@cello-protocol/daemon 0.0.11 → 0.0.13

package/dist/daemon.js

@@ -53,6 +53,8 @@ import { parseSessionAssignment, sessionRequestErrorReason } from "./session-ass
 import { wireSessionCeremonyHandler, wireSessionOfferHandler, wireSealCeremonyHandler, verifyUnilateralCertificate, verifyBilateralSealCertificate } from "./session-ceremony.js";
 import { reDeriveFrontiers, findInflatedFrontier } from "./seal-frontier-verify.js";
 import { LocalAutoNatStub } from "@cello-protocol/transport";
+import { startHttpManifestPoll } from "./http-manifest-poll.js";
+import { resolveDirectoryUrl } from "./directory-bootstrap.js";
 /**
  * M7-SESSION-001 (H-1): canonical byte encoding of a SEAL-INTERRUPTED leaf for
  * Ed25519 signing/verification. Field order is fixed and deterministic. Both the
@@ -170,7 +172,7 @@ class ProductionSessionNodeFactory {
     }
 }
 export async function startDaemon(config) {
-    const { celloDir, socketPath, lockFilePath, maxConnections, version, logger, manifestProvider, manifestRootKeys, manifestThreshold, manifestVersionStore: injectedManifestVersionStore, manifestPollScheduler, signalingConnect, challengeVerifier, directoryEndpointResolver, sessionNodeFactory, sessionNegotiator, getRelayCircuitAddress, } = config;
+    const { celloDir, socketPath, lockFilePath, maxConnections, version, logger, manifestProvider, manifestRootKeys, manifestThreshold, manifestVersionStore: injectedManifestVersionStore, manifestPollScheduler, directoryHttpUrl, signalingConnect, challengeVerifier, directoryEndpointResolver, sessionNodeFactory, sessionNegotiator, getRelayCircuitAddress, } = config;
     // CELLO-M7-TRANSPORT-001: composition-root selection of the transport selector.
     // Driven by CELLO_ENV; fails fast at startup (here, not at first session) when a
     // production environment is missing the required transport dialer (AC-010).
@@ -283,6 +285,24 @@ export async function startDaemon(config) {
         throw new Error("Manifest verification failed. The daemon cannot start with an unverified manifest when manifestProvider is configured. " +
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
+    // CELLO-M7-CONN-001 (DOD-CONN-3): start the daemon-level HTTP manifest poll. It fetches
+    // ${directoryHttpUrl}/manifest, verifies the threshold signature against the locally-pinned
+    // root keys, applies anti-rollback + expiry, and adopts a newer manifest — independent of any
+    // agent identity, running even with ZERO agents (the deleted keystone could not). Gated on the
+    // same manifest deps as the old signaling poll; off on the M6 backward-compat path (no scheduler).
+    let stopHttpManifestPoll;
+    if (manifestPollScheduler && manifestProvider && manifestRootKeys && manifestRootKeys.length > 0 && manifestThreshold && manifestThreshold >= 1) {
+        stopHttpManifestPoll = startHttpManifestPoll({
+            scheduler: manifestPollScheduler,
+            directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+            manifestProvider,
+            manifestVersionStore,
+            rootKeys: manifestRootKeys,
+            threshold: manifestThreshold,
+            logger,
+            mintCorrelationId: () => randomUUID(),
+        });
+    }
     // Load agent identities from the encrypted `agents` table (PERSIST-002 AC-007 — one path).
     // (The encrypted store + lock were established above, before manifest verification.)
     const { loaded: loadedAgents, failed: failedAgents } = await loadAgents(sessionNodeManager.getDb(), logger);
@@ -336,111 +356,63 @@ export async function startDaemon(config) {
     const defaultConnect = async () => {
         throw new Error("directory_signaling_not_configured");
     };
-    // M7 Keystone (Part 1): resolve the agent identity that authenticates the
-    // directory signaling stream. The daemon's directory-facing node is one per
-    // daemon, so the keystone authenticates as the PRIMARY agent (first successfully
-    // loaded). Returns null when no agent is registered yet → connect() throws
-    // no_agent_identity and the SignalingManager stays reconnecting until one exists
-    // (registration, Action 2, brings the first identity).
+    // CELLO-M7-CONN-001 (DOD-CONN-1): the keystone is DELETED. There is no shared directory
+    // connection borrowing the "primary" agent's identity. In PRODUCTION every agent operates its
+    // OWN directory signaling connection authenticated as itself (getAgentSignaling / signalingFor);
+    // removing any agent tears down only that agent's own connection, so the daemon never holds a
+    // connection authenticated as a removed agent (the Demo1 stranding bug). A single SHARED manager
+    // exists ONLY for the in-process test / backward-compat path (a single injected signalingConnect,
+    // no per-agent isolation) — in production it is undefined.
     //
-    // NOTE (multi-agent, Action 2+): per-agent directory operations under distinct
-    // identities are out of keystone scope. This establishes the directory door.
-    // L4: sort by name so the "primary" agent is STABLE across restarts — readdir
-    // order (agent-loader) is platform-dependent and unsorted, which would otherwise
-    // let the authenticating identity change between daemon restarts.
-    // CELLO-M7-ONBOARD-001: `primaryAgent` is mutable so the FIRST agent created at runtime
-    // (cello_create_agent on a fresh install) can be elected as the keystone identity — otherwise the
-    // directory door stays `reconnecting` forever until a restart. getAuthIdentity reads it on every
-    // reconnect attempt, so electing it makes the already-running reconnect loop authenticate + connect.
-    let primaryAgent = [...loadedAgents].sort((a, b) => a.name.localeCompare(b.name))[0];
-    const getAuthIdentity = () => {
-        if (!primaryAgent)
-            return null;
-        return { keyProvider: primaryAgent.keyProvider, pubkeyHex: primaryAgent.pubkey };
-    };
-    // Production builds signalingConnect from the bootstrap resolver + agent identity.
-    // Tests inject signalingConnect directly (takes precedence). Neither → defaultConnect
-    // (DAEMON-001 backward-compat). challengeVerifier is left to the caller: when absent,
-    // step-6 directory verification is skipped — the M6 path that connected and ran the
-    // full DKG/seal pipeline.
-    // M7 Action 2: the daemon holds a reference to the live directory-facing node so
-    // registration's FROST DKG (NetworkDirectoryNode) — and future ceremonies/seal — can
-    // open streams to the directory on the SAME node. createSignalingConnect sets it via
-    // publishNode on a successful connect and clears it (null) when the stream closes.
-    // Consumers MUST gate use on signalingManager.status === "connected".
+    // M7 Action 2: the daemon holds a reference to a live directory-facing node so registration's
+    // FROST DKG can open streams on the SAME node. In production each per-agent manager publishes its
+    // OWN node (getAgentSignaling); this shared ref is the test-path node only.
     let directoryNode = null;
     const getDirectoryNode = () => directoryNode;
-    const resolvedConnect = signalingConnect ??
-        (directoryEndpointResolver
-            ? createSignalingConnect({
-                getDirectoryEndpoint: directoryEndpointResolver,
-                getAuthIdentity,
-                logger,
-                challengeVerifier,
-                getManifestVersion: () => verifiedManifestVersion,
-                publishNode: (n) => {
-                    directoryNode = n;
-                },
-            })
-            : defaultConnect);
-    // H1: a long-running daemon must ride out directory outages — notably the
-    // 25-30 min multi-region directory deploy. The transport default of 10 reconnect
-    // attempts (~5 min with default backoff) transitions the manager to terminal
-    // "lost" mid-deploy, with no public way to re-enter the loop — the daemon would
-    // never recover without a cello logout/login. Use an effectively-unbounded attempt
-    // budget with a capped backoff so it keeps retrying and reconnects within
-    // ~maxBackoffMs of the directory returning. (Availability is a first-class invariant.)
-    //
-    // L3: challengeVerifier is NOT passed here — the dialer (createSignalingConnect)
-    // performs step-6 verification itself, matching #doOpen. The manager's copy would
-    // be dead (processStep5Frame is only invoked inside connect()).
-    const signalingManager = new SignalingManager({
-        connect: resolvedConnect,
-        logger,
-        maxReconnectAttempts: Number.MAX_SAFE_INTEGER,
-        maxBackoffMs: 30_000,
-        // DOD-AUTH-2: the keystone manager (primary agent's directory door) carries the
-        // manifest-poll deps so it re-polls the directory on its live stream and adopts a
-        // newer signed manifest. The SAME shared manifestProvider instance the startup load
-        // + challengeVerifier use, so an adopted manifest updates the cache step-6 reads from.
-        // All optional — undefined on the M6 backward-compat path → polling is simply off.
-        pollScheduler: manifestPollScheduler,
-        manifestProvider,
-        manifestVersionStore,
-        rootKeys: manifestRootKeys,
-        threshold: manifestThreshold,
-    });
+    // H1: a long-running daemon must ride out directory outages — notably the 25-30 min multi-region
+    // directory deploy. Use an effectively-unbounded reconnect budget with a capped backoff so each
+    // connection keeps retrying and reconnects within ~maxBackoffMs of the directory returning.
+    const sharedSignaling = directoryEndpointResolver
+        ? undefined
+        : new SignalingManager({
+            connect: signalingConnect ?? defaultConnect,
+            logger,
+            maxReconnectAttempts: Number.MAX_SAFE_INTEGER,
+            maxBackoffMs: 30_000,
+        });
     const perAgentSignaling = new Map();
     /**
-     * Return the directory signaling stream for `agentName`, authenticated as that
-     * agent. The primary agent reuses the keystone manager + its published node; any
-     * other agent gets (and caches) a dedicated manager. Falls back to the keystone
-     * manager when no production bootstrap resolver is configured (in-process tests
-     * inject a single `signalingConnect` and never exercise the per-agent path).
+     * Return the directory signaling stream for `agentName`, authenticated as that agent.
+     * Production: a dedicated per-agent manager (created + cached on first use). Test /
+     * backward-compat path (no directoryEndpointResolver): the single shared manager.
      *
-     * SCOPE (SPINE-5 follow-on): this wires per-agent signaling for REGISTRATION (the
-     * registration reply frames are routed via the per-agent DaemonRegistrationContext's
-     * own inbound handler). The daemon's INBOUND SESSION handlers (session_assignment /
-     * session_request, registerInboundHandler below) are still attached to the keystone
-     * `signalingManager` only — so a NON-primary agent can register but cannot yet RECEIVE
-     * inbound sessions on its dedicated stream (frames there are unhandled). Not a
-     * regression (before this, a non-primary agent could not register at all); closing it
-     * is SPINE-5, which attaches the session inbound handlers per-agent. Tracked in the
-     * M7 build journal + DoD SPINE-5 scope note.
+     * CONN-001 (DOD-CONN-2): the per-agent manager wires BOTH registration AND inbound session
+     * handlers (session_assignment / seal_interrupted_request) via wirePerAgentSessionInbound,
+     * so a non-primary agent RECEIVES inbound sessions on its own stream — closing the prior
+     * SPINE-5 gap where only the primary (keystone) received them. Earlier scope note (now
+     * resolved): inbound handlers used to be attached to the keystone only; they are now
+     * attached per-agent here via wirePerAgentSessionInbound.
      */
     function getAgentSignaling(agentName, agentKeyProvider, agentPubkeyHex) {
-        if (primaryAgent && agentName === primaryAgent.name) {
-            return { signaling: signalingManager, getNode: getDirectoryNode };
+        // CONN-001: test / backward-compat path — a single shared manager (no per-agent isolation;
+        // a single injected signalingConnect). In production sharedSignaling is undefined and every
+        // agent builds its own dedicated manager below.
+        if (sharedSignaling) {
+            return { signaling: sharedSignaling, getNode: getDirectoryNode };
         }
         const existing = perAgentSignaling.get(agentName);
         if (existing)
             return existing;
+        // Unreachable in practice: sharedSignaling is defined iff directoryEndpointResolver is absent, and
+        // the sharedSignaling branch above already returned. This narrows the resolver for the type-checker
+        // and is a defensive guard.
         if (!directoryEndpointResolver) {
-            return { signaling: signalingManager, getNode: getDirectoryNode };
+            throw new Error("getAgentSignaling: no directory endpoint resolver configured (and no shared manager)");
         }
+        const resolver = directoryEndpointResolver;
         let nodeRef = null;
         const connect = createSignalingConnect({
-            getDirectoryEndpoint: directoryEndpointResolver,
+            getDirectoryEndpoint: resolver,
             getAuthIdentity: () => ({ keyProvider: agentKeyProvider, pubkeyHex: agentPubkeyHex }),
             logger,
             challengeVerifier,
@@ -496,6 +468,9 @@ export async function startDaemon(config) {
             signaling: mgr,
             logger,
         });
+        // CELLO-M7-CONN-001 (DOD-CONN-2): inbound session_assignment + seal_interrupted_request
+        // on THIS agent's own stream, so a non-primary agent receives inbound sessions (SPINE-5).
+        wirePerAgentSessionInbound(mgr);
         return entry;
     }
     /** Resolve once `mgr` reaches "connected", or false on timeout. */
@@ -510,9 +485,9 @@ export async function startDaemon(config) {
      * Stop and forget a dedicated per-agent signaling manager. Called when an agent's
      * registration fails terminally — otherwise the lazily-created manager (and its
      * libp2p node + effectively-unbounded reconnect loop) would keep reconnecting forever
-     * for an agent that is not registered/online. No-op for the primary (it reuses the
-     * keystone manager, which is never stored here) and for agents with no dedicated
-     * manager. On a later retry, getAgentSignaling re-creates it.
+     * for an agent that is not registered/online. No-op on the test path (the shared manager is not
+     * stored in perAgentSignaling) and for agents with no dedicated manager. On a later retry,
+     * getAgentSignaling re-creates it.
      */
     async function dropAgentSignaling(agentName) {
         const entry = perAgentSignaling.get(agentName);
@@ -522,63 +497,113 @@ export async function startDaemon(config) {
         await entry.signaling.stop();
         logger.info("agent.signaling.dropped", { agentName });
     }
-    // DOD-SPINE-5/7: the PRIMARY agent registers + initiates + coordinates the session/seal FROST
-    // ceremonies over the keystone signaling stream (not a per-agent one), so its ceremony/seal/offer
-    // handlers must be wired on the keystone manager — otherwise a primary-agent initiator's session
-    // ceremony would time out. CELLO-M7-ONBOARD-001: extracted into a function so it can also be wired
-    // when the first agent is elected at runtime (cello_create_agent), not only at startup.
-    // Returns a disposer that UNREGISTERS the six keystone listeners. Each wire*/register* helper returns
-    // its own unregister fn; the keystone manager is shared and never stopped, so (unlike the per-agent
-    // managers, which unregister implicitly on stop) these MUST be unregistered explicitly when the
-    // primary is cleared or re-elected — otherwise removing-then-recreating the primary STACKS a second
-    // full set of listeners on the shared stream, double-firing every ceremony/seal frame (review HIGH).
-    function wireKeystonePrimary(agent) {
-        const unregister = [];
-        unregister.push(wireSessionCeremonyHandler({
+    // CONN-001: wire a manager's session/seal/offer handlers for `agent`. Used ONLY for the
+    // in-process test path's shared manager — production wires these PER-AGENT in getAgentSignaling.
+    function wireSharedHandlers(agent, mgr) {
+        wireSessionCeremonyHandler({
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
-            signaling: signalingManager,
+            signaling: mgr,
             logger,
-        }));
-        unregister.push(wireSealCeremonyHandler({
+        });
+        wireSealCeremonyHandler({
             agentName: agent.name,
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
-            signaling: signalingManager,
+            signaling: mgr,
             logger,
-        }));
-        unregister.push(wireSessionOfferHandler({
+        });
+        wireSessionOfferHandler({
             agentName: agent.name,
             getStandingReceiverEndpoint: () => sessionNodeManager.getStandingReceiverInfo(agent.name),
-            signaling: signalingManager,
+            signaling: mgr,
             logger,
-        }));
-        // The primary closes its OWN sessions over the keystone stream, so the directory routes its
-        // session_sealed / seal_unilateral_confirmed / seal_unilateral_notification frames there. These
-        // seal-completion listeners MUST be registered for the keystone primary (startup OR runtime
-        // election) — otherwise the close waiter never resolves and the seal silently never finalizes
-        // (review HIGH: previously these were a separate startup-only block, skipped on a fresh install).
-        // The register* functions are hoisted declarations within startDaemon, so callable here.
-        unregister.push(registerSessionSealedListener(signalingManager, agent.name, agent.pubkey));
-        unregister.push(registerUnilateralConfirmedListener(signalingManager, agent.name, agent.pubkey));
-        unregister.push(registerUnilateralUpgradeListener(signalingManager, agent.name, agent.pubkey));
-        return () => { for (const u of unregister) {
+        });
+        registerSessionSealedListener(mgr, agent.name, agent.pubkey);
+        registerUnilateralConfirmedListener(mgr, agent.name, agent.pubkey);
+        registerUnilateralUpgradeListener(mgr, agent.name, agent.pubkey);
+    }
+    // CONN-001: the directory signaling manager that OWNS operations for `agentName`. In production
+    // that is the agent's OWN per-agent manager (authenticated as itself); on the in-process test
+    // path it is the single shared manager (agentName ignored). Returns undefined only when the agent
+    // is not loaded in production (e.g. removed mid-flow) — callers treat that as a send failure.
+    function signalingFor(agentName) {
+        if (sharedSignaling)
+            return sharedSignaling;
+        const kp = keyProviders.get(agentName);
+        const agent = loadedAgents.find((a) => a.name === agentName);
+        if (!kp || !agent)
+            return undefined;
+        return getAgentSignaling(agentName, kp, agent.pubkey).signaling;
+    }
+    // CONN-001: send a frame over the OWNING agent's directory manager (per-agent in production, the
+    // shared manager in tests). If the agent has no manager (e.g. removed mid-flow), return a send
+    // failure rather than throw — callers already branch on `!result.ok`.
+    async function sendOver(agentName, frame) {
+        const mgr = signalingFor(agentName);
+        if (!mgr)
+            return { ok: false, reason: "directory_unreachable" };
+        return mgr.sendRaw(frame);
+    }
+    // CONN-001: aggregate directory signaling status for `cello status`. Test path → the shared
+    // manager's status. Production → connected if ANY online agent's connection is connected; else
+    // reconnecting if any per-agent connection exists; else disconnected (no agents online → no
+    // connections, which is correct — there is no shared connection to be "reconnecting").
+    function directorySignalingStatus() {
+        if (sharedSignaling)
+            return sharedSignaling.status;
+        const managers = [...perAgentSignaling.values()];
+        // CONN-001 (fallback-finder MED): a single daemon-level field cannot fully represent N independent
+        // per-agent connections, but it must NOT show "connected" while any agent is severed (that would
+        // mask a partial directory outage — the severed agent silently never receives inbound). So report
+        // "connected" ONLY when every per-agent manager is connected; otherwise "reconnecting" (degraded or
+        // none). No managers (no agent online) → "reconnecting", matching pre-CONN-001 fresh-install
+        // behavior. (Per-agent connection state is the future faithful surface.)
+        if (managers.length === 0)
+            return "reconnecting";
+        return managers.every((m) => m.signaling.status === "connected") ? "connected" : "reconnecting";
+    }
+    // CONN-001: stop every directory signaling connection on shutdown — the shared test manager AND
+    // every per-agent manager — so no reconnect loop is orphaned past shutdown.
+    async function stopAllSignaling() {
+        if (sharedSignaling) {
+            try {
+                await sharedSignaling.stop();
+            }
+            catch { /* best-effort */ }
+        }
+        for (const entry of perAgentSignaling.values()) {
             try {
-                u();
+                await entry.signaling.stop();
             }
-            catch { /* unregister is best-effort */ }
-        } };
+            catch { /* best-effort */ }
+        }
+    }
+    // CONN-001: test path only — wire the shared manager's session/seal handlers for the first loaded
+    // agent. Production wires them per-agent (getAgentSignaling). There is NO keystone identity to
+    // elect and no re-election machinery: the shared test manager is never removed, and in production
+    // a fresh create-agent brings up that agent's OWN connection (no shared door to elect into).
+    if (sharedSignaling && loadedAgents.length > 0) {
+        const first = [...loadedAgents].sort((a, b) => a.name.localeCompare(b.name))[0];
+        wireSharedHandlers(first, sharedSignaling);
+    }
+    // CELLO-M7-CONN-001 (DOD-CONN-1, code-review HIGH): in PRODUCTION, bring up EACH loaded agent's OWN
+    // directory connection at startup. A registered agent must have a directory presence whenever the
+    // daemon runs — so the directory can route inbound session_assignment/seal to it (notably after a
+    // restart, where login does NOT auto-start agents), and `cello status` reflects directory_signaling
+    // as soon as the daemon is up. This replaces the pre-CONN-001 keystone (which connected only the
+    // loaded PRIMARY at startup) with a per-agent connection for EVERY loaded agent. Idempotent with the
+    // create/register/start connect (getAgentSignaling caches per agent).
+    if (!sharedSignaling) {
+        for (const agent of loadedAgents) {
+            getAgentSignaling(agent.name, agent.keyProvider, agent.pubkey);
+        }
     }
-    // Disposer for the currently-wired keystone primary listeners (CELLO-M7-REMOVE-001): call it before
-    // clearing or re-electing the primary so the shared stream never carries a stale/duplicate set.
-    let keystoneDispose;
-    if (primaryAgent)
-        keystoneDispose = wireKeystonePrimary(primaryAgent);
     // Per-connection state: tracks which agent is "current" for each IPC connection.
     // Key = connectionId (assigned by IPC server), Value = current agent name or null.
     const perConnectionState = new Map();
@@ -893,7 +918,7 @@ export async function startDaemon(config) {
         const interrupted_sessions = buildInterruptedSessions();
         return {
             daemon: "running",
-            directory_signaling: signalingManager.status,
+            directory_signaling: directorySignalingStatus(),
             agents,
             connections,
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
@@ -932,6 +957,18 @@ export async function startDaemon(config) {
             return { ok: true };
         }
         onlineAgents.add(name);
+        // CELLO-M7-CONN-001 (DOD-CONN-2, code-review HIGH): the "online" transition establishes THIS
+        // agent's OWN directory signaling connection (the documented getAgentSignaling "online" trigger),
+        // so the directory has a stream to push inbound session_assignment / seal_interrupted_request to.
+        // Without this, a started receiver agent sitting in cello_await_session (notably after a daemon
+        // restart, where login does NOT auto-start agents) would have no stream and never receive inbound —
+        // a regression of the pre-CONN-001 keystone, which connected the primary at startup. Lazy +
+        // idempotent (getAgentSignaling reuses an existing manager); the test path returns the shared one.
+        const startKp = keyProviders.get(name);
+        if (startKp && agent.pubkey) {
+            getAgentSignaling(name, startKp, agent.pubkey);
+            logger.info("agent.directory.connection.initiated", { agentName: name, agentPubkey: agent.pubkey });
+        }
         // DOD-LOOP-1: each online agent gets its OWN standing receiver, so two agents on one daemon
         // (loopback) never contend for a single one. Fire-and-forget (initiate/accept also ensure on
         // demand); never let it throw out of the handler. Once the SR is up, re-park any of THIS
@@ -983,23 +1020,16 @@ export async function startDaemon(config) {
             const loaded = { name, pubkey: pubkeyHex, keyProvider };
             loadedAgents.push(loaded);
             agents.push({ name, state: "registered", pubkey: pubkeyHex });
-            // CELLO-M7-ONBOARD-001: on a FRESH install the daemon started with no agents, so there was no
-            // keystone identity and the directory door is stuck `reconnecting`. Elect this first agent as the
-            // keystone primary + wire its ceremony/seal handlers; the running reconnect loop then
-            // authenticates with it (getAuthIdentity now returns it) and connects on its next attempt — no
-            // restart needed. Only the FIRST agent is elected (loadedAgents is empty here, so it is also the
-            // name-sort min). NOTE (accepted LOW, review): if the operator then creates a lexicographically
-            // SMALLER second agent before any restart, the keystone primary stays this one until the next
-            // restart, where it re-derives to sort[0] — benign (each agent authenticates its own stream; the
-            // demoted agent gets fully wired via the per-agent path on restart), and not worth runtime
-            // re-election (un-wire/re-wire) churn.
-            if (!primaryAgent) {
-                // Dispose any prior keystone wiring before re-electing, so listeners never stack (REMOVE-001).
-                keystoneDispose?.();
-                primaryAgent = loaded;
-                keystoneDispose = wireKeystonePrimary(loaded);
-                logger.info("directory.keystone.elected", { agentName: name, agentPubkey: pubkeyHex });
-            }
+            // CELLO-M7-CONN-001 (DOD-CONN-1, supersedes ONBOARD-001 keystone election): on a fresh install
+            // the daemon started with zero agents, so there were no directory connections. Bring up THIS
+            // agent's OWN directory connection now (production: getAgentSignaling creates + connects a
+            // dedicated manager authenticated as this agent; the directory door becomes active with no
+            // restart). There is no shared keystone to elect into. In the test path getAgentSignaling returns
+            // the already-present shared manager (no-op).
+            getAgentSignaling(name, keyProvider, pubkeyHex);
+            // "initiated" not "established": getAgentSignaling starts the connection but does not await it
+            // (the SignalingManager emits directory.signaling.connected when it actually authenticates).
+            logger.info("agent.directory.connection.initiated", { agentName: name, agentPubkey: pubkeyHex });
         }
         catch (err) {
             logger.error("persist.identity.persist.failed", { agentName: name, error: err instanceof Error ? err.message : String(err) });
@@ -1030,16 +1060,18 @@ export async function startDaemon(config) {
         const sigHex = Buffer.from(await signer.sign(tbs)).toString("hex");
         // If the agent has no live signaling (e.g. a re-push of an already-retired agent), getAgentSignaling
         // lazily creates a dedicated manager — drop it again afterwards so we don't leak a reconnect loop.
-        const hadSignaling = perAgentSignaling.has(agentName) || primaryAgent?.name === agentName;
+        const hadSignaling = perAgentSignaling.has(agentName);
         const { signaling } = getAgentSignaling(agentName, signer, kLocalPubkeyHex);
-        const createdSignaling = !hadSignaling && primaryAgent?.name !== agentName;
+        // createdSignaling is true only when this call lazily created a NEW per-agent manager (production);
+        // on the shared test path perAgentSignaling stays empty, so it is false and dropAgentSignaling no-ops.
+        const createdSignaling = !hadSignaling && perAgentSignaling.has(agentName);
         try {
             const connected = await waitForSignalingConnected(signaling, 10_000);
             if (!connected)
                 return { recorded: false, reason: "directory_unreachable" };
             let resolveFrame;
             const pending = new Promise((r) => { resolveFrame = r; });
-            // Match the reply by agent_id so a revocation on the shared keystone is never cross-wired.
+            // Match the reply by agent_id so a revocation on a shared signaling stream is never cross-wired.
             const unregister = signaling.registerInboundHandler((frame) => {
                 const t = frame["type"];
                 if ((t === "agent_revocation_ack" || t === "agent_revocation_error") && frame["agent_id"] === regAgentId)
@@ -1143,14 +1175,11 @@ export async function startDaemon(config) {
             const ai = agents.findIndex((a) => a.name === name);
             if (ai >= 0)
                 agents.splice(ai, 1);
-            // If the retired agent was the directory keystone, UNWIRE its keystone listeners + clear it
-            // (review HIGH-2: the listeners were never unregistered → double-wire on re-election).
-            if (primaryAgent && primaryAgent.name === name) {
-                keystoneDispose?.();
-                keystoneDispose = undefined;
-                primaryAgent = undefined;
-                logger.info("directory.keystone.cleared", { agentName: name, agentId });
-            }
+            // CELLO-M7-CONN-001 (DOD-CONN-1): no keystone to clear — the agent's OWN per-agent directory
+            // connection was already torn down above (dropAgentSignaling). Removing any agent disturbs only
+            // its own connection; no other agent's connection, and no shared "keystone", is affected. This is
+            // the fix for the Demo1 bug (the keystone lingered authenticated as the removed agent).
+            logger.info("agent.directory.connection.dropped", { agentName: name, agentId, reason: "agent_removed" });
             // Drop the retired agent as any connection's current agent.
             for (const [connId, state] of perConnectionState) {
                 if (state.currentAgent === name) {
@@ -1304,8 +1333,8 @@ export async function startDaemon(config) {
             const directoryEndpoint = { peer_id: ep.peerId, multiaddrs: [ep.multiaddr] };
             // Multi-agent: register over THIS agent's own directory signaling stream (authed
             // as this agent), so the directory routes its dkg_complete/register_success back
-            // to it. The primary agent reuses the keystone stream; any other agent gets a
-            // dedicated one. The DKG's FROST streams open on this agent's directory node.
+            // to it. CONN-001: every agent has its own dedicated stream (no shared keystone). The
+            // DKG's FROST streams open on this agent's directory node.
             const agentRecord = loadedAgents.find((a) => a.name === name);
             const agentPubkeyHex = agentRecord?.pubkey ?? Buffer.from(await keyProvider.getPublicKey()).toString("hex");
             const { signaling: agentSignaling, getNode: agentGetNode } = getAgentSignaling(name, keyProvider, agentPubkeyHex);
@@ -1388,9 +1417,9 @@ export async function startDaemon(config) {
     // Prevents duplicate concurrent seal-interrupted attempts for the same (agent, session) (AC-011).
     const sealInterruptedInProgress = new Set();
     const pendingSealWaiters = new Map();
-    // M7 DOD-SPINE-7: register the session_sealed completion handler on a signaling seam (keystone
-    // for the primary agent, per-agent for the rest — the directory routes session_sealed to the
-    // session-owning agent's authenticated stream). Function declaration so getAgentSignaling
+    // M7 DOD-SPINE-7: register the session_sealed completion handler on a signaling manager — per-agent
+    // in production (the directory routes session_sealed to the session-owning agent's authenticated
+    // stream), or the shared manager on the test path. Function declaration so getAgentSignaling
     // (defined earlier, called at runtime) can wire it per-agent.
     function registerSessionSealedListener(signaling, agentName, agentPubkeyHex) {
         return signaling.registerInboundHandler((frame) => {
@@ -1673,7 +1702,7 @@ export async function startDaemon(config) {
     handlers.set("cello_status", async (_params, connectionId) => {
         return {
             daemon: "running",
-            directory_signaling: signalingManager.status,
+            directory_signaling: directorySignalingStatus(),
             agents: getAgentsForConnection(connectionId),
             connections,
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
@@ -1875,7 +1904,7 @@ export async function startDaemon(config) {
             };
         }
         // DB-001: signaling stream reconnecting
-        if (record.status === "interrupted" && signalingManager.status === "reconnecting") {
+        if (record.status === "interrupted" && signalingFor(record.agent_name)?.status === "reconnecting") {
             return {
                 ok: false,
                 reason: "signaling_reconnecting",
@@ -1975,7 +2004,7 @@ export async function startDaemon(config) {
                 let resolveUni;
                 const uniP = new Promise((r) => { resolveUni = r; });
                 pendingUnilateralWaiters.set(sessionId, resolveUni);
-                const sent = await signalingManager.sendRaw({
+                const sent = await sendOver(record.agent_name, {
                     type: "seal_unilateral",
                     session_id: new Uint8Array(Buffer.from(sessionId, "hex")),
                     reported_root: new Uint8Array(Buffer.from(submit.reportedRootHex, "hex")),
@@ -2404,13 +2433,24 @@ export async function startDaemon(config) {
             return;
         }
         const reject = async (reason) => {
-            await signalingManager.sendRaw({
+            // CONN-001: send the rejection over the LOCAL responder agent's own stream (the agent whose
+            // pubkey is counterpartyPubkey — the stream this request arrived on). If unresolved, sendOver
+            // reports a send failure rather than throwing.
+            const sent = await sendOver(agents.find((a) => a.pubkey === counterpartyPubkey)?.name ?? "", {
                 type: "seal_interrupted_rejection",
                 sessionId,
                 initiatorPubkey,
                 reason,
             });
-            logger.warn("session.interrupted.request.rejected", { sessionId, reason, correlationId });
+            // fallback-finder LOW: don't log the rejection as delivered when the send failed (e.g. no local
+            // agent for counterpartyPubkey, or a transient send error) — the counterparty would otherwise
+            // appear rejected but only ever see a timeout.
+            if (sent.ok) {
+                logger.warn("session.interrupted.request.rejected", { sessionId, reason, correlationId });
+            }
+            else {
+                logger.warn("session.interrupted.request.rejection.send.failed", { sessionId, reason, sendReason: sent.reason, correlationId });
+            }
         };
         // DOD-LOOP-1: resolve the addressed local agent FIRST — the composite (agent, session_id) key
         // needs it. The request must be addressed to one of our agents (counterpartyPubkey is OUR
@@ -2489,7 +2529,7 @@ export async function startDaemon(config) {
             nonce,
             sealInterruptedLeaf: ownLeaf,
         };
-        const sendResult = await signalingManager.sendRaw(ack);
+        const sendResult = await sendOver(localAgent.name, ack);
         if (!sendResult.ok) {
             logger.error("session.interrupted.ack.send.failed", {
                 sessionId,
@@ -2506,13 +2546,6 @@ export async function startDaemon(config) {
             correlationId,
         });
     }
-    // Register the persistent responder. This is a REAL registered handler (not a
-    // test-only path): it fires for every inbound seal_interrupted_request.
-    signalingManager.registerInboundHandler((frame) => {
-        if (frame["type"] !== "seal_interrupted_request")
-            return;
-        void handleInboundSealInterruptedRequest(frame);
-    });
     // Per-agent FIFO queue (events accepted while no cello_await_session is blocked) and
     // the per-agent list of blocked waiters. Inbound sessions are addressed to a specific
     // local agent (participant_b), so both are keyed by agent name.
@@ -2812,17 +2845,34 @@ export async function startDaemon(config) {
             });
         });
     }
-    signalingManager.registerInboundHandler((frame) => {
-        if (frame["type"] !== "session_assignment")
-            return;
-        handleInboundSessionAssignment(frame);
-    });
-    // M7 DOD-SPINE-7: session_sealed listener. The directory delivers this over the SESSION-OWNING
-    // CELLO-M7-ONBOARD-001: the keystone primary's seal-completion listeners (session_sealed /
-    // seal_unilateral_confirmed / seal_unilateral_notification) are now registered inside
-    // wireKeystonePrimary — at startup for a loaded primary AND at runtime when the first agent is
-    // elected (cello_create_agent on a fresh install). They must NOT be a separate startup-only block,
-    // or a fresh-install primary's seals would silently never finalize (review HIGH).
+    // CELLO-M7-CONN-001 (DOD-CONN-2): wire the inbound session/seal responders onto a GIVEN
+    // signaling manager. Called for EVERY agent's own per-agent manager (via getAgentSignaling)
+    // so each agent receives inbound session_assignment + seal_interrupted_request on its OWN
+    // authenticated stream — closing the SPINE-5 gap where only the primary (whose stream WAS
+    // the keystone) received them. A frame arrives on exactly one agent's stream, so there is no
+    // double-dispatch; each handler resolves the local agent internally and that resolution
+    // matches the stream the directory routed the frame to.
+    function wirePerAgentSessionInbound(mgr) {
+        mgr.registerInboundHandler((frame) => {
+            if (frame["type"] !== "seal_interrupted_request")
+                return;
+            void handleInboundSealInterruptedRequest(frame);
+        });
+        mgr.registerInboundHandler((frame) => {
+            if (frame["type"] !== "session_assignment")
+                return;
+            handleInboundSessionAssignment(frame);
+        });
+    }
+    // CONN-001: test path only — the shared manager's inbound session/seal responders. Production
+    // wires them per-agent in getAgentSignaling (each agent receives on its own stream).
+    if (sharedSignaling)
+        wirePerAgentSessionInbound(sharedSignaling);
+    // M7 DOD-SPINE-7 / CELLO-M7-CONN-001: the seal-completion listeners (session_sealed /
+    // seal_unilateral_confirmed / seal_unilateral_notification) are registered PER-AGENT inside
+    // getAgentSignaling (the directory routes each over the session-owning agent's authenticated
+    // stream), and on the shared manager for the test path via wireSharedHandlers. No keystone, no
+    // runtime election — a fresh-install agent gets them when it comes online (create/start).
     // cello_await_session — the counterparty's blocking pull for the next inbound session.
     // Returns immediately if one is already queued for the current agent (FIFO), otherwise
     // blocks until one arrives or timeout_ms elapses. Response shape matches the established
@@ -2876,13 +2926,18 @@ export async function startDaemon(config) {
     // out). Extracted so the two flows wait identically — the directory pass-through
     // routing (directory-node.ts) is the only wired transport for this exchange.
     const SEAL_INTERRUPTED_TIMEOUT_MS = 30_000;
-    function awaitSealAck(sessionId) {
+    function awaitSealAck(sessionId, mgr) {
         return new Promise((resolve) => {
+            // CONN-001: await the ack on the OWNING agent's own stream (per-agent in prod, shared in test).
+            if (!mgr) {
+                resolve({ type: "timeout" });
+                return;
+            }
             const timeoutHandle = setTimeout(() => {
                 unregister();
                 resolve({ type: "timeout" });
             }, SEAL_INTERRUPTED_TIMEOUT_MS);
-            const unregister = signalingManager.registerInboundHandler((frame) => {
+            const unregister = mgr.registerInboundHandler((frame) => {
                 if (frame.type !== "seal_interrupted_ack" && frame.type !== "seal_interrupted_rejection") {
                     return;
                 }
@@ -2928,7 +2983,7 @@ export async function startDaemon(config) {
             ? sessionNodeManager.getSessionTreeRootHex(record.agent_name, sessionId)
             : merkleRootAtInterruption;
         // DB-001: check signaling status before attempting to send
-        if (signalingManager.status === "reconnecting") {
+        if (signalingFor(record.agent_name)?.status === "reconnecting") {
             logger.error("session.interrupted.seal.failed", {
                 sessionId,
                 agentName: record.agent_name,
@@ -2974,7 +3029,7 @@ export async function startDaemon(config) {
             merkleRootAtInterruption: effectiveRoot,
             nonce,
         };
-        const sendResult = await signalingManager.sendRaw(request);
+        const sendResult = await sendOver(record.agent_name, request);
         if (!sendResult.ok) {
             logger.error("session.interrupted.seal.failed", {
                 sessionId,
@@ -2990,7 +3045,7 @@ export async function startDaemon(config) {
             };
         }
         // Wait for counterparty ack/rejection via the shared signaling await machinery.
-        const ackResult = await awaitSealAck(sessionId);
+        const ackResult = await awaitSealAck(sessionId, signalingFor(record.agent_name));
         if (ackResult.type === "timeout") {
             logger.error("session.interrupted.seal.failed", {
                 sessionId,
@@ -3098,7 +3153,7 @@ export async function startDaemon(config) {
         const myPubkeyHex = agent?.pubkey ?? "";
         const kp = keyProviders.get(record.agent_name);
         // DB-002: never initiate a partial seal while signaling is reconnecting.
-        if (signalingManager.status === "reconnecting") {
+        if (signalingFor(record.agent_name)?.status === "reconnecting") {
             return {
                 ok: false,
                 reason: "signaling_reconnecting",
@@ -3160,7 +3215,7 @@ export async function startDaemon(config) {
         // Submit the SEAL request over the directory signaling stream (the SAME wired
         // pass-through the interrupted-seal flow uses) and AWAIT the counterparty's
         // bilateral ack. We never report success on a fire-and-forget send.
-        const sendResult = await signalingManager.sendRaw({
+        const sendResult = await sendOver(record.agent_name, {
             type: "seal_interrupted_request",
             sessionId,
             initiatorPubkey: myPubkeyHex,
@@ -3178,14 +3233,14 @@ export async function startDaemon(config) {
             });
             return {
                 ok: false,
-                reason: sendResult.reason,
+                reason: sendResult.reason ?? "directory_unreachable",
                 guidance: "guidance" in sendResult && typeof sendResult.guidance === "string"
                     ? sendResult.guidance
                     : "The seal could not be submitted to the directory. Retry once cello status shows directory_signaling connected.",
             };
         }
         // Wait for the counterparty's bilateral ack (or rejection / timeout).
-        const ackResult = await awaitSealAck(sessionId);
+        const ackResult = await awaitSealAck(sessionId, signalingFor(record.agent_name));
         if (ackResult.type === "timeout" || ackResult.type === "seal_interrupted_rejection") {
             const reason = ackResult.type === "timeout" ? "seal_counterparty_unavailable" : "seal_rejected_by_counterparty";
             logger.error("session.seal.initiate.failed", {
@@ -3446,25 +3501,23 @@ export async function startDaemon(config) {
         agentCount: loadedAgents.length,
         manifestVerified,
     });
-    // M7-MANIFEST-002 / DOD-AUTH-2: background manifest polling is now ACTIVE. The keystone
-    // SignalingManager (constructed above with the poll deps) calls startPolling() when its
-    // stream reaches connected — it re-polls the directory on the randomized 6–12h interval
-    // and adopts a newer signed manifest (handleManifestPollResponse). No separate wiring
-    // needed here; poll lifecycle = the keystone connection lifecycle.
+    // CELLO-M7-CONN-001 (DOD-CONN-3): background manifest polling runs daemon-level over
+    // unauthenticated HTTP (startHttpManifestPoll above), NOT over a signaling stream. Its
+    // lifecycle is the daemon's, not any agent connection's — so it polls even with zero agents.
     // Graceful shutdown
     async function stop(reason) {
-        // Cancel any pending manifest poll timer
+        // CELLO-M7-CONN-001: stop the HTTP manifest poll (sets the stopped flag so an in-flight
+        // tick cannot re-arm, and cancels the scheduler). Belt-and-suspenders cancel for the
+        // no-poll case (scheduler present but poll not started).
+        stopHttpManifestPoll?.();
         if (manifestPollScheduler) {
             manifestPollScheduler.cancel();
         }
         logger.info("daemon.stopped", { pid: process.pid, reason });
-        // Stop SignalingManager (flushes pending ops with shutdown error, cancels reconnect loop)
-        await signalingManager.stop();
-        // Stop every per-agent signaling stream too (multi-agent), so no agent's directory
-        // node / reconnect loop is orphaned past shutdown.
-        for (const entry of perAgentSignaling.values()) {
-            await entry.signaling.stop();
-        }
+        // CONN-001 (code-review LOW): stopAllSignaling() stops the shared manager AND every per-agent
+        // manager (best-effort). The previously-separate per-agent stop loop here was redundant and
+        // unguarded (would abort the rest of shutdown if stop() ever threw on a second call) — removed.
+        await stopAllSignaling();
         // Gracefully mark active sessions interrupted (AC-009) before stopping IPC
         await sessionNodeManager.gracefulShutdown();
         await ipcServer.stop();