@cotal-ai/auth 0.57.0 → 0.59.0

package/dist/service.js

@@ -54,27 +54,29 @@
  */
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
+import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, readSvcRecordLeader, reconcileEndpointGate, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC } from "@cotal-ai/core";
-import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
+import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, authorizeServeGrant, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
+import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject } from "./derive.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS } from "./token.js";
+import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { issueRemoteManagerAuthority } from "./manager-authority.js";
+import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, issueRemoteManagerAuthority, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
-import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement } from "./managed-agent-enrollment.js";
+import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
 import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 import { validateRetainedManagedAgent } from "./continuity.js";
-import { reconstructRemoteManagerServeGrant } from "./manager-contract.js";
-import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, remoteManagerIssuerGrants, remoteManagerRegistrationProof } from "./authority-client.js";
+import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster } from "./manager-contract.js";
+import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, remoteManagerIssuerGrants, remoteManagerRegistrationProof, authRegistrationExecutorGrants } from "./authority-client.js";
 import { authorizeConnectCredential } from "./connect-reader.js";
 import { ensureRootCredential } from "./root-credential.js";
 import { observeGate, openLifecycleRegistry, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
@@ -82,11 +84,12 @@ import { openAuthLedgerScannerCandidate } from "./ledger-scanner.js";
 import { openRecordsScannerCandidate } from "./records-scanner.js";
 import { acquirePlaneClaim, makeDeliveryAdminPlaneOracle, makeDeliveryAdminPrincipalOracle, scannerDeathCopy } from "./plane-claim.js";
 import { enumerateOperationIntents, resumeAgentTakeover } from "./credential-ledger.js";
-import { makeDeliveryAdminEvictor } from "./barrier-evict.js";
+import { makeDeliveryAdminEvictor, makeDeliveryAdminHolderEvictor } from "./barrier-evict.js";
 import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
+import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
 import { AGENT_BEARER_TTL_SEC, findInteractiveActor, findManagedActor, ledgerAclResolver, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, } from "./ledger.js";
 import { AUTH_PROVIDER_NAME, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
@@ -143,6 +146,10 @@ export function authorizeRemoteManagerRetirement(args) {
  */
 export async function openAuthAuthorityPlane(opts) {
     const { server, space, dataAccount, log } = opts;
+    const standingTtl = opts.standingRenewableTtlSeconds ?? STANDING_RENEWABLE_TTL_SEC;
+    if (!Number.isSafeInteger(standingTtl) || standingTtl < 5 || standingTtl > STANDING_RENEWABLE_TTL_SEC) {
+        throw new Error(`standingRenewableTtlSeconds must be an integer between 5 and ${STANDING_RENEWABLE_TTL_SEC} seconds (got ${standingTtl})`);
+    }
     const writer = await openAuthorityClient({ server, space, dataAccount, label: `cotal:auth-mint:${space}`, grants: (id) => authorityWriterGrants(space, id), log });
     let registry;
     try {
@@ -153,6 +160,87 @@ export async function openAuthAuthorityPlane(opts) {
         await writer.close();
         throw e;
     }
+    // #399 M2: register the auth plane itself as an ordinary `auth` service endpoint — the SAME
+    // §13.7 registration ceremony the manager runs (`manager.ts:6562-6690`), before the listener
+    // below serves a single request. The persisted instance id + serve nkey (under the plane's
+    // `dir`, hardened the way the manager's own instance identity is) so a restart re-registers the
+    // SAME instance: `registerServiceInstance` advances the process epoch on a re-registration and
+    // fences the predecessor; a first registration stays at epoch 0.
+    let authServeInstanceId;
+    let authServeGrant;
+    try {
+        const persisted = loadAuthInstanceIdentity(opts.dir, space);
+        const authIdentity = persisted ?? createAuthInstanceIdentity(opts.dir, space, {
+            instanceId: mintLifecycleUid(),
+            serveIdentity: newIdentity(),
+        });
+        const iid = authIdentity.instanceId;
+        const artifacts = authClusterArtifacts();
+        const store = new Map([
+            [artifacts.rootDigest, artifacts.document],
+            [artifacts.closureDigest, artifacts.manifest],
+        ]);
+        const readClusterArtifact = (digest) => store.get(digest);
+        // §13.9 name authority, static mode: the auth plane holds the space signing seed, so it
+        // self-authorizes exactly its own name ("auth") for exactly DEV_OWNER — mirrors the manager's
+        // own self-authorization for "manager".
+        const authority = {
+            authorize: (name, owner) => ({ authorized: name === AUTH_SERVICE_ENDPOINT && owner === DEV_OWNER, revision: 0 }),
+        };
+        const servePrincipal = principalKey(DEV_OWNER, authIdentity.serveIdentity.id).key;
+        const registrationOpId = mintLifecycleUid();
+        const regClient = await openAuthorityClient({
+            server, space, dataAccount, label: `cotal:auth-registration:${space}`,
+            grants: (id) => authRegistrationExecutorGrants(space, id, iid),
+            log,
+        });
+        try {
+            const authKv = await new Kvm(regClient.nc).open(epAuthBucket(space));
+            const recordsKv = await new Kvm(regClient.nc).open(recordsBucket(space));
+            // §13.7 contract-artifact publication BEFORE the registration that advertises the digests.
+            const storeCtx = await contractStoreContext(regClient.nc, space);
+            for (const value of [...authContractArtifactValues(), artifacts.document, artifacts.manifest])
+                await publishContractArtifact(storeCtx, contractArtifactCanonicalBytes(value));
+            // §13.1 pre-registration: the issuance gate, born open@gen0, provisioned ONCE on the FIRST
+            // registration. On a restart the gate already exists; `registerServiceInstance` below
+            // freezes + re-registers it (advancing the epoch).
+            if ((await serveIssuanceGateKv(authKv, space, { endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid }).observe()) === null)
+                await provisionEndpointGateOpen(authKv, { endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid, principal: servePrincipal });
+            const barrier = endpointRegistrationBarrier(authKv, space, { endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid, opId: registrationOpId });
+            const spec = { endpoint: AUTH_SERVICE_ENDPOINT, owner: DEV_OWNER, clusterDigests: [artifacts.closureDigest], protocol: { v: 1 } };
+            const { registrationRevision } = await registerServiceInstance(recordsKv, {
+                space, spec, instanceId: iid, registrant: { owner: DEV_OWNER }, authority, barrier, readClusterArtifact,
+            });
+            const fence = serveIssuanceGateKv(authKv, space, { endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid });
+            const observed = await fence.observe();
+            if (observed === null)
+                throw new Error(`the issuance gate for ${AUTH_SERVICE_ENDPOINT}/${iid} vanished after registration`);
+            const readProcessEpoch = async () => {
+                const g = await fence.observe();
+                if (g === null)
+                    throw new Error(`no issuance gate for ${AUTH_SERVICE_ENDPOINT}/${iid}`);
+                return g.processEpoch;
+            };
+            const grant = await authorizeServeGrant(recordsKv, {
+                space, endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid, epoch: observed.processEpoch,
+                holder: { owner: DEV_OWNER }, authority, readClusterArtifact, readProcessEpoch,
+            });
+            await writeServiceStatus(recordsKv, {
+                endpoint: AUTH_SERVICE_ENDPOINT, instanceId: iid, epoch: observed.processEpoch,
+                status: { state: SERVICE_READY, epoch: observed.processEpoch, observedSpecRevision: registrationRevision },
+                readProcessEpoch,
+            });
+            authServeInstanceId = iid;
+            authServeGrant = grant;
+        }
+        finally {
+            await regClient.close();
+        }
+    }
+    catch (e) {
+        await writer.close();
+        throw e;
+    }
     let reader;
     try {
         reader = await openSupervisedConnectReader({ server, space, dataAccount, log });
@@ -325,7 +413,7 @@ export async function openAuthAuthorityPlane(opts) {
     // the FRESH space-manager-lease holder check) and dispatches.
     let authAdmin;
     try {
-        authAdmin = await openAuthAdminListener({ server, space, dataAccount, reg: barrierReg, retirement, barrierFlight: retirementFlights, log });
+        authAdmin = await openAuthAdminListener({ server, space, dataAccount, reg: barrierReg, retirement, barrierFlight: retirementFlights, instanceId: authServeInstanceId, epoch: authServeGrant.epoch, grant: authServeGrant, log });
     }
     catch (e) {
         closing = true;
@@ -340,9 +428,34 @@ export async function openAuthAuthorityPlane(opts) {
     }
     const fileArm = ledgerAuthorizeConnect(opts.dir);
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
-    const root = findCotalRoot();
+    const loadLocalManager = opts.localManager ?? (() => undefined);
+    // Standing renewal re-derives the serve surface from the REGISTERED service spec at the gate's
+    // registration revision: spec (leader read) -> closure manifest -> root document, each verified
+    // against its content digest. The request never selects the surface.
+    const registeredManagerCluster = async (owner, instanceId, observed) => {
+        const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
+        if (!rec || "deleted" in rec || rec.revision !== observed.registrationRevision)
+            throw new EpEnvelopeError("failed-precondition", "manager-service renewal found no service spec at the gate's registration revision");
+        const spec = parseServiceSpec(rec.value, { endpoint: "manager" });
+        if (spec.owner !== owner)
+            throw new EpEnvelopeError("permission-denied", "manager-service renewal spec belongs to another owner");
+        const store = await contractStoreContext(remoteIssuer.nc, space);
+        const read = async (digest) => {
+            const bytes = await fetchContractArtifact(store, contractRefToHex(digest));
+            if (!bytes)
+                throw new EpEnvelopeError("failed-precondition", `manager-service renewal cannot read registered contract artifact ${digest}`);
+            return JSON.parse(new TextDecoder().decode(bytes));
+        };
+        for (const closure of spec.clusterDigests) {
+            const { root } = verifyClusterManifest(closure, await read(closure));
+            const document = await read(root);
+            if (verifyClusterRoot(root, document).urn === "ai.cotal.manager")
+                return document;
+        }
+        throw new EpEnvelopeError("failed-precondition", "manager-service renewal spec registers no manager cluster");
+    };
     const managerGate = async (owner, instanceId) => {
-        const localManager = loadManagerInstanceIdentity(root, space);
+        const localManager = loadLocalManager();
         const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
         if (!gate)
             return "unknown";
@@ -379,7 +492,7 @@ export async function openAuthAuthorityPlane(opts) {
         const remoteInstances = [];
         const remoteLive = [];
         let localCandidate;
-        const localManager = loadManagerInstanceIdentity(root, space);
+        const localManager = loadLocalManager();
         for (const raw of await scanner.scanManagerGates()) {
             if (raw.op !== undefined)
                 continue;
@@ -434,6 +547,18 @@ export async function openAuthAuthorityPlane(opts) {
             if (verdict !== "candidate")
                 throw new Error(`manager instance ${instanceId} is ${verdict} at the permission mint`);
         },
+        verifySession: async (principal, claim) => {
+            refuseIfFenced();
+            return verifySessionRedemption({
+                jsm: recordsJsm,
+                space,
+                managerGate: async (owner, instanceId) => {
+                    const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "serving.instanceId"));
+                    const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+                    return { verdict, ...(gate ? { processEpoch: gate.processEpoch } : {}) };
+                },
+            }, principal, claim);
+        },
         retireInteractiveLifecycle: async (args) => {
             refuseIfFenced();
             const owner = assertDerivedOwnerToken(args.owner);
@@ -494,13 +619,43 @@ export async function openAuthAuthorityPlane(opts) {
         },
         issueManagerServiceAuthority: async ({ owner, scope, request }) => {
             refuseIfFenced();
+            const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
                 owner,
                 scope,
                 request,
+                authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
+                    request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
+                    observeManagerGate,
+                    observeRun: async (runId) => {
+                        const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
+                        return await observeHostedRunAttempt(recordsKv, "manager", runId, {
+                            supervisorId: r.identities.supervisor.id,
+                            instanceId: r.instanceId,
+                        });
+                    },
+                }),
                 issue: async ({ actors, request: r }) => {
                     const credential = async (key, profile, actor, opts) => mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
                     const credentials = {};
+                    const siblingOn = (gate, observed) => async (key, profile, actor) => {
+                        const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: standingTtl } : { expiresInSeconds: standingTtl });
+                        await commitSiblingIssuance(gate, observed, {
+                            credentialId: rawDigest(issued.jwt).replace("sha256:", "sha256-"),
+                            credentialKey: r.identities[key].id,
+                            holderPrincipal: `${owner}.${actor}`,
+                            endpoint: "manager",
+                            lifecycleUid: r.instanceId,
+                            sourceChain: ["root"],
+                            state: "active",
+                            exp: issued.exp,
+                            generation: observed.generation,
+                            processEpoch: observed.processEpoch,
+                            registrationRevision: observed.registrationRevision,
+                            nameAuthorityRevision: observed.nameAuthorityRevision,
+                        });
+                        return issued;
+                    };
                     if (r.operation === "renew") {
                         const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
                         const observed = await gate.observe();
@@ -516,7 +671,7 @@ export async function openAuthAuthorityPlane(opts) {
                     if (r.operation === "prepare" || r.operation === "renew") {
                         credentials.supervisor = await credential("supervisor", "remote-manager", actors.supervisor, {
                             remoteManager: { instanceId: r.instanceId, owner, actor: actors.supervisor },
-                            expiresInSeconds: STANDING_RENEWABLE_TTL_SEC,
+                            expiresInSeconds: standingTtl,
                         });
                         // The executor receives the exact instance-scoped registration/maintenance surface under
                         // a separate nkey and bounded five-minute lifetime. The participant retains it for the
@@ -564,6 +719,71 @@ export async function openAuthAuthorityPlane(opts) {
                         });
                         return { credentials };
                     }
+                    if (r.operation === "renewStandingBundle") {
+                        // authorizeRenewal fresh-checked account, owner, epoch and the current-registration proof
+                        // (which binds the held nkeys and lifecycle). Re-observe so every row binds one revision.
+                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const observed = await gate.observe();
+                        if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
+                            throw new EpEnvelopeError("conflict", "manager-service standing renewal gate moved before issuance");
+                        credentials.supervisor = await credential("supervisor", "remote-manager", actors.supervisor, {
+                            remoteManager: { instanceId: r.instanceId, owner, actor: actors.supervisor },
+                            expiresInSeconds: standingTtl,
+                        });
+                        credentials.executor = await credential("executor", "remote-manager", actors.executor, {
+                            remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
+                            expiresInSeconds: 5 * 60,
+                        });
+                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                            principal: { owner, actor: actors.serve },
+                            lifecycleUid: r.managerLifecycleUid,
+                            expiresInSeconds: standingTtl,
+                            endpointServe: remoteManagerServeGrantFromCluster(r, owner, await registeredManagerCluster(owner, r.instanceId, observed), observed),
+                            serveIssuance: gate,
+                        });
+                        const sibling = siblingOn(gate, observed);
+                        credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
+                        credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
+                        return { credentials };
+                    }
+                    if (r.operation === "renewRunDriver") {
+                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const observed = await gate.observe();
+                        if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
+                            throw new EpEnvelopeError("conflict", "manager-service run renewal gate moved before issuance");
+                        const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
+                        const run = await observeHostedRunAttempt(recordsKv, "manager", r.run.runId, {
+                            supervisorId: r.identities.supervisor.id,
+                            instanceId: r.instanceId,
+                        });
+                        if (!run || run.state !== "running" || run.instanceId !== r.instanceId ||
+                            run.holder !== r.run.holder || run.takeoverId !== r.run.takeoverId ||
+                            run.epoch !== r.run.epoch || run.fencingToken !== r.run.fencingToken)
+                            throw new EpEnvelopeError("conflict", "manager-service run renewal authority moved before issuance");
+                        const caller = runDriverCaller(r.run.runId, owner);
+                        const binding = {
+                            endpoint: "manager",
+                            runId: r.run.runId,
+                            takeoverId: r.run.takeoverId,
+                            instanceId: r.instanceId,
+                            epoch: r.run.epoch,
+                            owner,
+                        };
+                        const auth = { space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } };
+                        credentials.runDriver = await mintPublicUserJwt(auth, r.run.driverId, "run-driver", {
+                            principal: { owner, actor: caller.actor },
+                            lifecycleUid: r.managerLifecycleUid,
+                            runDriver: binding,
+                            expiresInSeconds: standingTtl,
+                        });
+                        credentials.runMediator = await mintPublicUserJwt(auth, r.run.mediatorId, "run-mediator", {
+                            principal: { owner, actor: caller.actor },
+                            lifecycleUid: r.managerLifecycleUid,
+                            runMediator: binding,
+                            expiresInSeconds: standingTtl,
+                        });
+                        return { credentials };
+                    }
                     if (r.operation === "activate") {
                         const expectedProof = remoteManagerRegistrationProof(owner, r);
                         if (r.registrationProof !== expectedProof)
@@ -580,30 +800,13 @@ export async function openAuthAuthorityPlane(opts) {
                         credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
-                            expiresInSeconds: STANDING_RENEWABLE_TTL_SEC,
+                            expiresInSeconds: standingTtl,
                             endpointServe: reconstructRemoteManagerServeGrant(r, owner, actors.serve, observed),
                             serveIssuance: gate,
                         });
                         if (!observed)
                             throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
-                        const sibling = async (key, profile, actor) => {
-                            const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: STANDING_RENEWABLE_TTL_SEC } : { expiresInSeconds: STANDING_RENEWABLE_TTL_SEC });
-                            await commitSiblingIssuance(gate, observed, {
-                                credentialId: rawDigest(issued.jwt).replace("sha256:", "sha256-"),
-                                credentialKey: r.identities[key].id,
-                                holderPrincipal: `${owner}.${actor}`,
-                                endpoint: "manager",
-                                lifecycleUid: r.instanceId,
-                                sourceChain: ["root"],
-                                state: "active",
-                                exp: issued.exp,
-                                generation: observed.generation,
-                                processEpoch: observed.processEpoch,
-                                registrationRevision: observed.registrationRevision,
-                                nameAuthorityRevision: observed.nameAuthorityRevision,
-                            });
-                            return issued;
-                        };
+                        const sibling = siblingOn(gate, observed);
                         credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
                         credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
                         return {
@@ -664,7 +867,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const result = await principalOracle(principal);
                         return { state: result.state, detail: result.note ?? `delivery-daemon principal sweep, sweepComplete=${String(result.sweepComplete)}` };
                     },
-                    evict: async (principal) => (await evict(principal)).verifiedGone,
+                    evictHolders: makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log }),
                     log,
                 });
             }
@@ -715,6 +918,22 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
+        verifyManagedAgentRuntime: async ({ owner, request }) => {
+            refuseIfFenced();
+            const args = {
+                owner,
+                dir: opts.dir,
+                proofSecret: dataAccount.signingSeed,
+                space,
+                observeManagerGate: async (instanceId) => {
+                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
+                    return gate.observe();
+                },
+            };
+            return request.kind === "manager-managed-agent-runtime-status"
+                ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
+                : authorizeRemoteManagedAgentRuntimeCreate({ ...args, request });
+        },
         scanManagerGoalIndex: async ({ owner, scope, request }) => {
             refuseIfFenced();
             const authorized = await authorizeRemoteManagerGoalIndexScan({
@@ -741,6 +960,124 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
+        admitManagerRun: async ({ owner, scope, request }) => {
+            refuseIfFenced();
+            if (!scope.includes("supervise"))
+                throw new EpEnvelopeError("permission-denied", 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
+            const runId = parseRemoteRunAdmissionRequest(request).run.runId;
+            const hostAuth = {
+                space,
+                operator: { seed: "", jwt: "" },
+                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
+                sys: { pub: "", jwt: "" },
+            };
+            return withIssuerSession({ servers: server, space, auth: hostAuth, tls: false }, async (session) => {
+                const admitterNc = await connect({
+                    servers: server,
+                    ...standaloneConnectOpts({
+                        creds: await mintCreds(hostAuth, newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }),
+                        tls: false,
+                    }),
+                    maxReconnectAttempts: 0,
+                });
+                try {
+                    return await admitRemoteRun({
+                        request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
+                        observeManagerGate: async (instanceId) => {
+                            const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
+                            return gate.observe();
+                        },
+                        issued: session.store,
+                        sourceIsLive: (source) => session.sourceIsLive(source),
+                        admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
+                    });
+                }
+                finally {
+                    await admitterNc.drain().catch(() => admitterNc.close());
+                }
+            });
+        },
+        issueManagerRunAttempt: async ({ owner, scope, request }) => {
+            refuseIfFenced();
+            if (!scope.includes("supervise"))
+                throw new EpEnvelopeError("permission-denied", 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
+            const req = parseRemoteRunAttemptRequest(request);
+            const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
+            const grant = await authorizeRemoteRunAttempt({
+                request,
+                owner,
+                space,
+                accountPublicKey: dataAccount.pub,
+                proofSecret: dataAccount.signingSeed,
+                endpoint: "manager",
+                observeManagerGate: async (instanceId) => {
+                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
+                    return gate.observe();
+                },
+                readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
+                readRunStatus: async (runId) => (await readRunRecord(recordsKv, "manager", runId))?.status?.value,
+                checkpointWaiting: async (token) => (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value.state === "waiting",
+            });
+            const hostAuth = {
+                space,
+                operator: { seed: "", jwt: "" },
+                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
+                sys: { pub: "", jwt: "" },
+            };
+            if (grant.kind === "attempt") {
+                const caller = runDriverCaller(grant.driver.runDriver.runId, owner);
+                const driver = await mintPublicUserJwt(hostAuth, grant.driver.id, "run-driver", {
+                    principal: { owner, actor: caller.actor },
+                    lifecycleUid: req.managerLifecycleUid,
+                    runDriver: grant.driver.runDriver,
+                    expiresInSeconds: standingTtl,
+                });
+                const mediator = await mintPublicUserJwt(hostAuth, grant.mediator.id, "run-mediator", {
+                    principal: { owner, actor: caller.actor },
+                    lifecycleUid: req.managerLifecycleUid,
+                    runMediator: grant.mediator.runMediator,
+                    expiresInSeconds: standingTtl,
+                });
+                return {
+                    v: 1,
+                    kind: "manager-run-attempt",
+                    space,
+                    owner,
+                    actor: req.actor,
+                    instanceId: req.instanceId,
+                    managerLifecycleUid: req.managerLifecycleUid,
+                    requestId: req.requestId,
+                    registrationProof: req.registrationProof,
+                    accountPublicKey: req.accountPublicKey,
+                    processEpoch: req.processEpoch,
+                    identities: req.identities,
+                    attempt: req.attempt,
+                    credentials: { driver, mediator },
+                };
+            }
+            const operator = await mintPublicUserJwt(hostAuth, grant.operator.id, "run-operator", {
+                principal: { owner, actor: req.actor },
+                lifecycleUid: req.managerLifecycleUid,
+                runOperator: grant.operator.runOperator,
+                expiresInSeconds: 60,
+            });
+            return {
+                v: 1,
+                kind: "manager-run-attempt",
+                space,
+                owner,
+                actor: req.actor,
+                instanceId: req.instanceId,
+                managerLifecycleUid: req.managerLifecycleUid,
+                requestId: req.requestId,
+                registrationProof: req.registrationProof,
+                accountPublicKey: req.accountPublicKey,
+                processEpoch: req.processEpoch,
+                identities: req.identities,
+                operator: req.operator,
+                credentials: { operator },
+            };
+        },
         fenced,
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
@@ -894,6 +1231,77 @@ export async function runAuthService(args, store) {
             await new Promise((r) => setTimeout(r, hold));
         }
     }
+    const started = await startAuthContext({
+        space,
+        server,
+        port,
+        dir,
+        secrets,
+        hostedStore: store !== undefined,
+        ...(publicPort !== undefined ? { publicFace: { port: publicPort, urlFlag: publicUrlFlag, trustedProxy, advertisedServer, agentProvisioningUrl } } : {}),
+        // The CLI composition's local manager is this workspace root's persisted instance, re-read per
+        // selection exactly as before. A hosted context passes no local manager at all.
+        localManager: () => loadManagerInstanceIdentity(root, space),
+    });
+    // All planes bound — NOW write the discovery file (its existence is the readiness signal).
+    saveAuthServiceInfo(dir, { url: started.url, pid: process.pid, cap: started.cap, ...(started.publicUrl !== undefined ? { publicUrl: started.publicUrl } : {}) });
+    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${started.url}${started.publicUrl !== undefined ? `, public exchange at ${started.publicUrl}` : ""}`);
+    // The CLI wrapper, not the context, owns process signals and exit codes.
+    const stop = async () => {
+        clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
+        await started.handle.close();
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void stop());
+    process.on("SIGTERM", () => void stop());
+    // A dropped broker connection is fatal-loud, not a zombie: the supervising `up`/`down` lifecycle
+    // owns restarts, and a callout that silently stopped answering would hang every user connect.
+    // A FENCED plane is equally fatal (SPEC 13.13): its scanners are no longer whole, every authority
+    // operation already refuses, and a daemon that stayed up would look healthy while a successor
+    // reclaims — down the whole service instead.
+    const ended = await started.ended;
+    clearAuthServiceInfo(dir);
+    if (ended.kind === "fenced") {
+        console.error(`✗ auth-service: ${ended.cause} - exiting`);
+        process.exit(1);
+    }
+    if (ended.cause !== undefined) {
+        console.error(`✗ auth-service: broker connection closed (${ended.cause}) - exiting`);
+        process.exit(1);
+    }
+    process.exit(0);
+}
+/** Start one account-scoped auth-service context. Every input is explicit: the state dir, the
+ *  injected store with its proved identity, the assigned data account and the broker. The context
+ *  installs no process signal handler, never exits the process, never selects a root from cwd,
+ *  and has no local manager. It returns only after the authority plane, the callout subscription
+ *  and the loopback listener are bound. A failed start releases what it acquired and throws. A
+ *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
+export async function startAuthService(inputs) {
+    if (!inputs.context?.accountPublicKey || !inputs.context.lifecycleUid || !inputs.space || !inputs.servers || !inputs.stateDir)
+        throw new Error("auth-service: hosted context needs an account, lifecycle, space, server and stateDir");
+    if (inputs.store.identity === undefined)
+        throw new Error("auth-service: hosted SecretStore must declare a stable identity");
+    const actual = parseSecretStoreIdentity(inputs.store.identity);
+    if (actual.kind !== "injected" || !sameSecretStoreIdentity(actual, inputs.storeIdentity))
+        throw new Error("auth-service: hosted SecretStore identity does not match the assigned store identity");
+    const port = inputs.port ?? 0;
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        throw new Error(`auth-service: port must be a port number, got ${port}`);
+    const started = await startAuthContext({
+        space: inputs.space,
+        server: inputs.servers,
+        port,
+        dir: resolve(inputs.stateDir),
+        secrets: inputs.store,
+        hostedStore: true,
+        localManager: () => undefined,
+        context: inputs.context,
+    });
+    return started.handle;
+}
+async function startAuthContext(o) {
+    const { space, server, dir, secrets, port } = o;
     const keys = await loadServiceKeys(secrets, space);
     const callout = await loadCalloutAuth(secrets, space);
     const issuer = await loadIssuer(secrets, space);
@@ -907,10 +1315,12 @@ export async function runAuthService(args, store) {
             ...(ownerSecret ? [] : ["owner secret"]),
             ...(idp ? [] : [`IdP pin under ${dir}`]),
         ];
-        throw new Error(`auth-service: user-auth material is missing (${missing.join(", ")}) - ${store ? "the hosted composition must provision the secret store before starting this daemon" : "enable it with `cotal up --user-auth --idp <url>`"}`);
+        throw new Error(`auth-service: user-auth material is missing (${missing.join(", ")}) - ${o.hostedStore ? "the hosted composition must provision the secret store before starting this daemon" : "enable it with `cotal up --user-auth --idp <url>`"}`);
     }
     if (issuer.issuer !== spaceIssuer(space))
         throw new Error(`auth-service: issuer pin ${issuer.issuer} does not match space "${space}"`);
+    if (o.context !== undefined && keys.dataAccount.pub !== o.context.accountPublicKey)
+        throw new Error("auth-service: the store's data account does not match the assigned hosted context");
     if (!(await isReachable(server, { creds: callout.calloutCreds })))
         throw new Error(`auth-service: can't reach the broker at ${server} with the callout creds - is the mesh up (with the callout account preloaded)?`);
     // ---- The authority plane (R1): stores ensured + registry + supervised reader, BEFORE the
@@ -921,132 +1331,172 @@ export async function runAuthService(args, store) {
         dir,
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
+        localManager: o.localManager,
     });
-    // ---- Plane 2: the callout, on its own callout-account connection ----
-    const nc = await connect({
-        servers: server,
-        authenticator: credsAuthenticator(new TextEncoder().encode(callout.calloutCreds)),
-        name: `cotal:auth-service:${space}`,
-    });
-    startAuthCallout(nc, {
-        xkeySeed: callout.xkey.seed,
-        authAccount: { pub: callout.account.pub, signingSeed: callout.account.signingSeed },
-        dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
-        space,
-        token: { key: issuer.localKeySet(), issuer: issuer.issuer },
-        authorizeActor: plane.authorizeConnect,
-        permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller),
-        log: (l) => console.error(l),
-    });
-    // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a
-    // usable user mesh while the SUB was still in flight would intermittently deny first connects.
-    await nc.flush();
-    // ---- Plane 1: the exchange + JWKS, loopback HTTP ----
-    const bridgeIdp = { issuer: idp.issuer, audience: idp.audience, key: pinnedJwksResolver(idp.jwksUri) };
-    const bridge = createIdpBridge({
-        idp: bridgeIdp,
-        space,
-        spaceSecret: ownerSecret,
-        issuer,
-        authorizeActor: ledgerAuthorizeGrant(dir),
-        mintConnectCredential: plane.mintConnectCredential,
-    });
-    const cap = randomBytes(32).toString("hex"); // per-start exchange capability (rotates with the daemon)
-    const failures = []; // rolling-window timestamps of REFUSED exchanges
-    const badCaps = []; // rolling-window timestamps of invalid-capability attempts
-    const ctx = {
-        issuer,
-        bridge,
-        bridgeIdp,
-        ownerSecret,
-        managerServiceAuthority: plane.issueManagerServiceAuthority,
-        maintainRemoteManager: plane.maintainRemoteManager,
-        validateRetainedAgent: plane.validateRetainedAgent,
-        verifyManagedAgentEnrollment: plane.verifyManagedAgentEnrollment,
-        verifyManagedAgentPrepareRetirement: plane.verifyManagedAgentPrepareRetirement,
-        scanManagerGoalIndex: plane.scanManagerGoalIndex,
-        authorizeManagerAdmin: plane.authorizeManagerAdmin,
-        secrets,
-        retireInteractiveLifecycle: plane.retireInteractiveLifecycle,
-        retireManagedLifecycle: plane.retireManagedLifecycle,
-        cap,
-        failures,
-        badCaps,
-        space,
-        dir,
-        mintConnectCredential: plane.mintConnectCredential,
-        selectManagerInstance: plane.selectManagerInstance,
-    };
-    const http = createServer((req, res) => void handle(req, res, ctx));
-    await new Promise((resolvePort, reject) => {
-        http.once("error", reject);
-        http.listen(port, "127.0.0.1", () => resolvePort());
-    });
-    const addr = http.address();
-    const boundPort = typeof addr === "object" && addr ? addr.port : port;
-    const url = `http://127.0.0.1:${boundPort}`;
-    // The optional PUBLIC face: its own server, its own closed route table, its own budgets — also
-    // loopback-bound (the operator's reverse proxy terminates TLS and forwards here).
+    let nc;
+    let http;
     let publicHttp;
-    let publicUrl;
-    if (publicPort !== undefined) {
-        // The discovery bundle is GENERATED from the daemon's own recorded config — the pinned IdP,
-        // the flags, the callout material — so it cannot drift from what this process enforces.
-        // `endpoints.url` is finalized AFTER bind (the closure sees the mutation): with `--port 0`
-        // the pre-bind port would advertise an address nothing listens on.
-        const bundle = composeUserBundle({
+    // Stop admission, let accepted requests settle within the public request deadline, then cut
+    // whatever is still open so a stuck client cannot hold this context's close forever.
+    const closeServer = async (srv) => {
+        if (srv === undefined || !srv.listening)
+            return;
+        const closed = new Promise((r) => srv.close(() => r()));
+        let timer;
+        await Promise.race([closed, new Promise((r) => { timer = setTimeout(r, PUBLIC_DEADLINE_MS); })]);
+        clearTimeout(timer);
+        srv.closeAllConnections();
+        await closed;
+    };
+    try {
+        // ---- Plane 2: the callout, on its own callout-account connection ----
+        nc = await connect({
+            servers: server,
+            authenticator: credsAuthenticator(new TextEncoder().encode(callout.calloutCreds)),
+            name: `cotal:auth-service:${space}`,
+        });
+        startAuthCallout(nc, {
+            xkeySeed: callout.xkey.seed,
+            authAccount: { pub: callout.account.pub, signingSeed: callout.account.signingSeed },
+            dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
             space,
-            // What participants DIAL, not what the callout dials: the daemon reaches the broker on its
-            // loopback/LAN address (--server), which is meaningless off this machine. --advertised-server
-            // is the publicly dialable address (e.g. wss://… through the reverse proxy).
-            server: advertisedServer ?? server,
-            idp: { url: idp.url, issuer: idp.issuer, audience: idp.audience },
-            sentinelCreds: callout.sentinelCreds,
-            ...(agentProvisioningUrl ? { agentProvisioningUrl } : {}),
+            token: { key: issuer.localKeySet(), issuer: issuer.issuer },
+            authorizeActor: plane.authorizeConnect,
+            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller, plane.verifySession),
+            log: (l) => console.error(l),
         });
-        publicHttp = createServer(makePublicHandler(ctx, makePublicPolicy(trustedProxy), bundle));
+        // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a
+        // usable user mesh while the SUB was still in flight would intermittently deny first connects.
+        await nc.flush();
+        // ---- Plane 1: the exchange + JWKS, loopback HTTP ----
+        const bridgeIdp = { issuer: idp.issuer, audience: idp.audience, key: pinnedJwksResolver(idp.jwksUri) };
+        const bridge = createIdpBridge({
+            idp: bridgeIdp,
+            space,
+            spaceSecret: ownerSecret,
+            issuer,
+            authorizeActor: ledgerAuthorizeGrant(dir),
+            mintConnectCredential: plane.mintConnectCredential,
+        });
+        const cap = randomBytes(32).toString("hex"); // per-start exchange capability (rotates with the daemon)
+        const failures = []; // rolling-window timestamps of REFUSED exchanges
+        const badCaps = []; // rolling-window timestamps of invalid-capability attempts
+        const ctx = {
+            issuer,
+            bridge,
+            bridgeIdp,
+            ownerSecret,
+            managerServiceAuthority: plane.issueManagerServiceAuthority,
+            maintainRemoteManager: plane.maintainRemoteManager,
+            validateRetainedAgent: plane.validateRetainedAgent,
+            verifyManagedAgentEnrollment: plane.verifyManagedAgentEnrollment,
+            verifyManagedAgentPrepareRetirement: plane.verifyManagedAgentPrepareRetirement,
+            verifyManagedAgentRuntime: plane.verifyManagedAgentRuntime,
+            scanManagerGoalIndex: plane.scanManagerGoalIndex,
+            authorizeManagerAdmin: plane.authorizeManagerAdmin,
+            admitManagerRun: plane.admitManagerRun,
+            issueManagerRunAttempt: plane.issueManagerRunAttempt,
+            secrets,
+            retireInteractiveLifecycle: plane.retireInteractiveLifecycle,
+            retireManagedLifecycle: plane.retireManagedLifecycle,
+            cap,
+            failures,
+            badCaps,
+            space,
+            dir,
+            mintConnectCredential: plane.mintConnectCredential,
+            selectManagerInstance: plane.selectManagerInstance,
+            verifySession: plane.verifySession,
+        };
+        const loopback = createServer((req, res) => void handle(req, res, ctx));
+        http = loopback;
         await new Promise((resolvePort, reject) => {
-            publicHttp.once("error", reject);
-            publicHttp.listen(publicPort, "127.0.0.1", () => resolvePort());
+            loopback.once("error", reject);
+            loopback.listen(port, "127.0.0.1", () => resolvePort());
         });
-        const paddr = publicHttp.address();
-        const boundPublic = typeof paddr === "object" && paddr ? paddr.port : publicPort;
-        publicUrl = publicUrlFlag ?? `http://127.0.0.1:${boundPublic}`;
-        finalizeUserBundleEndpoint(bundle, publicUrl);
+        const addr = loopback.address();
+        const boundPort = typeof addr === "object" && addr ? addr.port : port;
+        const url = `http://127.0.0.1:${boundPort}`;
+        // The optional PUBLIC face: its own server, its own closed route table, its own budgets — also
+        // loopback-bound (the operator's reverse proxy terminates TLS and forwards here).
+        let publicUrl;
+        if (o.publicFace !== undefined) {
+            const face = o.publicFace;
+            // The discovery bundle is GENERATED from the daemon's own recorded config — the pinned IdP,
+            // the flags, the callout material — so it cannot drift from what this process enforces.
+            // `endpoints.url` is finalized AFTER bind (the closure sees the mutation): with `--port 0`
+            // the pre-bind port would advertise an address nothing listens on.
+            const bundle = composeUserBundle({
+                space,
+                // What participants DIAL, not what the callout dials: the daemon reaches the broker on its
+                // loopback/LAN address (--server), which is meaningless off this machine. --advertised-server
+                // is the publicly dialable address (e.g. wss://… through the reverse proxy).
+                server: face.advertisedServer ?? server,
+                idp: { url: idp.url, issuer: idp.issuer, audience: idp.audience },
+                sentinelCreds: callout.sentinelCreds,
+                ...(face.agentProvisioningUrl ? { agentProvisioningUrl: face.agentProvisioningUrl } : {}),
+            });
+            const pub = createServer(makePublicHandler(ctx, makePublicPolicy(face.trustedProxy), bundle));
+            publicHttp = pub;
+            await new Promise((resolvePort, reject) => {
+                pub.once("error", reject);
+                pub.listen(face.port, "127.0.0.1", () => resolvePort());
+            });
+            const paddr = pub.address();
+            const boundPublic = typeof paddr === "object" && paddr ? paddr.port : face.port;
+            publicUrl = face.urlFlag ?? `http://127.0.0.1:${boundPublic}`;
+            finalizeUserBundleEndpoint(bundle, publicUrl);
+        }
+        const callNc = nc;
+        let state = "ready";
+        let cause;
+        let closePromise;
+        const close = () => {
+            if (closePromise !== undefined)
+                return closePromise;
+            if (state === "ready")
+                state = "draining";
+            closePromise = (async () => {
+                await Promise.all([closeServer(http), closeServer(publicHttp)]);
+                await plane.close().catch(() => { });
+                await callNc.close().catch(() => { });
+            })();
+            return closePromise;
+        };
+        const ended = Promise.race([
+            callNc.closed().then((err) => ({ kind: "broker", ...(err ? { cause: err.message } : {}) })),
+            plane.fenced.then((reason) => ({ kind: "fenced", cause: reason })),
+        ]).then((end) => {
+            // A clean broker close after this context's own close() is the orderly end, not a failure.
+            if (end.kind === "fenced" || end.cause !== undefined || closePromise === undefined) {
+                state = "unavailable";
+                cause = end.kind === "fenced" ? end.cause : `broker connection closed${end.cause !== undefined ? ` (${end.cause})` : ""}`;
+                void close();
+            }
+            return end;
+        });
+        const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
+        const service = {
+            url,
+            ...(publicUrl !== undefined ? { publicUrl } : {}),
+            readiness() {
+                if (state === "unavailable")
+                    return { state, context, cause: cause ?? "auth-service context is unavailable" };
+                return { state: closePromise === undefined ? "ready" : "draining", context };
+            },
+            drain: close,
+            close,
+        };
+        return { url, ...(publicUrl !== undefined ? { publicUrl } : {}), cap, handle: service, ended };
     }
-    // All planes bound — NOW write the discovery file (its existence is the readiness signal).
-    saveAuthServiceInfo(dir, { url, pid: process.pid, cap, ...(publicUrl !== undefined ? { publicUrl } : {}) });
-    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${url}${publicUrl !== undefined ? `, public exchange at ${publicUrl}` : ""}`);
-    const stop = async () => {
-        clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
-        http.close();
-        publicHttp?.close();
+    catch (e) {
+        // A failed start releases only what THIS context acquired, in reverse order.
+        await closeServer(publicHttp).catch(() => { });
+        await closeServer(http).catch(() => { });
+        await nc?.close().catch(() => { });
         await plane.close().catch(() => { });
-        await nc.close().catch(() => { });
-        process.exit(0);
-    };
-    process.on("SIGINT", () => void stop());
-    process.on("SIGTERM", () => void stop());
-    // A dropped broker connection is fatal-loud, not a zombie: the supervising `up`/`down` lifecycle
-    // owns restarts, and a callout that silently stopped answering would hang every user connect.
-    // A FENCED plane is equally fatal (SPEC 13.13): its scanners are no longer whole, every authority
-    // operation already refuses, and a daemon that stayed up would look healthy while a successor
-    // reclaims — down the whole service instead.
-    await Promise.race([
-        nc.closed().then((err) => {
-            clearAuthServiceInfo(dir);
-            if (err) {
-                console.error(`✗ auth-service: broker connection closed (${err.message}) - exiting`);
-                process.exit(1);
-            }
-            process.exit(0);
-        }),
-        plane.fenced.then((reason) => {
-            clearAuthServiceInfo(dir);
-            console.error(`✗ auth-service: ${reason} - exiting`);
-            process.exit(1);
-        }),
-    ]);
+        throw e;
+    }
 }
 /** Dispatch one already-authenticated manager-authority body through the fixed host validator. */
 export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
@@ -1063,6 +1513,9 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
     // would answer a manager-lifecycle phase for an agent-lifecycle request.
     if (request.kind === "manager-managed-agent-enrollment" || request.kind === "manager-managed-agent-prepare-retirement")
         throw new EpEnvelopeError("unimplemented", "managed agent enrollment and retirement preparation must be handled by host platform interception");
+    // The hosted runtime kinds read and drive host-owned intent state that stock does not hold.
+    if (request.kind === "manager-managed-agent-runtime-create" || request.kind === "manager-managed-agent-runtime-status")
+        throw new EpEnvelopeError("unimplemented", "managed agent runtime create and status must be handled by host platform interception");
     if (request.kind === "manager-retained-agent-validation") {
         const retained = await ctx.validateRetainedAgent({
             owner,
@@ -1084,6 +1537,10 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
         return ctx.scanManagerGoalIndex({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-admin-authorization")
         return ctx.authorizeManagerAdmin({ owner, scope: row.scope ?? [], request: body.request });
+    if (request.kind === "manager-run-admission")
+        return ctx.admitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    if (request.kind === "manager-run-attempt")
+        return ctx.issueManagerRunAttempt({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-service-maintenance")
         return ctx.maintainRemoteManager({ owner, scope: row.scope ?? [], request: body.request });
     return ctx.managerServiceAuthority({ owner, scope: row.scope ?? [], request: body.request });
@@ -1308,8 +1765,9 @@ async function handleVerifyManagedAgentEnrollment(req, res, ctx) {
     if (typeof raw.owner !== "string" || raw.request === null || typeof raw.request !== "object" || Array.isArray(raw.request))
         return send(res, 400, { error: "managed agent enrollment verification needs a string owner and an object request" });
     const request = raw.request;
-    if (request.kind !== "manager-managed-agent-enrollment" && request.kind !== "manager-managed-agent-prepare-retirement")
-        return send(res, 400, { error: 'managed agent enrollment verification serves only kind "manager-managed-agent-enrollment" or "manager-managed-agent-prepare-retirement"' });
+    const runtimeKind = request.kind === "manager-managed-agent-runtime-create" || request.kind === "manager-managed-agent-runtime-status";
+    if (request.kind !== "manager-managed-agent-enrollment" && request.kind !== "manager-managed-agent-prepare-retirement" && !runtimeKind)
+        return send(res, 400, { error: 'managed agent enrollment verification serves only kind "manager-managed-agent-enrollment", "manager-managed-agent-prepare-retirement", "manager-managed-agent-runtime-create" or "manager-managed-agent-runtime-status"' });
     if (typeof request.actor !== "string")
         return send(res, 400, { error: "managed agent enrollment verification request requires an actor" });
     try {
@@ -1319,6 +1777,14 @@ async function handleVerifyManagedAgentEnrollment(req, res, ctx) {
         // caller. An ungranted actor throws the ledger's own operator-exact sentence.
         const row = ledgerAuthorizeGrant(ctx.dir)(owner, request.actor);
         const scope = row.scope ?? [];
+        if (runtimeKind) {
+            // The plane re-reads the same ledger row itself: the runtime decision never takes a scope.
+            const decision = await ctx.verifyManagedAgentRuntime({
+                owner,
+                request: raw.request,
+            });
+            return send(res, 200, { authorized: true, ...decision });
+        }
         if (request.kind === "manager-managed-agent-enrollment") {
             const verified = await ctx.verifyManagedAgentEnrollment({
                 owner,
@@ -1396,7 +1862,9 @@ async function handleExchange(req, res, ctx, policy) {
     const peer = policy.peerKey(req);
     const peerThrottled = policy.throttled(ctx, peer);
     const body = await readJsonBody(req);
-    const { idpToken, actor, actorToken, owner, ttlSec, view, managerInstanceId } = body;
+    const { idpToken, actor, actorToken, owner, ttlSec, view, managerInstanceId, sessionGrant } = body;
+    if ((view === "session-caller") !== (sessionGrant !== undefined))
+        return send(res, 400, { error: 'view "session-caller" and sessionGrant come together or not at all' });
     if (ttlSec !== undefined && typeof ttlSec !== "number")
         return send(res, 400, { error: "ttlSec must be a number" });
     if (view !== undefined && typeof view !== "string")
@@ -1475,11 +1943,16 @@ async function handleExchange(req, res, ctx, policy) {
         const selectedManagerInstanceId = view === "manager-caller"
             ? await ctx.selectManagerInstance(deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, (await verifyIdpToken(idpToken, ctx.bridgeIdp)).sub), managerInstanceId)
             : undefined;
+        // #2312: a session-caller bearer is signed only once the identity plane has decided that THIS
+        // principal holds THAT redeemed session. The bridge's `verifySession` hook runs the decision on
+        // the principal it derived, before signing; the callout re-runs it at the mint.
+        const session = view === "session-caller" ? grantCoordinates(sessionGrant) : undefined;
         const r = await ctx.bridge.exchange(idpToken, {
             actor,
             ttlSec,
             view: view,
             managerInstanceId: selectedManagerInstanceId,
+            ...(session ? { verifySession: (p) => ctx.verifySession(p, session) } : {}),
         });
         return send(res, 200, r);
     }
@@ -1496,7 +1969,7 @@ async function handleExchange(req, res, ctx, policy) {
 }
 /** Loopback/operator-only typed manager authority exchange. The public route table never includes
  * this path, and the loopback capability is checked here in addition to the route separation. */
-async function handleManagerServiceAuthority(req, res, ctx, policy) {
+export async function handleManagerServiceAuthority(req, res, ctx, policy) {
     if (req.method !== "POST")
         return send(res, 405, { error: "POST only" });
     if (req.headers.origin !== undefined)