@byollm/protocol 0.1.0-alpha.7 → 0.1.0-alpha.70

package/dist/index.js

@@ -1,9 +1,78 @@
+// src/about.ts
+var ABOUT = `# About BYOLLM
+
+**What BYOLLM is**
+
+BYOLLM lets you use your own AI on websites. You install one small program on
+your computer. Then, websites that support BYOLLM can use the AI you already
+have \u2014 a free model running on your machine, or an AI service you already pay
+for \u2014 instead of the website paying for AI and passing the cost to you.
+
+**Why it matters**
+
+For you:
+
+- Your favorite model, everywhere you go.
+- New models the moment you get them \u2013 not when a site gets around to adding
+  them.
+- Encrypted end-to-end. Your prompts go to your own device; byollm.cloud can't
+  read them.
+- Sites never learn which model you use, and your subscriptions are never
+  shared.
+- Pay less. Sites that don't pay for AI can charge you less \u2013 or nothing.
+
+For sites and developers:
+
+- Zero AI bills. Your users bring their own compute.
+- No floating money \u2013 you don't pay LLM bills up front and hope to collect
+  later, and you never ask people to prepay just to try you.
+- Free trials that cost you nothing to offer.
+- Ship the AI features you kept private for fear of the API bill.
+- One small integration. Your users choose the models.
+
+**Your device**
+
+The \`byollm\` program runs on your computer. It knows which AI services you have
+set up: free open-source models on your machine, metered services you pay per
+use, or your own subscriptions like Claude Pro/Max. When a website you have
+enabled sends work, your device runs it with the service you chose. Your
+prompts are encrypted end-to-end to your own device. byollm.cloud passes them
+along and cannot read them.
+
+**Sites**
+
+A website that wants to use BYOLLM says what it needs \u2014 "writing help," "chat,"
+and so on. When you connect the site, you pick which of your services answers
+each one. The site never learns which model you use. You can turn a site off at
+any time, and it stops getting your work.
+
+**Teams (optional)**
+
+A team lets you share what runs on your devices with people you name \u2014 the free
+open-source models on your machine, or a metered service with a spending limit
+you set. Your subscription accounts (like Claude Pro/Max) are never shared with
+anyone. That is a rule, not a setting.
+
+**byollm.cloud (or your own relay)**
+
+Many sites, many devices, many people. byollm.cloud keeps track of who has
+allowed what and sends each job to the right device. It never sees your
+prompts. If you would rather run this part yourself, the relay is open source \u2014
+you can run your own instead of using byollm.cloud.`;
+var ABOUT_SHORT_LEDE = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.";
+var ABOUT_SHORT_TAIL = "Sites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+var ABOUT_SHORT = `${ABOUT_SHORT_LEDE}
+
+${ABOUT_SHORT_TAIL}`;
+
 // src/audience.ts
 import { z as z2 } from "zod";
 
 // src/backends.ts
+import { isIP } from "net";
 import { z } from "zod";
 var BackendClass = z.enum(["http", "process"]);
+var BACKEND_CLASSES = Object.freeze(BackendClass.options);
 var BackendCost = z.enum(["free", "metered", "subscription"]);
 var backend = (b) => Object.freeze(b);
 var BACKENDS = Object.freeze({
@@ -162,6 +231,24 @@ var BACKENDS = Object.freeze({
     class: "process",
     cost: "subscription",
     adversarialCorpus: "process"
+  }),
+  /**
+   * OpenAI's Codex CLI, on a ChatGPT plan — byollm_016 stage 3.
+   *
+   * `subscription`, so `SUBSCRIPTION_SELF_LOCK` pins it to its owner's own
+   * work whatever the config says. That is load-bearing here in a way it is
+   * not for `claude-cli`: Codex is an *agent*, and its default feature set
+   * includes a shell tool, browser control and computer use. The daemon
+   * disables every one of them, verified against the shipped binary rather
+   * than assumed — see `codex-cli.ts` — but the self-lock is the floor under
+   * that verification rather than a duplicate of it.
+   */
+  "codex-cli": backend({
+    id: "codex-cli",
+    label: "Codex CLI (your ChatGPT plan)",
+    class: "process",
+    cost: "subscription",
+    adversarialCorpus: "process"
   })
 });
 var BACKEND_IDS = Object.freeze(Object.keys(BACKENDS));
@@ -177,42 +264,87 @@ function backendDescriptor(id) {
 function isLocalHost(hostname) {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
   if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (host === "::1") return true;
+  const version = isIP(host);
+  if (version === 0) return false;
+  if (version === 6) {
+    if (host === "::1") return true;
+    return /^f[cd]/.test(host);
+  }
   if (host.startsWith("127.")) return true;
   if (host.startsWith("10.")) return true;
   if (host.startsWith("192.168.")) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
-  if (/^f[cd]/.test(host)) return true;
-  return false;
+  return /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+function isCloudTaggedModel(model) {
+  return /:[^:]*cloud$/.test(model);
+}
+function resolveCost(id, baseUrl, model) {
+  return classifyCost(id, baseUrl, model).cost;
+}
+function backendName(id) {
+  return BACKENDS[id].label.replace(/\s*\([^)]*\)$/, "");
 }
-function resolveCost(id, baseUrl) {
+function classifyCost(id, baseUrl, model) {
   const declared = BACKENDS[id].cost;
-  if (declared !== null) return declared;
-  if (baseUrl === void 0) return "metered";
+  if (declared !== null) {
+    const label = BACKENDS[id].label;
+    return {
+      cost: declared,
+      because: {
+        subscription: `${label} runs on an account you subscribe to`,
+        metered: `${label} bills per token`,
+        free: `${label} runs on this machine`
+      }[declared]
+    };
+  }
+  if (model !== void 0 && isCloudTaggedModel(model)) {
+    return {
+      cost: "metered",
+      because: `its model tag ends in \`:cloud\`, so the work runs on your provider's cloud account rather than on this machine`
+    };
+  }
+  if (baseUrl === void 0) {
+    return {
+      cost: "metered",
+      because: "it has no address, so where the work runs cannot be checked"
+    };
+  }
   try {
-    return isLocalHost(new URL(baseUrl).hostname) ? "free" : "metered";
+    return isLocalHost(new URL(baseUrl).hostname) ? { cost: "free", because: "it runs on this machine" } : {
+      cost: "metered",
+      because: "its address is not on this machine, so the work leaves it"
+    };
   } catch {
-    return "metered";
+    return {
+      cost: "metered",
+      because: "its address cannot be read, so where the work runs is unknown"
+    };
   }
 }
 
 // src/audience.ts
-var Audience = z2.enum(["self", "named", "public"]);
-var OfferScope = z2.enum(["self", "named", "public"]);
+var Audience = z2.enum(["private", "team"]);
+var OfferScope = z2.enum(["private", "team"]);
 var AUDIENCES = Object.freeze(Audience.options);
 var OFFER_SCOPES = Object.freeze(OfferScope.options);
 var MatchRefusal = z2.enum([
   /** The daemon advertises no capability for this kind. */
   "no-capability",
-  /** Job is `self` but this daemon belongs to a different user. */
+  /** Job is `private` but this daemon belongs to a different user. */
   "audience-self-other-owner",
-  /** Job is `named` but this daemon's local allowlist does not admit the owner. */
+  /**
+   * Job is `team` and nothing this device verified admits the job's owner.
+   *
+   * The id predates the grant and is kept, because ids are public and cited
+   * by conformance output. What it means has not moved: this device was not
+   * shown anything it could check.
+   */
   "not-locally-allowed",
-  /** Job is `named`/`public` but the server's own allowlist excludes this runner. */
+  /** Job is `team` but the server's own allowlist excludes this runner. */
   "not-in-server-allowlist",
-  /** The backend offers only `self` and the job belongs to someone else. */
+  /** The service offers only `private` and the job belongs to someone else. */
   "offer-scope-too-narrow",
-  /** The matched backend is subscription-class, which is locked to `self`. */
+  /** The matched backend is subscription-class, which is locked to `private`. */
   "subscription-self-lock",
   /** The backend spends the owner's money and they have not agreed to share it. */
   "metered-no-spend-consent",
@@ -222,16 +354,16 @@ var MatchRefusal = z2.enum([
 var ALLOWED = Object.freeze({ ok: true });
 var refuse = (refusal) => Object.freeze({ ok: false, refusal });
 function effectiveOfferScope(configured, cost, spend) {
-  if (cost === "subscription") return "self";
-  if (cost === "metered" && spend?.acknowledged !== true) return "self";
+  if (cost === "subscription") return "private";
+  if (cost === "metered" && spend?.acknowledged !== true) return "private";
   return configured;
 }
 function matchAudience(job, daemon) {
   const sameOwner = job.owner === daemon.owner;
-  if (job.audience === "self" && !sameOwner) {
+  if (job.audience === "private" && !sameOwner) {
     return refuse("audience-self-other-owner");
   }
-  if (job.audience === "named" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
+  if (job.audience === "team" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
     return refuse("not-in-server-allowlist");
   }
   const scope = effectiveOfferScope(
@@ -254,20 +386,18 @@ function matchAudience(job, daemon) {
     }
   }
   switch (scope) {
-    case "self":
+    case "private":
       return refuse("offer-scope-too-narrow");
-    case "named":
-      return daemon.locallyAllows(job.owner) ? ALLOWED : refuse("not-locally-allowed");
-    case "public":
-      return ALLOWED;
+    case "team":
+      return daemon.admits(job.owner) ? ALLOWED : refuse("not-locally-allowed");
   }
 }
 var REFUSAL_MESSAGES = Object.freeze({
-  "no-capability": "no backend on this machine is configured and healthy for that job kind",
-  "audience-self-other-owner": "the job is private to its owner and this machine is paired to someone else",
-  "not-locally-allowed": "the job's owner is not on this machine's allowlist (byollm allow <server> <user>)",
-  "not-in-server-allowlist": "the app restricted this job to named runners and this machine is not one of them",
-  "offer-scope-too-narrow": "this backend is offered to its owner only (byollm offer <backend> named|public to widen)",
+  "no-capability": "no backend on this device is configured and healthy for that job kind",
+  "audience-self-other-owner": "the job is private to its owner and this device is paired to someone else",
+  "not-locally-allowed": "nothing this device can verify says the job's owner may use it",
+  "not-in-server-allowlist": "the app restricted this job to named runners and this device is not one of them",
+  "offer-scope-too-narrow": "this service is offered to its owner only (`byollm offer <service> team` to widen)",
   "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting",
   "metered-no-spend-consent": "this backend bills its owner per token, and they have not agreed to spend it on other people's work",
   "metered-ceiling-reached": "this backend is shared but has reached the spend ceiling its owner set"
@@ -286,20 +416,33 @@ var PAYLOAD_LIMITS = Object.freeze({
 var ChatMessage = z3.object({
   role: z3.enum(["system", "user", "assistant"]),
   content: z3.string().max(PAYLOAD_LIMITS.maxTextChars)
-});
+}).strict();
 var GeneratePayload = z3.object({
   prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.prompt.length + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var ChatPayload = z3.object({
   messages: z3.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict();
+}).strict().refine(
+  (payload) => payload.messages.reduce((sum, m) => sum + m.content.length, 0) + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
 var JobKind = z3.enum(["llm.generate", "llm.chat"]);
 var JOB_KINDS = Object.freeze(JobKind.options);
 var KindedPayload = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }),
-  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload })
+  // Strict on the wrappers too. A union member that strips is a door beside
+  // the one that is locked: the payloads inside are strict, and an extra key
+  // on the envelope vanished just as quietly.
+  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }).strict(),
+  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload }).strict()
 ]);
 function isJobKind(value) {
   return JOB_KINDS.includes(value);
@@ -316,161 +459,12 @@ function payloadTextLength(kinded) {
 }
 
 // src/job.ts
-import { z as z4 } from "zod";
-var JobState = z4.enum([
-  "queued",
-  "claimed",
-  "running",
-  "ok",
-  "error",
-  "canceled",
-  "expired"
-]);
-var TERMINAL_STATES = Object.freeze([
-  "ok",
-  "error",
-  "canceled",
-  "expired"
-]);
-function isTerminal(state) {
-  return TERMINAL_STATES.includes(state);
-}
-var TRANSITIONS = Object.freeze({
-  queued: ["claimed", "expired", "canceled"],
-  // A claimed job returns to `queued` when its lease expires un-renewed
-  // ({@link MUSTS.LEASE_RECLAIMABLE}).
-  claimed: ["running", "queued", "canceled", "error"],
-  running: ["ok", "error", "canceled", "queued"],
-  ok: [],
-  error: [],
-  canceled: [],
-  expired: []
-});
-function canTransition(from, to) {
-  return TRANSITIONS[from].includes(to);
-}
-var Lease = z4.object({
-  /**
-   * Identifies *this* grant, not just its holder.
-   *
-   * A runner can hold a job, release it, and claim it again — three leases,
-   * one runner id. Without an id for the grant itself, a lease-scoped request
-   * names a mutable target ambiguously, and a replayed release from the first
-   * grant lands on the third: the job returns to the queue while the daemon
-   * is mid-execution, and the work runs twice on the owner's hardware.
-   *
-   * That was a live hole, found in review after signed requests shipped. The
-   * signature scheme's replay argument rests on endpoints being idempotent —
-   * and release *is*, per lease, but not across leases, because nothing in
-   * the request said which one.
-   */
-  id: z4.string().min(1),
-  /** The runner holding the lease. */
-  runnerId: z4.string().min(1),
-  /** Epoch milliseconds after which the claim is void. */
-  expiresAt: z4.number().int().positive()
-});
-var JobPayload = z4.union([GeneratePayload, ChatPayload]);
-var ClaimedJob = z4.object({
-  id: z4.string().min(1),
-  kind: JobKind,
-  payload: JobPayload,
-  audience: Audience,
-  /** The app's id for the user who enqueued it. */
-  owner: z4.string().min(1),
-  /** Runner owners the app restricted a `named` job to, if any. */
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
-  lease: Lease
-}).strict();
-var ResultProvenance = z4.object({
-  /** The audience the job ran under. */
-  audience: Audience,
-  /** The runner that produced it. */
-  runnerId: z4.string().min(1),
-  /** The runner owner's id in this app's namespace. */
-  runnerOwner: z4.string().min(1),
-  /** Which backend class produced it — an HTTP call or a sandboxed spawn. */
-  backendClass: BackendClass,
-  /** The model the runner reports having used. */
-  model: z4.string().min(1),
-  /**
-   * False only for `self` jobs. When true the app MUST treat `text` as
-   * untrusted third-party content.
-   */
-  untrusted: z4.boolean()
-}).strict();
-function provenanceFor(input) {
-  return {
-    audience: input.audience,
-    runnerId: input.runnerId,
-    runnerOwner: input.runnerOwner,
-    backendClass: input.backendClass,
-    model: input.model,
-    untrusted: input.audience !== "self"
-  };
-}
-var JobResultOk = z4.object({
-  outcome: z4.literal("ok"),
-  text: z4.string(),
-  /** Optional reference to a stored artifact; never a local path. */
-  artifactUrl: z4.url().optional()
-}).strict();
-var JobResultError = z4.object({
-  outcome: z4.literal("error"),
-  code: z4.string().min(1),
-  message: z4.string().min(1),
-  /** Whether the app may reasonably re-enqueue. */
-  retryable: z4.boolean()
-}).strict();
-var JobResultCanceled = z4.object({
-  outcome: z4.literal("canceled")
-}).strict();
-var JobOutcome = z4.discriminatedUnion("outcome", [
-  JobResultOk,
-  JobResultError,
-  JobResultCanceled
-]);
-var DeliveredResult = z4.object({
-  jobId: z4.string().min(1),
-  state: JobState,
-  outcome: JobOutcome.optional(),
-  provenance: ResultProvenance.optional()
-}).strict();
-var SizeClass = z4.enum(["small", "medium", "large", "unbounded"]);
-var SIZE_CLASS_LIMITS = Object.freeze({
-  small: 4e3,
-  medium: 64e3,
-  large: Number.POSITIVE_INFINITY
-});
-function sizeClassCeiling(sizeClass) {
-  if (sizeClass === "unbounded") return Number.POSITIVE_INFINITY;
-  return SIZE_CLASS_LIMITS[sizeClass];
-}
-function sizeClassOf(textChars) {
-  if (textChars <= SIZE_CLASS_LIMITS.small) return "small";
-  if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
-  return "large";
-}
-var JobStub = z4.object({
-  id: z4.string().min(1),
-  kind: JobKind,
-  /** The app's id for the user who enqueued it. */
-  owner: z4.string().min(1),
-  audience: Audience,
-  audienceAllow: z4.array(z4.string().min(1)).optional(),
-  sizeClass: SizeClass,
-  /** Reserved for byollm_006. False until streaming exists. */
-  streaming: z4.boolean(),
-  /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
-  deadlineAt: z4.number().int().positive()
-}).strict();
-var ClaimedStub = JobStub.extend({ lease: Lease }).strict();
-
-// src/envelope.ts
-import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
-import sodium from "libsodium-wrappers";
 import { z as z6 } from "zod";
 
+// src/grant.ts
+import { Buffer as Buffer2 } from "buffer";
+import { z as z5 } from "zod";
+
 // src/keys.ts
 import {
   createHash,
@@ -480,12 +474,12 @@ import {
   sign,
   verify
 } from "crypto";
-import { z as z5 } from "zod";
-var PublicIdentity = z5.object({
+import { z as z4 } from "zod";
+var PublicIdentity = z4.object({
   /** Raw Ed25519 public key. The pinned one. */
-  identity: z5.string().min(1),
+  identity: z4.string().min(1),
   /** Raw X25519 public key, for sealing to this party. */
-  encryption: z5.string().min(1),
+  encryption: z4.string().min(1),
   /**
    * Ed25519 signature over the encryption key, by the identity key.
    *
@@ -493,16 +487,16 @@ var PublicIdentity = z5.object({
    * own while relaying a genuine identity: the receiver pins the identity
    * and refuses any encryption key not signed by it.
    */
-  encryptionSig: z5.string().min(1)
+  encryptionSig: z4.string().min(1)
 }).strict();
-var StoredKeys = z5.object({
-  version: z5.literal(1),
-  identityPublic: z5.string().min(1),
-  identityPrivate: z5.string().min(1),
-  encryptionPublic: z5.string().min(1),
-  encryptionPrivate: z5.string().min(1),
-  encryptionSig: z5.string().min(1),
-  createdAt: z5.number().int().positive()
+var StoredKeys = z4.object({
+  version: z4.literal(1),
+  identityPublic: z4.string().min(1),
+  identityPrivate: z4.string().min(1),
+  encryptionPublic: z4.string().min(1),
+  encryptionPrivate: z4.string().min(1),
+  encryptionSig: z4.string().min(1),
+  createdAt: z4.number().int().positive()
 }).strict();
 var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
 function rawPublic(key) {
@@ -595,21 +589,456 @@ function fingerprint(identityPublic) {
 }
 var keyId = (identityPublic) => fingerprint(identityPublic);
 
+// src/grant.ts
+var GRANT_MAX_AGE_MS = 12e4;
+var CLOCK_SKEW_WARN_MS = 3e4;
+var CLOCK_ATTRIBUTION_MS = 5e3;
+var GRANT_CONTEXT = "byollm/v1/grant";
+var SignedGrant = z5.object({
+  /**
+   * This grant's own id — what makes it single-use.
+   *
+   * **Not the job id, and the difference is load-bearing.** Binding
+   * single-use to `jobId` would refuse a legitimate retry: a claim that
+   * times out is re-claimed, the control plane authors a second grant for
+   * the same job, and a device that recorded the job id as spent would
+   * reject its own recovery. A fresh id per authorship replays nothing and
+   * retries fine.
+   */
+  grantId: z5.string().min(1),
+  /**
+   * The job this grant admits, and only this one.
+   *
+   * A grant lifted from one job and presented for another is the obvious
+   * attack, and this field is why it fails.
+   */
+  jobId: z5.string().min(1),
+  /**
+   * The site the work came from, **as a key id** — byollm-review 2026-08-27.
+   *
+   * This was `siteId`, holding the site's id in the control plane's
+   * namespace, and it was signed by the engine and read by nobody. A signed
+   * field nobody checks is not a weak guarantee, it is the appearance of
+   * one: the design says "the grant carries the site", and nothing anywhere
+   * compared it to anything.
+   *
+   * It could not be compared. Job ids are chosen per site, so a grant
+   * authored for (site A, `job_1`) satisfied every device check against a
+   * stub naming (site B, `job_1`) — but the device holds sites only by the
+   * key ids it pinned, and had no way to relate a control-plane uuid to
+   * one. Checking the field would have meant a lookup through the party the
+   * grant exists to distrust.
+   *
+   * So the namespace changes to the one the device already has, and the
+   * name changes with it: this is the same value as {@link JobStub.site},
+   * compared directly, no lookup and nothing to believe. The control-plane
+   * id is not carried alongside — it had no reader, and keeping an
+   * unchecked field beside a checked one is how this hole was dug.
+   */
+  site: z5.string().min(1),
+  /** Whose job it is — the person the site enqueued for. */
+  user: z5.string().min(1),
+  /**
+   * Whose device it is for.
+   *
+   * Passed to {@link verifyGrant} rather than read out of the document, for
+   * the reason every verifier here takes its subject as an argument: a
+   * verifier that recovered the owner from the signed bytes would accept a
+   * genuine grant belonging to somebody else and pass every check.
+   */
+  owner: z5.string().min(1),
+  /** The site purpose this job serves — byollm_016 Amendment L. */
+  purpose: z5.string().min(1),
+  /** The kind of work. */
+  kind: z5.string().min(1),
+  /**
+   * The service the control plane resolved this (purpose, kind) to, from
+   * the user's own mapping.
+   *
+   * Selection is the control plane's; **offer-consistency is the
+   * device's**. A device verifies it actually offers this service, at a
+   * scope that includes {@link user}, before running anything.
+   */
+  service: z5.string().min(1),
+  /** When the control plane signed it — epoch ms, the only anchor for age. */
+  issuedAt: z5.number().int().positive(),
+  /** Base64url Ed25519 over {@link grantStatement}. */
+  signature: z5.string().min(1)
+}).strict();
+var GRANT_SIGNED_FIELDS = Object.freeze(
+  Object.keys(SignedGrant.shape).filter((key) => key !== "signature").sort()
+);
+function grantStatement(claims) {
+  return Buffer2.from(
+    JSON.stringify([
+      GRANT_CONTEXT,
+      ...GRANT_SIGNED_FIELDS.map((field) => claims[field])
+    ]),
+    "utf8"
+  );
+}
+function signGrant(keys, claims) {
+  return { ...claims, signature: signWith(keys, grantStatement(claims)) };
+}
+function verifyGrant(input) {
+  const { grant, now } = input;
+  if (grant.owner !== input.owner) return "wrong-owner";
+  if (grant.jobId !== input.jobId) return "wrong-job";
+  const age = now - grant.issuedAt;
+  if (age < -CLOCK_SKEW_WARN_MS) return "from-the-future";
+  if (age > (input.maxAgeMs ?? GRANT_MAX_AGE_MS)) return "expired";
+  return verifyWith(
+    input.controlPlanePublic,
+    grantStatement(grant),
+    grant.signature
+  ) ? null : "bad-signature";
+}
+
+// src/job.ts
+var JobState = z6.enum([
+  "queued",
+  "claimed",
+  "running",
+  "ok",
+  "error",
+  "canceled",
+  "expired"
+]);
+var TERMINAL_STATES = Object.freeze([
+  "ok",
+  "error",
+  "canceled",
+  "expired"
+]);
+function isTerminal(state) {
+  return TERMINAL_STATES.includes(state);
+}
+var TRANSITIONS = Object.freeze({
+  queued: ["claimed", "expired", "canceled"],
+  // A claimed job returns to `queued` when its lease expires un-renewed
+  // ({@link MUSTS.LEASE_RECLAIMABLE}).
+  claimed: ["running", "queued", "canceled", "error"],
+  running: ["ok", "error", "canceled", "queued"],
+  ok: [],
+  error: [],
+  canceled: [],
+  expired: []
+});
+function canTransition(from, to) {
+  return TRANSITIONS[from].includes(to);
+}
+var Lease = z6.object({
+  /**
+   * Identifies *this* grant, not just its holder.
+   *
+   * A runner can hold a job, release it, and claim it again — three leases,
+   * one runner id. Without an id for the grant itself, a lease-scoped request
+   * names a mutable target ambiguously, and a replayed release from the first
+   * grant lands on the third: the job returns to the queue while the daemon
+   * is mid-execution, and the work runs twice on the owner's hardware.
+   *
+   * That was a live hole, found in review after signed requests shipped. The
+   * signature scheme's replay argument rests on endpoints being idempotent —
+   * and release *is*, per lease, but not across leases, because nothing in
+   * the request said which one.
+   */
+  id: z6.string().min(1),
+  /** The runner holding the lease. */
+  runnerId: z6.string().min(1),
+  /** Epoch milliseconds after which the claim is void. */
+  expiresAt: z6.number().int().positive()
+}).strict();
+var JobPayload = z6.union([GeneratePayload, ChatPayload]);
+var ClaimedJob = z6.object({
+  id: z6.string().min(1),
+  kind: JobKind,
+  payload: JobPayload,
+  audience: Audience,
+  /** The app's id for the user who enqueued it. */
+  owner: z6.string().min(1),
+  /**
+   * Which site's job — V1-3.
+   *
+   * The stub has always carried it; the opened job did not, so everything
+   * downstream of the payload — the ingress line above all — recorded a job
+   * id that belongs to a site without saying which. Two sites can choose
+   * the same id, and the meter is the product.
+   *
+   * Optional so a caller assembling a job by hand is not forced to invent
+   * one, and so this reads as what it is: a fact about where the work came
+   * from, not a second copy of the routing key.
+   */
+  site: z6.string().min(1).optional(),
+  /**
+   * Which of the owner's services runs this — resolved, not requested.
+   *
+   * The daemon picks the backend from this, so it has to be the answer
+   * rather than a wish. On a relayed route it is copied off the **grant**,
+   * where a control plane put the person's own mapping and signed it; a
+   * site never named it and could not.
+   *
+   * It used to be what the site asked for, which made a job that selected a
+   * non-default service liable to be served by the default instead — the
+   * substitution `NO_PAYLOAD_ROUTING` forbids. Amendment L removed the
+   * asking; what is left is the answering.
+   *
+   * Optional, because direct mode has no control plane to resolve anything
+   * and the owner's own defaults answer under the ambiguity law.
+   */
+  service: z6.string().min(1).optional(),
+  lease: Lease
+}).strict();
+var ResultProvenance = z6.object({
+  /** The audience the job ran under. */
+  audience: Audience,
+  /** The runner that produced it. */
+  runnerId: z6.string().min(1),
+  /** The runner owner's id in this app's namespace. */
+  runnerOwner: z6.string().min(1),
+  /** Which backend class produced it — an HTTP call or a sandboxed spawn. */
+  backendClass: BackendClass,
+  /** The model the runner reports having used. */
+  model: z6.string().min(1),
+  /**
+   * False only for `self` jobs. When true the app MUST treat `text` as
+   * untrusted third-party content.
+   */
+  untrusted: z6.boolean()
+}).strict();
+function provenanceFor(input) {
+  return {
+    audience: input.audience,
+    runnerId: input.runnerId,
+    runnerOwner: input.runnerOwner,
+    backendClass: input.backendClass,
+    model: input.model,
+    untrusted: input.audience !== "private"
+  };
+}
+var RunMetadata = z6.object({
+  /** Which model actually served it. */
+  model: z6.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z6.number().int().nonnegative()
+}).strict();
+var JobResultOk = z6.object({
+  outcome: z6.literal("ok"),
+  text: z6.string(),
+  /** Optional reference to a stored artifact; never a local path. */
+  artifactUrl: z6.url().optional()
+}).strict();
+var JobResultError = z6.object({
+  outcome: z6.literal("error"),
+  code: z6.string().min(1),
+  message: z6.string().min(1),
+  /** Whether the app may reasonably re-enqueue. */
+  retryable: z6.boolean()
+}).strict();
+var JobResultCanceled = z6.object({
+  outcome: z6.literal("canceled")
+}).strict();
+var JobOutcome = z6.discriminatedUnion("outcome", [
+  JobResultOk,
+  JobResultError,
+  JobResultCanceled
+]);
+var RefusalReason = z6.enum([
+  /**
+   * Two or more services answer this kind and the owner has named no default,
+   * so the kind is withheld. Nobody may pick on the owner's behalf — the wrong
+   * guess is the metered one.
+   *
+   * Told apart from its neighbour deliberately, and the line is whether a
+   * requester can walk a namespace. There are two kinds; asking about one
+   * enumerates nothing they could not learn from what the device advertises,
+   * and the difference is actionable — "the owner has not chosen" is fixable
+   * by the owner, "the default cannot serve you" is not. It is also already
+   * what a team member sees on the devices page: `awaitingDefault` carries
+   * exactly this, by kind, for exactly this reason.
+   */
+  "default-ambiguity",
+  /**
+   * A default exists and this requester can never use it — byollm_016's
+   * defaults-meet-audiences corner.
+   *
+   * The specimen: an owner's default for `llm.chat` is their Claude
+   * subscription, self-locked by `SUBSCRIPTION_SELF_LOCK`. A team member's
+   * job resolves to it and can never be served by it. That must be a refusal
+   * on the spot, not a wait that expires an hour later looking like nobody
+   * was online.
+   *
+   * Bounded like the value above, and unprobeable for the same reason: the
+   * requester named nothing, so there is no name space to walk.
+   */
+  "default-unusable"
+]);
+var JobRefused = z6.object({
+  outcome: z6.literal("refused"),
+  reason: RefusalReason,
+  /** Plain words for a human reading a log, never parsed. */
+  message: z6.string().min(1)
+}).strict();
+var REFUSAL_TEXT = Object.freeze({
+  "default-ambiguity": "this device serves that kind from more than one service and its owner has not chosen which",
+  "default-unusable": "this device's default for that kind cannot run work for you"
+});
+var SealedOutcome = z6.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
+var DeliveredResult = z6.object({
+  jobId: z6.string().min(1),
+  state: JobState,
+  outcome: JobOutcome.optional(),
+  provenance: ResultProvenance.optional(),
+  /**
+   * Present, and always `true`, when this did not come from a runner —
+   * {@link MUSTS.FALLBACK_LABELED}.
+   *
+   * The app's own `onNoRunner` value produced it: a hosted model, a cached
+   * answer, an apology. It never travels on the wire, because nothing on
+   * the wire produced it; it exists so that a result which did not come
+   * from the user's own compute cannot be reported as though it did.
+   *
+   * A literal rather than a boolean, so `fallback: false` is not a
+   * spelling anybody can reach for. The absence of this field means a
+   * runner ran the job, and the *server* stamps it — an app cannot supply
+   * a substitute that hides what it is.
+   */
+  fallback: z6.literal(true).optional()
+}).strict();
+var SizeClass = z6.enum(["small", "medium", "large", "unbounded"]);
+var SIZE_CLASSES = Object.freeze(SizeClass.options);
+var MAX_ENVELOPE_BYTES = 10 * 1024 * 1024;
+function envelopeBytes(envelope) {
+  const serialised = JSON.stringify(envelope);
+  return serialised === void 0 ? 0 : serialised.length;
+}
+var SIZE_CLASS_LIMITS = Object.freeze({
+  small: 4e3,
+  medium: 64e3,
+  large: Number.POSITIVE_INFINITY
+});
+function sizeClassCeiling(sizeClass) {
+  if (sizeClass === "unbounded") return Number.POSITIVE_INFINITY;
+  return SIZE_CLASS_LIMITS[sizeClass];
+}
+function sizeClassOf(textChars) {
+  if (textChars <= SIZE_CLASS_LIMITS.small) return "small";
+  if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
+  return "large";
+}
+var JobStub = z6.object({
+  id: z6.string().min(1),
+  kind: JobKind,
+  /** The app's id for the user who enqueued it. */
+  owner: z6.string().min(1),
+  /**
+   * Which site this job belongs to — byollm_009 Amendment A §A.3.
+   *
+   * **The site's identity key id**, not an id somebody assigned it. §6 has
+   * listed `site` since this spec was frozen; the schema never carried it,
+   * which is the drift the amendment closes.
+   *
+   * A key id rather than an opaque handle for one reason above the others:
+   * it makes the stub *self-describing* instead of a pointer into somebody
+   * else's table. A daemon holds this key id already, from pinning, so it
+   * can check `stub.site` against the payload envelope's `senderKeyId`
+   * without a lookup and without trusting the party that routed it. An
+   * opaque id can only be believed.
+   *
+   * It also avoids inventing a second namespace for a thing that has a
+   * canonical one — the shape of finding 41 (two owner namespaces compared
+   * for equality) and of finding fourteen before it.
+   *
+   * Rotation is a designed transition rather than a cost: a site publishes a
+   * new identity signed by the outgoing one, both are valid through an
+   * overlap window, and a daemon re-keys its own map by verifying that
+   * signature against the key it already pinned (§A.3.1).
+   */
+  site: z6.string().min(1),
+  audience: Audience,
+  // `audienceAllow` is **not** here, and its absence is the enforcement —
+  // cloud_008 §0.2.
+  //
+  // It was a list of the people who may run a job, travelling to every
+  // routing party on every shared job. byollm_001 Rev 1 §B settled who
+  // decides that long before this schema existed: *the daemon's own list
+  // decides, not the server's*, and `allowlist.predicateFor(origin)` is the
+  // enforcement in both lanes. So this was a second answer to a question the
+  // daemon already owned — able only to agree, in which case it was
+  // redundant, or to disagree, in which case nothing said which wins.
+  //
+  // The rule it leaves behind, which decides the next field too: **a class
+  // the router acts on may travel; membership never does.** `audience` stays
+  // for exactly that reason — the relay narrows on it. A roster does not
+  // travel, so `ROSTER_NOT_DISCLOSED` holds here by absence, which is the
+  // strongest way for a MUST to hold.
+  //
+  // The site keeps its own copy on `JobRecord` and still filters candidates
+  // with it before offering. That is server-internal, where the party
+  // holding the list authored it.
+  /**
+   * Which of the site's declared purposes this job serves — Amendment L.
+   *
+   * **A need, never a name.** The site's vocabulary is its own purposes;
+   * the person's is their services; and the two never meet. This field says
+   * "writing-assistant", and a control plane joins it to whatever that
+   * person mapped it to. The site learns only whether the slot was
+   * satisfiable.
+   *
+   * It replaced `service`, which let a site name one of the owner's
+   * services directly. That field is gone from both routes (Amendment L
+   * rider) and its refusal machinery with it — including the collapsed
+   * `select-unavailable`, which existed so that "no such service" and "not
+   * offered to you" could not be told apart. There is nothing left to
+   * probe: **a vocabulary that never crosses the boundary cannot be
+   * enumerated across it**, which is a stronger guarantee than the one the
+   * collapse gave.
+   *
+   * It travels for the reason the absent `audienceAllow` establishes: *a
+   * class the router acts on may travel; membership never does.* A purpose
+   * is a class, and the control plane acts on it.
+   *
+   * Optional because direct mode has no control plane to hold a mapping and
+   * is kind-only: the owner's own config and defaults answer, under the
+   * ambiguity law as shipped. Absent on a relayed route resolves against
+   * the site's reserved purpose, which a site that declared its own
+   * purposes will not have mapped — so the slot reads as unmapped and the
+   * site falls back, loudly enough and without a special case.
+   *
+   * A **stub** field and never a payload field, which is the line
+   * `NO_PAYLOAD_ROUTING` draws: the prompt cannot reach it, so no amount of
+   * user text can influence what runs.
+   */
+  purpose: z6.string().min(1).optional(),
+  sizeClass: SizeClass,
+  /** Reserved for byollm_006. False until streaming exists. */
+  streaming: z6.boolean(),
+  /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
+  deadlineAt: z6.number().int().positive()
+}).strict();
+var ClaimedStub = JobStub.extend({
+  lease: Lease,
+  grant: SignedGrant.optional()
+}).strict();
+
 // src/envelope.ts
+import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
+import sodium from "libsodium-wrappers";
+import { z as z7 } from "zod";
 var readied;
 async function cryptoReady() {
   readied ??= sodium.ready;
   await readied;
 }
 var ENVELOPE_MAX_AGE_MS = 24 * 60 * 6e4;
-var EnvelopeDirection = z6.enum(["payload", "result"]);
-var SealedEnvelope = z6.object({
+var EnvelopeDirection = z7.enum(["payload", "result"]);
+var SealedEnvelope = z7.object({
   /** Base64url `crypto_box_seal` output over the signed plaintext. */
-  ciphertext: z6.string().min(1),
+  ciphertext: z7.string().min(1),
   /** Who this was sealed to — the recipient checks it is them. */
-  recipientKeyId: z6.string().min(1),
+  recipientKeyId: z7.string().min(1),
   /** Who signed it — the recipient checks this against its pin. */
-  senderKeyId: z6.string().min(1),
+  senderKeyId: z7.string().min(1),
   direction: EnvelopeDirection,
   /**
    * When this ciphertext stops being worth keeping.
@@ -623,7 +1052,7 @@ var SealedEnvelope = z6.object({
    * Not trusted as written: it is also inside the signature, so a changed
    * deadline fails to verify.
    */
-  deadlineAt: z6.number().int().positive()
+  deadlineAt: z7.number().int().positive()
 }).strict();
 function signedBody(context, plaintext) {
   return Buffer.from(
@@ -718,15 +1147,15 @@ async function open(input) {
 
 // src/signing.ts
 import { createHash as createHash2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var MAX_CLOCK_SKEW_MS = 12e4;
-var RequestSignature = z7.object({
+var RequestSignature = z8.object({
   /** Which runner is calling. The server looks up its pinned identity. */
-  runnerId: z7.string().min(1),
+  runnerId: z8.string().min(1),
   /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
-  issuedAt: z7.number().int().positive(),
+  issuedAt: z8.number().int().positive(),
   /** Base64url Ed25519 signature over {@link canonicalRequest}. */
-  signature: z7.string().min(1)
+  signature: z8.string().min(1)
 }).strict();
 function canonicalRequest(input) {
   const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
@@ -748,6 +1177,21 @@ function signRequest(keys, input) {
     signature: signWith(keys, canonicalRequest(input))
   };
 }
+function signSiteRequest(keys, input) {
+  return signRequest(keys, {
+    endpoint: siteEndpoint(input.endpoint),
+    runnerId: input.siteId,
+    issuedAt: input.issuedAt,
+    body: input.body
+  });
+}
+function verifySiteRequest(input) {
+  return verifyRequest({
+    ...input,
+    endpoint: siteEndpoint(input.endpoint)
+  });
+}
+var siteEndpoint = (endpoint) => `site/${endpoint}`;
 function verifyRequest(input) {
   const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
   if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
@@ -764,7 +1208,119 @@ function verifyRequest(input) {
   return ok ? null : "bad-signature";
 }
 
+// src/manifest.ts
+import { z as z9 } from "zod";
+var RESERVED_PURPOSE = "default";
+var RENDERABLE = /^[^\p{Cc}\p{Cf}\p{Cs}\p{Co}]+$/u;
+var renderable = (max, what) => z9.string().min(1).max(max).regex(
+  RENDERABLE,
+  `a ${what} is text a person reads \u2014 no control characters, direction overrides or zero-width padding`
+).refine((value) => value.trim() !== "", {
+  message: `a ${what} cannot be blank`
+});
+var PurposeKey = z9.string().regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "a purpose key is a lowercase slug \u2014 letters, digits and hyphens"
+).max(64);
+var Purpose = z9.object({
+  /**
+   * What a person reads on the consent screen. The only rendered field.
+   *
+   * Declared rather than derived from the key, because a key is a
+   * compromise between machines and this is not. "Writing Assistant" is
+   * what somebody understands; `writing-assistant` is what travels.
+   */
+  label: renderable(80, "label"),
+  /** One line of context for the consent screen. Optional. */
+  description: renderable(280, "description").optional(),
+  /**
+   * The kinds this purpose uses.
+   *
+   * A purpose may span kinds, and a mapping is per (purpose, kind) — so a
+   * person can send this purpose's chat to one service and its generation
+   * to another. Listing a kind here is what makes that slot appear.
+   */
+  kinds: z9.array(JobKind).min(1).max(JOB_KINDS.length).refine((kinds) => new Set(kinds).size === kinds.length, {
+    message: "a purpose lists each kind once"
+  })
+}).strict();
+var MAX_PURPOSES = 32;
+var Manifest = z9.record(PurposeKey, Purpose).refine((manifest) => Object.keys(manifest).length > 0, {
+  message: "a manifest declares at least one purpose"
+}).refine((manifest) => Object.keys(manifest).length <= MAX_PURPOSES, {
+  message: `a manifest declares at most ${String(MAX_PURPOSES)} purposes \u2014 a consent screen is a set of questions somebody answers one at a time`
+}).refine((manifest) => !(RESERVED_PURPOSE in manifest), {
+  message: `"${RESERVED_PURPOSE}" is reserved for a site that declares no purposes of its own \u2014 give this one a name from your own vocabulary`
+});
+function singlePurposeManifest(input) {
+  return {
+    [RESERVED_PURPOSE]: { label: input.label, kinds: [...input.kinds] }
+  };
+}
+
+// src/succession.ts
+import { z as z10 } from "zod";
+var SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+var RETIREMENT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
+var MAX_SUCCESSION_CHAIN = 64;
+var Succession = z10.object({
+  /**
+   * The predecessor's public identity — K1, in full.
+   *
+   * The whole identity rather than the key id, because a daemon meeting a
+   * chain it has not seen before has to *verify* each link, and a key id is
+   * a fingerprint: enough to compare, never enough to check a signature.
+   */
+  identity: PublicIdentity,
+  /** K1's signature over the statement naming K1 and its successor. */
+  signature: z10.string().min(1)
+}).strict();
+function successionStatement(fromKeyId, toKeyId) {
+  return Buffer.from(`${SUCCESSION_CONTEXT}:${fromKeyId}:${toKeyId}`);
+}
+function signSuccession(previous, next) {
+  return {
+    identity: {
+      identity: previous.identityPublic,
+      encryption: previous.encryptionPublic,
+      encryptionSig: previous.encryptionSig
+    },
+    signature: signWith(
+      previous,
+      successionStatement(keyId(previous.identityPublic), keyId(next.identity))
+    )
+  };
+}
+function verifyLink(link, toKeyId) {
+  if (!verifyPublicIdentity(link.identity)) return false;
+  return verifyWith(
+    link.identity.identity,
+    successionStatement(keyId(link.identity.identity), toKeyId),
+    link.signature
+  );
+}
+function walkSuccession(input) {
+  const { current, chain, approved } = input;
+  if (chain.length === 0) return { path: [current], failure: "no-chain" };
+  if (chain.length > MAX_SUCCESSION_CHAIN)
+    return { path: [current], failure: "too-long" };
+  const steps = [...chain].reverse();
+  const path = [current];
+  let succeeding = current;
+  for (const link of steps) {
+    if (!verifyLink(link, succeeding)) return { path, failure: "broken-link" };
+    const previous = keyId(link.identity.identity);
+    path.unshift(previous);
+    if (approved(previous)) return { path, from: previous };
+    succeeding = previous;
+  }
+  return { path, failure: "unknown-origin" };
+}
+
 // src/musts.ts
+function kindsOf(must2) {
+  return typeof must2.verifiedBy === "string" ? [must2.verifiedBy] : must2.verifiedBy;
+}
 var must = (m) => Object.freeze(m);
 var MUSTS = Object.freeze({
   // ---- Pairing and identity -------------------------------------------
@@ -797,6 +1353,50 @@ var MUSTS = Object.freeze({
     verifiedBy: "conformance",
     source: "byollm_009 \xA74"
   }),
+  SITE_KEY_BY_STUB: must({
+    id: "SITE_KEY_BY_STUB",
+    statement: "A daemon MUST verify a job's payload against the pinned key of the site the stub names, and MUST refuse a job naming a site it has not pinned. It MUST NOT fall back to another pinned key, and MUST refuse an envelope whose declared sender disagrees with the stub's site.",
+    enforcedBy: "daemon",
+    // Adversarial, and the reason is the finding that produced it: the
+    // honest paths pass with every site check deleted, because `open`
+    // refuses a signature from the wrong key anyway. What distinguishes an
+    // enforced rule from a coincidence here is a hostile pairing of stub and
+    // envelope, which no conformance client would ever send.
+    verifiedBy: "adversarial",
+    source: "byollm_009 \xA7A.3"
+  }),
+  SITES_LOCALLY_APPROVED: must({
+    id: "SITES_LOCALLY_APPROVED",
+    statement: "A daemon MUST NOT run work for a site on an upstream's word alone. An upstream may propose a site set; work for any site in it MUST additionally carry a grant signed by the control-plane key this daemon pinned at pairing. A key that has changed for an id this daemon already pinned MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already pinned, over a statement naming both key ids MUST be accepted \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently. The first job from a site this daemon has never served MUST be announced at the machine.",
+    enforcedBy: "daemon",
+    // Two kinds, and the second is the one that matters — V1-1.
+    //
+    // `construction`: the daemon cannot serve a site that is not in its
+    // pinned map, and admission refuses before a payload is fetched — and
+    // since byollm_016 Amendment K, being in the map is no longer sufficient
+    // either: a signed grant is, and the relay proposing the set cannot
+    // produce one.
+    //
+    // `adversarial`: the property that survives is about a *sequence* —
+    // remove the id, re-offer it under a different key — which no honest
+    // upstream sends and which the fence above does not see. That was the
+    // bypass: the pin was deleted with the id, so the comparison had nothing
+    // to compare against and the substitution arrived as a stranger.
+    // **Not `conformance`, and that is a live gap rather than a judgement.**
+    // Amendment C's succession clause is a rule about two implementations
+    // agreeing, which is what a conformance check is for — but rotating a
+    // site's key is not something `ConformanceTarget` can express, and adding
+    // an optional hook that most targets omit would produce a check reporting
+    // success for a reason unrelated to the property it claims. That is this
+    // project's most-repeated bug, and it is not worth reintroducing for a
+    // stronger-sounding word in a table. The rotation path is verified by
+    // `site-rotation.test.ts` (both directions, against the shipped runner)
+    // and `relay/test/rotation.test.ts` (both planes, against the reference
+    // relay); the missing piece is a second *independent* implementation to
+    // check them against, and there is not one yet.
+    verifiedBy: ["construction", "adversarial"],
+    source: "byollm_009 \xA7B.2, Amendment C"
+  }),
   KEYS_EXCHANGED_AT_CONSENT: must({
     id: "KEYS_EXCHANGED_AT_CONSENT",
     statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
@@ -928,7 +1528,7 @@ var MUSTS = Object.freeze({
   }),
   NAMED_LOCAL_ALLOWLIST: must({
     id: "NAMED_LOCAL_ALLOWLIST",
-    statement: "A 'named' job MUST be admitted only by the daemon's own local (server origin, user id) allowlist \u2014 never on the server's assertion alone.",
+    statement: "A 'team' job MUST be admitted only by something the device itself verified, keyed by (server origin, user id) \u2014 never on the routing party's assertion alone.",
     enforcedBy: "daemon",
     verifiedBy: "conformance",
     source: "byollm_001 Rev 1 \xA7B"
@@ -984,12 +1584,12 @@ var MUSTS = Object.freeze({
     verifiedBy: "conformance",
     source: "byollm_001 \xA7Endpoints.4"
   }),
-  RESULT_PROVENANCE: must({
-    id: "RESULT_PROVENANCE",
-    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
     enforcedBy: "server",
     verifiedBy: "conformance",
-    source: "byollm_003 Rev 1 \xA7Return-trip"
+    source: "byollm_009 \xA711"
   }),
   // ---- The trust surface -------------------------------------------------
   INGRESS_LOGGED_BEFORE_EXECUTION: must({
@@ -1007,12 +1607,33 @@ var MUSTS = Object.freeze({
     verifiedBy: "adversarial",
     source: "byollm_004 \xA72"
   }),
+  /**
+   * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
+   *
+   * A site may now name a **service** on the stub. The temptation is to read
+   * that as a crack in this law, so the statement below says exactly where the
+   * line is: a name selects from a menu the owner published, and resolves to a
+   * model, backend, base URL and flags **only** through that owner's own
+   * config. The site supplies a key; the owner supplies every value it maps
+   * to. A name the owner does not advertise is refused rather than
+   * substituted, because substitution is how "you may pick from my list" turns
+   * into "you may ask for anything and get something".
+   *
+   * Two properties keep it from drifting into "sites demand models":
+   *
+   *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+   *      no flag crosses the wire — only a key that means nothing off this
+   *      owner's machine.
+   *   2. **It is a stub field, never a payload field.** The prompt cannot
+   *      reach it. That is unchanged and is the sentence the second clause
+   *      below still enforces verbatim.
+   */
   NO_PAYLOAD_ROUTING: must({
     id: "NO_PAYLOAD_ROUTING",
-    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them.",
+    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them. A stub MAY name a service the owner advertises, which selects among that owner's own config entries and MUST NOT introduce any value the owner did not write; an unadvertised name MUST be refused, never substituted.",
     enforcedBy: "daemon",
     verifiedBy: "adversarial",
-    source: "byollm_004 \xA72"
+    source: "byollm_004 \xA72, amended byollm_016 \xA7Phase B"
   }),
   STRIPPED_CHILD_ENV: must({
     id: "STRIPPED_CHILD_ENV",
@@ -1041,26 +1662,117 @@ var MUSTS = Object.freeze({
     enforcedBy: "daemon",
     verifiedBy: "adversarial",
     source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
   })
 });
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
+});
 var MUST_IDS = Object.freeze(Object.keys(MUSTS));
 function mustsVerifiedBy(kind) {
-  return MUST_IDS.filter((id) => MUSTS[id].verifiedBy === kind);
+  return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
 }
 
 // src/wire.ts
-import { z as z8 } from "zod";
-var PROTOCOL_VERSION = "0";
+import { z as z11 } from "zod";
+var PROTOCOL_VERSION = "1";
 var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
   PROTOCOL_VERSION
 ]);
 var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
+function declaredVersion(input) {
+  const { body, query } = input;
+  if (typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion")) {
+    return body.protocolVersion;
+  }
+  return query?.get("protocolVersion") ?? void 0;
+}
 function checkProtocolVersion(body) {
   const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
   if (typeof declared !== "string" || declared.length === 0) {
     return {
       error: "unsupported-protocol-version",
-      message: "this request declared no protocol version. Upgrade the daemon: `npm i -g byollm@alpha`.",
+      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
       supported: SUPPORTED_PROTOCOL_VERSIONS,
       minimum: MIN_PROTOCOL_VERSION
     };
@@ -1068,13 +1780,14 @@ function checkProtocolVersion(body) {
   if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
     return {
       error: "unsupported-protocol-version",
-      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? "Upgrade the daemon: `npm i -g byollm@alpha`." : "This daemon is newer than the server; the server needs upgrading."),
+      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
       supported: SUPPORTED_PROTOCOL_VERSIONS,
       minimum: MIN_PROTOCOL_VERSION
     };
   }
   return null;
 }
+var UPGRADE_COMMAND = "npm i -g byollm@latest";
 var PROTOCOL_PREFIX = "/byollm";
 var ENDPOINTS = Object.freeze([
   "pair",
@@ -1084,23 +1797,65 @@ var ENDPOINTS = Object.freeze([
   "result",
   "release"
 ]);
-var Capability = z8.object({
+var Capability = z11.object({
   kind: JobKind,
+  /**
+   * The owner's name for the service answering this kind — byollm_016.
+   *
+   * A device advertises *which* of its services serves a kind, not merely
+   * that something does. **A site never sees this**, and never did after
+   * Amendment L: it is what a control plane resolves a person's mapping
+   * against, so that the service a grant names is one this device actually
+   * offers rather than one somebody invented.
+   *
+   * `isDefault` used to sit beside it, saying which row an unselected job
+   * took. Nothing selects any more — a job names a purpose and a person's
+   * mapping names a service — so there is no unselected job for a default
+   * to catch, and the field went with the machinery it served.
+   */
+  service: z11.string().min(1),
   backendId: BackendIdSchema,
   backendClass: BackendClass,
-  model: z8.string().min(1),
+  model: z11.string().min(1),
+  /**
+   * Models this device's CLI knows about — byollm_017 ruling 3.
+   *
+   * **Suggestions, not a vocabulary.** Free text is always allowed: the
+   * promise is that a model released this morning works this morning, and a
+   * frozen list anywhere a person picks from breaks that on the first day
+   * it matters. What makes free text safe is ruling 2 — a model is probed
+   * before it is stored, so "found is not works" is answered by the device
+   * rather than by a list.
+   *
+   * Announced with the capability rather than kept in the dashboard,
+   * because the answer is "what does THIS device's CLI know" and only the
+   * device can say. A list held cloud-side would be one more thing to
+   * update on release day, and wrong for anybody who had not upgraded.
+   *
+   * Optional, and empty is legal. A backend with nothing to suggest — a
+   * local server serving one model — is not a backend in an error state,
+   * and a reader must not render an absent list as "no models available".
+   */
+  knownModels: z11.array(z11.string().min(1)).optional(),
   offerScope: OfferScope
 }).strict();
-var CapabilityMatrix = z8.array(Capability);
-var PairStartRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  action: z8.literal("start"),
-  daemon: z8.object({
-    version: z8.string().min(1),
+var CapabilityMatrix = z11.array(Capability);
+var WithheldKind = z11.object({
+  kind: JobKind,
+  claimants: z11.array(
+    z11.object({ service: z11.string().min(1), offer: OfferScope }).strict()
+  ).min(2)
+}).strict();
+var GrantRef = z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict();
+var PairStartRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  action: z11.literal("start"),
+  daemon: z11.object({
+    version: z11.string().min(1),
     /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z8.string().min(1).max(120),
-    platform: z8.enum(["darwin", "linux", "win32"])
-  }),
+    label: z11.string().min(1).max(120),
+    platform: z11.enum(["darwin", "linux", "win32"])
+  }).strict(),
   /**
    * This machine's public keys (byollm_009 §5).
    *
@@ -1111,111 +1866,278 @@ var PairStartRequest = z8.object({
   device: PublicIdentity,
   capabilities: CapabilityMatrix
 }).strict();
-var PairStartResponse = z8.object({
+var PairStartResponse = z11.object({
   /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z8.string().min(20),
+  deviceCode: z11.string().min(20),
   /** Short code the user reads and confirms in the browser. */
-  userCode: z8.string().min(4).max(16),
+  userCode: z11.string().min(4).max(16),
   /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z8.url(),
+  verificationUrl: z11.url(),
   /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z8.number().int().positive(),
+  expiresAt: z11.number().int().positive(),
   /** How often the daemon may poll. */
-  pollIntervalMs: z8.number().int().min(500).max(6e4)
+  pollIntervalMs: z11.number().int().min(500).max(6e4)
 }).strict();
-var PairPollRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  action: z8.literal("poll"),
-  deviceCode: z8.string().min(20)
+var PairPollRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  action: z11.literal("poll"),
+  deviceCode: z11.string().min(20)
 }).strict();
-var PairPollResponse = z8.discriminatedUnion("status", [
-  z8.object({ status: z8.literal("pending") }).strict(),
-  z8.object({ status: z8.literal("denied") }).strict(),
-  z8.object({ status: z8.literal("expired") }).strict(),
-  z8.object({
-    status: z8.literal("approved"),
-    /** Bearer token for every later call. Scoped to exactly one user. */
-    runnerToken: z8.string().min(20),
-    runnerId: z8.string().min(1),
+var PairPollResponse = z11.discriminatedUnion("status", [
+  z11.object({ status: z11.literal("pending") }).strict(),
+  z11.object({ status: z11.literal("denied") }).strict(),
+  z11.object({ status: z11.literal("expired") }).strict(),
+  z11.object({
+    status: z11.literal("approved"),
+    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
+    //
+    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
+    // the daemon's pairings file, and then **never sent, never looked up
+    // and never compared**. `getRunnerByTokenHash` existed on both stores
+    // and was called by nothing but a test asserting it returns null.
+    //
+    // Not merely dead wire, which is what `audienceAllow` and
+    // `HeartbeatResponse.leases` were. This was a *secret*: minted,
+    // transmitted, and written to two disks at rest, for nothing. A
+    // credential with no purpose is a liability rather than clutter,
+    // because the only thing it can ever do is leak.
+    //
+    // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
+    // enforced — every authenticated call is signed by the device's pinned
+    // identity key. This removes the thing the MUST is named after.
+    runnerId: z11.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z8.string().min(1),
+    owner: z11.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z8.string().optional(),
+    ownerLabel: z11.string().optional(),
     /**
-     * The site's public keys, for the daemon to pin (byollm_009 §5).
+     * The sites this pairing covers, for the daemon to pin (byollm_009 §5),
+     * keyed by each site's identity key id — cloud_009 §5.
      *
-     * Returned only on approval — a pending or denied poll learns nothing,
+     * Returned only on approval: a pending or denied poll learns nothing,
      * so an unapproved code cannot be used to enumerate a site's keys.
+     *
+     * **One pairing per upstream, not one per site.** A user who connects a
+     * site on a web dashboard has no reason to go back to a laptop and run
+     * a command, so which sites a pairing covers is a projection of consent
+     * — refreshed on the heartbeat — rather than something frozen at
+     * pairing. A direct site answers with exactly one entry, which is the
+     * same shape and not a special case.
+     *
+     * Keyed by the id `stub.site` carries (Amendment A §A.3), so the
+     * runner's lookup is a map read rather than a join across two
+     * namespaces.
      */
-    site: PublicIdentity
+    sites: z11.record(z11.string().min(1), PublicIdentity),
+    /**
+     * The control plane's grant-signing key, pinned here — Amendment J.
+     *
+     * **Pairing is when, and that is the whole question.** Pairing is
+     * already the ceremony where an owner proves out of band that this
+     * device is theirs, so a key learned here rides trust that has already
+     * happened. The rejected alternative is trust-on-first-grant, and it is
+     * rejected because it hands the decision back to the relay: a daemon
+     * that learns whose signature to trust from the first grant to arrive
+     * has its admission authority chosen by whoever controls delivery.
+     *
+     * Optional on the wire, and only on the wire: a direct-mode server has
+     * no control plane and signs nothing, and a daemon that receives no key
+     * serves its owner alone. It is not optional for a relay with a control
+     * plane — one that omitted it would be asking devices to accept grants
+     * from nobody in particular, and would find every job refused.
+     *
+     * Rotation is Amendment C's, with no path where a grant teaches a
+     * daemon a new key.
+     */
+    controlPlanePublic: z11.string().min(1).optional()
   }).strict()
 ]);
-var PairRequest = z8.discriminatedUnion("action", [
+var PairRequest = z11.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
+var ClaimRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z8.number().int().min(1).max(64)
+  max: z11.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z8.object({
+var ClaimResponse = z11.object({
   /**
    * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
    * device claimed — see {@link JobStub} for the exhaustive metadata list.
    */
-  jobs: z8.array(ClaimedStub),
+  jobs: z11.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z8.number().int().positive()
+  leaseMs: z11.number().int().positive()
 }).strict();
-var HeartbeatRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
-  daemonVersion: z8.string().min(1),
+var HeartbeatRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  daemonVersion: z11.string().min(1),
   capabilities: CapabilityMatrix,
+  /**
+   * Kinds this device is withholding, and why it can be said.
+   *
+   * Optional so a daemon that has nothing withheld sends nothing, and so an
+   * older daemon against a newer hub is simply a device with no withheld
+   * kinds rather than a parse failure.
+   */
+  withheld: z11.array(WithheldKind).default([]),
   /**
    * Leases this daemon believes it holds; the server renews exactly these.
    *
    * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
    * grant the runner no longer holds — see {@link Lease.id}.
    */
-  activeLeases: z8.array(
-    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
-  ),
+  activeLeases: z11.array(GrantRef),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z8.boolean()
+  paused: z11.boolean()
 }).strict();
-var HeartbeatResponse = z8.object({
-  /** Once true, the daemon stops claiming and abandons in-flight work. */
-  revoked: z8.boolean(),
+var HeartbeatResponse = z11.object({
+  /**
+   * The sites this daemon may serve, right now — cloud_008 finding 59.
+   *
+   * Revocation used to be a boolean, and it was device-wide: the daemon
+   * plane refused every call when the (owner, hub-site) consent was gone,
+   * heartbeat answered `revoked: true` with `lost: all`, and the daemon
+   * dropped its whole pairing by origin. Under a hub that is one site's
+   * revocation ending a machine's relationship with every other site it
+   * served — the amplification finding 48 warned about, arriving through
+   * the one field nobody thought of as tenancy.
+   *
+   * So the answer is the set. A site that leaves it is revoked *for that
+   * site*: the daemon drops that pin and keeps the rest. An empty set is
+   * what "revoked" used to mean, and the daemon can see that for itself
+   * rather than being told a second time — two fields for one fact is how
+   * they drift.
+   */
+  sites: z11.record(z11.string().min(1), PublicIdentity),
+  /**
+   * How a site's current key traces back to one this daemon already holds —
+   * byollm_009 Amendment C.
+   *
+   * Keyed by the same id as `sites`, and **additive on purpose**: `sites`
+   * remains the one statement of which key is current, and this says only
+   * how that key got there. Two fields for one fact is how they drift; this
+   * is two facts, and the second is evidence about the first.
+   *
+   * Optional because a site that has never rotated has no chain, which is
+   * every site today. A daemon that receives one for an id it already holds
+   * ignores it: the pin it has is the pin it approved.
+   *
+   * §12 carries what this adds to the metadata surface — a site's rotation
+   * history is public by construction, because a daemon that cannot read it
+   * cannot verify it.
+   */
+  successions: z11.record(
+    z11.string().min(1),
+    z11.object({
+      /** Oldest last, as the projection carries it. */
+      succeeds: z11.array(Succession).max(MAX_SUCCESSION_CHAIN),
+      /**
+       * Until when the superseded key may still sign work — epoch ms.
+       *
+       * The daemon holds its own clock against this, for the reason it
+       * holds its own allowlist: a projection that could extend the
+       * window indefinitely would be a two-key site forever, decided by
+       * the party this design does not trust.
+       */
+      retiringUntil: z11.number().int().positive().optional()
+    }).strict()
+  ).optional(),
   /**
    * Per-job cancel (byollm_001 Rev 1 §C). The daemon aborts these jobs'
    * in-flight backend calls and reports them `canceled`.
+   *
+   * **The grant, not the id** — V1-3. Job ids are chosen per site, so two
+   * sites may pick the same one, and a bare id told a daemon holding both
+   * to abort whichever it happened to have filed under that name. The lease
+   * is the unique grant and the daemon already keys its work by it; this is
+   * the same shape `activeLeases` sends in the other direction.
    */
-  cancel: z8.array(z8.string().min(1)),
-  /** Jobs whose leases were renewed, with their new expiry. */
-  leases: z8.array(
-    z8.object({
-      jobId: z8.string().min(1),
-      expiresAt: z8.number().int().positive()
-    }).strict()
+  cancel: z11.array(
+    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
   ),
+  // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
+  //
+  // It carried "these leases were renewed, and here is the new expiry", and
+  // **no daemon ever read it.** A mutation returning an empty list while
+  // renewing correctly survived every test, which is what made it visible.
+  //
+  // It is neither a class nor membership, so Amendment A's rule does not
+  // decide it — the older test does: nothing reads it, so it is dead wire.
+  // §6's exhaustiveness is a commitment about what an upstream can see, and
+  // it applies to every message rather than only to the stub.
+  //
+  // `lost` is the actionable signal and always was: a daemon stops work on
+  // a lease it no longer holds. "Renewed" was the same question answered a
+  // second time, and a second answer can only agree or contradict.
+  //
+  // Renewal itself is untouched — the upstream still extends the grants a
+  // heartbeat names, which is what §0.6 fixed. What ended is telling the
+  // daemon about it in a field it ignored. If an upstream ever needs to
+  // push lease decisions, that is a new field with a reader, added on
+  // purpose.
   /**
    * Jobs the daemon thinks it holds but the server has reassigned or
    * expired. The daemon must stop work on these and not report results.
+   *
+   * Named by grant rather than by id, for V1-3's reason: a bare id is
+   * ambiguous across sites, and "the lease you no longer hold" is exactly
+   * what this field means anyway.
    */
-  lost: z8.array(z8.string().min(1)),
+  lost: z11.array(
+    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
+  ),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z8.number().int().positive()
+  serverTime: z11.number().int().positive(),
+  /**
+   * Sites whose disclosure the user must read again before work moves —
+   * cloud_008 finding 48, named rather than counted.
+   *
+   * A **subset of `sites`**, deliberately: a paused site keeps its pin, so
+   * re-consenting never costs a re-pair. The daemon can say which site is
+   * waiting and the user can go and read it, which is the difference
+   * between a machine that is quietly idle and one that says why.
+   *
+   * Not `revoked`, which is a human ending a relationship, and not
+   * `paused`, which on the request side already means "this daemon's
+   * operator stopped it" — one word with two subjects on two halves of one
+   * exchange is a confusion nobody untangles from a log.
+   */
+  awaitingConsent: z11.array(z11.string().min(1))
 }).strict();
-var ResultDisposition = z8.enum(["ok", "error", "canceled"]);
-var ResultRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
-  jobId: z8.string().min(1),
+var ResultDisposition = z11.enum(["ok", "error", "canceled"]);
+var ResultRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  jobId: z11.string().min(1),
+  /**
+   * The grant this result was produced under — cloud_008 §1.4a.
+   *
+   * `fetch` has always named its lease, with the reasoning written beside
+   * it: a request that names only the job would be answerable for whatever
+   * lease exists when it arrives. **The operation that writes the result did
+   * not**, on either plane, and checked only the runner id — which survives
+   * a claim-release-reclaim cycle, so a device whose grant had been swept
+   * and reissued could still land a result for a job it no longer held.
+   *
+   * Found by tracing a mutation that survived in §0.6: the lease lapsed, the
+   * sweep requeued, the daemon re-claimed under a new grant, and the
+   * original run finished and posted anyway. The relay marked the job done
+   * with a result the site cannot open — it verifies the envelope against
+   * the *current* holder's device, so the crypto contains the substitution —
+   * and then refused the real holder's result as a replay. A lost job, in
+   * silence.
+   *
+   * `LEASE_HONORED` is a statement about a lease *instance*. That was
+   * learned once already, when a replayed release yanked a later grant, and
+   * it applies here for the same reason.
+   */
+  leaseId: z11.string().min(1),
   /**
    * The outcome, sealed to the site and signed by the device.
    *
@@ -1231,26 +2153,48 @@ var ResultRequest = z8.object({
    * fact: believing it unverified would let a daemon mark a job `ok` while
    * sealing an error, and only the app would ever find out.
    */
-  disposition: ResultDisposition,
-  /** Which model actually served it, for the result's provenance. */
-  model: z8.string().min(1),
-  backendClass: BackendClass,
-  /** Wall-clock milliseconds the backend call took. */
-  durationMs: z8.number().int().nonnegative()
+  disposition: ResultDisposition
+  // `model`, `backendClass` and `durationMs` are **inside the envelope** —
+  // cloud_008 §2.5. See {@link RunMetadata}.
+  //
+  // They were here, in the clear, and that was two problems wearing one
+  // coat. On the direct plane the site recorded unauthenticated fields
+  // beside an authenticated answer: a daemon could seal one result and
+  // declare a different model, and only the unsigned half would reach the
+  // app. Through a relay they reached a third party that acts on none of
+  // them — `model` in particular being the sort of detail Amendment A's
+  // rule keeps off the wire.
+  //
+  // `disposition` stays, and the difference is the test: a relay *routes*
+  // on it, so it is a class a routing party consumes. Nobody between the
+  // two ends consumes these.
 }).strict();
-var ResultResponse = z8.object({
+var ResultResponse = z11.object({
   /**
-   * False when the submission lost an idempotency race or the lease was
-   * already gone — the daemon should discard, not retry
-   * ({@link MUSTS.RESULT_IDEMPOTENT}).
+   * False when this submission wrote nothing — the daemon should discard,
+   * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z8.boolean(),
+  accepted: z11.boolean(),
+  /**
+   * True when this device had already recorded this job's result.
+   *
+   * The difference between "already recorded" and "you no longer hold this"
+   * — cloud_008 §3.6. A daemon whose acknowledgment was lost is in the first
+   * case and needs to hear it: its answer is safely on disk. Reporting a
+   * stale lease instead invents a worry about a result that is already
+   * stored, and sends its owner looking for a routing problem.
+   *
+   * Set only for the device that finished the job. A different device gets
+   * the same refusal it would get for a job that is *not* terminal, so a job
+   * id cannot be used as a terminality probe.
+   */
+  duplicate: z11.boolean().optional(),
   /** The job's state after this submission. */
-  state: z8.string().min(1)
+  state: z11.string().min(1)
 }).strict();
-var ReleaseRequest = z8.object({
-  protocolVersion: z8.literal(PROTOCOL_VERSION),
-  runnerId: z8.string().min(1),
+var ReleaseRequest = z11.object({
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
   /**
    * Which leases to release — the grant, not just the job.
    *
@@ -1258,51 +2202,162 @@ var ReleaseRequest = z8.object({
    * moment it arrives, which for a replayed request is not the lease the
    * daemon meant. See {@link Lease.id}.
    */
-  leases: z8.array(
-    z8.object({ jobId: z8.string().min(1), leaseId: z8.string().min(1) })
-  ),
+  leases: z11.array(GrantRef),
   /**
    * Why, so the app's runner list can say something true.
    *
-   * `refused` is load-bearing, not cosmetic: the server cannot evaluate a
-   * daemon's *local* `named` allowlist (§4.2), so it may legitimately offer
+   * `refused` is load-bearing, not cosmetic: the server cannot evaluate
+   * what a device will admit (§4.2), so it may legitimately offer
    * a job this daemon then declines. The server MUST record the refusal and
    * stop offering that job to that runner, or the pair would spin between
    * claim and release forever.
    */
-  reason: z8.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  reason: z11.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseResponse = z8.object({
-  released: z8.array(z8.string().min(1))
+var ReleaseResponse = z11.object({
+  released: z11.array(z11.string().min(1))
 }).strict();
-var WireErrorCode = z8.enum([
+var WireErrorCode = z11.enum([
   "bad-request",
   "unsupported-protocol-version",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
   "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
   "revoked",
   "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  /**
+   * The job is over, and this call is about a job — V1-6, and the code the
+   * site plane has been serving without one (V1-13).
+   *
+   * Distinct from `not-found`, which says "no such job", and from
+   * `not-ready`, which says "not yet, keep asking". This one says "yes, and
+   * it finished" — so a daemon must stop rather than retry, and a replayed
+   * request must not be able to reopen it.
+   */
+  "too-late",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
   "rate-limited",
   "server-error"
 ]);
-var WireError = z8.object({
+var WireError = z11.object({
   error: WireErrorCode,
-  message: z8.string().min(1),
+  message: z11.string().min(1),
+  /**
+   * What this server speaks, on `unsupported-protocol-version` — §B.4.
+   *
+   * The refusal has carried these since the version handshake existed and
+   * the enumeration did not model them, so the one error that exists to be
+   * *acted on* was the one that failed to parse as a wire error. Found by
+   * the relay's own suite the day the relay started sending it: a refusal
+   * outside the enumerated shape is a refusal a client cannot branch on,
+   * which is the whole reason §1.4 enumerates them.
+   *
+   * Modelled the way `clock-skew`'s two fields already are — code-specific
+   * extras, refused on any other code by the refinement below.
+   */
+  supported: z11.array(z11.string().min(1)).optional(),
+  minimum: z11.string().min(1).optional(),
   /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z8.number().int().nonnegative().optional()
-}).strict();
+  retryAfter: z11.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z11.number().int().positive().optional(),
+  maxSkewMs: z11.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+  const version = error.error === "unsupported-protocol-version";
+  const versionFields = error.supported !== void 0 || error.minimum !== void 0;
+  if (version && !versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: "unsupported-protocol-version must carry supported and minimum"
+    });
+  }
+  if (!version && versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry supported or minimum`
+    });
+  }
+});
 var ERROR_STATUS = Object.freeze({
   "bad-request": 400,
   "unsupported-protocol-version": 400,
   unauthorized: 401,
+  forbidden: 403,
   revoked: 403,
   "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // The same 409 as `not-ready` and the opposite instruction: that one says
+  // keep asking, this one says stop. The status is the class of the
+  // problem — a request that does not fit the resource's state — and the
+  // code is what a caller acts on.
+  "too-late": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
   "rate-limited": 429,
   "server-error": 500
 });
-var FetchRequest = z8.object({
-  protocolVersion: z8.string().min(1),
-  runnerId: z8.string().min(1),
-  jobId: z8.string().min(1),
+var FetchRequest = z11.object({
+  // `literal`, like every other request — V1-17. This one said
+  // `string().min(1)`, so a daemon speaking a version this server does not
+  // know got past the handshake on the one endpoint that hands over a
+  // sealed payload. The version check exists so that a mismatch is a named
+  // refusal rather than a schema failure three fields later; here it was
+  // neither.
+  protocolVersion: z11.literal(PROTOCOL_VERSION),
+  runnerId: z11.string().min(1),
+  jobId: z11.string().min(1),
   /**
    * The grant this daemon holds.
    *
@@ -1310,9 +2365,9 @@ var FetchRequest = z8.object({
    * only the job would be answerable for whatever lease exists when it
    * arrives ({@link Lease.id}).
    */
-  leaseId: z8.string().min(1)
+  leaseId: z11.string().min(1)
 }).strict();
-var FetchResponse = z8.object({
+var FetchResponse = z11.object({
   /**
    * The work, sealed to the device that claimed it — byollm_009 §6.
    *
@@ -1324,13 +2379,20 @@ var FetchResponse = z8.object({
   envelope: SealedEnvelope
 }).strict();
 export {
+  ABOUT,
+  ABOUT_SHORT,
+  ABOUT_SHORT_LEDE,
+  ABOUT_SHORT_TAIL,
   AUDIENCES,
   Audience,
   BACKENDS,
+  BACKEND_CLASSES,
   BACKEND_IDS,
   BackendClass,
   BackendCost,
   BackendIdSchema,
+  CLOCK_ATTRIBUTION_MS,
+  CLOCK_SKEW_WARN_MS,
   Capability,
   CapabilityMatrix,
   ChatMessage,
@@ -1340,19 +2402,25 @@ export {
   ClaimedJob,
   ClaimedStub,
   DeliveredResult,
+  ENCRYPTION_KEY_CONTEXT,
   ENDPOINTS,
   ENVELOPE_MAX_AGE_MS,
   ERROR_STATUS,
   EnvelopeDirection,
   FetchRequest,
   FetchResponse,
+  GRANT_CONTEXT,
+  GRANT_MAX_AGE_MS,
+  GRANT_SIGNED_FIELDS,
   GeneratePayload,
+  GrantRef,
   HeartbeatRequest,
   HeartbeatResponse,
   JOB_KINDS,
   JobKind,
   JobOutcome,
   JobPayload,
+  JobRefused,
   JobResultCanceled,
   JobResultError,
   JobResultOk,
@@ -1361,9 +2429,13 @@ export {
   KindedPayload,
   Lease,
   MAX_CLOCK_SKEW_MS,
+  MAX_ENVELOPE_BYTES,
+  MAX_PURPOSES,
+  MAX_SUCCESSION_CHAIN,
   MIN_PROTOCOL_VERSION,
   MUSTS,
   MUST_IDS,
+  Manifest,
   MatchRefusal,
   OFFER_SCOPES,
   OfferScope,
@@ -1376,7 +2448,11 @@ export {
   PairStartRequest,
   PairStartResponse,
   PublicIdentity,
+  Purpose,
   REFUSAL_MESSAGES,
+  RESERVED_PURPOSE,
+  RETIREMENT_WINDOW_MS,
+  RefusalReason,
   ReleaseRequest,
   ReleaseResponse,
   RequestSignature,
@@ -1384,27 +2460,41 @@ export {
   ResultProvenance,
   ResultRequest,
   ResultResponse,
+  RunMetadata,
+  SIZE_CLASSES,
   SIZE_CLASS_LIMITS,
+  SUCCESSION_CONTEXT,
   SUPPORTED_PROTOCOL_VERSIONS,
   SealedEnvelope,
+  SealedOutcome,
+  SignedGrant,
   SizeClass,
   StoredKeys,
+  Succession,
   TERMINAL_STATES,
   WireError,
   WireErrorCode,
+  WithheldKind,
   backendDescriptor,
+  backendName,
   canTransition,
   canonicalRequest,
   checkProtocolVersion,
+  classifyCost,
   cryptoReady,
+  declaredVersion,
   effectiveOfferScope,
+  envelopeBytes,
   fingerprint,
   generateKeys,
+  grantStatement,
   isBackendId,
+  isCloudTaggedModel,
   isJobKind,
   isLocalHost,
   isTerminal,
   keyId,
+  kindsOf,
   matchAudience,
   mustsVerifiedBy,
   open,
@@ -1413,12 +2503,21 @@ export {
   publicIdentityOf,
   resolveCost,
   seal,
+  signGrant,
   signRequest,
+  signSiteRequest,
+  signSuccession,
   signWith,
+  singlePurposeManifest,
   sizeClassCeiling,
   sizeClassOf,
+  successionStatement,
+  verifyGrant,
+  verifyLink,
   verifyPublicIdentity,
   verifyRequest,
-  verifyWith
+  verifySiteRequest,
+  verifyWith,
+  walkSuccession
 };
 //# sourceMappingURL=index.js.map