@corca-org/ceal-host-linux-arm64 1.0.16 → 1.0.18

package/libexec/ceal-host/relay.mjs

@@ -200,6 +200,9 @@ var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([..
 function vocabulary(words) {
   return Object.freeze(words);
 }
+function isVocabularyWord(words, value) {
+  return words.some((word) => word === value);
+}
 
 // packages/ceal-client-protocol/src/gateway-response-types.ts
 var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
@@ -212,7 +215,7 @@ var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailabl
 var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
 var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
 var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
 var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
 var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
 var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
@@ -365,6 +368,7 @@ var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_
 // packages/ceal-client-protocol/src/operation-contract-types.ts
 var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
 var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
 var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
@@ -738,9 +742,6 @@ var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "insta
 var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
 var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
 var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
-var CEAL_OPERATION_RESULT_KEYS = vocabulary(["ok", "operation_id", "operation_receipt", "schema_version", "value"]);
-var CEAL_OPERATION_COMPACT_RESULT_KEYS = vocabulary(["ok", "operation_evidence", "operation_id", "schema_version", "value"]);
-var CEAL_OPERATION_RESULT_OPTIONAL_KEYS = vocabulary(["model_disclosure", "result_complete", "resume"]);
 
 // packages/ceal-client-protocol/src/operation-catalog.ts
 var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
@@ -804,10 +805,6 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.host_observation.v1",
   "ceal.host_registration_request.v1",
   "ceal.host_registration_result.v1",
-  "ceal.leased-resource-stream.v1",
-  "ceal.leased_consumer_attachment_stream_frame.v1",
-  "ceal.leased_consumer_attachment_stream_request.v1",
-  "ceal.leased_consumer_attachment_stream_transport.v1",
   "ceal.operation_descriptor.v1",
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
@@ -833,12 +830,6 @@ var CEAL_SCHEMA_LITERAL_SET = new Set(CEAL_SCHEMA_LITERALS);
 // packages/ceal-client-protocol/src/bounded-series.ts
 import { join } from "node:path";
 var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
-  usage_record: (root) => join(root, "run-usage.jsonl"),
-  control_commit: (root) => join(root, "control-auto-commit.jsonl"),
-  engagement_signal: (root) => join(root, "runtime-state", "slack-feedback.jsonl"),
-  runtime_error: (root) => join(root, "runtime-state", "runtime-errors.jsonl"),
-  turn_bridge_request: (root) => join(root, ".ceal", "turn-bridge", "requests.jsonl"),
-  thread_run_events: (root) => join(root, "run-events.jsonl"),
   bounded_store_sidecar: (root) => `${root}.jsonl`,
   gateway_audit_archive: (root) => `${root}.jsonl`,
   gateway_access_group_connector_control_audit: (root) => `${root}.audit.jsonl`,
@@ -872,35 +863,6 @@ var CEAL_HOST_INSTALLATION_REF_PATTERN = new RegExp(`^host-installation:${CEAL_L
 var CEAL_HOST_SOURCE_REF_PATTERN = new RegExp(`^host-source:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
 var CEAL_HOST_ACCESS_TOKEN_PATTERN = /^ceal_host_[A-Za-z0-9_-]{43}$/u;
 
-// packages/ceal-client-protocol/src/agent-session-handoff.ts
-var CEAL_AGENT_ADMISSION_PHASES = vocabulary([
-  "incumbent_admitted",
-  "incumbent_draining",
-  "drained",
-  "candidate_admitted",
-  "candidate_draining",
-  "rollback_admitted"
-]);
-var CEAL_AGENT_SERVICE_SESSION_RECORD_KEYS = vocabulary([
-  "admission_fence",
-  "admission_state",
-  "admission_state_generation",
-  "bearer",
-  "consumer_ref",
-  "credential_generation",
-  "expires_at",
-  "gateway_instance",
-  "gateway_origin",
-  "gateway_serving_generation",
-  "issued_at",
-  "record_sha256",
-  "renew_after",
-  "renew_by",
-  "schema_version",
-  "session_revision"
-]);
-var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_session_revision", "session_revision"]);
-
 // packages/ceal-client-protocol/src/operation-result-completeness.ts
 var CEAL_READ_VALUE_CONTINUATION_KEYS = vocabulary(["continuation", "continuation_ref", "next_cursor"]);
 
@@ -911,7 +873,9 @@ var CEAL_OPERATION_INVOKE_COMMAND = "invoke";
 var CEAL_OPERATION_INPUT_FLAG = "--input";
 var CEAL_OPERATION_ID_PLACEHOLDER = "<operation-id>";
 var CEAL_OPERATION_INPUT_PLACEHOLDER = "<json-object>";
-var CEAL_MODEL_INVOCATION_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+var MODEL_INVOCATION_BASE_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER].join(" ");
+var CEAL_MODEL_INVOCATION_ARGUMENTS = [MODEL_INVOCATION_BASE_ARGUMENTS, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+var CEAL_MODEL_INPUT_SOURCE_GUIDANCE = `For caller-owned fields, add ${CEAL_OPERATION_INPUT_FLAG} ${shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)}. Use inline JSON for short input; for longer or generated input, put exactly one JSON object in a caller-owned regular non-symlink UTF-8 JSON file and pass --input @path; relative paths resolve from the command working directory.`;
 function shellSingleQuoted(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -943,19 +907,73 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
   }
 });
 
+// packages/ceal-client-protocol/src/provider-operation-vocabulary.ts
+var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
+var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
+var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
+  "paragraph",
+  "heading_1",
+  "heading_2",
+  "heading_3",
+  "bulleted_list_item",
+  "numbered_list_item",
+  "to_do",
+  "code"
+]);
+var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "select",
+  "multi_select",
+  "people",
+  "url",
+  "email",
+  "phone",
+  "unsupported"
+]);
+var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
+  "identity_unavailable",
+  "identity_stale",
+  "identity_ambiguous",
+  "identity_revoked",
+  "identity_unlinked"
+]);
+var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
+
+// packages/ceal-client-protocol/src/opaque-reference.ts
+var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
+var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
+
 // packages/ceal-client-protocol/src/bare-document.ts
 var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
 var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
 
-// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
-var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
-var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
-var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
-var CEAL_LEASED_MESSAGE_DELIVERY_OPERATION_IDS = vocabulary(["message.send", "message.update", "message.delete"]);
+// packages/ceal-client-protocol/src/resource-row.ts
+var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
+var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "authored_by", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
-var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
-var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
-var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
+var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
+var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
+  "message_created",
+  "commit_authored",
+  "resource_created",
+  "review_submitted",
+  "comment_created",
+  "event_start",
+  "all_day_start",
+  "file_created",
+  "file_modified",
+  "file_modified_by_me",
+  "file_viewed_by_me",
+  "page_created",
+  "page_last_edited",
+  "resource_modified"
+]);
+var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
 var CEAL_ACTIVITY_GAP_CODES = vocabulary([
   "provider_page_budget",
   "call_deadline",
@@ -966,8 +984,6 @@ var CEAL_ACTIVITY_GAP_CODES = vocabulary([
   "unsupported_event_kind",
   "direct_messages_excluded"
 ]);
-var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
-var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
 var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
   "slack.message",
   "slack.reply",
@@ -1008,73 +1024,6 @@ var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
   "notion.page.created": "page_created",
   "notion.page.edited": "page_last_edited"
 });
-var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
-  "message_created",
-  "commit_authored",
-  "resource_created",
-  "review_submitted",
-  "comment_created",
-  "event_start",
-  "all_day_start",
-  "file_created",
-  "file_modified",
-  "file_modified_by_me",
-  "file_viewed_by_me",
-  "page_created",
-  "page_last_edited",
-  "resource_modified"
-]);
-var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
-var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
-var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
-var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
-var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
-var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
-var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
-var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
-var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
-var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
-var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
-var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
-  "paragraph",
-  "heading_1",
-  "heading_2",
-  "heading_3",
-  "bulleted_list_item",
-  "numbered_list_item",
-  "to_do",
-  "code"
-]);
-var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
-  "text",
-  "number",
-  "boolean",
-  "date",
-  "select",
-  "multi_select",
-  "people",
-  "url",
-  "email",
-  "phone",
-  "unsupported"
-]);
-var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
-  "identity_unavailable",
-  "identity_stale",
-  "identity_ambiguous",
-  "identity_revoked",
-  "identity_unlinked"
-]);
-var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
-var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
-var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
-var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
-var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
-
-// packages/ceal-client-protocol/src/resource-row.ts
 var CEAL_DATED_NOTE_BASES = vocabulary(["recording", "calendar_event", "created_time"]);
 var CEAL_DATED_NOTE_TRANSCRIPT_STATES = vocabulary(["present", "absent", "unestablished"]);
 var CEAL_READ_SEARCH_COST_CLASSES = vocabulary(["native_index", "scan"]);
@@ -1083,6 +1032,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   ref: { required: true, timestamp: false },
   next: { required: true, timestamp: false },
   kind: { required: true, timestamp: false },
+  matched_kinds: { required: false, timestamp: false },
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
@@ -1159,17 +1109,6 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   "refresh_recovery_expired"
 ]);
 
-// packages/ceal-client-protocol/src/leased-artifact-contract.ts
-var CEAL_LEASED_CONSUMER_ARTIFACT_CHUNK_MAX_BYTES = 12 * 1024;
-
-// packages/ceal-client-protocol/src/leased-resource-stream.ts
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAGIC = new Uint8Array([67, 69, 65, 76, 82, 83, 50, 0]);
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES = 8;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_HEADER_BYTES = 16 * 1024;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_CHUNK_BYTES = 64 * 1024;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_RECORD_BYTES = CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES + CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_HEADER_BYTES + CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_CHUNK_BYTES;
-var CEAL_ATTACHMENT_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "digest_mismatch"]);
-
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
 import { createHash } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
@@ -1336,6 +1275,10 @@ var CEAL_REQUEST_RUN_BATCH_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-observation.ts
+var CEAL_HOST_INPUT_KINDS = vocabulary(["human", "host_automatic"]);
+function isCealHostInputKind(value) {
+  return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
+}
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
 function validateCealHostObservationDraft(value) {
   const record6 = operationRecord(value, "Ceal Host observation draft is invalid.");
@@ -1392,12 +1335,6 @@ var OWNER_WRITE_STATES = Object.freeze(["attempt_started", "provider_acknowledge
 var OWNER_EFFECT_STATES = Object.freeze(["none", "applied", "failed", "unknown", "reconciled"]);
 var OWNER_RECEIPT_STATES = Object.freeze(["pending", "available", "failed", "unknown", "reconciled"]);
 
-// packages/ceal-client-protocol/src/thread-excerpt.ts
-var CEAL_THREAD_RECENT_WINDOW = 6;
-var CEAL_THREAD_LAST_APP_MESSAGES_WINDOW = 3;
-var CEAL_THREAD_OLDER_SUMMARY_WINDOW = 4;
-var CEAL_FED_THREAD_MESSAGE_LIMIT = CEAL_THREAD_RECENT_WINDOW + CEAL_THREAD_OLDER_SUMMARY_WINDOW + CEAL_THREAD_LAST_APP_MESSAGES_WINDOW;
-
 // packages/ceal-client-protocol/src/request-graph-readiness.ts
 var REQUEST_GRAPH_PRODUCER_TO_APPEND_SCHEMA = {
   type: "object",
@@ -1486,6 +1423,16 @@ var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().enc
   expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
 })}
 `).byteLength;
+var CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS = vocabulary([
+  "request_authority_unavailable",
+  "request_missing",
+  "authority_mismatch",
+  "host_source_mismatch",
+  "host_session_mismatch",
+  "host_turn_mismatch",
+  "host_input_mismatch",
+  "host_prompt_mismatch"
+]);
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
   if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");
@@ -1502,25 +1449,10 @@ function exactKeys(value, expected) {
 }
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
+var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
 var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
-var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id"]);
-var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "read_argv", "local_result_root", "continue_argv", "model_disclosure", "item_read_argv"]);
-
-// packages/ceal-client-protocol/src/session-start-affordance.ts
-var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
-var CEAL_LINK_RESOURCE_PRECEDENCE = `When the user asks to use Ceal or provides a link to information that may be available through installed organizational capabilities, run bare \`${CEAL_SESSION_ENTRY_INVOCATION}\`. The Host supplies the current user prompt without exposing it to the client command, and the Gateway returns the applicable entry in that one response. Treat a supplied link as a candidate Ceal resource rather than a public web-search target. Reach for a generic web fetch or web search only when the Gateway offered nothing.`;
-
-// packages/ceal-client-protocol/src/conversation-contracts.ts
-var CEAL_APPROVAL_POLICY_KINDS = vocabulary(["requester_only", "named_users", "role_based"]);
-var CEAL_APPROVAL_TARGET_KINDS = vocabulary([
-  "repo_change",
-  "investigation",
-  "skill_creation",
-  "command_creation",
-  "connector_creation",
-  "generic"
-]);
-var CEAL_PROGRESS_PHASES = vocabulary(["request_review", "information_gathering", "work_execution", "result_check"]);
+var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "read_argv"]);
+var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "local_result_root", "continue_argv", "model_disclosure"]);
 
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -1731,7 +1663,7 @@ function assertHostRelaySourcePaths(stateRoot, config, platform = process.platfo
 // host/relay/src/host-relay-runtime.ts
 import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
 import { lstat as lstat4, open as open5 } from "node:fs/promises";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 
 // host/abortable-wait.ts
 function waitForAbort(signal, milliseconds) {
@@ -1835,6 +1767,9 @@ var HostProducerFrameError = class extends Error {
     this.code = code;
   }
 };
+function assertHostProducerFrame(value) {
+  validateFrame(value);
+}
 function encodeHostProducerFrame(frame) {
   validateFrame(frame);
   const json = Buffer.from(JSON.stringify(frame), "utf8");
@@ -1911,13 +1846,13 @@ function validTurn(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref"], ["model", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && optionalText(value.model, 256) && validObservations(value.observations);
 }
 function validInput(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "origin_input", "observations"], ["decision", "local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && typeof value.origin_input === "boolean" && validInputOptionals(value);
+  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "input_kind", "origin_input", "observations"], ["local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && isCealHostInputKind(value.input_kind) && typeof value.origin_input === "boolean" && validInputOptionals(value);
 }
 function validInputObservations(value) {
   return validObservations(value) && Array.isArray(value) && value.filter((item) => record(item) && item.observation_kind === "prompt").length === 1;
 }
 function validInputOptionals(value) {
-  return validDecision(value.decision) && optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
+  return optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
 }
 function validTerminal(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref", "terminal_state"], ["abort_reason", "duration_ms", "time_to_first_token_ms", "usage", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && validTerminalDisposition(value.terminal_state, value.abort_reason) && optionalNonNegative(value.duration_ms) && optionalNonNegative(value.time_to_first_token_ms) && (value.usage === void 0 || jsonValue(value.usage)) && validObservations(value.observations);
@@ -1928,9 +1863,6 @@ function validTerminalDisposition(state, reason) {
 function validStatus(value) {
   return exactOptional(value, ["status", "reason_code"], ["detail"]) && ["ready", "degraded", "stopping"].includes(String(value.status)) && safeRef(value.reason_code) && optionalText(value.detail, 4096);
 }
-function validDecision(value) {
-  return value === void 0 || record(value) && exactKeys2(value, ["decision", "approval_ref"]) && (value.decision === "approved" || value.decision === "denied") && safeRef(value.approval_ref);
-}
 function optionalText(value, maxLength) {
   return value === void 0 || typeof value === "string" && value.length > 0 && value.length <= maxLength;
 }
@@ -2518,31 +2450,53 @@ var RelayAdmissionStore = class {
     for (const producerId of PRODUCER_ORDER) {
       const head = state.entries.find((entry2) => entry2.producer_id === producerId);
       if (!head || head.retry_at_ms > options.now_ms) continue;
-      const input = { frame: structuredClone(head.frame), host_source_ref: options.host_source_ref, submission_ref: hostProducerSubmissionRef(options.host_source_ref, head.frame) };
-      const outcome = await deliver(input);
-      const exhausted = retryExhausted(outcome, head);
-      if (outcome.status === "retryable" && !exhausted) {
-        scheduleRetry(head, options.now_ms, outcome.reason);
-        retained.push(input.submission_ref);
-        await this.write(state);
-        continue;
-      }
-      const installation2 = state.installations[installationKey(head.frame)];
-      if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
-      if (outcome.status === "refused" || exhausted) {
-        await this.quarantine.retainFrame(head.frame, "gateway_refused");
-        installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), refused_at_ms: options.now_ms };
-        refused.push(input.submission_ref);
-      } else {
-        await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
-        delivered.push(input.submission_ref);
-      }
-      state.entries.splice(state.entries.indexOf(head), 1);
-      installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
-      await this.write(state);
+      if (await this.refusePoisonHead(state, head, options, refused)) continue;
+      await this.deliverHead(state, head, deliver, options, delivered, retained, refused);
     }
     return { delivered, retained, refused };
   }
+  async deliverHead(state, head, deliver, options, delivered, retained, refused) {
+    const input = { frame: structuredClone(head.frame), host_source_ref: options.host_source_ref, submission_ref: hostProducerSubmissionRef(options.host_source_ref, head.frame) };
+    const outcome = await deliver(input);
+    const exhausted = retryExhausted(outcome, head);
+    if (outcome.status === "retryable" && !exhausted) {
+      scheduleRetry(head, options.now_ms, outcome.reason);
+      retained.push(input.submission_ref);
+      await this.write(state);
+      return;
+    }
+    const installation2 = state.installations[installationKey(head.frame)];
+    if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
+    if (outcome.status === "refused" || exhausted) {
+      await this.quarantine.retainFrame(head.frame, "gateway_refused");
+      installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), refused_at_ms: options.now_ms };
+      refused.push(input.submission_ref);
+    } else {
+      await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
+      delivered.push(input.submission_ref);
+    }
+    state.entries.splice(state.entries.indexOf(head), 1);
+    installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
+    await this.write(state);
+  }
+  async refusePoisonHead(state, head, options, refused) {
+    const poison = poisonFrameError(head.frame);
+    if (poison === null) return false;
+    const installation2 = state.installations[installationKey(head)];
+    if (!hasIntactAdmissionEnvelope(head, installation2)) throw new TypeError("Host Relay admission state is invalid.");
+    const json = Buffer.from(JSON.stringify(head.frame), "utf8");
+    const raw = Buffer.allocUnsafe(json.byteLength + 4);
+    raw.writeUInt32BE(json.byteLength, 0);
+    json.copy(raw, 4);
+    await this.quarantine.retainMalformed(raw, poison.code);
+    const submissionRef = hostProducerSubmissionRef(options.host_source_ref, { producer_id: head.producer_id, producer_installation_ref: head.producer_installation_ref, sequence: head.sequence });
+    installation2.last_refusal = { sequence: head.sequence, submission_ref: submissionRef, code: poison.code, message: `Host Relay persisted frame is invalid: ${poison.code}.`, refused_at_ms: options.now_ms };
+    refused.push(submissionRef);
+    state.entries.splice(state.entries.indexOf(head), 1);
+    installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
+    await this.write(state);
+    return true;
+  }
   async read() {
     try {
       return decodeState3(JSON.parse(await readFile2(join4(this.root, "admission.json"), "utf8")));
@@ -2608,6 +2562,8 @@ function decodeState3(value) {
   const entries = [];
   for (const item of value.entries) {
     if (!entry(item)) throw new TypeError("Host Relay entry state is invalid.");
+    poisonFrameError(item.frame);
+    if (!hasIntactAdmissionEnvelope(item, installations[installationKey(item)])) throw new TypeError("Host Relay admission state is invalid.");
     entries.push(item);
   }
   return { schema_version: "ceal.host_relay_admission_state.v1", installations, entries };
@@ -2630,6 +2586,60 @@ function producer2(value) {
 function object(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function poisonFrameError(frame) {
+  try {
+    assertHostProducerFrame(frame);
+    return null;
+  } catch (error) {
+    if (error instanceof HostProducerFrameError) return error;
+    throw error;
+  }
+}
+function hasIntactAdmissionEnvelope(entryValue, installation2) {
+  if (installation2 === void 0) return false;
+  return poisonIdentityValid(entryValue) && poisonEnvelopeMatches(entryValue, installation2) && poisonIntegrityMatches(entryValue) && poisonSequenceInRange(entryValue, installation2);
+}
+function poisonIdentityValid(entryValue) {
+  if (entryValue.producer_id !== "codex" && entryValue.producer_id !== "claude") return false;
+  if (!opaqueHostSourceRef(entryValue.producer_installation_ref)) return false;
+  return Number.isSafeInteger(entryValue.sequence) && entryValue.sequence > 0;
+}
+function poisonEnvelopeMatches(entryValue, installation2) {
+  const frame = entryValue.frame;
+  if (!object(frame)) return false;
+  return poisonEnvelopeSchema(frame) && poisonEnvelopeProducer(frame, entryValue) && poisonEnvelopeInstallation(frame, entryValue) && poisonEnvelopeEpoch(frame, installation2) && poisonEnvelopeSequence(frame, entryValue) && poisonEnvelopeKind(frame) && poisonEnvelopeTimestamp(frame);
+}
+function poisonEnvelopeSchema(frame) {
+  return frame.schema_version === "ceal.host_producer_frame.v1";
+}
+function poisonEnvelopeProducer(frame, entryValue) {
+  return producer2(frame.producer_id) && frame.producer_id === entryValue.producer_id;
+}
+function poisonEnvelopeInstallation(frame, entryValue) {
+  return opaqueHostSourceRef(frame.producer_installation_ref) && frame.producer_installation_ref === entryValue.producer_installation_ref;
+}
+function poisonEnvelopeEpoch(frame, installation2) {
+  return Number.isSafeInteger(frame.producer_epoch) && typeof frame.producer_epoch === "number" && frame.producer_epoch > 0 && frame.producer_epoch <= installation2.epoch;
+}
+function poisonEnvelopeSequence(frame, entryValue) {
+  return Number.isSafeInteger(frame.sequence) && frame.sequence === entryValue.sequence;
+}
+function poisonEnvelopeKind(frame) {
+  return isHostProducerFrameKind(frame.frame_kind);
+}
+function poisonEnvelopeTimestamp(frame) {
+  return typeof frame.occurred_at === "string" && Number.isFinite(Date.parse(frame.occurred_at));
+}
+function poisonIntegrityMatches(entryValue) {
+  const frame = entryValue.frame;
+  if (!object(frame)) return false;
+  const json = JSON.stringify(frame);
+  return entryValue.charged_bytes === 4 + Buffer.byteLength(json, "utf8") && entryValue.hash === hostProducerFrameHash(entryValue.frame);
+}
+function poisonSequenceInRange(entryValue, installation2) {
+  if (entryValue.sequence <= installation2.delivered_through_sequence) return false;
+  return entryValue.sequence <= installation2.admitted_through_sequence;
+}
 
 // host/relay/src/relay-gateway-bridge.ts
 import { readFile as readFile3 } from "node:fs/promises";
@@ -2693,6 +2703,8 @@ var RelayGatewayBridge = class {
   }
   async deliverInput(state, input) {
     const prepared = prepareInput(state, input, this.hostSourceRef);
+    const priorRefusal = refusedUnboundInput(prepared.turn);
+    if (priorRefusal !== void 0) return priorRefusal;
     const outcome = await this.submit(prepared.submission);
     if ("refusal" in outcome) {
       if (outcome.refusal.definitive && prepared.turn !== void 0) await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: { ...prepared.turn, input_refused: { code: outcome.refusal.code, message: outcome.refusal.message } } } });
@@ -2701,14 +2713,18 @@ var RelayGatewayBridge = class {
     const acknowledgement2 = outcome.acknowledgement;
     const nextTurn = bindInput(prepared, acknowledgement2.request_ref, input.submission_ref);
     await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: nextTurn } });
-    const binding = { frame: structuredClone(input.frame), request_ref: acknowledgement2.request_ref, prompt_ref: prepared.promptRef, host_binding: {
+    if (!bindsOriginInput(prepared)) return { status: "created" };
+    const bindingRequestRef = nextTurn.request_ref ?? acknowledgement2.request_ref;
+    const bindingPromptRef = nextTurn.prompt_ref ?? prepared.promptRef;
+    const bindingInputRef = nextTurn.origin_host_input_ref ?? prepared.hostInputRef;
+    const binding = { frame: structuredClone(input.frame), request_ref: bindingRequestRef, prompt_ref: bindingPromptRef, host_binding: {
       host_source_ref: prepared.submission.identity.host_source_ref,
       host_session_ref: prepared.submission.identity.host_session_ref,
       host_turn_ref: prepared.submission.identity.host_turn_ref,
-      host_input_ref: prepared.hostInputRef,
-      prompt_ref: prepared.promptRef
+      host_input_ref: bindingInputRef,
+      prompt_ref: bindingPromptRef
     } };
-    const context = createRelayRequestWorkContext({ request_ref: acknowledgement2.request_ref, host_binding: binding.host_binding });
+    const context = createRelayRequestWorkContext({ request_ref: bindingRequestRef, host_binding: binding.host_binding });
     try {
       await this.onRequestBound(binding, context);
     } catch (error) {
@@ -2728,6 +2744,7 @@ var RelayGatewayBridge = class {
     const outcome = await this.submit({
       identity: { host_source_ref: this.hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
       host_input_ref: turn.origin_host_input_ref,
+      input_kind: "host_automatic",
       prompt_ref: turn.prompt_ref,
       observations: payloadObservations(input.frame),
       request_ref: turn.request_ref,
@@ -2789,9 +2806,9 @@ function prepareInput(state, input, hostSourceRef) {
   const submission = compactSubmission({
     identity: { host_source_ref: hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
     host_input_ref: hostInputRef,
+    input_kind: payloadInputKind(input.frame),
     prompt_ref: promptRef,
     observations,
-    decision: payloadDecision(input.frame),
     request_ref: turn?.request_ref,
     submission_ref: input.submission_ref
   });
@@ -2802,11 +2819,18 @@ function bindInput(prepared, requestRef, submissionRef) {
     host_session_ref: prepared.refs.host_session_ref,
     observations: prepared.turn?.observations ?? [],
     submission_ref: prepared.turn?.submission_ref ?? submissionRef,
-    request_ref: requestRef,
-    prompt_ref: prepared.promptRef,
+    request_ref: prepared.turn?.request_ref ?? requestRef,
+    prompt_ref: prepared.turn?.prompt_ref ?? prepared.promptRef,
     origin_host_input_ref: prepared.turn?.origin_host_input_ref ?? prepared.hostInputRef
   };
 }
+function refusedUnboundInput(turn) {
+  if (turn?.request_ref !== void 0 || turn?.input_refused === void 0) return void 0;
+  return { status: "refused", code: "origin_input_refused", message: `The input frame names a turn whose origin input was refused (${turn.input_refused.code}: ${turn.input_refused.message}).` };
+}
+function bindsOriginInput(prepared) {
+  return prepared.turn?.request_ref === void 0 || prepared.turn.origin_host_input_ref === prepared.hostInputRef;
+}
 function payloadRef(frame, key) {
   const value = frame.payload[key];
   if (typeof value !== "string" || !SAFE_REF4.test(value)) throw new TypeError("Host Relay frame reference is invalid.");
@@ -2820,16 +2844,17 @@ function payloadPromptDigest(frame) {
 function payloadObservations(frame) {
   return Array.isArray(frame.payload.observations) ? frame.payload.observations.filter(isObservation) : [];
 }
-function payloadDecision(frame) {
-  const value = frame.payload.decision;
-  return isRecord(value) && (value.decision === "approved" || value.decision === "denied") && typeof value.approval_ref === "string" ? { decision: value.decision, approval_ref: value.approval_ref } : void 0;
+function payloadInputKind(frame) {
+  const value = frame.payload.input_kind;
+  if (!isCealHostInputKind(value)) throw new TypeError("Host Relay input kind is invalid.");
+  return value;
 }
 function uniqueObservations(values) {
   const seen = /* @__PURE__ */ new Set();
   return values.filter((value) => !seen.has(value.observation_ref) && Boolean(seen.add(value.observation_ref)));
 }
 function compactSubmission(value) {
-  return { identity: value.identity, host_input_ref: value.host_input_ref, prompt_ref: value.prompt_ref, observations: value.observations, submission_ref: value.submission_ref, ...value.decision === void 0 ? {} : { decision: value.decision }, ...value.request_ref === void 0 ? {} : { request_ref: value.request_ref } };
+  return { identity: value.identity, host_input_ref: value.host_input_ref, input_kind: value.input_kind, prompt_ref: value.prompt_ref, observations: value.observations, submission_ref: value.submission_ref, ...value.request_ref === void 0 ? {} : { request_ref: value.request_ref } };
 }
 function isObservation(value) {
   try {
@@ -2895,6 +2920,7 @@ import { dirname as dirname2 } from "node:path";
 // host/gateway-http.ts
 var SAFE_HOST_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 function hostIngressBody(input, invalidEventTime) {
+  if (!isCealHostInputKind(input.input_kind)) throw new TypeError("Host ingress input kind is invalid.");
   const prompt = input.observations.find((observation) => observation.observation_kind === "prompt");
   const observedAt = prompt?.observed_at ?? input.observations[0]?.observed_at;
   if (observedAt === void 0 || !Number.isFinite(Date.parse(observedAt))) throw invalidEventTime();
@@ -2904,11 +2930,11 @@ function hostIngressBody(input, invalidEventTime) {
     host_session_ref: input.identity.host_session_ref,
     host_turn_ref: input.identity.host_turn_ref,
     host_input_ref: input.host_input_ref,
+    input_kind: input.input_kind,
     prompt_ref: input.prompt_ref,
     observed_at: observedAt,
     observations: input.observations,
-    ...input.request_ref === void 0 ? {} : { request_ref: input.request_ref },
-    ...input.decision === void 0 ? {} : { decision: input.decision.decision, approval_ref: input.decision.approval_ref }
+    ...input.request_ref === void 0 ? {} : { request_ref: input.request_ref }
   };
 }
 async function responseJson(response2, invalidResponse2) {
@@ -2958,20 +2984,29 @@ var HostRelayGatewayError = class extends Error {
   status;
   /** The Gateway's own refusal word, when it named one; a bounded token, never its message. */
   error_code;
-  constructor(code, message, status, errorCode9) {
+  /** The Gateway mint refusal's bounded continuity reason, when it named one; a fixed token, never its message. */
+  refusal_reason;
+  constructor(code, message, status, errorCode9, refusalReason) {
     super(message);
     this.code = code;
     if (status !== void 0) this.status = status;
     if (errorCode9 !== void 0) this.error_code = errorCode9;
+    if (refusalReason !== void 0) this.refusal_reason = refusalReason;
   }
 };
 var GATEWAY_REFUSAL_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
-async function gatewayRefusalCode(response2) {
+async function gatewayRefusal(response2) {
   try {
     const body = await response2.json();
-    return isCealJsonRecord(body) && typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
+    if (!isCealJsonRecord(body)) return {};
+    const code = typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
+    const reason = code === "request_context_refused" && typeof body.reason === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.reason) && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, body.reason) ? body.reason : void 0;
+    return {
+      ...code === void 0 ? {} : { code },
+      ...reason === void 0 ? {} : { reason }
+    };
   } catch {
-    return void 0;
+    return {};
   }
 }
 function refusalMessage(status, body) {
@@ -3019,7 +3054,10 @@ function createHostRelayGatewayHttpPort(options) {
       } catch {
         throw new HostRelayGatewayError("gateway_unavailable", "Gateway Host invocation context is unavailable.");
       }
-      if (!response2.ok) throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, await gatewayRefusalCode(response2));
+      if (!response2.ok) {
+        const refusal = await gatewayRefusal(response2);
+        throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, refusal.code, refusal.reason);
+      }
       let value;
       try {
         value = await response2.json();
@@ -3140,8 +3178,9 @@ function acknowledgement(value) {
 }
 
 // host/relay/src/relay-ipc.ts
-import { chmod, lstat as lstat3, unlink as unlink2 } from "node:fs/promises";
+import { chmod, lstat as lstat3, rename as rename2, unlink as unlink2 } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
+import { dirname as dirname3, join as join6 } from "node:path";
 
 // host/relay/src/current-prompt-custody.ts
 import { createHash as createHash5 } from "node:crypto";
@@ -3222,7 +3261,15 @@ var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
   "deadline",
   "cancelled",
   "mint_failed",
-  "relay_failed"
+  "relay_failed",
+  "request_authority_unavailable",
+  "request_missing",
+  "authority_mismatch",
+  "host_source_mismatch",
+  "host_session_mismatch",
+  "host_turn_mismatch",
+  "host_input_mismatch",
+  "host_prompt_mismatch"
 ]);
 var HostRelayInvocationMintRefusal = class extends Error {
   reason;
@@ -3254,15 +3301,42 @@ var HostRelayIpcError = class extends Error {
   }
 };
 async function startHostRelayIpcServer(options) {
-  await assertEndpointVacant(options.endpoint);
-  const active = /* @__PURE__ */ new Map();
-  const sockets = /* @__PURE__ */ new Set();
-  const quarantine = options.quarantine ?? options.admission.quarantine;
-  const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
-  const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
-  await listen(server, options.endpoint);
-  if (process.platform !== "win32") await chmod(options.endpoint, 384);
-  return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+  return withRelayEndpointLock(options.endpoint, async () => {
+    if (process.platform === "win32") {
+      await assertEndpointVacant(options.endpoint);
+    } else {
+      await assertTrustedEndpointParent(options.endpoint);
+      await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
+    }
+    const active = /* @__PURE__ */ new Map();
+    const sockets = /* @__PURE__ */ new Set();
+    const quarantine = options.quarantine ?? options.admission.quarantine;
+    const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
+    const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
+    if (process.platform === "win32") {
+      try {
+        await listen(server, options.endpoint);
+      } catch (error) {
+        await abandonRelayServer(server, sockets);
+        throw error;
+      }
+      return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+    }
+    const staging = stagingRelayEndpoint(options.endpoint);
+    await listenStagingRelayEndpoint(server, sockets, staging);
+    let owned;
+    try {
+      await options.testHooks?.beforeCaptureOwnedEndpoint?.(options.endpoint);
+      owned = await readStagingRelayEndpointIdentity(staging);
+      await chmod(staging, 384);
+      const identity = await publishStagingRelayEndpoint(staging, owned, options.endpoint);
+      return { endpoint: options.endpoint, close: () => closeRelayServer(server, sockets, options.endpoint, identity, options.testHooks) };
+    } catch (error) {
+      if (owned !== void 0) await releaseOwnedRelayEndpoint(server, sockets, options.endpoint, owned);
+      else await abandonRelayServer(server, sockets);
+      throw error;
+    }
+  });
 }
 function encodeHostRelayIpcResponse(response2) {
   const body = Buffer.from(JSON.stringify(response2), "utf8");
@@ -3424,8 +3498,9 @@ function writeCurrentPromptResponse(socket, status) {
 async function resolveInvocationContext(request2, admission, bindings, currentPrompts, mint, signal) {
   if (mint === void 0) throw new HostRelayIpcError("relay_unavailable");
   const query = bindingQueryFromRequest(request2);
+  const expectedSequences = pendingAdmissionSequences(await admission.snapshot(), query);
   const binding = await waitForRequestBinding(query, admission, bindings, signal);
-  if (binding.status !== "ready") return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
+  if (binding.status !== "ready") return unboundInvocationContextRefusal(await admission.snapshot(), query, expectedSequences) ?? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
   const currentPrompt = currentPrompts.take({ producer_id: request2.producer_id, producer_installation_ref: request2.producer_installation_ref, local_session_ref: request2.local_session_ref, local_turn_ref: request2.local_turn_ref, prompt_ref: binding.binding.prompt_ref });
   let result2;
   try {
@@ -3435,6 +3510,24 @@ async function resolveInvocationContext(request2, admission, bindings, currentPr
   }
   return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "ready", result: result2 };
 }
+function unboundInvocationContextRefusal(snapshot, query, expectedSequences) {
+  if (expectedSequences.length === 0) return null;
+  const refusal = snapshot.installations[`${query.producer_id}\0${query.producer_installation_ref}`]?.last_refusal;
+  if (refusal === void 0 || !expectedSequences.includes(refusal.sequence) || refusal.code !== "gateway_refused") return null;
+  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "gateway_refused" };
+}
+function pendingAdmissionSequences(snapshot, query) {
+  const sequences = [];
+  for (const entry2 of snapshot.entries) {
+    if (entry2.frame.frame_kind !== "user_input") continue;
+    const payload = entry2.frame.payload;
+    if (typeof payload.local_session_ref !== "string" || typeof payload.local_turn_ref !== "string") continue;
+    const aliases = Array.isArray(payload.local_turn_aliases) ? payload.local_turn_aliases.filter((value) => typeof value === "string") : [];
+    if (!relayRequestBindingMatchesQuery(query, { producer_id: entry2.frame.producer_id, producer_installation_ref: entry2.frame.producer_installation_ref, local_session_ref: payload.local_session_ref, local_turn_ref: payload.local_turn_ref, local_turn_aliases: aliases })) continue;
+    sequences.push(entry2.sequence);
+  }
+  return sequences;
+}
 async function waitForRequestBinding(query, admission, bindings, signal) {
   let binding = await bindings.query(query);
   if (binding.status === "ready") return binding;
@@ -3610,6 +3703,160 @@ async function closeServer(server, sockets, endpoint) {
   await new Promise((resolve) => server.close(() => resolve()));
   if (process.platform !== "win32") await unlink2(endpoint).catch(() => void 0);
 }
+var relayEndpointLocks = /* @__PURE__ */ new Map();
+function withRelayEndpointLock(endpoint, run) {
+  const prior = relayEndpointLocks.get(endpoint) ?? Promise.resolve();
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const tail = prior.then(() => gate);
+  relayEndpointLocks.set(endpoint, tail);
+  return prior.then(run).finally(() => {
+    release?.();
+    if (relayEndpointLocks.get(endpoint) === tail) relayEndpointLocks.delete(endpoint);
+  });
+}
+function currentUid(fallback) {
+  return typeof process.geteuid === "function" ? process.geteuid() : fallback;
+}
+async function assertTrustedEndpointParent(endpoint) {
+  const parent = dirname3(endpoint);
+  let stats;
+  try {
+    stats = await lstat3(parent);
+  } catch {
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint parent is unavailable; leaving it untouched.");
+  }
+  if (!stats.isDirectory() || stats.uid !== currentUid(stats.uid) || (stats.mode & 63) !== 0) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint parent is not an owner-private directory; leaving it untouched.");
+}
+var HOST_RELAY_ENDPOINT_PROBE_TIMEOUT_MS = 1e3;
+function probeRelayEndpoint(endpoint) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const socket = createConnection(endpoint);
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(outcome);
+    };
+    const timer = setTimeout(() => finish("ambiguous"), HOST_RELAY_ENDPOINT_PROBE_TIMEOUT_MS);
+    timer.unref?.();
+    socket.once("connect", () => finish("live"));
+    socket.once("error", (error) => {
+      const code = errorCode8(error);
+      if (code === "ECONNREFUSED") finish("stale");
+      else if (code === "ENOENT") finish("missing");
+      else finish("ambiguous");
+    });
+  });
+}
+async function removeStaleRelayEndpoint(endpoint, testHooks) {
+  const observed = await readEndpointStats(endpoint);
+  if (observed === null) return;
+  if (!observed.isSocket()) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already present and is not a socket; leaving it untouched.");
+  if (observed.uid !== currentUid(observed.uid)) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is not owned by the current uid; leaving it untouched.");
+  const captured = { uid: observed.uid, dev: observed.dev, ino: observed.ino };
+  await requireStaleEndpoint(endpoint);
+  await testHooks?.beforeRemoveStaleEndpoint?.(endpoint);
+  const current = await readEndpointStats(endpoint);
+  if (current === null) return;
+  requireSameEndpointIdentity(current, captured, "Host Relay IPC endpoint changed before cleanup; leaving it untouched.");
+  await unlinkRelayEndpoint(endpoint);
+}
+async function requireStaleEndpoint(endpoint) {
+  switch (await probeRelayEndpoint(endpoint)) {
+    case "missing":
+    case "stale":
+      return;
+    case "live":
+      throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already served by a live Relay; leaving it untouched.");
+    case "ambiguous":
+      throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint liveness is ambiguous; leaving it untouched.");
+  }
+}
+async function readEndpointStats(endpoint) {
+  try {
+    return await lstat3(endpoint);
+  } catch (error) {
+    if (errorCode8(error) === "ENOENT") return null;
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint identity is ambiguous; leaving it untouched.");
+  }
+}
+function requireSameEndpointIdentity(current, owned, message) {
+  if (!current.isSocket() || current.uid !== owned.uid || current.dev !== owned.dev || current.ino !== owned.ino) throw new HostRelayIpcError("relay_unavailable", message);
+}
+async function unlinkRelayEndpoint(endpoint) {
+  try {
+    await unlink2(endpoint);
+  } catch (error) {
+    if (errorCode8(error) !== "ENOENT") throw error;
+  }
+}
+var relayStagingSequence = 0;
+function stagingRelayEndpoint(canonical) {
+  const parent = dirname3(canonical);
+  const pid = process.pid.toString(36);
+  const sequence = (relayStagingSequence++ % (36 * 36)).toString(36);
+  return join6(parent, `.r${pid}${sequence}`);
+}
+async function readStagingRelayEndpointIdentity(staging) {
+  let created;
+  try {
+    created = await lstat3(staging);
+  } catch {
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable after listen; leaving it untouched.");
+  }
+  if (!created.isSocket()) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  if (created.uid !== currentUid(created.uid)) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is not owned by the current uid after listen; leaving it untouched.");
+  return { uid: created.uid, dev: created.dev, ino: created.ino };
+}
+async function listenStagingRelayEndpoint(server, sockets, staging) {
+  try {
+    await listen(server, staging);
+  } catch (error) {
+    await abandonRelayServer(server, sockets);
+    throw error;
+  }
+}
+async function publishStagingRelayEndpoint(staging, owned, canonical) {
+  const incumbent = await readEndpointStats(canonical);
+  if (incumbent !== null) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  await rename2(staging, canonical);
+  const published = await readEndpointStats(canonical);
+  if (published === null) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable after listen; leaving it untouched.");
+  requireSameEndpointIdentity(published, owned, "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  return { uid: published.uid, dev: published.dev, ino: published.ino };
+}
+async function releaseOwnedRelayEndpoint(server, sockets, endpoint, owned) {
+  await abandonRelayServer(server, sockets);
+  try {
+    const current = await readEndpointStats(endpoint);
+    if (current === null) return;
+    requireSameEndpointIdentity(current, owned, "Host Relay IPC endpoint changed while releasing a failed startup; leaving it untouched.");
+    await unlinkRelayEndpoint(endpoint);
+  } catch {
+  }
+}
+async function closeRelayServer(server, sockets, endpoint, owned, testHooks) {
+  await withRelayEndpointLock(endpoint, async () => {
+    for (const socket of sockets) socket.destroy();
+    await new Promise((resolve) => server.close(() => resolve()));
+    await testHooks?.beforeRemoveOwnedEndpoint?.(endpoint);
+    const current = await readEndpointStats(endpoint);
+    if (current === null) return;
+    requireSameEndpointIdentity(current, owned, "Host Relay IPC endpoint was replaced after this server listened; leaving it untouched.");
+    await unlinkRelayEndpoint(endpoint);
+  });
+}
+async function abandonRelayServer(server, sockets) {
+  for (const socket of sockets) socket.destroy();
+  await new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
 function errorCode8(error) {
   return record4(error) && typeof error.code === "string" ? error.code : null;
 }
@@ -3631,7 +3878,7 @@ async function readHostRelayConfig(path) {
   if (!isAbsoluteNormalizedNonRootPath(path, process.platform, true)) throw new HostRelayConfigError("invalid_config_path", `invalid_config_path: Host Relay config path is invalid: ${refusalFact("config_path", path, "absolute, normalized, and non-root")}.`);
   let handle;
   try {
-    await assertOwnerPrivateDirectory2(dirname3(path));
+    await assertOwnerPrivateDirectory2(dirname4(path));
     handle = await open5(path, O_RDONLY4 | O_NOFOLLOW3);
     const stats = await handle.stat();
     if (!stats.isFile() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not owner-private.");
@@ -3656,7 +3903,7 @@ async function readHostRelayConfig(path) {
 }
 function validateHostRelaySourcePaths(config) {
   try {
-    assertHostRelaySourcePaths(dirname3(config.registration_state_file), config);
+    assertHostRelaySourcePaths(dirname4(config.registration_state_file), config);
   } catch (error) {
     throw new HostRelayConfigError("invalid_config", error instanceof Error ? error.message : "Host Relay source tuple is invalid.");
   }
@@ -3686,10 +3933,10 @@ function validConfigRuntime(value) {
 var HOST_RELAY_INVOCATION_MINT_LOG_TAG = "[host-relay-invocation-mint]";
 var HOST_RELAY_INVOCATION_MINT_LINE = new RegExp(`^${HOST_RELAY_INVOCATION_MINT_LOG_TAG.replace(/[[\]]/gu, "\\$&")} outcome=([a-z_]+)(?: reason=([a-z][a-z0-9_]{0,63}))? elapsed_ms=[0-9]+$`, "u");
 async function serveHostRelay(config, signal, dependencies = {}) {
-  const admission = new RelayAdmissionStore(join6(config.state_root, "admission"));
-  const bindings = new RelayRequestBindingStore(join6(config.state_root, "bindings"));
+  const admission = new RelayAdmissionStore(join7(config.state_root, "admission"));
+  const bindings = new RelayRequestBindingStore(join7(config.state_root, "bindings"));
   const gateway = (dependencies.createGateway ?? createHostRelayGatewayHttpPort)({ registration_state_file: config.registration_state_file, host_source_ref: config.host_source_ref });
-  const bridge = new RelayGatewayBridge({ state_root: join6(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
+  const bridge = new RelayGatewayBridge({ state_root: join7(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
     await bindings.bind(binding);
   } });
   let server;
@@ -3730,7 +3977,11 @@ function invocationMintRefusalReason(error, cancellation) {
   if (error.code === "gateway_unavailable") return "gateway_unavailable";
   if (error.code === "invalid_response") return "gateway_response_invalid";
   if (error.code !== "gateway_refused") return "mint_failed";
-  return (error.error_code === void 0 ? void 0 : GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code)) ?? "gateway_refused";
+  return gatewayMintRefusalReason(error);
+}
+function gatewayMintRefusalReason(error) {
+  if (error.error_code === "request_context_refused" && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, error.refusal_reason)) return error.refusal_reason;
+  return GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code ?? "") ?? "gateway_refused";
 }
 var GATEWAY_MINT_REFUSAL_REASONS = /* @__PURE__ */ new Map([
   ["request_context_refused", "context_stale"],