@cotal-ai/auth 0.67.0 → 0.69.0

package/dist/service.js

@@ -57,9 +57,9 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
-import { jetstreamManager } from "@nats-io/jetstream";
+import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance } from "@cotal-ai/core";
+import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
@@ -90,6 +90,7 @@ import { makeDeliveryAdminEvictor, makeDeliveryAdminHolderEvictor } from "./barr
 import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
+import { serializedFor } from "./serialized.js";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
@@ -122,20 +123,12 @@ const PUBLIC_PEER_BUCKETS_MAX = 1024; // bounded LRU of per-peer failure buckets
 const PUBLIC_MAX_IN_FLIGHT = 64; // global concurrent-admission cap on the public listener
 const PUBLIC_DEADLINE_MS = 10_000; // hard wall-clock deadline per public request
 const HOST_FENCE_POLL_MS = 1_000; // how often awaitHostFence re-reads the host gate
-const OBSERVED_RUN_REQUEST_WINDOW_MS = 5 * 60_000; // how long an observed served resume or answer can still be forwarded
+const OBSERVED_RUN_REQUEST_WINDOW_MS = 5 * 60_000; // how long an observed served run request can still be forwarded
 /** Enrollment and retirement preparation of one managed agent run one at a time, so neither acts on
  *  a grant the other is still writing or releasing. The chain lives at module level, keyed by the
  *  ledger directory, so two plane instances over one ledger share it. */
 const MANAGED_ALIAS_CHAINS = new Map();
-const serializedForAlias = (dir, owner, actor, fn) => {
-    const key = `${resolve(dir)}:${principalKey(owner, actor).key}`;
-    const run = (MANAGED_ALIAS_CHAINS.get(key) ?? Promise.resolve()).then(fn, fn);
-    const tail = run.then(() => undefined, () => undefined);
-    MANAGED_ALIAS_CHAINS.set(key, tail);
-    void tail.then(() => { if (MANAGED_ALIAS_CHAINS.get(key) === tail)
-        MANAGED_ALIAS_CHAINS.delete(key); });
-    return run;
-};
+const serializedForAlias = (dir, owner, actor, fn) => serializedFor(MANAGED_ALIAS_CHAINS, `${resolve(dir)}:${principalKey(owner, actor).key}`, fn);
 /** Package-internal policy step for the hosted retirement requester. The HTTP production door calls
  * this after deriving the owner and manager actors; broker-free smokes exercise the same decision. */
 export function authorizeRemoteManagerRetirement(args) {
@@ -310,6 +303,9 @@ export async function openAuthAuthorityPlane(opts) {
     let recordsScanner;
     let barrierReg;
     let closing = false;
+    // A failed open throws its own error, so a release failing on the way out is only logged: the
+    // row stays held and the next open reclaims it like a crash.
+    const releaseAfterFailedOpen = async () => hold?.release().catch((r) => log(r.message));
     // The plane-fatal channel (fact HIGH: a fenced plane must never keep serving): the mid-life
     // fence resolves it, every authority operation refuses from then on, and the composition root
     // downs the daemon. A clean close never resolves it.
@@ -349,7 +345,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsCand?.close();
         await ledgerCand?.close();
-        await hold?.release();
+        await releaseAfterFailedOpen();
         await barrier?.close();
         await remoteIssuer.close();
         await reader.close();
@@ -415,7 +411,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsScanner.close();
         await scanner.close();
-        await hold.release();
+        await releaseAfterFailedOpen();
         await barrier.close();
         await remoteIssuer.close();
         await reader.close();
@@ -438,7 +434,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsScanner.close();
         await scanner.close();
-        await hold.release();
+        await releaseAfterFailedOpen();
         await barrier.close();
         await remoteIssuer.close();
         await reader.close();
@@ -447,6 +443,9 @@ export async function openAuthAuthorityPlane(opts) {
     }
     const fileArm = ledgerAuthorizeConnect(opts.dir);
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
+    const authKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
+    const managerIssuanceGate = (instanceId) => serveIssuanceGateKv(authKv, space, { endpoint: "manager", instanceId });
+    const observeManagerGate = async (instanceId) => managerIssuanceGate(instanceId).observe();
     const loadLocalManager = opts.localManager ?? (() => undefined);
     // Standing renewal and a served resume or answer read the manager surface from the REGISTERED
     // service spec at the gate's registration revision: spec (leader read) -> closure manifest -> root
@@ -475,7 +474,7 @@ export async function openAuthAuthorityPlane(opts) {
     };
     const managerGate = async (owner, instanceId) => {
         const localManager = loadLocalManager();
-        const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+        const gate = await observeManagerGate(instanceId);
         if (!gate)
             return "unknown";
         if (gate.state !== "open")
@@ -549,8 +548,8 @@ export async function openAuthAuthorityPlane(opts) {
         if (fatalReason !== undefined)
             throw new EpEnvelopeError("unavailable", `the auth service for space "${space}" is momentarily unavailable (it detected a fault and is restarting); retry shortly`);
     };
-    // The issuer window's signer: the data account's signing key, the same `hostAuth` shape the run
-    // admission builds.
+    // The plane holds only the data account's signing key. The operator and system halves stay blank
+    // because core's mint reads only the space, the account pub and the signing seed.
     const issuerAuth = () => ({
         space,
         operator: { seed: "", jwt: "" },
@@ -560,10 +559,11 @@ export async function openAuthAuthorityPlane(opts) {
     // The source check the issuing host resolves with: an actor-ledger row is attested here, from the
     // ledger this service owns; every other coordinate goes to core's check (SPEC 13.15).
     const composedSourceIsLive = (session) => (source) => parseActorLedgerSource(source) ? Promise.resolve(ledgerActorSourceIsLive(opts.dir)(source)) : session.sourceIsLive(source);
-    // A served resume or answer is issued only for a request this host saw its caller publish, only
-    // once, and only for what that request's envelope asked (SPEC 14.8): the forward's coordinates
-    // are the manager's word. The manager forwards from inside the handler serving the request, so an
-    // observation older than the window has no forward left to bind; the window also bounds the table.
+    // A served run-start is admitted, and a served resume or answer issued, only for a request this
+    // host saw its caller publish, and only once; a resume or answer only for what that request's
+    // envelope asked (SPEC 14.8): the forward's coordinates are the manager's word. The manager
+    // forwards from inside the handler serving the request, so an observation older than the window
+    // has no forward left to bind; the window also bounds the table.
     const observedRunRequests = new Map();
     for (const subject of servedRunRequestSubjects(space))
         remoteIssuer.nc.subscribe(subject, {
@@ -590,7 +590,6 @@ export async function openAuthAuthorityPlane(opts) {
         observedRunRequests.delete(subject);
         return observed !== undefined && observed.expires > Date.now() ? observed.request : undefined;
     };
-    const observeManagerGate = async (instanceId) => serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
     // A managed lifecycle's broker footprint, released under a deprovisioner pinned to that uid, so
     // no call here can reach a same-name successor's durables.
     const deprovisionManagedFootprint = async (owner, actor, lifecycleUid, memberChannels) => {
@@ -656,7 +655,7 @@ export async function openAuthAuthorityPlane(opts) {
                 space,
                 managerGate: async (owner, instanceId) => {
                     const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "serving.instanceId"));
-                    const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+                    const gate = await observeManagerGate(instanceId);
                     return { verdict, ...(gate ? { processEpoch: gate.processEpoch } : {}) };
                 },
             }, principal, claim);
@@ -731,7 +730,6 @@ export async function openAuthAuthorityPlane(opts) {
         issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
-            const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
                 ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
@@ -746,7 +744,8 @@ export async function openAuthAuthorityPlane(opts) {
                     },
                 }),
                 issue: async ({ actors, request: r }) => {
-                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
+                    const signer = { space, account: dataAccount };
+                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
                     const credentials = {};
                     const siblingOn = (gate, observed) => async (key, profile, actor) => {
                         const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: standingTtl } : { expiresInSeconds: standingTtl });
@@ -767,7 +766,7 @@ export async function openAuthAuthorityPlane(opts) {
                         return issued;
                     };
                     if (r.operation === "renew") {
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open")
                             throw new EpEnvelopeError("failed-precondition", "manager-service renewal found no current open manager gate");
@@ -798,7 +797,7 @@ export async function openAuthAuthorityPlane(opts) {
                             throw new EpEnvelopeError("permission-denied", "manager-service session proof does not match this owner/lifecycle");
                         const session = r.session;
                         const exp = Math.min(session.exp, Math.floor(Date.now() / 1000) + 24 * 60 * 60);
-                        credentials.sessionServing = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, session.id, "session-serving", {
+                        credentials.sessionServing = await mintPublicUserJwt(signer, session.id, "session-serving", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             sessionServing: { endpoint: "manager", sessionId: session.sessionId, epoch: session.epoch },
@@ -810,7 +809,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const expectedProof = remoteManagerRegistrationProof(owner, r);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service transfer reader proof does not match this owner/lifecycle");
-                        credentials.transferReader = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
+                        credentials.transferReader = await mintPublicUserJwt(signer, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
                         return { credentials };
                     }
                     if (r.operation === "retire") {
@@ -818,13 +817,13 @@ export async function openAuthAuthorityPlane(opts) {
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service retirement proof does not match this owner/lifecycle");
                         const retirement = r.retirement;
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         authorizeRemoteManagerRetirement({
                             owner, serveActor: actors.serve, instanceId: r.instanceId,
                             targetOwner: retirement.target.owner, serveEpoch: retirement.serveEpoch, gate: observed,
                         });
-                        credentials.retirementRequester = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, retirement.id, "retirement-requester", {
+                        credentials.retirementRequester = await mintPublicUserJwt(signer, retirement.id, "retirement-requester", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             retirementRequester: {
@@ -839,7 +838,7 @@ export async function openAuthAuthorityPlane(opts) {
                     if (r.operation === "renewStandingBundle") {
                         // authorizeRenewal fresh-checked account, owner, epoch and the current-registration proof
                         // (which binds the held nkeys and lifecycle). Re-observe so every row binds one revision.
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
                             throw new EpEnvelopeError("conflict", "manager-service standing renewal gate moved before issuance");
@@ -851,7 +850,7 @@ export async function openAuthAuthorityPlane(opts) {
                             remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
                             expiresInSeconds: 5 * 60,
                         });
-                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
@@ -864,7 +863,7 @@ export async function openAuthAuthorityPlane(opts) {
                         return { credentials };
                     }
                     if (r.operation === "renewRunDriver") {
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
                             throw new EpEnvelopeError("conflict", "manager-service run renewal gate moved before issuance");
@@ -886,14 +885,13 @@ export async function openAuthAuthorityPlane(opts) {
                             epoch: r.run.epoch,
                             owner,
                         };
-                        const auth = { space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } };
-                        credentials.runDriver = await mintPublicUserJwt(auth, r.run.driverId, "run-driver", {
+                        credentials.runDriver = await mintPublicUserJwt(signer, r.run.driverId, "run-driver", {
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             runDriver: binding,
                             expiresInSeconds: standingTtl,
                         });
-                        credentials.runMediator = await mintPublicUserJwt(auth, r.run.mediatorId, "run-mediator", {
+                        credentials.runMediator = await mintPublicUserJwt(signer, r.run.mediatorId, "run-mediator", {
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             // Renewed with the placement the attempt was issued with (authorizeRemoteRunAttempt).
@@ -911,19 +909,17 @@ export async function openAuthAuthorityPlane(opts) {
                         // cross HTTP, so the host independently validates the deterministic proof + canonical
                         // artifact set and scopes the JWT to the already-registered instance rails. The grant
                         // rows are reconstructed from the canonical manager command set by the host protocol.
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed)
                             throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
-                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
-                            endpointServe: reconstructRemoteManagerServeGrant(r, owner, actors.serve, observed),
+                            endpointServe: reconstructRemoteManagerServeGrant(r, owner, observed),
                             serveIssuance: gate,
                         });
-                        if (!observed)
-                            throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
                         const sibling = siblingOn(gate, observed);
                         credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
                         credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
@@ -942,27 +938,20 @@ export async function openAuthAuthorityPlane(opts) {
         maintainRemoteManager: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
-            const gateKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
             const authorized = await authorizeRemoteManagerMaintenance({
                 ...holder,
                 space,
                 scanner,
-                observeManagerGate: async (instanceId) => serveIssuanceGateKv(gateKv, space, { endpoint: "manager", instanceId }).observe(),
+                observeManagerGate,
             });
-            const evict = makeDeliveryAdminEvictor({ space, server, dataAccount, log });
+            const evictHolders = makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log });
             if (authorized.operation === "evict-family-principal") {
-                const eviction = await evict(authorized.principal);
-                return completeRemoteManagerMaintenance(authorized, owner, { eviction });
+                const evictions = await evictHolders(authorized.principals);
+                return completeRemoteManagerMaintenance(authorized, owner, { evictions });
             }
             const principalOracle = makeDeliveryAdminPrincipalOracle({ space, server, dataAccount, log });
             const executorIdentity = newIdentity();
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
-            const executorCreds = await mintCreds(hostAuth, executorIdentity, "endpoint-serve-executor", {
+            const executorCreds = await mintCreds(issuerAuth(), executorIdentity, "endpoint-serve-executor", {
                 endpointServeExecutor: { endpoint: "manager", instanceId: authorized.targetInstanceId },
                 expiresInSeconds: 60,
             });
@@ -984,7 +973,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const result = await principalOracle(principal);
                         return { state: result.state, detail: result.note ?? `delivery-daemon principal sweep, sweepComplete=${String(result.sweepComplete)}` };
                     },
-                    evictHolders: makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log }),
+                    evictHolders: async (holders) => (await evictHolders(holders)).map((e) => e.verifiedGone),
                     log,
                 });
             }
@@ -999,10 +988,7 @@ export async function openAuthAuthorityPlane(opts) {
                 ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         verifyManagedAgentEnrollment: async ({ owner, scope, request }) => {
@@ -1013,10 +999,7 @@ export async function openAuthAuthorityPlane(opts) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         verifyManagedAgentPrepareRetirement: async ({ owner, scope, request }) => {
@@ -1027,10 +1010,7 @@ export async function openAuthAuthorityPlane(opts) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         enrollManagedAgent: async ({ owner, scope, request, sentinelCreds, agentBearerExchangeUrl }) => {
@@ -1155,10 +1135,7 @@ export async function openAuthAuthorityPlane(opts) {
                 dir: opts.dir,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             };
             return request.kind === "manager-managed-agent-runtime-status"
                 ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
@@ -1169,10 +1146,7 @@ export async function openAuthAuthorityPlane(opts) {
             const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
                 ...holder, proofSecret: dataAccount.signingSeed, space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
@@ -1185,10 +1159,7 @@ export async function openAuthAuthorityPlane(opts) {
                 space,
                 dir: opts.dir,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         admitManagerRun: async ({ request, ...holder }) => {
@@ -1196,17 +1167,11 @@ export async function openAuthAuthorityPlane(opts) {
             const { owner } = holder;
             requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
             const runId = parseRemoteRunAdmissionRequest(request).run.runId;
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
-            return withIssuerSession({ servers: server, space, auth: hostAuth, tls: false }, async (session) => {
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
                 const admitterNc = await connect({
                     servers: server,
                     ...standaloneConnectOpts({
-                        creds: await mintCreds(hostAuth, newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }),
+                        creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }),
                         tls: false,
                     }),
                     maxReconnectAttempts: 0,
@@ -1214,12 +1179,10 @@ export async function openAuthAuthorityPlane(opts) {
                 try {
                     return await admitRemoteRun({
                         request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
-                        observeManagerGate: async (instanceId) => {
-                            const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                            return gate.observe();
-                        },
+                        observeManagerGate,
                         issued: session.store,
                         sourceIsLive: composedSourceIsLive(session),
+                        takeObserved: takeObservedRunRequest,
                         admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
                     });
                 }
@@ -1253,12 +1216,28 @@ export async function openAuthAuthorityPlane(opts) {
                 accountPublicKey: dataAccount.pub,
                 proofSecret: dataAccount.signingSeed,
                 endpoint: "manager",
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
                 readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
                 readRunStatus: async (runId) => (await readRunRecord(recordsKv, "manager", runId))?.status?.value,
+                // Replayed under a read operator minted for that one run, the rows the manager's own read rides.
+                readJournal: async (runId) => {
+                    const takeoverId = newTakeoverId();
+                    const readerNc = await connect({
+                        servers: server,
+                        ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-operator", { runOperator: { endpoint: "manager", takeoverId, runId }, expiresInSeconds: 60 }),
+                            tls: false,
+                        }),
+                        maxReconnectAttempts: 0,
+                    });
+                    try {
+                        const replay = await replayRunJournal(jetstream(readerNc), await jetstreamManager(readerNc), space, runId, takeoverId);
+                        return replay.records.flatMap((stored) => stored.record.kind === "step" ? [stored.record.entry] : []);
+                    }
+                    finally {
+                        await readerNc.drain().catch(() => readerNc.close());
+                    }
+                },
                 checkpointWaiting: async (token) => (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value.state === "waiting",
                 checkpointSettled: async (token) => {
                     const status = (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value;
@@ -1269,21 +1248,15 @@ export async function openAuthAuthorityPlane(opts) {
             const grant = req.attempt?.served !== undefined || req.operator?.served !== undefined
                 ? await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, (session) => authorize(session))
                 : await authorize();
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
             if (grant.kind === "attempt") {
                 const caller = runDriverCaller(grant.driver.runDriver.runId, owner);
-                const driver = await mintPublicUserJwt(hostAuth, grant.driver.id, "run-driver", {
+                const driver = await mintPublicUserJwt(issuerAuth(), grant.driver.id, "run-driver", {
                     principal: { owner, actor: caller.actor },
                     lifecycleUid: req.managerLifecycleUid,
                     runDriver: grant.driver.runDriver,
                     expiresInSeconds: standingTtl,
                 });
-                const mediator = await mintPublicUserJwt(hostAuth, grant.mediator.id, "run-mediator", {
+                const mediator = await mintPublicUserJwt(issuerAuth(), grant.mediator.id, "run-mediator", {
                     principal: { owner, actor: caller.actor },
                     lifecycleUid: req.managerLifecycleUid,
                     runMediator: grant.mediator.runMediator,
@@ -1306,7 +1279,7 @@ export async function openAuthAuthorityPlane(opts) {
                     credentials: { driver, mediator },
                 };
             }
-            const operator = await mintPublicUserJwt(hostAuth, grant.operator.id, "run-operator", {
+            const operator = await mintPublicUserJwt(issuerAuth(), grant.operator.id, "run-operator", {
                 principal: { owner, actor: req.actor },
                 lifecycleUid: req.managerLifecycleUid,
                 runOperator: grant.operator.runOperator,
@@ -1331,7 +1304,7 @@ export async function openAuthAuthorityPlane(opts) {
         },
         observeManagerInstance: async (instanceId) => {
             refuseIfFenced();
-            const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+            const gate = await observeManagerGate(instanceId);
             const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
             return { registered: rec !== undefined && !("deleted" in rec), gate: gate ?? null };
         },
@@ -1356,7 +1329,7 @@ export async function openAuthAuthorityPlane(opts) {
         },
         observeEndpointGate: async (endpoint, instanceId) => {
             refuseIfFenced();
-            return await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint, instanceId }).observe();
+            return await serveIssuanceGateKv(authKv, space, { endpoint, instanceId }).observe();
         },
         fenced,
         close: async () => {
@@ -1368,10 +1341,14 @@ export async function openAuthAuthorityPlane(opts) {
             await reader.close();
             await recordsScanner.close();
             await scanner.close();
-            await hold.release();
-            await barrier.close();
-            await remoteIssuer.close();
-            await writer.close();
+            try {
+                await hold.release();
+            }
+            finally {
+                await barrier.close();
+                await remoteIssuer.close();
+                await writer.close();
+            }
         },
     };
 }
@@ -1522,7 +1499,13 @@ export async function runAuthService(args, store) {
     // The CLI wrapper, not the context, owns process signals and exit codes.
     const stop = async () => {
         clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
-        await started.handle.close();
+        try {
+            await started.handle.close();
+        }
+        catch (e) {
+            console.error(`✗ auth-service: ${e.message} - exiting`);
+            process.exit(1);
+        }
         process.exit(0);
     };
     process.on("SIGINT", () => void stop());
@@ -1549,7 +1532,10 @@ export async function runAuthService(args, store) {
  *  installs no process signal handler, never exits the process, never selects a root from cwd,
  *  and has no local manager. It returns only after the authority plane, the callout subscription
  *  and the loopback listener are bound. A failed start releases what it acquired and throws. A
- *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
+ *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources.
+ *  `close()` rejects when the context did not release its plane claim (SPEC 13.13): the row was
+ *  no longer its own, or the release write failed. The next start reclaims a row left held through
+ *  the liveness oracle. */
 export async function startAuthService(inputs) {
     if (!inputs.context?.accountPublicKey || !inputs.context.lifecycleUid || !inputs.space || !inputs.servers || !inputs.stateDir)
         throw new Error("auth-service: hosted context needs an account, lifecycle, space, server and stateDir");
@@ -1585,7 +1571,7 @@ export async function startAuthService(inputs) {
         ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
         ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
-    return started.handle;
+    return { ...started.handle, readiness: () => ({ ...started.status(), context: inputs.context }) };
 }
 async function startAuthContext(o) {
     const { space, server, dir, secrets, port } = o;
@@ -1758,8 +1744,12 @@ async function startAuthContext(o) {
             closePromise = (async () => {
                 await Promise.all([closeServer(http), closeServer(publicHttp)]);
                 await reader?.client.then((c) => c.close(), () => { });
-                await plane.close().catch(() => { });
-                await callNc.close().catch(() => { });
+                try {
+                    await plane.close();
+                }
+                finally {
+                    await callNc.close();
+                }
             })();
             return closePromise;
         };
@@ -1771,11 +1761,11 @@ async function startAuthContext(o) {
             if (end.kind === "fenced" || end.cause !== undefined || closePromise === undefined) {
                 state = "unavailable";
                 cause = end.kind === "fenced" ? end.cause : `broker connection closed${end.cause !== undefined ? ` (${end.cause})` : ""}`;
-                void close();
+                // A later close() returns this same promise, so its failure still reaches the host.
+                close().catch(() => { });
             }
             return end;
         });
-        const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
         const platformControl = o.platformControl;
         const host = platformControl?.host;
         // The human route's retained-validation composition, for the platform holder.
@@ -1878,15 +1868,11 @@ async function startAuthContext(o) {
                     }
                 },
             } : {}),
-            readiness() {
-                if (state === "unavailable")
-                    return { state, context, cause: cause ?? "auth-service context is unavailable" };
-                return { state: closePromise === undefined ? "ready" : "draining", context };
-            },
             drain: close,
             close,
         };
-        return { handle: service, ended };
+        const status = () => state === "unavailable" ? { state, cause: cause ?? "auth-service context is unavailable" } : { state: closePromise === undefined ? "ready" : "draining" };
+        return { handle: service, status, ended };
     }
     catch (e) {
         // A failed start releases only what THIS context acquired, in reverse order.