@cotal-ai/auth 0.73.0 → 0.77.0

package/dist/service.js

@@ -25,8 +25,9 @@
  *
  * REMOTE EXCHANGE — the OPTIONAL second listener (`--exchange-public-port`, also binding
  * 127.0.0.1; TLS terminates at a reverse proxy — in-process TLS was rejected: it duplicates cert
- * renewal and forks deploy). It serves ONLY `GET /health`, `GET /jwks`, `POST /exchange`, and
- * `GET /.well-known/cotal-mesh` (the generated discovery bundle); everything else 404s. Its
+ * renewal and forks deploy). It serves ONLY `GET /health`, `GET /jwks`, `POST /exchange`,
+ * `POST /manager-service-authority`, and `GET /.well-known/cotal-mesh` (the generated discovery
+ * bundle); everything else 404s. Its
  * `/exchange` demands NO capability — honestly: the 0600 cap is a same-uid file-ACL boundary with
  * no remote meaning, so requiring its bytes from a remote caller would prove nothing. The proof on
  * the public face is the credential itself: the human arm presents an EdDSA IdP JWT verified
@@ -59,19 +60,20 @@ import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance } from "@cotal-ai/core";
+import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRevocation, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance, epgateKey, isCasLoss } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
 import { makePlatformControlAuthority, makePlatformControlReadiness, requireManagerAuthorityHolder } from "./platform-control.js";
 import { OwnedConnections } from "./owned-connections.js";
+import { makePlatformSupervisorAuthority, makePlatformSupervisorEnd, platformSupervisorEnded, requirePlatformSupervisorAdmin } from "./platform-supervisor.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim } from "./token.js";
 import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest } from "./manager-authority.js";
+import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, holdsRunFence, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest, parseRemoteRunRevokeRequest, revokeRemoteRun } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
 import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
@@ -96,7 +98,7 @@ import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
 import { AGENT_BEARER_TTL_SEC, assertWithinSpawnerGrant, findInteractiveActor, findManagedActor, findActorUnified, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, revokeManagedActorAt, } from "./ledger.js";
-import { AUTH_PROVIDER_NAME, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
+import { AUTH_PROVIDER_NAME, claimAuthInstanceIdentity, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
 export const JWKS_MAX_AGE_SEC = 300;
@@ -187,6 +189,24 @@ async function registerSelfAuthorizedInstance(nc, args, register) {
         throw new EpEnvelopeError("conflict", `the issuance gate of ${endpoint}/${instanceId} is no longer open at this registration (process epoch ${processEpoch}, revision ${registrationRevision}); a later barrier fenced this start (SPEC 13.1)`);
     return registered;
 }
+/** The accepted-row token one platform supervisor duty's issued generation is recorded under. */
+function supervisorAcceptedToken(owner, instanceId, lifecycleUid, duty) {
+    return connectionAcceptedToken(`platform-supervisor:${owner}:${instanceId}:${lifecycleUid}:${duty}`);
+}
+/** The issued generation recorded for one platform supervisor duty, or undefined when none was.
+ *  The accepted store is write-once per key, so the first row is the only row. */
+async function supervisorGeneration(session, space, owner, instanceId, lifecycleUid, duty) {
+    const response = await session.nc.request(acceptedReadGrant(space, supervisorAcceptedToken(owner, instanceId, lifecycleUid, duty)), new Uint8Array(0), { timeout: 3000 });
+    const status = response.headers?.get("Status");
+    if (response.headers?.code === 404 || status?.startsWith("404"))
+        return undefined;
+    if (status)
+        throw new EpEnvelopeError("unavailable", "platform supervisor accepted-row read failed");
+    const accepted = JSON.parse(new TextDecoder().decode(response.data));
+    if (accepted.version !== 1 || accepted.ref.space !== space || accepted.ref.owner !== owner || accepted.ref.actor !== remoteManagerActors(instanceId)[duty] || accepted.ref.uid !== lifecycleUid)
+        throw new EpEnvelopeError("permission-denied", "platform supervisor accepted row names another owner or lifecycle");
+    return accepted.ref;
+}
 /**
  * Open the authority plane — the PRODUCTION connect/exchange composition (exported so the live
  * deny-new smoke exercises exactly what the daemon runs). Boot order is the readiness contract:
@@ -228,17 +248,16 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     // #399 M2: register the auth plane itself as an ordinary `auth` service endpoint — the SAME
     // §13.7 registration ceremony the manager runs (`manager.ts:6562-6690`), before the listener
     // below serves a single request. The persisted instance id + serve nkey (in `identityRoot`,
-    // hardened the way the manager's own instance identity is) so a restart re-registers the
-    // SAME instance: `registerServiceInstance` advances the process epoch on a re-registration and
-    // fences the predecessor; a first registration stays at epoch 0.
+    // hardened the way the manager's own instance identity is, or in a hosted context's store) so a
+    // restart re-registers the SAME instance: `registerServiceInstance` advances the process epoch
+    // on a re-registration and fences the predecessor; a first registration stays at epoch 0.
     let authServeInstanceId;
     let authServeGrant;
     {
-        const persisted = loadAuthInstanceIdentity(opts.identityRoot, space);
-        const authIdentity = persisted ?? createAuthInstanceIdentity(opts.identityRoot, space, {
-            instanceId: mintLifecycleUid(),
-            serveIdentity: newIdentity(),
-        });
+        const mint = () => ({ instanceId: mintLifecycleUid(), serveIdentity: newIdentity() });
+        const authIdentity = opts.identityStore
+            ? await claimAuthInstanceIdentity(opts.identityStore, space, opts.identityRoot, mint)
+            : loadAuthInstanceIdentity(opts.identityRoot, space) ?? createAuthInstanceIdentity(opts.identityRoot, space, mint());
         const iid = authIdentity.instanceId;
         const artifacts = authClusterArtifacts();
         const values = [...authContractArtifactValues(), artifacts.document, artifacts.manifest];
@@ -683,23 +702,47 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
-            return issueRemoteManagerAuthority({
+            // The ended-assignment fence (SPEC 13.16): read on every call, before anything is signed. The
+            // retired gate and the retired generations are terminal rows, so no host view reopens them.
+            if (holder.supervisorExpiresAt !== undefined) {
+                const gate = await observeManagerGate(holder.request.instanceId);
+                if (gate?.state === "retired")
+                    throw platformSupervisorEnded(owner);
+                await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
+                    for (const duty of ["supervisor", "executor"]) {
+                        const ref = await supervisorGeneration(session, space, owner, holder.request.instanceId, holder.request.managerLifecycleUid, duty);
+                        if (ref === undefined)
+                            continue;
+                        try {
+                            await session.store.resolve(ref, session.sourceIsLive);
+                        }
+                        catch (error) {
+                            throw platformSupervisorEnded(owner, error instanceof Error ? error.message : String(error));
+                        }
+                    }
+                });
+            }
+            const observeManagerRun = async (r, runId) => observeHostedRunAttempt(await openRecordsBucket(remoteIssuer.nc, space), "manager", runId, { supervisorId: r.identities.supervisor.id, instanceId: r.instanceId });
+            const material = await issueRemoteManagerAuthority({
                 ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
                     request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
                     observeManagerGate,
-                    observeRun: async (runId) => {
-                        const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
-                        return await observeHostedRunAttempt(recordsKv, "manager", runId, {
-                            supervisorId: r.identities.supervisor.id,
-                            instanceId: r.instanceId,
-                        });
-                    },
+                    observeRun: (runId) => observeManagerRun(r, runId),
                 }),
                 issue: async ({ actors, request: r }) => {
                     const signer = { space, account: dataAccount };
+                    const bounded = (opts) => {
+                        if (holder.supervisorExpiresAt === undefined)
+                            return opts;
+                        const now = Math.floor(Date.now() / 1000);
+                        if (holder.supervisorExpiresAt <= now)
+                            throw new EpEnvelopeError("permission-denied", `platform supervisor lifecycle has ended for owner ${owner}`);
+                        const { expiresInSeconds, expiresAt, ...rest } = opts ?? {};
+                        return { ...rest, expiresAt: Math.min(holder.supervisorExpiresAt, expiresAt ?? now + (expiresInSeconds ?? standingTtl)) };
+                    };
                     const registration = { space: r.space, instanceId: r.instanceId, lifecycleUid: r.managerLifecycleUid, identities: r.identities };
-                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
+                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, bounded({ ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid }));
                     const credentials = {};
                     const siblingOn = (gate, observed) => async (key, profile, actor) => {
                         const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: standingTtl } : { expiresInSeconds: standingTtl });
@@ -803,13 +846,13 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
                             expiresInSeconds: 5 * 60,
                         });
-                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", bounded({
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
                             endpointServe: remoteManagerServeGrantFromCluster(r, owner, await registeredManagerCluster(owner, r.instanceId, observed), observed),
                             serveIssuance: gate,
-                        });
+                        }));
                         const sibling = siblingOn(gate, observed);
                         credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
                         credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
@@ -820,14 +863,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
                             throw new EpEnvelopeError("conflict", "manager-service run renewal gate moved before issuance");
-                        const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
-                        const run = await observeHostedRunAttempt(recordsKv, "manager", r.run.runId, {
-                            supervisorId: r.identities.supervisor.id,
-                            instanceId: r.instanceId,
-                        });
-                        if (!run || run.state !== "running" || run.instanceId !== r.instanceId ||
-                            run.holder !== r.run.holder || run.takeoverId !== r.run.takeoverId ||
-                            run.epoch !== r.run.epoch || run.fencingToken !== r.run.fencingToken)
+                        if (!holdsRunFence(await observeManagerRun(r, r.run.runId), r))
                             throw new EpEnvelopeError("conflict", "manager-service run renewal authority moved before issuance");
                         const caller = runDriverCaller(r.run.runId, owner);
                         const binding = {
@@ -838,19 +874,19 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             epoch: r.run.epoch,
                             owner,
                         };
-                        credentials.runDriver = await mintPublicUserJwt(signer, r.run.driverId, "run-driver", {
+                        credentials.runDriver = await mintPublicUserJwt(signer, r.run.driverId, "run-driver", bounded({
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             runDriver: binding,
                             expiresInSeconds: standingTtl,
-                        });
-                        credentials.runMediator = await mintPublicUserJwt(signer, r.run.mediatorId, "run-mediator", {
+                        }));
+                        credentials.runMediator = await mintPublicUserJwt(signer, r.run.mediatorId, "run-mediator", bounded({
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             // Renewed with the placement the attempt was issued with (authorizeRemoteRunAttempt).
                             runMediator: { ...binding, placement: { instanceId: r.instanceId } },
                             expiresInSeconds: standingTtl,
-                        });
+                        }));
                         return { credentials };
                     }
                     if (r.operation === "activate") {
@@ -866,13 +902,13 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                         const observed = await gate.observe();
                         if (!observed)
                             throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
-                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", bounded({
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
                             endpointServe: reconstructRemoteManagerServeGrant(r, owner, observed),
                             serveIssuance: gate,
-                        });
+                        }));
                         const sibling = siblingOn(gate, observed);
                         credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
                         credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
@@ -887,6 +923,82 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                     return { credentials };
                 },
             });
+            if (holder.supervisorExpiresAt !== undefined) {
+                await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
+                    for (const duty of ["supervisor", "executor"]) {
+                        const credential = material.credentials[duty];
+                        if (!credential)
+                            continue;
+                        const payload = decodeJwt(credential.jwt);
+                        const permissions = importNativeSubjectPermissions({ pub: payload.nats?.pub, sub: payload.nats?.sub });
+                        const actor = remoteManagerActors(holder.request.instanceId)[duty];
+                        if (!actor || payload.sub !== holder.request.identities[duty]?.id)
+                            throw new EpEnvelopeError("internal", "platform supervisor issued a duty outside its fixed standing identities");
+                        const acceptedToken = supervisorAcceptedToken(owner, holder.request.instanceId, holder.request.managerLifecycleUid, duty);
+                        const existing = await supervisorGeneration(session, space, owner, holder.request.instanceId, holder.request.managerLifecycleUid, duty);
+                        if (existing === undefined) {
+                            const ref = { space, owner, actor, uid: holder.request.managerLifecycleUid, generation: mintGeneration() };
+                            const prepared = await session.store.stage({ version: 1, ref, sources: [], permissions, expiresAt: holder.supervisorExpiresAt });
+                            await session.store.release(prepared, async () => { });
+                            await writeAcceptedRow(session.accepted, acceptedToken, ref);
+                        }
+                        else {
+                            await session.store.resolve(existing, session.sourceIsLive);
+                            await session.store.confirm(existing, permissions);
+                        }
+                    }
+                });
+            }
+            return material;
+        },
+        endPlatformSupervisor: async ({ owner, instanceId, lifecycleUid }) => {
+            refuseIfFenced();
+            // Retire the issued generations first, then the gate. Each step is idempotent, so a retry after
+            // a partial end completes it. The retired gate alone refuses a lifecycle that issued nothing.
+            await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
+                for (const duty of ["supervisor", "executor"]) {
+                    const ref = await supervisorGeneration(session, space, owner, instanceId, lifecycleUid, duty);
+                    if (ref !== undefined)
+                        await session.store.retire(ref);
+                }
+            });
+            const key = epgateKey("manager", instanceId);
+            const opId = managedRetirementOpId(lifecycleUid);
+            for (let attempt = 0; attempt < 4; attempt++) {
+                const entry = await authKv.get(key);
+                if (entry === null) {
+                    // No gate yet: create it retired, so a later registration finds the terminal row.
+                    const row = { state: "retired", generation: 0, processEpoch: 0, registrationRevision: 0, nameAuthorityRevision: 0, principal: `${owner}.${remoteManagerActors(instanceId).serve}`, op: { opId, kind: "retirement" } };
+                    parseEndpointGate(new TextEncoder().encode(JSON.stringify(row)), key);
+                    try {
+                        await authKv.create(key, new TextEncoder().encode(JSON.stringify(row)));
+                        return;
+                    }
+                    catch (error) {
+                        if (isCasLoss(error))
+                            continue;
+                        throw error;
+                    }
+                }
+                if (entry.operation !== "PUT")
+                    throw new EpEnvelopeError("failed-precondition", `the manager gate ${key} carries a ${entry.operation} marker; a gate is never deleted (SPEC 13.12)`);
+                const row = parseEndpointGate(entry.value, key);
+                if (row.principal !== `${owner}.${remoteManagerActors(instanceId).serve}`)
+                    throw new EpEnvelopeError("permission-denied", `the manager gate ${key} belongs to ${row.principal}, not owner ${owner}`);
+                if (row.state === "retired")
+                    return;
+                const { op: _op, ...rest } = row;
+                void _op;
+                try {
+                    await authKv.update(key, new TextEncoder().encode(JSON.stringify({ ...rest, state: "retired", op: { opId, kind: "retirement" } })), entry.revision);
+                    return;
+                }
+                catch (error) {
+                    if (!isCasLoss(error))
+                        throw error;
+                }
+            }
+            throw new EpEnvelopeError("conflict", `ending the platform supervisor of ${owner} lost repeated CAS attempts on ${key}; retry`);
         },
         maintainRemoteManager: async (holder) => {
             refuseIfFenced();
@@ -1147,6 +1259,31 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 }
             });
         },
+        revokeManagerRun: async ({ request, ...holder }) => {
+            refuseIfFenced();
+            const req = parseRemoteRunRevokeRequest(request);
+            const admitterNc = await connect({
+                servers: server,
+                ...standaloneConnectOpts({
+                    creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId: req.revoke.runId }, expiresInSeconds: 60 }),
+                    tls: false,
+                }),
+                maxReconnectAttempts: 0,
+            });
+            onConnection?.(admitterNc, `cotal:run-revoker:${space}`);
+            try {
+                return await revokeRemoteRun({
+                    ...holder, request: req, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
+                    observeManagerGate,
+                    readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
+                    readRevocation: (runId) => readRunRevocation(recordsJsm, space, "manager", runId),
+                    admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
+                });
+            }
+            finally {
+                await admitterNc.drain().catch(() => admitterNc.close());
+            }
+        },
         issueManagerRunAttempt: async ({ request, ...holder }) => {
             refuseIfFenced();
             const { owner } = holder;
@@ -1551,6 +1688,7 @@ export async function startAuthService(inputs) {
         context: inputs.context,
         ...(inputs.publicFace !== undefined ? { publicFace: inputs.publicFace } : {}),
         ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
+        ...(inputs.platformSupervisor !== undefined ? { platformSupervisor: inputs.platformSupervisor } : {}),
         ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
     return { ...started.handle, readiness: () => ({ ...started.status(), context: inputs.context }) };
@@ -1587,6 +1725,7 @@ async function startAuthContext(o) {
         space,
         dir,
         identityRoot: o.identityRoot,
+        ...(o.context !== undefined ? { identityStore: secrets } : {}),
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
@@ -1664,6 +1803,7 @@ async function startAuthContext(o) {
             scanManagerGoalIndex: plane.scanManagerGoalIndex,
             authorizeManagerAdmin: plane.authorizeManagerAdmin,
             admitManagerRun: plane.admitManagerRun,
+            revokeManagerRun: plane.revokeManagerRun,
             issueManagerRunAttempt: plane.issueManagerRunAttempt,
             secrets,
             retireInteractiveLifecycle: plane.retireInteractiveLifecycle,
@@ -1844,6 +1984,25 @@ async function startAuthContext(o) {
             cap,
             closed: owned.closed,
             connections: () => owned.connections(),
+            ...(o.platformSupervisor !== undefined ? {
+                platformSupervisorAuthority: async (owner) => {
+                    refuseUnlessReady();
+                    assertDerivedOwnerToken(owner);
+                    const input = o.platformSupervisor;
+                    await requirePlatformSupervisorAdmin(input, owner);
+                    return makePlatformSupervisorAuthority({
+                        ...input, owner, space, accountPublicKey: keys.dataAccount.pub, ready: refuseUnlessReady,
+                        observePrincipal: async (instanceId) => (await plane.observeManagerInstance(instanceId)).gate?.principal,
+                        issue: (boundOwner, supervisorExpiresAt, request) => plane.issueManagerServiceAuthority({
+                            owner: boundOwner, scope: ["supervise"], supervisorExpiresAt, request,
+                        }),
+                    });
+                },
+                endPlatformSupervisorAssignment: makePlatformSupervisorEnd({
+                    ...o.platformSupervisor, space, accountPublicKey: keys.dataAccount.pub, ready: refuseUnlessReady,
+                    end: (owner, instanceId, lifecycleUid) => plane.endPlatformSupervisor({ owner, instanceId, lifecycleUid }),
+                }),
+            } : {}),
             ...(platformDeps !== undefined ? {
                 platformControlAuthority: makePlatformControlAuthority({
                     ...platformDeps,
@@ -1951,6 +2110,11 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
         return ctx.authorizeManagerAdmin({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-run-admission")
         return ctx.admitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    if (request.kind === "manager-run-revoke") {
+        if (ctx.revokeManagerRun === undefined)
+            throw new EpEnvelopeError("unimplemented", "this issuing host has no run revoke handler");
+        return ctx.revokeManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    }
     if (request.kind === "manager-run-attempt")
         return ctx.issueManagerRunAttempt({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-service-maintenance")
@@ -1962,7 +2126,6 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
 const LOOPBACK_POLICY = {
     requireCapability: true,
     refuseViews: false,
-    allowManagerAuthority: true,
     peerKey: (req) => req.socket.remoteAddress ?? "loopback",
     throttled: (ctx) => {
         const now = Date.now();
@@ -1996,7 +2159,6 @@ function makePublicPolicy(trustedProxy) {
     return {
         requireCapability: false,
         refuseViews: true,
-        allowManagerAuthority: true,
         peerKey: (req) => {
             if (trustedProxy) {
                 const xff = req.headers["x-forwarded-for"];
@@ -2384,8 +2546,9 @@ async function handleExchange(req, res, ctx, policy) {
         return send(res, 401, { error: reason });
     }
 }
-/** Loopback/operator-only typed manager authority exchange. The public route table never includes
- * this path, and the loopback capability is checked here in addition to the route separation. */
+/** The typed manager authority exchange, served on both faces. The face's policy decides whether the
+ *  loopback capability is demanded; on the public face the verified IdP JWT is the proof, and the
+ *  dispatcher reads the caller's scope from the ledger either way. */
 export async function handleManagerServiceAuthority(req, res, ctx, policy) {
     if (req.method !== "POST")
         return send(res, 405, { error: "POST only" });
@@ -2393,8 +2556,6 @@ export async function handleManagerServiceAuthority(req, res, ctx, policy) {
         return send(res, 403, { error: "browser-origin requests are not served here" });
     if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
         return send(res, 415, { error: "content-type must be application/json" });
-    if (!policy.allowManagerAuthority)
-        return send(res, 403, { error: "manager-service authority is not enabled on this exchange face" });
     if (policy.requireCapability && req.headers.authorization !== `Bearer ${ctx.cap}`)
         return send(res, 401, { error: "missing/invalid exchange capability - manager-service authority requires the operator exchange capability on this face" });
     const body = await readJsonBody(req);
@@ -2489,7 +2650,8 @@ export function checkAgentProvisioningUrl(raw) {
     return undefined;
 }
 /** Build the PUBLIC listener's request handler: its own closed route table (/health, /jwks,
- *  /exchange under the public policy, /.well-known/cotal-mesh — 404 everything else), behind a
+ *  /exchange and /manager-service-authority under the public policy, /.well-known/cotal-mesh — 404
+ *  everything else), behind a
  *  global concurrent-admission cap and a hard wall-clock deadline. All of it is public-face-local
  *  state: nothing here touches the loopback face's windows. */
 function makePublicHandler(ctx, policy, bundle) {