large", "unbounded"]);
 var SIZE_CLASS_LIMITS = Object.freeze({
@@ -456,8 +587,75 @@ var JobStub = z4.object({
   kind: JobKind,
   /** The app's id for the user who enqueued it. */
   owner: z4.string().min(1),
+  /**
+   * Which site this job belongs to — byollm_009 Amendment A §A.3.
+   *
+   * **The site's identity key id**, not an id somebody assigned it. §6 has
+   * listed `site` since this spec was frozen; the schema never carried it,
+   * which is the drift the amendment closes.
+   *
+   * A key id rather than an opaque handle for one reason above the others:
+   * it makes the stub *self-describing* instead of a pointer into somebody
+   * else's table. A daemon holds this key id already, from pinning, so it
+   * can check `stub.site` against the payload envelope's `senderKeyId`
+   * without a lookup and without trusting the party that routed it. An
+   * opaque id can only be believed.
+   *
+   * It also avoids inventing a second namespace for a thing that has a
+   * canonical one — the shape of finding 41 (two owner namespaces compared
+   * for equality) and of finding fourteen before it.
+   *
+   * Rotation is a designed transition rather than a cost: a site publishes a
+   * new identity signed by the outgoing one, both are valid through an
+   * overlap window, and a daemon re-keys its own map by verifying that
+   * signature against the key it already pinned (§A.3.1).
+   */
+  site: z4.string().min(1),
   audience: Audience,
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
+  // `audienceAllow` is **not** here, and its absence is the enforcement —
+  // cloud_008 §0.2.
+  //
+  // It was a list of the people who may run a job, travelling to every
+  // routing party on every `named` job. byollm_001 Rev 1 §B settled who
+  // decides that long before this schema existed: *the daemon's own list
+  // decides, not the server's*, and `allowlist.predicateFor(origin)` is the
+  // enforcement in both lanes. So this was a second answer to a question the
+  // daemon already owned — able only to agree, in which case it was
+  // redundant, or to disagree, in which case nothing said which wins.
+  //
+  // The rule it leaves behind, which decides the next field too: **a class
+  // the router acts on may travel; membership never does.** `audience` stays
+  // for exactly that reason — the relay narrows on it. A roster does not
+  // travel, so `ROSTER_NOT_DISCLOSED` holds here by absence, which is the
+  // strongest way for a MUST to hold.
+  //
+  // The site keeps its own copy on `JobRecord` and still filters candidates
+  // with it before offering. That is server-internal, where the party
+  // holding the list authored it.
+  /**
+   * Which of the owner's services should answer — byollm_016 Phase B.
+   *
+   * **A selection from a menu, never a demand.** The owner advertises named
+   * services; a site may name one of them, and that is the entire power the
+   * field grants. It carries no model, no base URL, no flags — the daemon
+   * resolves the name against its own config and nothing else, so what
+   * actually runs is still decided exclusively by the person who owns the
+   * hardware. A name that is not on that owner's menu is refused
+   * (`select-unadvertised`), never silently substituted, because a
+   * substitution is how "select" would quietly become "whatever we had".
+   *
+   * Absent means "the owner's default for this kind", which is the only
+   * behaviour Phase A had.
+   *
+   * It travels because the router matches on it, under the rule the absent
+   * `audienceAllow` above establishes: *a class the router acts on may
+   * travel; membership never does.* This is a class.
+   *
+   * It is a **stub** field and never a payload field, which is the line
+   * `NO_PAYLOAD_ROUTING` draws: the prompt cannot reach it, so no amount of
+   * user text can influence what runs.
+   */
+  service: z4.string().min(1).optional(),
   sizeClass: SizeClass,
   /** Reserved for byollm_006. False until streaming exists. */
   streaming: z4.boolean(),
@@ -748,6 +946,21 @@ function signRequest(keys, input) {
     signature: signWith(keys, canonicalRequest(input))
   };
 }
+function signSiteRequest(keys, input) {
+  return signRequest(keys, {
+    endpoint: siteEndpoint(input.endpoint),
+    runnerId: input.siteId,
+    issuedAt: input.issuedAt,
+    body: input.body
+  });
+}
+function verifySiteRequest(input) {
+  return verifyRequest({
+    ...input,
+    endpoint: siteEndpoint(input.endpoint)
+  });
+}
+var siteEndpoint = (endpoint) => `site/${endpoint}`;
 function verifyRequest(input) {
   const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
   if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
@@ -764,7 +977,69 @@ function verifyRequest(input) {
   return ok ? null : "bad-signature";
 }
 
+// src/succession.ts
+import { z as z8 } from "zod";
+var SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+var RETIREMENT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
+var MAX_SUCCESSION_CHAIN = 64;
+var Succession = z8.object({
+  /**
+   * The predecessor's public identity — K1, in full.
+   *
+   * The whole identity rather than the key id, because a daemon meeting a
+   * chain it has not seen before has to *verify* each link, and a key id is
+   * a fingerprint: enough to compare, never enough to check a signature.
+   */
+  identity: PublicIdentity,
+  /** K1's signature over the statement naming K1 and its successor. */
+  signature: z8.string().min(1)
+}).strict();
+function successionStatement(fromKeyId, toKeyId) {
+  return Buffer.from(`${SUCCESSION_CONTEXT}:${fromKeyId}:${toKeyId}`);
+}
+function signSuccession(previous, next) {
+  return {
+    identity: {
+      identity: previous.identityPublic,
+      encryption: previous.encryptionPublic,
+      encryptionSig: previous.encryptionSig
+    },
+    signature: signWith(
+      previous,
+      successionStatement(keyId(previous.identityPublic), keyId(next.identity))
+    )
+  };
+}
+function verifyLink(link, toKeyId) {
+  if (!verifyPublicIdentity(link.identity)) return false;
+  return verifyWith(
+    link.identity.identity,
+    successionStatement(keyId(link.identity.identity), toKeyId),
+    link.signature
+  );
+}
+function walkSuccession(input) {
+  const { current, chain, approved } = input;
+  if (chain.length === 0) return { path: [current], failure: "no-chain" };
+  if (chain.length > MAX_SUCCESSION_CHAIN)
+    return { path: [current], failure: "too-long" };
+  const steps = [...chain].reverse();
+  const path = [current];
+  let succeeding = current;
+  for (const link of steps) {
+    if (!verifyLink(link, succeeding)) return { path, failure: "broken-link" };
+    const previous = keyId(link.identity.identity);
+    path.unshift(previous);
+    if (approved(previous)) return { path, from: previous };
+    succeeding = previous;
+  }
+  return { path, failure: "unknown-origin" };
+}
+
 // src/musts.ts
+function kindsOf(must2) {
+  return typeof must2.verifiedBy === "string" ? [must2.verifiedBy] : must2.verifiedBy;
+}
 var must = (m) => Object.freeze(m);
 var MUSTS = Object.freeze({
   // ---- Pairing and identity -------------------------------------------
@@ -797,6 +1072,48 @@ var MUSTS = Object.freeze({
     verifiedBy: "conformance",
     source: "byollm_009 \xA74"
   }),
+  SITE_KEY_BY_STUB: must({
+    id: "SITE_KEY_BY_STUB",
+    statement: "A daemon MUST verify a job's payload against the pinned key of the site the stub names, and MUST refuse a job naming a site it has not pinned. It MUST NOT fall back to another pinned key, and MUST refuse an envelope whose declared sender disagrees with the stub's site.",
+    enforcedBy: "daemon",
+    // Adversarial, and the reason is the finding that produced it: the
+    // honest paths pass with every site check deleted, because `open`
+    // refuses a signature from the wrong key anyway. What distinguishes an
+    // enforced rule from a coincidence here is a hostile pairing of stub and
+    // envelope, which no conformance client would ever send.
+    verifiedBy: "adversarial",
+    source: "byollm_009 \xA7A.3"
+  }),
+  SITES_LOCALLY_APPROVED: must({
+    id: "SITES_LOCALLY_APPROVED",
+    statement: "A daemon MUST NOT run work for a site it has not approved on the machine itself. An upstream may propose a site set; a site the daemon has never approved MUST be offered to its owner and served nothing until they approve it. A key that has changed for an already-approved id MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already approved, over a statement naming both key ids MUST be accepted without a new local approval \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently.",
+    enforcedBy: "daemon",
+    // Two kinds, and the second is the one that matters — V1-1.
+    //
+    // `construction`: the daemon cannot serve a site that is not in its
+    // pinned map, and admission refuses before a payload is fetched, so the
+    // ordinary path cannot reach a site nobody approved.
+    //
+    // `adversarial`: the property that survives is about a *sequence* —
+    // remove the id, re-offer it under a different key — which no honest
+    // upstream sends and which the fence above does not see. That was the
+    // bypass: the pin was deleted with the id, so the comparison had nothing
+    // to compare against and the substitution arrived as a stranger.
+    // **Not `conformance`, and that is a live gap rather than a judgement.**
+    // Amendment C's succession clause is a rule about two implementations
+    // agreeing, which is what a conformance check is for — but rotating a
+    // site's key is not something `ConformanceTarget` can express, and adding
+    // an optional hook that most targets omit would produce a check reporting
+    // success for a reason unrelated to the property it claims. That is this
+    // project's most-repeated bug, and it is not worth reintroducing for a
+    // stronger-sounding word in a table. The rotation path is verified by
+    // `site-rotation.test.ts` (both directions, against the shipped runner)
+    // and `relay/test/rotation.test.ts` (both planes, against the reference
+    // relay); the missing piece is a second *independent* implementation to
+    // check them against, and there is not one yet.
+    verifiedBy: ["construction", "adversarial"],
+    source: "byollm_009 \xA7B.2, Amendment C"
+  }),
   KEYS_EXCHANGED_AT_CONSENT: must({
     id: "KEYS_EXCHANGED_AT_CONSENT",
     statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
@@ -984,12 +1301,12 @@ var MUSTS = Object.freeze({
     verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.4"
   }),
-  RESULT_PROVENANCE: must({
-    id: "RESULT_PROVENANCE",
-    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
     enforcedBy: "server",
     verifiedBy: "conformance",
-    source: "byollm_003 Rev 1 \xA7Return-trip"
+    source: "byollm_009 \xA711"
   }),
   // ---- The trust surface -------------------------------------------------
   INGRESS_LOGGED_BEFORE_EXECUTION: must({
@@ -1007,12 +1324,33 @@ var MUSTS = Object.freeze({
     verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
+  /**
+   * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
+   *
+   * A site may now name a **service** on the stub. The temptation is to read
+   * that as a crack in this law, so the statement below says exactly where the
+   * line is: a name selects from a menu the owner published, and resolves to a
+   * model, backend, base URL and flags **only** through that owner's own
+   * config. The site supplies a key; the owner supplies every value it maps
+   * to. A name the owner does not advertise is refused rather than
+   * substituted, because substitution is how "you may pick from my list" turns
+   * into "you may ask for anything and get something".
+   *
+   * Two properties keep it from drifting into "sites demand models":
+   *
+   *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+   *      no flag crosses the wire — only a key that means nothing off this
+   *      owner's machine.
+   *   2. **It is a stub field, never a payload field.** The prompt cannot
+   *      reach it. That is unchanged and is the sentence the second clause
+   *      below still enforces verbatim.
+   */
   NO_PAYLOAD_ROUTING: must({
     id: "NO_PAYLOAD_ROUTING",
-    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them.",
+    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them. A stub MAY name a service the owner advertises, which selects among that owner's own config entries and MUST NOT introduce any value the owner did not write; an unadvertised name MUST be refused, never substituted.",
     enforcedBy: "daemon",
     verifiedBy: "adversarial",
-    source: "byollm_004 \xA72"
+    source: "byollm_004 \xA72, amended byollm_016 \xA7Phase B"
   }),
   STRIPPED_CHILD_ENV: must({
     id: "STRIPPED_CHILD_ENV",
@@ -1041,26 +1379,117 @@ var MUSTS = Object.freeze({
     enforcedBy: "daemon",
     verifiedBy: "adversarial",
     source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
   })
 });
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
+});
 var MUST_IDS = Object.freeze(Object.keys(MUSTS));
 function mustsVerifiedBy(kind) {
-  return MUST_IDS.filter((id) => MUSTS[id].verifiedBy === kind);
+  return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
 }
 
 // src/wire.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var PROTOCOL_VERSION = "0";
 var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
   PROTOCOL_VERSION
 ]);
 var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
+function declaredVersion(input) {
+  const { body, query } = input;
+  if (typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion")) {
+    return body.protocolVersion;
+  }
+  return query?.get("protocolVersion") ?? void 0;
+}
 function checkProtocolVersion(body) {
   const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
   if (typeof declared !== "string" || declared.length === 0) {
     return {
       error: "unsupported-protocol-version",
-      message: "this request declared no protocol version. Upgrade the daemon: `npm i -g byollm@alpha`.",
+      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
       supported: SUPPORTED_PROTOCOL_VERSIONS,
       minimum: MIN_PROTOCOL_VERSION
     };
@@ -1068,13 +1497,14 @@ function checkProtocolVersion(body) {
   if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
     return {
       error: "unsupported-protocol-version",
-      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? "Upgrade the daemon: `npm i -g byollm@alpha`." : "This daemon is newer than the server; the server needs upgrading."),
+      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
       supported: SUPPORTED_PROTOCOL_VERSIONS,
       minimum: MIN_PROTOCOL_VERSION
     };
   }
   return null;
 }
+var UPGRADE_COMMAND = "npm i -g byollm@latest";
 var PROTOCOL_PREFIX = "/byollm";
 var ENDPOINTS = Object.freeze([
   "pair",
@@ -1084,22 +1514,46 @@ var ENDPOINTS = Object.freeze([
   "result",
   "release"
 ]);
-var Capability = z8.object({
+var Capability = z9.object({
   kind: JobKind,
+  /**
+   * The owner's name for the service answering this kind — byollm_016.
+   *
+   * A device advertises *which* of its services serves a kind, not merely
+   * that something does. Phase B lets a job select by this name; until then
+   * it is what a device page shows and what a default is chosen between.
+   */
+  service: z9.string().min(1),
+  /**
+   * Whether this row is the default for its kind.
+   *
+   * Stated rather than inferred from being the only row, which is true in
+   * Phase A and stops being true the moment Phase B advertises every
+   * selectable service per kind. A consumer that learned "default means
+   * alone" would have to unlearn it, and the ones that did not would be
+   * quietly wrong. One field now, no second shape later.
+   */
+  isDefault: z9.boolean(),
   backendId: BackendIdSchema,
   backendClass: BackendClass,
-  model: z8.string().min(1),
+  model: z9.string().min(1),
   offerScope: OfferScope
 }).strict();
-var CapabilityMatrix = z8.array(Capability);
-var PairStartRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  action: z8.literal("start"),
-  daemon: z8.object({
-    version: z8.string().min(1),
+var CapabilityMatrix = z9.array(Capability);
+var WithheldKind = z9.object({
+  kind: JobKind,
+  claimants: z9.array(
+    z9.object({ service: z9.string().min(1), offer: OfferScope }).strict()
+  ).min(2)
+}).strict();
+var PairStartRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  action: z9.literal("start"),
+  daemon: z9.object({
+    version: z9.string().min(1),
     /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z8.string().min(1).max(120),
-    platform: z8.enum(["darwin", "linux", "win32"])
+    label: z9.string().min(1).max(120),
+    platform: z9.enum(["darwin", "linux", "win32"])
   }),
   /**
    * This machine's public keys (byollm_009 §5).
@@ -1111,111 +1565,259 @@ var PairStartRequest = z8.object({
   device: PublicIdentity,
   capabilities: CapabilityMatrix
 }).strict();
-var PairStartResponse = z8.object({
+var PairStartResponse = z9.object({
   /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z8.string().min(20),
+  deviceCode: z9.string().min(20),
   /** Short code the user reads and confirms in the browser. */
-  userCode: z8.string().min(4).max(16),
+  userCode: z9.string().min(4).max(16),
   /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z8.url(),
+  verificationUrl: z9.url(),
   /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z8.number().int().positive(),
+  expiresAt: z9.number().int().positive(),
   /** How often the daemon may poll. */
-  pollIntervalMs: z8.number().int().min(500).max(6e4)
+  pollIntervalMs: z9.number().int().min(500).max(6e4)
 }).strict();
-var PairPollRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  action: z8.literal("poll"),
-  deviceCode: z8.string().min(20)
+var PairPollRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  action: z9.literal("poll"),
+  deviceCode: z9.string().min(20)
 }).strict();
-var PairPollResponse = z8.discriminatedUnion("status", [
-  z8.object({ status: z8.literal("pending") }).strict(),
-  z8.object({ status: z8.literal("denied") }).strict(),
-  z8.object({ status: z8.literal("expired") }).strict(),
-  z8.object({
-    status: z8.literal("approved"),
-    /** Bearer token for every later call. Scoped to exactly one user. */
-    runnerToken: z8.string().min(20),
-    runnerId: z8.string().min(1),
+var PairPollResponse = z9.discriminatedUnion("status", [
+  z9.object({ status: z9.literal("pending") }).strict(),
+  z9.object({ status: z9.literal("denied") }).strict(),
+  z9.object({ status: z9.literal("expired") }).strict(),
+  z9.object({
+    status: z9.literal("approved"),
+    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
+    //
+    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
+    // the daemon's pairings file, and then **never sent, never looked up
+    // and never compared**. `getRunnerByTokenHash` existed on both stores
+    // and was called by nothing but a test asserting it returns null.
+    //
+    // Not merely dead wire, which is what `audienceAllow` and
+    // `HeartbeatResponse.leases` were. This was a *secret*: minted,
+    // transmitted, and written to two disks at rest, for nothing. A
+    // credential with no purpose is a liability rather than clutter,
+    // because the only thing it can ever do is leak.
+    //
+    // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
+    // enforced — every authenticated call is signed by the device's pinned
+    // identity key. This removes the thing the MUST is named after.
+    runnerId: z9.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z8.string().min(1),
+    owner: z9.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z8.string().optional(),
+    ownerLabel: z9.string().optional(),
     /**
-     * The site's public keys, for the daemon to pin (byollm_009 §5).
+     * The sites this pairing covers, for the daemon to pin (byollm_009 §5),
+     * keyed by each site's identity key id — cloud_009 §5.
      *
-     * Returned only on approval — a pending or denied poll learns nothing,
+     * Returned only on approval: a pending or denied poll learns nothing,
      * so an unapproved code cannot be used to enumerate a site's keys.
+     *
+     * **One pairing per upstream, not one per site.** A user who connects a
+     * site on a web dashboard has no reason to go back to a laptop and run
+     * a command, so which sites a pairing covers is a projection of consent
+     * — refreshed on the heartbeat — rather than something frozen at
+     * pairing. A direct site answers with exactly one entry, which is the
+     * same shape and not a special case.
+     *
+     * Keyed by the id `stub.site` carries (Amendment A §A.3), so the
+     * runner's lookup is a map read rather than a join across two
+     * namespaces.
      */
-    site: PublicIdentity
+    sites: z9.record(z9.string().min(1), PublicIdentity)
   }).strict()
 ]);
-var PairRequest = z8.discriminatedUnion("action", [
+var PairRequest = z9.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
+var ClaimRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z8.number().int().min(1).max(64)
+  max: z9.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z8.object({
+var ClaimResponse = z9.object({
   /**
    * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
    * device claimed — see {@link JobStub} for the exhaustive metadata list.
    */
-  jobs: z8.array(ClaimedStub),
+  jobs: z9.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z8.number().int().positive()
+  leaseMs: z9.number().int().positive()
 }).strict();
-var HeartbeatRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
-  daemonVersion: z8.string().min(1),
+var HeartbeatRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  daemonVersion: z9.string().min(1),
   capabilities: CapabilityMatrix,
+  /**
+   * Kinds this device is withholding, and why it can be said.
+   *
+   * Optional so a daemon that has nothing withheld sends nothing, and so an
+   * older daemon against a newer hub is simply a device with no withheld
+   * kinds rather than a parse failure.
+   */
+  withheld: z9.array(WithheldKind).default([]),
   /**
    * Leases this daemon believes it holds; the server renews exactly these.
    *
    * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
    * grant the runner no longer holds — see {@link Lease.id}.
    */
-  activeLeases: z8.array(
-    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  activeLeases: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) })
   ),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z8.boolean()
+  paused: z9.boolean()
 }).strict();
-var HeartbeatResponse = z8.object({
-  /** Once true, the daemon stops claiming and abandons in-flight work. */
-  revoked: z8.boolean(),
+var HeartbeatResponse = z9.object({
+  /**
+   * The sites this daemon may serve, right now — cloud_008 finding 59.
+   *
+   * Revocation used to be a boolean, and it was device-wide: the daemon
+   * plane refused every call when the (owner, hub-site) consent was gone,
+   * heartbeat answered `revoked: true` with `lost: all`, and the daemon
+   * dropped its whole pairing by origin. Under a hub that is one site's
+   * revocation ending a machine's relationship with every other site it
+   * served — the amplification finding 48 warned about, arriving through
+   * the one field nobody thought of as tenancy.
+   *
+   * So the answer is the set. A site that leaves it is revoked *for that
+   * site*: the daemon drops that pin and keeps the rest. An empty set is
+   * what "revoked" used to mean, and the daemon can see that for itself
+   * rather than being told a second time — two fields for one fact is how
+   * they drift.
+   */
+  sites: z9.record(z9.string().min(1), PublicIdentity),
+  /**
+   * How a site's current key traces back to one this daemon already holds —
+   * byollm_009 Amendment C.
+   *
+   * Keyed by the same id as `sites`, and **additive on purpose**: `sites`
+   * remains the one statement of which key is current, and this says only
+   * how that key got there. Two fields for one fact is how they drift; this
+   * is two facts, and the second is evidence about the first.
+   *
+   * Optional because a site that has never rotated has no chain, which is
+   * every site today. A daemon that receives one for an id it already holds
+   * ignores it: the pin it has is the pin it approved.
+   *
+   * §12 carries what this adds to the metadata surface — a site's rotation
+   * history is public by construction, because a daemon that cannot read it
+   * cannot verify it.
+   */
+  successions: z9.record(
+    z9.string().min(1),
+    z9.object({
+      /** Oldest last, as the projection carries it. */
+      succeeds: z9.array(Succession).max(MAX_SUCCESSION_CHAIN),
+      /**
+       * Until when the superseded key may still sign work — epoch ms.
+       *
+       * The daemon holds its own clock against this, for the reason it
+       * holds its own allowlist: a projection that could extend the
+       * window indefinitely would be a two-key site forever, decided by
+       * the party this design does not trust.
+       */
+      retiringUntil: z9.number().int().positive().optional()
+    }).strict()
+  ).optional(),
   /**
    * Per-job cancel (byollm_001 Rev 1 §C). The daemon aborts these jobs'
    * in-flight backend calls and reports them `canceled`.
+   *
+   * **The grant, not the id** — V1-3. Job ids are chosen per site, so two
+   * sites may pick the same one, and a bare id told a daemon holding both
+   * to abort whichever it happened to have filed under that name. The lease
+   * is the unique grant and the daemon already keys its work by it; this is
+   * the same shape `activeLeases` sends in the other direction.
    */
-  cancel: z8.array(z8.string().min(1)),
-  /** Jobs whose leases were renewed, with their new expiry. */
-  leases: z8.array(
-    z8.object({
-      jobId: z8.string().min(1),
-      expiresAt: z8.number().int().positive()
-    }).strict()
+  cancel: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) }).strict()
   ),
+  // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
+  //
+  // It carried "these leases were renewed, and here is the new expiry", and
+  // **no daemon ever read it.** A mutation returning an empty list while
+  // renewing correctly survived every test, which is what made it visible.
+  //
+  // It is neither a class nor membership, so Amendment A's rule does not
+  // decide it — the older test does: nothing reads it, so it is dead wire.
+  // §6's exhaustiveness is a commitment about what an upstream can see, and
+  // it applies to every message rather than only to the stub.
+  //
+  // `lost` is the actionable signal and always was: a daemon stops work on
+  // a lease it no longer holds. "Renewed" was the same question answered a
+  // second time, and a second answer can only agree or contradict.
+  //
+  // Renewal itself is untouched — the upstream still extends the grants a
+  // heartbeat names, which is what §0.6 fixed. What ended is telling the
+  // daemon about it in a field it ignored. If an upstream ever needs to
+  // push lease decisions, that is a new field with a reader, added on
+  // purpose.
   /**
    * Jobs the daemon thinks it holds but the server has reassigned or
    * expired. The daemon must stop work on these and not report results.
+   *
+   * Named by grant rather than by id, for V1-3's reason: a bare id is
+   * ambiguous across sites, and "the lease you no longer hold" is exactly
+   * what this field means anyway.
    */
-  lost: z8.array(z8.string().min(1)),
+  lost: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) }).strict()
+  ),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z8.number().int().positive()
+  serverTime: z9.number().int().positive(),
+  /**
+   * Sites whose disclosure the user must read again before work moves —
+   * cloud_008 finding 48, named rather than counted.
+   *
+   * A **subset of `sites`**, deliberately: a paused site keeps its pin, so
+   * re-consenting never costs a re-pair. The daemon can say which site is
+   * waiting and the user can go and read it, which is the difference
+   * between a machine that is quietly idle and one that says why.
+   *
+   * Not `revoked`, which is a human ending a relationship, and not
+   * `paused`, which on the request side already means "this daemon's
+   * operator stopped it" — one word with two subjects on two halves of one
+   * exchange is a confusion nobody untangles from a log.
+   */
+  awaitingConsent: z9.array(z9.string().min(1))
 }).strict();
-var ResultDisposition = z8.enum(["ok", "error", "canceled"]);
-var ResultRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
-  jobId: z8.string().min(1),
+var ResultDisposition = z9.enum(["ok", "error", "canceled"]);
+var ResultRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  jobId: z9.string().min(1),
+  /**
+   * The grant this result was produced under — cloud_008 §1.4a.
+   *
+   * `fetch` has always named its lease, with the reasoning written beside
+   * it: a request that names only the job would be answerable for whatever
+   * lease exists when it arrives. **The operation that writes the result did
+   * not**, on either plane, and checked only the runner id — which survives
+   * a claim-release-reclaim cycle, so a device whose grant had been swept
+   * and reissued could still land a result for a job it no longer held.
+   *
+   * Found by tracing a mutation that survived in §0.6: the lease lapsed, the
+   * sweep requeued, the daemon re-claimed under a new grant, and the
+   * original run finished and posted anyway. The relay marked the job done
+   * with a result the site cannot open — it verifies the envelope against
+   * the *current* holder's device, so the crypto contains the substitution —
+   * and then refused the real holder's result as a replay. A lost job, in
+   * silence.
+   *
+   * `LEASE_HONORED` is a statement about a lease *instance*. That was
+   * learned once already, when a replayed release yanked a later grant, and
+   * it applies here for the same reason.
+   */
+  leaseId: z9.string().min(1),
   /**
    * The outcome, sealed to the site and signed by the device.
    *
@@ -1231,26 +1833,48 @@ var ResultRequest = z8.object({
    * fact: believing it unverified would let a daemon mark a job `ok` while
    * sealing an error, and only the app would ever find out.
    */
-  disposition: ResultDisposition,
-  /** Which model actually served it, for the result's provenance. */
-  model: z8.string().min(1),
-  backendClass: BackendClass,
-  /** Wall-clock milliseconds the backend call took. */
-  durationMs: z8.number().int().nonnegative()
+  disposition: ResultDisposition
+  // `model`, `backendClass` and `durationMs` are **inside the envelope** —
+  // cloud_008 §2.5. See {@link RunMetadata}.
+  //
+  // They were here, in the clear, and that was two problems wearing one
+  // coat. On the direct plane the site recorded unauthenticated fields
+  // beside an authenticated answer: a daemon could seal one result and
+  // declare a different model, and only the unsigned half would reach the
+  // app. Through a relay they reached a third party that acts on none of
+  // them — `model` in particular being the sort of detail Amendment A's
+  // rule keeps off the wire.
+  //
+  // `disposition` stays, and the difference is the test: a relay *routes*
+  // on it, so it is a class a routing party consumes. Nobody between the
+  // two ends consumes these.
 }).strict();
-var ResultResponse = z8.object({
+var ResultResponse = z9.object({
   /**
-   * False when the submission lost an idempotency race or the lease was
-   * already gone — the daemon should discard, not retry
-   * ({@link MUSTS.RESULT_IDEMPOTENT}).
+   * False when this submission wrote nothing — the daemon should discard,
+   * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z8.boolean(),
+  accepted: z9.boolean(),
+  /**
+   * True when this device had already recorded this job's result.
+   *
+   * The difference between "already recorded" and "you no longer hold this"
+   * — cloud_008 §3.6. A daemon whose acknowledgment was lost is in the first
+   * case and needs to hear it: its answer is safely on disk. Reporting a
+   * stale lease instead invents a worry about a result that is already
+   * stored, and sends its owner looking for a routing problem.
+   *
+   * Set only for the device that finished the job. A different device gets
+   * the same refusal it would get for a job that is *not* terminal, so a job
+   * id cannot be used as a terminality probe.
+   */
+  duplicate: z9.boolean().optional(),
   /** The job's state after this submission. */
-  state: z8.string().min(1)
+  state: z9.string().min(1)
 }).strict();
-var ReleaseRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
+var ReleaseRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
   /**
    * Which leases to release — the grant, not just the job.
    *
@@ -1258,8 +1882,8 @@ var ReleaseRequest = z8.object({
    * moment it arrives, which for a replayed request is not the lease the
    * daemon meant. See {@link Lease.id}.
    */
-  leases: z8.array(
-    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
+  leases: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) })
   ),
   /**
    * Why, so the app's runner list can say something true.
@@ -1270,39 +1894,152 @@ var ReleaseRequest = z8.object({
    * stop offering that job to that runner, or the pair would spin between
    * claim and release forever.
    */
-  reason: z8.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  reason: z9.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseResponse = z8.object({
-  released: z8.array(z8.string().min(1))
+var ReleaseResponse = z9.object({
+  released: z9.array(z9.string().min(1))
 }).strict();
-var WireErrorCode = z8.enum([
+var WireErrorCode = z9.enum([
   "bad-request",
   "unsupported-protocol-version",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
   "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
   "revoked",
   "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  /**
+   * The job is over, and this call is about a job — V1-6, and the code the
+   * site plane has been serving without one (V1-13).
+   *
+   * Distinct from `not-found`, which says "no such job", and from
+   * `not-ready`, which says "not yet, keep asking". This one says "yes, and
+   * it finished" — so a daemon must stop rather than retry, and a replayed
+   * request must not be able to reopen it.
+   */
+  "too-late",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
   "rate-limited",
   "server-error"
 ]);
-var WireError = z8.object({
+var WireError = z9.object({
   error: WireErrorCode,
-  message: z8.string().min(1),
+  message: z9.string().min(1),
+  /**
+   * What this server speaks, on `unsupported-protocol-version` — §B.4.
+   *
+   * The refusal has carried these since the version handshake existed and
+   * the enumeration did not model them, so the one error that exists to be
+   * *acted on* was the one that failed to parse as a wire error. Found by
+   * the relay's own suite the day the relay started sending it: a refusal
+   * outside the enumerated shape is a refusal a client cannot branch on,
+   * which is the whole reason §1.4 enumerates them.
+   *
+   * Modelled the way `clock-skew`'s two fields already are — code-specific
+   * extras, refused on any other code by the refinement below.
+   */
+  supported: z9.array(z9.string().min(1)).optional(),
+  minimum: z9.string().min(1).optional(),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z8.number().int().nonnegative().optional()
-}).strict();
+  retryAfter: z9.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z9.number().int().positive().optional(),
+  maxSkewMs: z9.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+  const version = error.error === "unsupported-protocol-version";
+  const versionFields = error.supported !== void 0 || error.minimum !== void 0;
+  if (version && !versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: "unsupported-protocol-version must carry supported and minimum"
+    });
+  }
+  if (!version && versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry supported or minimum`
+    });
+  }
+});
 var ERROR_STATUS = Object.freeze({
   "bad-request": 400,
   "unsupported-protocol-version": 400,
   unauthorized: 401,
+  forbidden: 403,
   revoked: 403,
   "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // The same 409 as `not-ready` and the opposite instruction: that one says
+  // keep asking, this one says stop. The status is the class of the
+  // problem — a request that does not fit the resource's state — and the
+  // code is what a caller acts on.
+  "too-late": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
   "rate-limited": 429,
   "server-error": 500
 });
-var FetchRequest = z8.object({
-  protocolVersion: z8.string().min(1),
-  runnerId: z8.string().min(1),
-  jobId: z8.string().min(1),
+var FetchRequest = z9.object({
+  // `literal`, like every other request — V1-17. This one said
+  // `string().min(1)`, so a daemon speaking a version this server does not
+  // know got past the handshake on the one endpoint that hands over a
+  // sealed payload. The version check exists so that a mismatch is a named
+  // refusal rather than a schema failure three fields later; here it was
+  // neither.
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  jobId: z9.string().min(1),
   /**
    * The grant this daemon holds.
    *
@@ -1310,9 +2047,9 @@ var FetchRequest = z8.object({
    * only the job would be answerable for whatever lease exists when it
    * arrives ({@link Lease.id}).
    */
-  leaseId: z8.string().min(1)
+  leaseId: z9.string().min(1)
 }).strict();
-var FetchResponse = z8.object({
+var FetchResponse = z9.object({
   /**
    * The work, sealed to the device that claimed it — byollm_009 §6.
    *
@@ -1340,6 +2077,7 @@ export {
   ClaimedJob,
   ClaimedStub,
   DeliveredResult,
+  ENCRYPTION_KEY_CONTEXT,
   ENDPOINTS,
   ENVELOPE_MAX_AGE_MS,
   ERROR_STATUS,
@@ -1353,6 +2091,7 @@ export {
   JobKind,
   JobOutcome,
   JobPayload,
+  JobRefused,
   JobResultCanceled,
   JobResultError,
   JobResultOk,
@@ -1361,6 +2100,7 @@ export {
   KindedPayload,
   Lease,
   MAX_CLOCK_SKEW_MS,
+  MAX_SUCCESSION_CHAIN,
   MIN_PROTOCOL_VERSION,
   MUSTS,
   MUST_IDS,
@@ -1377,6 +2117,8 @@ export {
   PairStartResponse,
   PublicIdentity,
   REFUSAL_MESSAGES,
+  RETIREMENT_WINDOW_MS,
+  RefusalReason,
   ReleaseRequest,
   ReleaseResponse,
   RequestSignature,
@@ -1384,27 +2126,35 @@ export {
   ResultProvenance,
   ResultRequest,
   ResultResponse,
+  RunMetadata,
   SIZE_CLASS_LIMITS,
+  SUCCESSION_CONTEXT,
   SUPPORTED_PROTOCOL_VERSIONS,
   SealedEnvelope,
+  SealedOutcome,
   SizeClass,
   StoredKeys,
+  Succession,
   TERMINAL_STATES,
   WireError,
   WireErrorCode,
+  WithheldKind,
   backendDescriptor,
   canTransition,
   canonicalRequest,
   checkProtocolVersion,
   cryptoReady,
+  declaredVersion,
   effectiveOfferScope,
   fingerprint,
   generateKeys,
   isBackendId,
+  isCloudTaggedModel,
   isJobKind,
   isLocalHost,
   isTerminal,
   keyId,
+  kindsOf,
   matchAudience,
   mustsVerifiedBy,
   open,
@@ -1414,11 +2164,17 @@ export {
   resolveCost,
   seal,
   signRequest,
+  signSiteRequest,
+  signSuccession,
   signWith,
   sizeClassCeiling,
   sizeClassOf,
+  successionStatement,
+  verifyLink,
   verifyPublicIdentity,
   verifyRequest,
-  verifyWith
+  verifySiteRequest,
+  verifyWith,
+  walkSuccession
 };
 //# sourceMappingURL=index.js.map