@byollm/protocol 0.1.0-alpha.57 → 0.1.0-alpha.59

package/dist/index.js

@@ -255,22 +255,28 @@ function classifyCost(id, baseUrl, model) {
 }
 
 // src/audience.ts
-var Audience = z2.enum(["private", "team", "public"]);
-var OfferScope = z2.enum(["private", "team", "public"]);
+var Audience = z2.enum(["private", "team"]);
+var OfferScope = z2.enum(["private", "team"]);
 var AUDIENCES = Object.freeze(Audience.options);
 var OFFER_SCOPES = Object.freeze(OfferScope.options);
 var MatchRefusal = z2.enum([
   /** The daemon advertises no capability for this kind. */
   "no-capability",
-  /** Job is `self` but this daemon belongs to a different user. */
+  /** Job is `private` but this daemon belongs to a different user. */
   "audience-self-other-owner",
-  /** Job is `named` but this daemon's local allowlist does not admit the owner. */
+  /**
+   * Job is `team` and nothing this device verified admits the job's owner.
+   *
+   * The id predates the grant and is kept, because ids are public and cited
+   * by conformance output. What it means has not moved: this device was not
+   * shown anything it could check.
+   */
   "not-locally-allowed",
-  /** Job is `named`/`public` but the server's own allowlist excludes this runner. */
+  /** Job is `team` but the server's own allowlist excludes this runner. */
   "not-in-server-allowlist",
-  /** The backend offers only `self` and the job belongs to someone else. */
+  /** The service offers only `private` and the job belongs to someone else. */
   "offer-scope-too-narrow",
-  /** The matched backend is subscription-class, which is locked to `self`. */
+  /** The matched backend is subscription-class, which is locked to `private`. */
   "subscription-self-lock",
   /** The backend spends the owner's money and they have not agreed to share it. */
   "metered-no-spend-consent",
@@ -315,17 +321,15 @@ function matchAudience(job, daemon) {
     case "private":
       return refuse("offer-scope-too-narrow");
     case "team":
-      return daemon.locallyAllows(job.owner) ? ALLOWED : refuse("not-locally-allowed");
-    case "public":
-      return ALLOWED;
+      return daemon.admits(job.owner) ? ALLOWED : refuse("not-locally-allowed");
   }
 }
 var REFUSAL_MESSAGES = Object.freeze({
   "no-capability": "no backend on this device is configured and healthy for that job kind",
   "audience-self-other-owner": "the job is private to its owner and this device is paired to someone else",
-  "not-locally-allowed": "the job's owner is not on this device's allowlist (byollm allow <server> <user>)",
+  "not-locally-allowed": "nothing this device can verify says the job's owner may use it",
   "not-in-server-allowlist": "the app restricted this job to named runners and this device is not one of them",
-  "offer-scope-too-narrow": "this backend is offered to its owner only (byollm offer <backend> named|public to widen)",
+  "offer-scope-too-narrow": "this service is offered to its owner only (`byollm offer <service> team` to widen)",
   "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting",
   "metered-no-spend-consent": "this backend bills its owner per token, and they have not agreed to spend it on other people's work",
   "metered-ceiling-reached": "this backend is shared but has reached the spend ceiling its owner set"
@@ -344,7 +348,7 @@ var PAYLOAD_LIMITS = Object.freeze({
 var ChatMessage = z3.object({
   role: z3.enum(["system", "user", "assistant"]),
   content: z3.string().max(PAYLOAD_LIMITS.maxTextChars)
-});
+}).strict();
 var GeneratePayload = z3.object({
   prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
@@ -366,8 +370,11 @@ var ChatPayload = z3.object({
 var JobKind = z3.enum(["llm.generate", "llm.chat"]);
 var JOB_KINDS = Object.freeze(JobKind.options);
 var KindedPayload = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }),
-  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload })
+  // Strict on the wrappers too. A union member that strips is a door beside
+  // the one that is locked: the payloads inside are strict, and an extra key
+  // on the envelope vanished just as quietly.
+  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }).strict(),
+  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload }).strict()
 ]);
 function isJobKind(value) {
   return JOB_KINDS.includes(value);
@@ -384,8 +391,243 @@ function payloadTextLength(kinded) {
 }
 
 // src/job.ts
+import { z as z6 } from "zod";
+
+// src/grant.ts
+import { Buffer as Buffer2 } from "buffer";
+import { z as z5 } from "zod";
+
+// src/keys.ts
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify
+} from "crypto";
 import { z as z4 } from "zod";
-var JobState = z4.enum([
+var PublicIdentity = z4.object({
+  /** Raw Ed25519 public key. The pinned one. */
+  identity: z4.string().min(1),
+  /** Raw X25519 public key, for sealing to this party. */
+  encryption: z4.string().min(1),
+  /**
+   * Ed25519 signature over the encryption key, by the identity key.
+   *
+   * This is what stops an upstream substituting an encryption key of its
+   * own while relaying a genuine identity: the receiver pins the identity
+   * and refuses any encryption key not signed by it.
+   */
+  encryptionSig: z4.string().min(1)
+}).strict();
+var StoredKeys = z4.object({
+  version: z4.literal(1),
+  identityPublic: z4.string().min(1),
+  identityPrivate: z4.string().min(1),
+  encryptionPublic: z4.string().min(1),
+  encryptionPrivate: z4.string().min(1),
+  encryptionSig: z4.string().min(1),
+  createdAt: z4.number().int().positive()
+}).strict();
+var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
+function rawPublic(key) {
+  const jwk = key.export({ format: "jwk" });
+  const x = jwk.x;
+  if (typeof x !== "string") throw new Error("key has no raw public component");
+  return x;
+}
+function importPublic(raw, crv) {
+  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
+}
+function importPrivate(stored) {
+  return createPrivateKey({
+    key: Buffer.from(stored, "base64"),
+    type: "pkcs8",
+    format: "der"
+  });
+}
+var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
+function generateKeys(now) {
+  const identity = generateKeyPairSync("ed25519");
+  const encryption = generateKeyPairSync("x25519");
+  const encryptionPublic = rawPublic(encryption.publicKey);
+  return {
+    version: 1,
+    identityPublic: rawPublic(identity.publicKey),
+    identityPrivate: exportPrivate(identity.privateKey),
+    encryptionPublic,
+    encryptionPrivate: exportPrivate(encryption.privateKey),
+    encryptionSig: sign(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
+      identity.privateKey
+    ).toString("base64url"),
+    createdAt: now
+  };
+}
+function publicIdentityOf(keys) {
+  return {
+    identity: keys.identityPublic,
+    encryption: keys.encryptionPublic,
+    encryptionSig: keys.encryptionSig
+  };
+}
+function verifyPublicIdentity(identity) {
+  try {
+    return verify(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
+      importPublic(identity.identity, "Ed25519"),
+      Buffer.from(identity.encryptionSig, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
+    "base64url"
+  );
+}
+function verifyWith(identityPublic, data, signature) {
+  try {
+    return verify(
+      null,
+      data,
+      importPublic(identityPublic, "Ed25519"),
+      Buffer.from(signature, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function fingerprint(identityPublic) {
+  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of digest.subarray(0, 15)) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET.charAt(value >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  const groups = out.match(/.{1,4}/g) ?? [];
+  return `BYOLLM-${groups.join("-")}`;
+}
+var keyId = (identityPublic) => fingerprint(identityPublic);
+
+// src/grant.ts
+var GRANT_MAX_AGE_MS = 12e4;
+var CLOCK_SKEW_WARN_MS = 3e4;
+var CLOCK_ATTRIBUTION_MS = 5e3;
+var GRANT_CONTEXT = "byollm/v1/grant";
+var SignedGrant = z5.object({
+  /**
+   * This grant's own id — what makes it single-use.
+   *
+   * **Not the job id, and the difference is load-bearing.** Binding
+   * single-use to `jobId` would refuse a legitimate retry: a claim that
+   * times out is re-claimed, the control plane authors a second grant for
+   * the same job, and a device that recorded the job id as spent would
+   * reject its own recovery. A fresh id per authorship replays nothing and
+   * retries fine.
+   */
+  grantId: z5.string().min(1),
+  /**
+   * The job this grant admits, and only this one.
+   *
+   * A grant lifted from one job and presented for another is the obvious
+   * attack, and this field is why it fails.
+   */
+  jobId: z5.string().min(1),
+  /**
+   * The site the work came from, **as a key id** — byollm-review 2026-08-27.
+   *
+   * This was `siteId`, holding the site's id in the control plane's
+   * namespace, and it was signed by the engine and read by nobody. A signed
+   * field nobody checks is not a weak guarantee, it is the appearance of
+   * one: the design says "the grant carries the site", and nothing anywhere
+   * compared it to anything.
+   *
+   * It could not be compared. Job ids are chosen per site, so a grant
+   * authored for (site A, `job_1`) satisfied every device check against a
+   * stub naming (site B, `job_1`) — but the device holds sites only by the
+   * key ids it pinned, and had no way to relate a control-plane uuid to
+   * one. Checking the field would have meant a lookup through the party the
+   * grant exists to distrust.
+   *
+   * So the namespace changes to the one the device already has, and the
+   * name changes with it: this is the same value as {@link JobStub.site},
+   * compared directly, no lookup and nothing to believe. The control-plane
+   * id is not carried alongside — it had no reader, and keeping an
+   * unchecked field beside a checked one is how this hole was dug.
+   */
+  site: z5.string().min(1),
+  /** Whose job it is — the person the site enqueued for. */
+  user: z5.string().min(1),
+  /**
+   * Whose device it is for.
+   *
+   * Passed to {@link verifyGrant} rather than read out of the document, for
+   * the reason every verifier here takes its subject as an argument: a
+   * verifier that recovered the owner from the signed bytes would accept a
+   * genuine grant belonging to somebody else and pass every check.
+   */
+  owner: z5.string().min(1),
+  /** The site purpose this job serves — byollm_016 Amendment L. */
+  purpose: z5.string().min(1),
+  /** The kind of work. */
+  kind: z5.string().min(1),
+  /**
+   * The service the control plane resolved this (purpose, kind) to, from
+   * the user's own mapping.
+   *
+   * Selection is the control plane's; **offer-consistency is the
+   * device's**. A device verifies it actually offers this service, at a
+   * scope that includes {@link user}, before running anything.
+   */
+  service: z5.string().min(1),
+  /** When the control plane signed it — epoch ms, the only anchor for age. */
+  issuedAt: z5.number().int().positive(),
+  /** Base64url Ed25519 over {@link grantStatement}. */
+  signature: z5.string().min(1)
+}).strict();
+var GRANT_SIGNED_FIELDS = Object.freeze(
+  Object.keys(SignedGrant.shape).filter((key) => key !== "signature").sort()
+);
+function grantStatement(claims) {
+  return Buffer2.from(
+    JSON.stringify([
+      GRANT_CONTEXT,
+      ...GRANT_SIGNED_FIELDS.map((field) => claims[field])
+    ]),
+    "utf8"
+  );
+}
+function signGrant(keys, claims) {
+  return { ...claims, signature: signWith(keys, grantStatement(claims)) };
+}
+function verifyGrant(input) {
+  const { grant, now } = input;
+  if (grant.owner !== input.owner) return "wrong-owner";
+  if (grant.jobId !== input.jobId) return "wrong-job";
+  const age = now - grant.issuedAt;
+  if (age < -CLOCK_SKEW_WARN_MS) return "from-the-future";
+  if (age > (input.maxAgeMs ?? GRANT_MAX_AGE_MS)) return "expired";
+  return verifyWith(
+    input.controlPlanePublic,
+    grantStatement(grant),
+    grant.signature
+  ) ? null : "bad-signature";
+}
+
+// src/job.ts
+var JobState = z6.enum([
   "queued",
   "claimed",
   "running",
@@ -417,7 +659,7 @@ var TRANSITIONS = Object.freeze({
 function canTransition(from, to) {
   return TRANSITIONS[from].includes(to);
 }
-var Lease = z4.object({
+var Lease = z6.object({
   /**
    * Identifies *this* grant, not just its holder.
    *
@@ -432,20 +674,20 @@ var Lease = z4.object({
    * and release *is*, per lease, but not across leases, because nothing in
    * the request said which one.
    */
-  id: z4.string().min(1),
+  id: z6.string().min(1),
   /** The runner holding the lease. */
-  runnerId: z4.string().min(1),
+  runnerId: z6.string().min(1),
   /** Epoch milliseconds after which the claim is void. */
-  expiresAt: z4.number().int().positive()
-});
-var JobPayload = z4.union([GeneratePayload, ChatPayload]);
-var ClaimedJob = z4.object({
-  id: z4.string().min(1),
+  expiresAt: z6.number().int().positive()
+}).strict();
+var JobPayload = z6.union([GeneratePayload, ChatPayload]);
+var ClaimedJob = z6.object({
+  id: z6.string().min(1),
   kind: JobKind,
   payload: JobPayload,
   audience: Audience,
   /** The app's id for the user who enqueued it. */
-  owner: z4.string().min(1),
+  owner: z6.string().min(1),
   /**
    * Which site's job — V1-3.
    *
@@ -458,39 +700,42 @@ var ClaimedJob = z4.object({
    * one, and so this reads as what it is: a fact about where the work came
    * from, not a second copy of the routing key.
    */
-  site: z4.string().min(1).optional(),
+  site: z6.string().min(1).optional(),
   /**
-   * Which service the site named, if it named one — byollm_016 Phase B.
+   * Which of the owner's services runs this — resolved, not requested.
+   *
+   * The daemon picks the backend from this, so it has to be the answer
+   * rather than a wish. On a relayed route it is copied off the **grant**,
+   * where a control plane put the person's own mapping and signed it; a
+   * site never named it and could not.
    *
-   * The same shape `site` documents above, and added for the same reason:
-   * the stub carries it, the opened job did not, and everything downstream
-   * of the payload lost it. Here that loss was not cosmetic — the daemon
-   * picks the backend from this, so a job that selected a non-default
-   * service would have been served by the default instead, which is the
-   * substitution `NO_PAYLOAD_ROUTING` forbids.
+   * It used to be what the site asked for, which made a job that selected a
+   * non-default service liable to be served by the default instead — the
+   * substitution `NO_PAYLOAD_ROUTING` forbids. Amendment L removed the
+   * asking; what is left is the answering.
    *
-   * Optional, because absent means "the owner's default" and that is every
-   * job written before selection existed.
+   * Optional, because direct mode has no control plane to resolve anything
+   * and the owner's own defaults answer under the ambiguity law.
    */
-  service: z4.string().min(1).optional(),
+  service: z6.string().min(1).optional(),
   lease: Lease
 }).strict();
-var ResultProvenance = z4.object({
+var ResultProvenance = z6.object({
   /** The audience the job ran under. */
   audience: Audience,
   /** The runner that produced it. */
-  runnerId: z4.string().min(1),
+  runnerId: z6.string().min(1),
   /** The runner owner's id in this app's namespace. */
-  runnerOwner: z4.string().min(1),
+  runnerOwner: z6.string().min(1),
   /** Which backend class produced it — an HTTP call or a sandboxed spawn. */
   backendClass: BackendClass,
   /** The model the runner reports having used. */
-  model: z4.string().min(1),
+  model: z6.string().min(1),
   /**
    * False only for `self` jobs. When true the app MUST treat `text` as
    * untrusted third-party content.
    */
-  untrusted: z4.boolean()
+  untrusted: z6.boolean()
 }).strict();
 function provenanceFor(input) {
   return {
@@ -502,62 +747,47 @@ function provenanceFor(input) {
     untrusted: input.audience !== "private"
   };
 }
-var RunMetadata = z4.object({
+var RunMetadata = z6.object({
   /** Which model actually served it. */
-  model: z4.string().min(1),
+  model: z6.string().min(1),
   backendClass: BackendClass,
   /** Wall-clock milliseconds the backend call took. */
-  durationMs: z4.number().int().nonnegative()
+  durationMs: z6.number().int().nonnegative()
 }).strict();
-var JobResultOk = z4.object({
-  outcome: z4.literal("ok"),
-  text: z4.string(),
+var JobResultOk = z6.object({
+  outcome: z6.literal("ok"),
+  text: z6.string(),
   /** Optional reference to a stored artifact; never a local path. */
-  artifactUrl: z4.url().optional()
+  artifactUrl: z6.url().optional()
 }).strict();
-var JobResultError = z4.object({
-  outcome: z4.literal("error"),
-  code: z4.string().min(1),
-  message: z4.string().min(1),
+var JobResultError = z6.object({
+  outcome: z6.literal("error"),
+  code: z6.string().min(1),
+  message: z6.string().min(1),
   /** Whether the app may reasonably re-enqueue. */
-  retryable: z4.boolean()
+  retryable: z6.boolean()
 }).strict();
-var JobResultCanceled = z4.object({
-  outcome: z4.literal("canceled")
+var JobResultCanceled = z6.object({
+  outcome: z6.literal("canceled")
 }).strict();
-var JobOutcome = z4.discriminatedUnion("outcome", [
+var JobOutcome = z6.discriminatedUnion("outcome", [
   JobResultOk,
   JobResultError,
   JobResultCanceled
 ]);
-var RefusalReason = z4.enum([
-  /**
-   * A selection this requester cannot be served — byollm_016 Phase B.
-   *
-   * **One value for two causes, and the collapse is the security property.**
-   * A named service may be unknown to this owner, or known and not offered to
-   * this requester. Those are different facts and the requester may learn
-   * neither, because telling them apart turns refusal wording into an
-   * inventory oracle: probe names, sort the answers, and enumerate a device
-   * you were never offered. The finer cause lives owner-side, where the person
-   * reading it already owns the machine — see {@link SelectionFailure}.
-   *
-   * The first draft of this enum had both causes on the wire with a comment
-   * claiming they disclosed identically. They did not; the comment described a
-   * property the code lacked, which is the more dangerous half of that mistake.
-   */
-  "select-unavailable",
+var RefusalReason = z6.enum([
   /**
    * Two or more services answer this kind and the owner has named no default,
    * so the kind is withheld. Nobody may pick on the owner's behalf — the wrong
    * guess is the metered one.
    *
-   * Not collapsed into the value above, and the reason is that a kind is not
-   * probeable. There are two kinds; a requester asking about one is not
-   * enumerating a namespace, and learns nothing they could not learn by
-   * looking at what the device advertises. It is also already what a roster
-   * member sees on the devices page — `awaitingDefault` carries exactly this,
-   * by kind, for exactly this reason.
+   * Told apart from its neighbour deliberately, and the line is whether a
+   * requester can walk a namespace. There are two kinds; asking about one
+   * enumerates nothing they could not learn from what the device advertises,
+   * and the difference is actionable — "the owner has not chosen" is fixable
+   * by the owner, "the default cannot serve you" is not. It is also already
+   * what a team member sees on the devices page: `awaitingDefault` carries
+   * exactly this, by kind, for exactly this reason.
    */
   "default-ambiguity",
   /**
@@ -566,34 +796,28 @@ var RefusalReason = z4.enum([
    *
    * The specimen: an owner's default for `llm.chat` is their Claude
    * subscription, self-locked by `SUBSCRIPTION_SELF_LOCK`. A team member's
-   * unselected job resolves to it and can never be served by it. That must be
-   * a refusal on the spot, not a wait that expires an hour later looking like
-   * nobody was online.
+   * job resolves to it and can never be served by it. That must be a refusal
+   * on the spot, not a wait that expires an hour later looking like nobody
+   * was online.
    *
-   * Bounded like the value above and probeable for the same reason it is not:
-   * the requester named nothing, so there is no name space to walk.
+   * Bounded like the value above, and unprobeable for the same reason: the
+   * requester named nothing, so there is no name space to walk.
    */
   "default-unusable"
 ]);
-var JobRefused = z4.object({
-  outcome: z4.literal("refused"),
+var JobRefused = z6.object({
+  outcome: z6.literal("refused"),
   reason: RefusalReason,
   /** Plain words for a human reading a log, never parsed. */
-  message: z4.string().min(1)
+  message: z6.string().min(1)
 }).strict();
 var REFUSAL_TEXT = Object.freeze({
-  "select-unavailable": "that service is not available to you on this device",
   "default-ambiguity": "this device serves that kind from more than one service and its owner has not chosen which",
   "default-unusable": "this device's default for that kind cannot run work for you"
 });
-var REFUSED_SELECTION = Object.freeze({
-  outcome: "refused",
-  reason: "select-unavailable",
-  message: REFUSAL_TEXT["select-unavailable"]
-});
-var SealedOutcome = z4.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
-var DeliveredResult = z4.object({
-  jobId: z4.string().min(1),
+var SealedOutcome = z6.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
+var DeliveredResult = z6.object({
+  jobId: z6.string().min(1),
   state: JobState,
   outcome: JobOutcome.optional(),
   provenance: ResultProvenance.optional(),
@@ -611,9 +835,9 @@ var DeliveredResult = z4.object({
    * runner ran the job, and the *server* stamps it — an app cannot supply
    * a substitute that hides what it is.
    */
-  fallback: z4.literal(true).optional()
+  fallback: z6.literal(true).optional()
 }).strict();
-var SizeClass = z4.enum(["small", "medium", "large", "unbounded"]);
+var SizeClass = z6.enum(["small", "medium", "large", "unbounded"]);
 var SIZE_CLASS_LIMITS = Object.freeze({
   small: 4e3,
   medium: 64e3,
@@ -628,11 +852,11 @@ function sizeClassOf(textChars) {
   if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
   return "large";
 }
-var JobStub = z4.object({
-  id: z4.string().min(1),
+var JobStub = z6.object({
+  id: z6.string().min(1),
   kind: JobKind,
   /** The app's id for the user who enqueued it. */
-  owner: z4.string().min(1),
+  owner: z6.string().min(1),
   /**
    * Which site this job belongs to — byollm_009 Amendment A §A.3.
    *
@@ -656,13 +880,13 @@ var JobStub = z4.object({
    * overlap window, and a daemon re-keys its own map by verifying that
    * signature against the key it already pinned (§A.3.1).
    */
-  site: z4.string().min(1),
+  site: z6.string().min(1),
   audience: Audience,
   // `audienceAllow` is **not** here, and its absence is the enforcement —
   // cloud_008 §0.2.
   //
   // It was a list of the people who may run a job, travelling to every
-  // routing party on every `named` job. byollm_001 Rev 1 §B settled who
+  // routing party on every shared job. byollm_001 Rev 1 §B settled who
   // decides that long before this schema existed: *the daemon's own list
   // decides, not the server's*, and `allowlist.predicateFor(origin)` is the
   // enforcement in both lanes. So this was a second answer to a question the
@@ -679,181 +903,68 @@ var JobStub = z4.object({
   // with it before offering. That is server-internal, where the party
   // holding the list authored it.
   /**
-   * Which of the owner's services should answer — byollm_016 Phase B.
-   *
-   * **A selection from a menu, never a demand.** The owner advertises named
-   * services; a site may name one of them, and that is the entire power the
-   * field grants. It carries no model, no base URL, no flags — the daemon
-   * resolves the name against its own config and nothing else, so what
-   * actually runs is still decided exclusively by the person who owns the
-   * hardware. A name that is not on that owner's menu is refused
-   * (`select-unadvertised`), never silently substituted, because a
-   * substitution is how "select" would quietly become "whatever we had".
-   *
-   * Absent means "the owner's default for this kind", which is the only
-   * behaviour Phase A had.
-   *
-   * It travels because the router matches on it, under the rule the absent
-   * `audienceAllow` above establishes: *a class the router acts on may
-   * travel; membership never does.* This is a class.
-   *
-   * It is a **stub** field and never a payload field, which is the line
+   * Which of the site's declared purposes this job serves — Amendment L.
+   *
+   * **A need, never a name.** The site's vocabulary is its own purposes;
+   * the person's is their services; and the two never meet. This field says
+   * "writing-assistant", and a control plane joins it to whatever that
+   * person mapped it to. The site learns only whether the slot was
+   * satisfiable.
+   *
+   * It replaced `service`, which let a site name one of the owner's
+   * services directly. That field is gone from both routes (Amendment L
+   * rider) and its refusal machinery with it — including the collapsed
+   * `select-unavailable`, which existed so that "no such service" and "not
+   * offered to you" could not be told apart. There is nothing left to
+   * probe: **a vocabulary that never crosses the boundary cannot be
+   * enumerated across it**, which is a stronger guarantee than the one the
+   * collapse gave.
+   *
+   * It travels for the reason the absent `audienceAllow` establishes: *a
+   * class the router acts on may travel; membership never does.* A purpose
+   * is a class, and the control plane acts on it.
+   *
+   * Optional because direct mode has no control plane to hold a mapping and
+   * is kind-only: the owner's own config and defaults answer, under the
+   * ambiguity law as shipped. Absent on a relayed route resolves against
+   * the site's reserved purpose, which a site that declared its own
+   * purposes will not have mapped — so the slot reads as unmapped and the
+   * site falls back, loudly enough and without a special case.
+   *
+   * A **stub** field and never a payload field, which is the line
    * `NO_PAYLOAD_ROUTING` draws: the prompt cannot reach it, so no amount of
    * user text can influence what runs.
    */
-  service: z4.string().min(1).optional(),
+  purpose: z6.string().min(1).optional(),
   sizeClass: SizeClass,
   /** Reserved for byollm_006. False until streaming exists. */
-  streaming: z4.boolean(),
+  streaming: z6.boolean(),
   /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
-  deadlineAt: z4.number().int().positive()
+  deadlineAt: z6.number().int().positive()
+}).strict();
+var ClaimedStub = JobStub.extend({
+  lease: Lease,
+  grant: SignedGrant.optional()
 }).strict();
-var ClaimedStub = JobStub.extend({ lease: Lease }).strict();
 
 // src/envelope.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
 import sodium from "libsodium-wrappers";
-import { z as z6 } from "zod";
-
-// src/keys.ts
-import {
-  createHash,
-  createPrivateKey,
-  createPublicKey,
-  generateKeyPairSync,
-  sign,
-  verify
-} from "crypto";
-import { z as z5 } from "zod";
-var PublicIdentity = z5.object({
-  /** Raw Ed25519 public key. The pinned one. */
-  identity: z5.string().min(1),
-  /** Raw X25519 public key, for sealing to this party. */
-  encryption: z5.string().min(1),
-  /**
-   * Ed25519 signature over the encryption key, by the identity key.
-   *
-   * This is what stops an upstream substituting an encryption key of its
-   * own while relaying a genuine identity: the receiver pins the identity
-   * and refuses any encryption key not signed by it.
-   */
-  encryptionSig: z5.string().min(1)
-}).strict();
-var StoredKeys = z5.object({
-  version: z5.literal(1),
-  identityPublic: z5.string().min(1),
-  identityPrivate: z5.string().min(1),
-  encryptionPublic: z5.string().min(1),
-  encryptionPrivate: z5.string().min(1),
-  encryptionSig: z5.string().min(1),
-  createdAt: z5.number().int().positive()
-}).strict();
-var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
-function rawPublic(key) {
-  const jwk = key.export({ format: "jwk" });
-  const x = jwk.x;
-  if (typeof x !== "string") throw new Error("key has no raw public component");
-  return x;
-}
-function importPublic(raw, crv) {
-  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
-}
-function importPrivate(stored) {
-  return createPrivateKey({
-    key: Buffer.from(stored, "base64"),
-    type: "pkcs8",
-    format: "der"
-  });
-}
-var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
-function generateKeys(now) {
-  const identity = generateKeyPairSync("ed25519");
-  const encryption = generateKeyPairSync("x25519");
-  const encryptionPublic = rawPublic(encryption.publicKey);
-  return {
-    version: 1,
-    identityPublic: rawPublic(identity.publicKey),
-    identityPrivate: exportPrivate(identity.privateKey),
-    encryptionPublic,
-    encryptionPrivate: exportPrivate(encryption.privateKey),
-    encryptionSig: sign(
-      null,
-      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
-      identity.privateKey
-    ).toString("base64url"),
-    createdAt: now
-  };
-}
-function publicIdentityOf(keys) {
-  return {
-    identity: keys.identityPublic,
-    encryption: keys.encryptionPublic,
-    encryptionSig: keys.encryptionSig
-  };
-}
-function verifyPublicIdentity(identity) {
-  try {
-    return verify(
-      null,
-      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
-      importPublic(identity.identity, "Ed25519"),
-      Buffer.from(identity.encryptionSig, "base64url")
-    );
-  } catch {
-    return false;
-  }
-}
-function signWith(keys, data) {
-  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
-    "base64url"
-  );
-}
-function verifyWith(identityPublic, data, signature) {
-  try {
-    return verify(
-      null,
-      data,
-      importPublic(identityPublic, "Ed25519"),
-      Buffer.from(signature, "base64url")
-    );
-  } catch {
-    return false;
-  }
-}
-var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function fingerprint(identityPublic) {
-  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
-  let bits = 0;
-  let value = 0;
-  let out = "";
-  for (const byte of digest.subarray(0, 15)) {
-    value = value << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      out += ALPHABET.charAt(value >>> bits - 5 & 31);
-      bits -= 5;
-    }
-  }
-  const groups = out.match(/.{1,4}/g) ?? [];
-  return `BYOLLM-${groups.join("-")}`;
-}
-var keyId = (identityPublic) => fingerprint(identityPublic);
-
-// src/envelope.ts
+import { z as z7 } from "zod";
 var readied;
 async function cryptoReady() {
   readied ??= sodium.ready;
   await readied;
 }
 var ENVELOPE_MAX_AGE_MS = 24 * 60 * 6e4;
-var EnvelopeDirection = z6.enum(["payload", "result"]);
-var SealedEnvelope = z6.object({
+var EnvelopeDirection = z7.enum(["payload", "result"]);
+var SealedEnvelope = z7.object({
   /** Base64url `crypto_box_seal` output over the signed plaintext. */
-  ciphertext: z6.string().min(1),
+  ciphertext: z7.string().min(1),
   /** Who this was sealed to — the recipient checks it is them. */
-  recipientKeyId: z6.string().min(1),
+  recipientKeyId: z7.string().min(1),
   /** Who signed it — the recipient checks this against its pin. */
-  senderKeyId: z6.string().min(1),
+  senderKeyId: z7.string().min(1),
   direction: EnvelopeDirection,
   /**
    * When this ciphertext stops being worth keeping.
@@ -867,7 +978,7 @@ var SealedEnvelope = z6.object({
    * Not trusted as written: it is also inside the signature, so a changed
    * deadline fails to verify.
    */
-  deadlineAt: z6.number().int().positive()
+  deadlineAt: z7.number().int().positive()
 }).strict();
 function signedBody(context, plaintext) {
   return Buffer.from(
@@ -962,15 +1073,15 @@ async function open(input) {
 
 // src/signing.ts
 import { createHash as createHash2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var MAX_CLOCK_SKEW_MS = 12e4;
-var RequestSignature = z7.object({
+var RequestSignature = z8.object({
   /** Which runner is calling. The server looks up its pinned identity. */
-  runnerId: z7.string().min(1),
+  runnerId: z8.string().min(1),
   /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
-  issuedAt: z7.number().int().positive(),
+  issuedAt: z8.number().int().positive(),
   /** Base64url Ed25519 signature over {@link canonicalRequest}. */
-  signature: z7.string().min(1)
+  signature: z8.string().min(1)
 }).strict();
 function canonicalRequest(input) {
   const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
@@ -1023,73 +1134,62 @@ function verifyRequest(input) {
   return ok ? null : "bad-signature";
 }
 
-// src/roster.ts
-import { Buffer as Buffer2 } from "buffer";
-import { z as z8 } from "zod";
-var ROSTER_MAX_AGE_MS = 60 * 6e4;
-var ROSTER_CONTEXT = "byollm/v1/roster";
-var SignedRoster = z8.object({
-  /** Whose devices this roster governs. */
-  owner: z8.string().min(1),
+// src/manifest.ts
+import { z as z9 } from "zod";
+var RESERVED_PURPOSE = "default";
+var RENDERABLE = /^[^\p{Cc}\p{Cf}\p{Cs}\p{Co}]+$/u;
+var renderable = (max, what) => z9.string().min(1).max(max).regex(
+  RENDERABLE,
+  `a ${what} is text a person reads \u2014 no control characters, direction overrides or zero-width padding`
+).refine((value) => value.trim() !== "", {
+  message: `a ${what} cannot be blank`
+});
+var PurposeKey = z9.string().regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "a purpose key is a lowercase slug \u2014 letters, digits and hyphens"
+).max(64);
+var Purpose = z9.object({
   /**
-   * Who may have their `team` work run on this owner's devices.
+   * What a person reads on the consent screen. The only rendered field.
    *
-   * Owner ids, sorted, so the same membership always produces the same
-   * bytes — a document that differed by iteration order would produce a new
-   * signature every read and no way to tell a change from a shuffle.
+   * Declared rather than derived from the key, because a key is a
+   * compromise between machines and this is not. "Writing Assistant" is
+   * what somebody understands; `writing-assistant` is what travels.
    */
-  members: z8.array(z8.string().min(1)),
+  label: renderable(80, "label"),
+  /** One line of context for the consent screen. Optional. */
+  description: renderable(280, "description").optional(),
   /**
-   * When the control plane signed it — epoch ms, and the **only** honest
-   * anchor for age.
+   * The kinds this purpose uses.
    *
-   * Not when the daemon received it. A relay that simply withholds updates
-   * would otherwise keep a removed member served forever, which is the
-   * attack {@link ROSTER_MAX_AGE_MS} exists to bound.
+   * A purpose may span kinds, and a mapping is per (purpose, kind) — so a
+   * person can send this purpose's chat to one service and its generation
+   * to another. Listing a kind here is what makes that slot appear.
    */
-  issuedAt: z8.number().int().positive(),
-  /** Base64url Ed25519 over {@link rosterStatement}. */
-  signature: z8.string().min(1)
+  kinds: z9.array(JobKind).min(1).max(JOB_KINDS.length).refine((kinds) => new Set(kinds).size === kinds.length, {
+    message: "a purpose lists each kind once"
+  })
 }).strict();
-function rosterStatement(input) {
-  return Buffer2.from(
-    [
-      ROSTER_CONTEXT,
-      input.owner,
-      String(input.issuedAt),
-      [...input.members].sort().join("\0")
-    ].join("\n"),
-    "utf8"
-  );
-}
-function signRoster(keys, input) {
-  const members = [...input.members].sort();
+var MAX_PURPOSES = 32;
+var Manifest = z9.record(PurposeKey, Purpose).refine((manifest) => Object.keys(manifest).length > 0, {
+  message: "a manifest declares at least one purpose"
+}).refine((manifest) => Object.keys(manifest).length <= MAX_PURPOSES, {
+  message: `a manifest declares at most ${String(MAX_PURPOSES)} purposes \u2014 a consent screen is a set of questions somebody answers one at a time`
+}).refine((manifest) => !(RESERVED_PURPOSE in manifest), {
+  message: `"${RESERVED_PURPOSE}" is reserved for a site that declares no purposes of its own \u2014 give this one a name from your own vocabulary`
+});
+function singlePurposeManifest(input) {
   return {
-    owner: input.owner,
-    members,
-    issuedAt: input.issuedAt,
-    signature: signWith(keys, rosterStatement({ ...input, members }))
+    [RESERVED_PURPOSE]: { label: input.label, kinds: [...input.kinds] }
   };
 }
-function verifyRoster(input) {
-  const { roster, owner, now } = input;
-  if (roster.owner !== owner) return "wrong-owner";
-  const age = now - roster.issuedAt;
-  if (age < 0) return "from-the-future";
-  if (age > (input.maxAgeMs ?? ROSTER_MAX_AGE_MS)) return "stale";
-  return verifyWith(
-    input.controlPlanePublic,
-    rosterStatement(roster),
-    roster.signature
-  ) ? null : "bad-signature";
-}
 
 // src/succession.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var SUCCESSION_CONTEXT = "byollm/v1/site-succession";
 var RETIREMENT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 var MAX_SUCCESSION_CHAIN = 64;
-var Succession = z9.object({
+var Succession = z10.object({
   /**
    * The predecessor's public identity — K1, in full.
    *
@@ -1099,7 +1199,7 @@ var Succession = z9.object({
    */
   identity: PublicIdentity,
   /** K1's signature over the statement naming K1 and its successor. */
-  signature: z9.string().min(1)
+  signature: z10.string().min(1)
 }).strict();
 function successionStatement(fromKeyId, toKeyId) {
   return Buffer.from(`${SUCCESSION_CONTEXT}:${fromKeyId}:${toKeyId}`);
@@ -1193,13 +1293,15 @@ var MUSTS = Object.freeze({
   }),
   SITES_LOCALLY_APPROVED: must({
     id: "SITES_LOCALLY_APPROVED",
-    statement: "A daemon MUST NOT run work for a site it has not approved on the machine itself. An upstream may propose a site set; a site the daemon has never approved MUST be offered to its owner and served nothing until they approve it. A key that has changed for an already-approved id MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already approved, over a statement naming both key ids MUST be accepted without a new local approval \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently.",
+    statement: "A daemon MUST NOT run work for a site on an upstream's word alone. An upstream may propose a site set; work for any site in it MUST additionally carry a grant signed by the control-plane key this daemon pinned at pairing. A key that has changed for an id this daemon already pinned MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already pinned, over a statement naming both key ids MUST be accepted \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently. The first job from a site this daemon has never served MUST be announced at the machine.",
     enforcedBy: "daemon",
     // Two kinds, and the second is the one that matters — V1-1.
     //
     // `construction`: the daemon cannot serve a site that is not in its
-    // pinned map, and admission refuses before a payload is fetched, so the
-    // ordinary path cannot reach a site nobody approved.
+    // pinned map, and admission refuses before a payload is fetched — and
+    // since byollm_016 Amendment K, being in the map is no longer sufficient
+    // either: a signed grant is, and the relay proposing the set cannot
+    // produce one.
     //
     // `adversarial`: the property that survives is about a *sequence* —
     // remove the id, re-offer it under a different key — which no honest
@@ -1352,7 +1454,7 @@ var MUSTS = Object.freeze({
   }),
   NAMED_LOCAL_ALLOWLIST: must({
     id: "NAMED_LOCAL_ALLOWLIST",
-    statement: "A 'named' job MUST be admitted only by the daemon's own local (server origin, user id) allowlist \u2014 never on the server's assertion alone.",
+    statement: "A 'team' job MUST be admitted only by something the device itself verified, keyed by (server origin, user id) \u2014 never on the routing party's assertion alone.",
     enforcedBy: "daemon",
     verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B"
@@ -1578,7 +1680,7 @@ function mustsVerifiedBy(kind) {
 }
 
 // src/wire.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var PROTOCOL_VERSION = "0";
 var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
   PROTOCOL_VERSION
@@ -1621,47 +1723,45 @@ var ENDPOINTS = Object.freeze([
   "result",
   "release"
 ]);
-var Capability = z10.object({
+var Capability = z11.object({
   kind: JobKind,
   /**
    * The owner's name for the service answering this kind — byollm_016.
    *
    * A device advertises *which* of its services serves a kind, not merely
-   * that something does. Phase B lets a job select by this name; until then
-   * it is what a device page shows and what a default is chosen between.
+   * that something does. **A site never sees this**, and never did after
+   * Amendment L: it is what a control plane resolves a person's mapping
+   * against, so that the service a grant names is one this device actually
+   * offers rather than one somebody invented.
+   *
+   * `isDefault` used to sit beside it, saying which row an unselected job
+   * took. Nothing selects any more — a job names a purpose and a person's
+   * mapping names a service — so there is no unselected job for a default
+   * to catch, and the field went with the machinery it served.
    */
-  service: z10.string().min(1),
-  /**
-   * Whether this row is the default for its kind.
-   *
-   * Stated rather than inferred from being the only row, which is true in
-   * Phase A and stops being true the moment Phase B advertises every
-   * selectable service per kind. A consumer that learned "default means
-   * alone" would have to unlearn it, and the ones that did not would be
-   * quietly wrong. One field now, no second shape later.
-   */
-  isDefault: z10.boolean(),
+  service: z11.string().min(1),
   backendId: BackendIdSchema,
   backendClass: BackendClass,
-  model: z10.string().min(1),
+  model: z11.string().min(1),
   offerScope: OfferScope
 }).strict();
-var CapabilityMatrix = z10.array(Capability);
-var WithheldKind = z10.object({
+var CapabilityMatrix = z11.array(Capability);
+var WithheldKind = z11.object({
   kind: JobKind,
-  claimants: z10.array(
-    z10.object({ service: z10.string().min(1), offer: OfferScope }).strict()
+  claimants: z11.array(
+    z11.object({ service: z11.string().min(1), offer: OfferScope }).strict()
   ).min(2)
 }).strict();
-var PairStartRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  action: z10.literal("start"),
-  daemon: z10.object({
-    version: z10.string().min(1),
+var GrantRef = z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict();
+var PairStartRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  action: z11.literal("start"),
+  daemon: z11.object({
+    version: z11.string().min(1),
     /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z10.string().min(1).max(120),
-    platform: z10.enum(["darwin", "linux", "win32"])
-  }),
+    label: z11.string().min(1).max(120),
+    platform: z11.enum(["darwin", "linux", "win32"])
+  }).strict(),
   /**
    * This machine's public keys (byollm_009 §5).
    *
@@ -1672,29 +1772,29 @@ var PairStartRequest = z10.object({
   device: PublicIdentity,
   capabilities: CapabilityMatrix
 }).strict();
-var PairStartResponse = z10.object({
+var PairStartResponse = z11.object({
   /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z10.string().min(20),
+  deviceCode: z11.string().min(20),
   /** Short code the user reads and confirms in the browser. */
-  userCode: z10.string().min(4).max(16),
+  userCode: z11.string().min(4).max(16),
   /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z10.url(),
+  verificationUrl: z11.url(),
   /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z10.number().int().positive(),
+  expiresAt: z11.number().int().positive(),
   /** How often the daemon may poll. */
-  pollIntervalMs: z10.number().int().min(500).max(6e4)
+  pollIntervalMs: z11.number().int().min(500).max(6e4)
 }).strict();
-var PairPollRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  action: z10.literal("poll"),
-  deviceCode: z10.string().min(20)
+var PairPollRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  action: z11.literal("poll"),
+  deviceCode: z11.string().min(20)
 }).strict();
-var PairPollResponse = z10.discriminatedUnion("status", [
-  z10.object({ status: z10.literal("pending") }).strict(),
-  z10.object({ status: z10.literal("denied") }).strict(),
-  z10.object({ status: z10.literal("expired") }).strict(),
-  z10.object({
-    status: z10.literal("approved"),
+var PairPollResponse = z11.discriminatedUnion("status", [
+  z11.object({ status: z11.literal("pending") }).strict(),
+  z11.object({ status: z11.literal("denied") }).strict(),
+  z11.object({ status: z11.literal("expired") }).strict(),
+  z11.object({
+    status: z11.literal("approved"),
     // `runnerToken` is gone — cloud_008 §2.4, finding 37.
     //
     // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
@@ -1711,11 +1811,11 @@ var PairPollResponse = z10.discriminatedUnion("status", [
     // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
     // enforced — every authenticated call is signed by the device's pinned
     // identity key. This removes the thing the MUST is named after.
-    runnerId: z10.string().min(1),
+    runnerId: z11.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z10.string().min(1),
+    owner: z11.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z10.string().optional(),
+    ownerLabel: z11.string().optional(),
     /**
      * The sites this pairing covers, for the daemon to pin (byollm_009 §5),
      * keyed by each site's identity key id — cloud_009 §5.
@@ -1734,55 +1834,55 @@ var PairPollResponse = z10.discriminatedUnion("status", [
      * runner's lookup is a map read rather than a join across two
      * namespaces.
      */
-    sites: z10.record(z10.string().min(1), PublicIdentity),
+    sites: z11.record(z11.string().min(1), PublicIdentity),
     /**
-     * The control plane's roster-signing key, pinned here — Amendment G.
+     * The control plane's grant-signing key, pinned here — Amendment J.
      *
      * **Pairing is when, and that is the whole question.** Pairing is
      * already the ceremony where an owner proves out of band that this
      * device is theirs, so a key learned here rides trust that has already
-     * happened. The rejected alternative is trust-on-first-roster, and it
-     * is rejected because it hands the decision back to the relay: a daemon
-     * that learns whose signature to trust from the first roster to arrive
-     * has its membership authority chosen by whoever controls delivery.
+     * happened. The rejected alternative is trust-on-first-grant, and it is
+     * rejected because it hands the decision back to the relay: a daemon
+     * that learns whose signature to trust from the first grant to arrive
+     * has its admission authority chosen by whoever controls delivery.
      *
      * Optional on the wire, and only on the wire: a direct-mode server has
-     * no control plane and signs no rosters, and a daemon that never
-     * receives one simply serves no `team` job through it. It is not
-     * optional for a hub — a hub that omitted it would be asking devices to
-     * accept rosters from nobody in particular.
+     * no control plane and signs nothing, and a daemon that receives no key
+     * serves its owner alone. It is not optional for a relay with a control
+     * plane — one that omitted it would be asking devices to accept grants
+     * from nobody in particular, and would find every job refused.
      *
-     * Rotation is Amendment C's, with no path where a roster teaches a
+     * Rotation is Amendment C's, with no path where a grant teaches a
      * daemon a new key.
      */
-    controlPlanePublic: z10.string().min(1).optional()
+    controlPlanePublic: z11.string().min(1).optional()
   }).strict()
 ]);
-var PairRequest = z10.discriminatedUnion("action", [
+var PairRequest = z11.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  runnerId: z10.string().min(1),
+var ClaimRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z10.number().int().min(1).max(64)
+  max: z11.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z10.object({
+var ClaimResponse = z11.object({
   /**
    * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
    * device claimed — see {@link JobStub} for the exhaustive metadata list.
    */
-  jobs: z10.array(ClaimedStub),
+  jobs: z11.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z10.number().int().positive()
+  leaseMs: z11.number().int().positive()
 }).strict();
-var HeartbeatRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  runnerId: z10.string().min(1),
-  daemonVersion: z10.string().min(1),
+var HeartbeatRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  daemonVersion: z11.string().min(1),
   capabilities: CapabilityMatrix,
   /**
    * Kinds this device is withholding, and why it can be said.
@@ -1791,20 +1891,18 @@ var HeartbeatRequest = z10.object({
    * older daemon against a newer hub is simply a device with no withheld
    * kinds rather than a parse failure.
    */
-  withheld: z10.array(WithheldKind).default([]),
+  withheld: z11.array(WithheldKind).default([]),
   /**
    * Leases this daemon believes it holds; the server renews exactly these.
    *
    * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
    * grant the runner no longer holds — see {@link Lease.id}.
    */
-  activeLeases: z10.array(
-    z10.object({ jobId: z10.string().min(1), leaseId: z10.string().min(1) })
-  ),
+  activeLeases: z11.array(GrantRef),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z10.boolean()
+  paused: z11.boolean()
 }).strict();
-var HeartbeatResponse = z10.object({
+var HeartbeatResponse = z11.object({
   /**
    * The sites this daemon may serve, right now — cloud_008 finding 59.
    *
@@ -1822,7 +1920,7 @@ var HeartbeatResponse = z10.object({
    * rather than being told a second time — two fields for one fact is how
    * they drift.
    */
-  sites: z10.record(z10.string().min(1), PublicIdentity),
+  sites: z11.record(z11.string().min(1), PublicIdentity),
   /**
    * How a site's current key traces back to one this daemon already holds —
    * byollm_009 Amendment C.
@@ -1840,11 +1938,11 @@ var HeartbeatResponse = z10.object({
    * history is public by construction, because a daemon that cannot read it
    * cannot verify it.
    */
-  successions: z10.record(
-    z10.string().min(1),
-    z10.object({
+  successions: z11.record(
+    z11.string().min(1),
+    z11.object({
       /** Oldest last, as the projection carries it. */
-      succeeds: z10.array(Succession).max(MAX_SUCCESSION_CHAIN),
+      succeeds: z11.array(Succession).max(MAX_SUCCESSION_CHAIN),
       /**
        * Until when the superseded key may still sign work — epoch ms.
        *
@@ -1853,7 +1951,7 @@ var HeartbeatResponse = z10.object({
        * window indefinitely would be a two-key site forever, decided by
        * the party this design does not trust.
        */
-      retiringUntil: z10.number().int().positive().optional()
+      retiringUntil: z11.number().int().positive().optional()
     }).strict()
   ).optional(),
   /**
@@ -1866,8 +1964,8 @@ var HeartbeatResponse = z10.object({
    * is the unique grant and the daemon already keys its work by it; this is
    * the same shape `activeLeases` sends in the other direction.
    */
-  cancel: z10.array(
-    z10.object({ jobId: z10.string().min(1), leaseId: z10.string().min(1) }).strict()
+  cancel: z11.array(
+    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
   ),
   // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
   //
@@ -1897,11 +1995,11 @@ var HeartbeatResponse = z10.object({
    * ambiguous across sites, and "the lease you no longer hold" is exactly
    * what this field means anyway.
    */
-  lost: z10.array(
-    z10.object({ jobId: z10.string().min(1), leaseId: z10.string().min(1) }).strict()
+  lost: z11.array(
+    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
   ),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z10.number().int().positive(),
+  serverTime: z11.number().int().positive(),
   /**
    * Sites whose disclosure the user must read again before work moves —
    * cloud_008 finding 48, named rather than counted.
@@ -1916,28 +2014,13 @@ var HeartbeatResponse = z10.object({
    * operator stopped it" — one word with two subjects on two halves of one
    * exchange is a confusion nobody untangles from a log.
    */
-  awaitingConsent: z10.array(z10.string().min(1)),
-  /**
-   * Who this owner's devices may serve `team` work for — Amendment G.
-   *
-   * Carried by the relay and authored by nobody it can reach. The daemon
-   * verifies it against the key pinned at pairing and admits from its own
-   * held copy, so this field is delivery and not instruction: withholding
-   * it narrows a device, and editing it is caught.
-   *
-   * Optional because a roster is a cloud-mode fact — direct mode has no
-   * control plane to author one — and because a daemon that has never
-   * received one must narrow rather than fail. Absent is not "admit
-   * nobody"; {@link ROSTER_MAX_AGE_MS} is what makes absence bite, and it
-   * bites the same way for a roster withheld as for one never sent.
-   */
-  roster: SignedRoster.optional()
+  awaitingConsent: z11.array(z11.string().min(1))
 }).strict();
-var ResultDisposition = z10.enum(["ok", "error", "canceled"]);
-var ResultRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  runnerId: z10.string().min(1),
-  jobId: z10.string().min(1),
+var ResultDisposition = z11.enum(["ok", "error", "canceled"]);
+var ResultRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  jobId: z11.string().min(1),
   /**
    * The grant this result was produced under — cloud_008 §1.4a.
    *
@@ -1960,7 +2043,7 @@ var ResultRequest = z10.object({
    * learned once already, when a replayed release yanked a later grant, and
    * it applies here for the same reason.
    */
-  leaseId: z10.string().min(1),
+  leaseId: z11.string().min(1),
   /**
    * The outcome, sealed to the site and signed by the device.
    *
@@ -1992,12 +2075,12 @@ var ResultRequest = z10.object({
   // on it, so it is a class a routing party consumes. Nobody between the
   // two ends consumes these.
 }).strict();
-var ResultResponse = z10.object({
+var ResultResponse = z11.object({
   /**
    * False when this submission wrote nothing — the daemon should discard,
    * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z10.boolean(),
+  accepted: z11.boolean(),
   /**
    * True when this device had already recorded this job's result.
    *
@@ -2011,13 +2094,13 @@ var ResultResponse = z10.object({
    * the same refusal it would get for a job that is *not* terminal, so a job
    * id cannot be used as a terminality probe.
    */
-  duplicate: z10.boolean().optional(),
+  duplicate: z11.boolean().optional(),
   /** The job's state after this submission. */
-  state: z10.string().min(1)
+  state: z11.string().min(1)
 }).strict();
-var ReleaseRequest = z10.object({
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  runnerId: z10.string().min(1),
+var ReleaseRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
   /**
    * Which leases to release — the grant, not just the job.
    *
@@ -2025,24 +2108,22 @@ var ReleaseRequest = z10.object({
    * moment it arrives, which for a replayed request is not the lease the
    * daemon meant. See {@link Lease.id}.
    */
-  leases: z10.array(
-    z10.object({ jobId: z10.string().min(1), leaseId: z10.string().min(1) })
-  ),
+  leases: z11.array(GrantRef),
   /**
    * Why, so the app's runner list can say something true.
    *
-   * `refused` is load-bearing, not cosmetic: the server cannot evaluate a
-   * daemon's *local* `named` allowlist (§4.2), so it may legitimately offer
+   * `refused` is load-bearing, not cosmetic: the server cannot evaluate
+   * what a device will admit (§4.2), so it may legitimately offer
    * a job this daemon then declines. The server MUST record the refusal and
    * stop offering that job to that runner, or the pair would spin between
    * claim and release forever.
    */
-  reason: z10.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  reason: z11.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseResponse = z10.object({
-  released: z10.array(z10.string().min(1))
+var ReleaseResponse = z11.object({
+  released: z11.array(z11.string().min(1))
 }).strict();
-var WireErrorCode = z10.enum([
+var WireErrorCode = z11.enum([
   "bad-request",
   "unsupported-protocol-version",
   // "We do not know who you are." Exactly 401, and only that — cloud_008
@@ -2092,9 +2173,9 @@ var WireErrorCode = z10.enum([
   "rate-limited",
   "server-error"
 ]);
-var WireError = z10.object({
+var WireError = z11.object({
   error: WireErrorCode,
-  message: z10.string().min(1),
+  message: z11.string().min(1),
   /**
    * What this server speaks, on `unsupported-protocol-version` — §B.4.
    *
@@ -2108,10 +2189,10 @@ var WireError = z10.object({
    * Modelled the way `clock-skew`'s two fields already are — code-specific
    * extras, refused on any other code by the refinement below.
    */
-  supported: z10.array(z10.string().min(1)).optional(),
-  minimum: z10.string().min(1).optional(),
+  supported: z11.array(z11.string().min(1)).optional(),
+  minimum: z11.string().min(1).optional(),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z10.number().int().nonnegative().optional(),
+  retryAfter: z11.number().int().nonnegative().optional(),
   /**
    * The server's clock, and the window it allows. `clock-skew` only.
    *
@@ -2121,8 +2202,8 @@ var WireError = z10.object({
    * heartbeat response returns the same value, and so does every `Date`
    * header.
    */
-  serverTime: z10.number().int().positive().optional(),
-  maxSkewMs: z10.number().int().positive().optional()
+  serverTime: z11.number().int().positive().optional(),
+  maxSkewMs: z11.number().int().positive().optional()
 }).strict().superRefine((error, ctx) => {
   const skew = error.error === "clock-skew";
   const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
@@ -2173,16 +2254,16 @@ var ERROR_STATUS = Object.freeze({
   "rate-limited": 429,
   "server-error": 500
 });
-var FetchRequest = z10.object({
+var FetchRequest = z11.object({
   // `literal`, like every other request — V1-17. This one said
   // `string().min(1)`, so a daemon speaking a version this server does not
   // know got past the handshake on the one endpoint that hands over a
   // sealed payload. The version check exists so that a mismatch is a named
   // refusal rather than a schema failure three fields later; here it was
   // neither.
-  protocolVersion: z10.literal(PROTOCOL_VERSION),
-  runnerId: z10.string().min(1),
-  jobId: z10.string().min(1),
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  jobId: z11.string().min(1),
   /**
    * The grant this daemon holds.
    *
@@ -2190,9 +2271,9 @@ var FetchRequest = z10.object({
    * only the job would be answerable for whatever lease exists when it
    * arrives ({@link Lease.id}).
    */
-  leaseId: z10.string().min(1)
+  leaseId: z11.string().min(1)
 }).strict();
-var FetchResponse = z10.object({
+var FetchResponse = z11.object({
   /**
    * The work, sealed to the device that claimed it — byollm_009 §6.
    *
@@ -2211,6 +2292,8 @@ export {
   BackendClass,
   BackendCost,
   BackendIdSchema,
+  CLOCK_ATTRIBUTION_MS,
+  CLOCK_SKEW_WARN_MS,
   Capability,
   CapabilityMatrix,
   ChatMessage,
@@ -2227,7 +2310,11 @@ export {
   EnvelopeDirection,
   FetchRequest,
   FetchResponse,
+  GRANT_CONTEXT,
+  GRANT_MAX_AGE_MS,
+  GRANT_SIGNED_FIELDS,
   GeneratePayload,
+  GrantRef,
   HeartbeatRequest,
   HeartbeatResponse,
   JOB_KINDS,
@@ -2247,6 +2334,7 @@ export {
   MIN_PROTOCOL_VERSION,
   MUSTS,
   MUST_IDS,
+  Manifest,
   MatchRefusal,
   OFFER_SCOPES,
   OfferScope,
@@ -2259,10 +2347,10 @@ export {
   PairStartRequest,
   PairStartResponse,
   PublicIdentity,
+  Purpose,
   REFUSAL_MESSAGES,
+  RESERVED_PURPOSE,
   RETIREMENT_WINDOW_MS,
-  ROSTER_CONTEXT,
-  ROSTER_MAX_AGE_MS,
   RefusalReason,
   ReleaseRequest,
   ReleaseResponse,
@@ -2277,7 +2365,7 @@ export {
   SUPPORTED_PROTOCOL_VERSIONS,
   SealedEnvelope,
   SealedOutcome,
-  SignedRoster,
+  SignedGrant,
   SizeClass,
   StoredKeys,
   Succession,
@@ -2296,6 +2384,7 @@ export {
   effectiveOfferScope,
   fingerprint,
   generateKeys,
+  grantStatement,
   isBackendId,
   isCloudTaggedModel,
   isJobKind,
@@ -2310,20 +2399,20 @@ export {
   provenanceFor,
   publicIdentityOf,
   resolveCost,
-  rosterStatement,
   seal,
+  signGrant,
   signRequest,
-  signRoster,
   signSiteRequest,
   signSuccession,
   signWith,
+  singlePurposeManifest,
   sizeClassCeiling,
   sizeClassOf,
   successionStatement,
+  verifyGrant,
   verifyLink,
   verifyPublicIdentity,
   verifyRequest,
-  verifyRoster,
   verifySiteRequest,
   verifyWith,
   walkSuccession