@cotal-ai/auth 0.90.1 → 0.92.0

package/dist/service.js

@@ -29,7 +29,8 @@ import { createToolResultConsentSigner, makeToolResultConsentRecorder } from "./
  * 127.0.0.1; TLS terminates at a reverse proxy — in-process TLS was rejected: it duplicates cert
  * renewal and forks deploy). It serves ONLY `GET /health`, `GET /jwks`, `POST /exchange`,
  * `POST /manager-service-authority`, and `GET /.well-known/cotal-mesh` (the generated discovery
- * bundle); everything else 404s. Its
+ * bundle), plus, only with `serviceEndpoints`, `/service-endpoint-authority` on both faces;
+ * everything else 404s. Its
  * `/exchange` demands NO capability — honestly: the 0600 cap is a same-uid file-ACL boundary with
  * no remote meaning, so requiring its bytes from a remote caller would prove nothing. The proof on
  * the public face is the credential itself: the human arm presents an EdDSA IdP JWT verified
@@ -62,7 +63,7 @@ import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRevocation, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance, epgateKey, isCasLoss } from "@cotal-ai/core";
+import { CotalEndpoint, deprovisionAgent, dlvDurable, dlvStream, dmDurable, dmStream, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRevocation, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance, parseServiceAuthorityEnvelope, SERVICE_AUTHORITY_MAX_BYTES, epgateKey, isCasLoss, sameManagedGrantCustody, parseServiceRegistrationWitness, serviceWitnessDigest } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
@@ -71,11 +72,11 @@ import { OwnedConnections } from "./owned-connections.js";
 import { makePlatformSupervisorAuthority, makePlatformSupervisorEnd, platformSupervisorEnded, requirePlatformSupervisorAdmin } from "./platform-supervisor.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof } from "./idp.js";
-import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim } from "./token.js";
+import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim, validateUserToken } from "./token.js";
 import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, holdsRunFence, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest, parseRemoteRunRevokeRequest, revokeRemoteRun } from "./manager-authority.js";
+import { handleRemoteRunCancel, parseRemoteRunCancelRequest, admitRemoteRun, handleRemoteRunSubmission, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, holdsRunFence, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest, parseRemoteRunRevokeRequest, revokeRemoteRun } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
 import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
@@ -83,11 +84,16 @@ import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 import { validateRetainedManagedAgent } from "./continuity.js";
 import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster, remoteManagerSurface } from "./manager-contract.js";
-import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, registrationExecutorGrants, servedRunRequestSubjects } from "./authority-client.js";
+import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, registrationExecutorGrants, servedRunRequestSubjects, servedRunCancelRequestSubject, serviceCalloutWriterGrants, serviceHostDiscoveryGrants } from "./authority-client.js";
+import { createNativeServiceCalloutAuthority } from "./native-service-callout.js";
 import { authorizeConnectCredential } from "./connect-reader.js";
+import { chatAwareAclResolver, openChatSessionAuthority } from "./chat-session-authority.js";
 import { makeNativeIssuanceRecorder, pruneNativeIssuance } from "./native-issuance.js";
 import { ensureRootCredential } from "./root-credential.js";
 import { activateLifecycleAtUid, observeGate, openLifecycleRegistry, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
+import { openServiceHostEffect, openServiceHostOperations } from "./service-host-ops.js";
+import { SERVICE_ENDPOINT_AUTHORITY_PATH, answerServiceAuthority, serviceAuthorityDenied, serviceAuthorityInfo } from "./service-endpoint-authority.js";
+import { validateServiceRenewalProof } from "./service-renewal.js";
 import { openAuthLedgerScannerCandidate } from "./ledger-scanner.js";
 import { openRecordsScannerCandidate } from "./records-scanner.js";
 import { acquirePlaneClaim, makeDeliveryAdminPlaneOracle, makeDeliveryAdminPrincipalOracle, scannerDeathCopy, planeClaimRefusal } from "./plane-claim.js";
@@ -97,16 +103,21 @@ import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-b
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
 import { serializedFor } from "./serialized.js";
+import { RunCancelObservations } from "./run-cancel-observation.js";
+import { readCancellationAdmission } from "@cotal-ai/core";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
-import { AGENT_BEARER_TTL_SEC, assertWithinSpawnerGrant, findInteractiveActor, findManagedActor, findActorUnified, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, revokeManagedActorAt, } from "./ledger.js";
+import { AGENT_BEARER_TTL_SEC, assertWithinSpawnerGrant, findInteractiveActor, findManagedActor, findActorUnified, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, revokeManagedActorIf, withManagedGrantTransaction, } from "./ledger.js";
 import { AUTH_PROVIDER_NAME, claimAuthInstanceIdentity, clearAuthServiceInfo, dataAccountAuth, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
 export const JWKS_MAX_AGE_SEC = 300;
 /** Loopback-only operator route used by `cotal actor grant/revoke` before rotating or deleting an interactive lifecycle. */
 export const INTERACTIVE_RETIRE_PATH = "/interactive-lifecycle/retire";
+/** The user-mode chat-session routes, on the loopback face (capability-gated) and the public face.
+ *  Each takes a fresh IdP proof; `bearer` and `retire` also take the session's holder proof. */
+export const CHAT_SESSION_PATHS = Object.freeze({ open: "/chat-session/open", bearer: "/chat-session/bearer", retire: "/chat-session/retire" });
 /** Loopback-only host route that finishes a managed lifecycle's terminal retirement after the host
  *  revoked its grant, when the remote manager that should have requested it is gone (#2070). */
 export const MANAGED_RETIRE_PATH = "/managed-lifecycle/retire";
@@ -227,6 +238,14 @@ async function supervisorGeneration(session, space, owner, instanceId, lifecycle
         throw new EpEnvelopeError("permission-denied", "platform supervisor accepted row names another owner or lifecycle");
     return accepted.ref;
 }
+function runtimeSelection(options) {
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        throw new Error("auth-service runtime options must be an object");
+    const selection = options.interactiveManagerSelection;
+    if (selection !== undefined && selection !== "local-primary")
+        throw new Error('interactiveManagerSelection must be "local-primary" when present');
+    return selection;
+}
 /**
  * Open the authority plane — the PRODUCTION connect/exchange composition (exported so the live
  * deny-new smoke exercises exactly what the daemon runs). Boot order is the readiness contract:
@@ -242,6 +261,28 @@ async function supervisorGeneration(session, space, owner, instanceId, lifecycle
 export async function openAuthAuthorityPlane(opts) {
     return await openAuthAuthorityPlaneWithCustody(opts);
 }
+/** The hosted door over a plane's service endpoint host: refused before entry unless the context is
+ *  ready, and mapped to the same engine so the internal accessor still finds it. */
+function hostedServiceEndpoints(host, ready) {
+    const door = async (request) => { ready(); return await host(request); };
+    const engine = SERVICE_HOST_ENGINES.get(host), callout = SERVICE_CALLOUTS.get(host);
+    if (engine !== undefined)
+        SERVICE_HOST_ENGINES.set(door, engine);
+    if (callout !== undefined)
+        SERVICE_CALLOUTS.set(door, callout);
+    return door;
+}
+/** Package-internal (not exported from the package index): the engine behind a plane's service
+ *  endpoint host, whose register admission only a later owner-verifying route may call. */
+const SERVICE_HOST_ENGINES = new WeakMap();
+export function serviceHostEngineOf(host) {
+    return SERVICE_HOST_ENGINES.get(host);
+}
+/** Package-internal: the native service callout authority composed with a plane's service host. */
+const SERVICE_CALLOUTS = new WeakMap();
+export function serviceHostCalloutOf(host) {
+    return SERVICE_CALLOUTS.get(host);
+}
 /** The context's custody callback is private. Failed construction unwinds from one place. */
 async function openAuthAuthorityPlaneWithCustody(opts, onConnection) {
     const unwind = [];
@@ -256,7 +297,9 @@ async function openAuthAuthorityPlaneWithCustody(opts, onConnection) {
 }
 /** The body of the plane opener, which owns the unwind of a failed construction. */
 async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
+    const interactiveManagerSelection = runtimeSelection(opts);
     const { server, space, dataAccount, log } = opts;
+    const cancelObservations = new RunCancelObservations(space, opts.runCancelLimits);
     const standingTtl = opts.standingRenewableTtlSeconds ?? STANDING_RENEWABLE_TTL_SEC;
     if (!Number.isSafeInteger(standingTtl) || standingTtl < 5 || standingTtl > STANDING_RENEWABLE_TTL_SEC) {
         throw new Error(`standingRenewableTtlSeconds must be an integer between 5 and ${STANDING_RENEWABLE_TTL_SEC} seconds (got ${standingTtl})`);
@@ -354,12 +397,17 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     // Mid-life disconnect = the FENCING event (security req: an owned scanner that dies must not
     // leave the plane half-running). First death wins: fence the guard with the ux state-3 copy,
     // close the sibling so a successor's reclaim isn't blocked by a half-dead pair, log loud.
+    let serviceHost;
     const fenceOnDeath = (role, sibling) => {
-        if (closing)
-            return;
         const copy = scannerDeathCopy(space, role);
+        // A closing plane does not go fatal, but a service host call it is still draining stops here.
+        if (closing) {
+            serviceHost?.trip(copy);
+            return;
+        }
         hold?.fence(copy);
         fatalReason = fatalReason ?? copy;
+        serviceHost?.trip(copy);
         fireFatal(copy);
         log(`auth-plane: ${copy}`);
         void sibling().catch(() => { });
@@ -435,11 +483,20 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     unwind.push(() => authAdmin.close());
     const recordToolResultConsent = makeToolResultConsentRecorder(registryStores(registry).authKv, () => refuseIfFenced(), space);
     const fileArm = ledgerAuthorizeConnect(opts.dir);
+    // A chat principal (its alias is in the chat row space) is checked by the chat arm: its active
+    // row, its parent pin and its holder index. Every other principal by the grant-file arm.
+    const connectArm = async (t) => {
+        if (chat.isChatPrincipal(t.owner, t.act.actor))
+            await chat.authorizeConnect(t);
+        else
+            fileArm(t);
+    };
     // The callout's issuance evidence: create-only natkey row, then the connect authority re-read
-    // in the same stream before the minted JWT may leave.
+    // in the same stream before the minted JWT may leave. For a chat session this re-read is the
+    // post-sign fence: its own head and root credential, its parent pin and its holder index.
     const recordIssuance = makeNativeIssuanceRecorder(registry, async (t) => {
         refuseIfFenced();
-        fileArm(t);
+        await connectArm(t);
         await authorizeConnectCredential(reader.current(), t, Date.now);
     });
     // Expired evidence goes at boot (a failure refuses the open) and then on the plane's own timer;
@@ -455,11 +512,15 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return;
         pruneTimer = setTimeout(() => {
             pruneFlight = pruneNativeIssuance(registry, Math.floor(Date.now() / 1000)).then(schedulePrune, (e) => {
-                if (closing)
-                    return;
                 const copy = `native-issuance cleanup failed: ${e instanceof Error ? e.message : String(e)}`;
+                // As for a scanner death: a closing plane does not go fatal, but a call it is draining stops.
+                if (closing) {
+                    serviceHost?.trip(copy);
+                    return;
+                }
                 hold?.fence(copy);
                 fatalReason = fatalReason ?? copy;
+                serviceHost?.trip(copy);
                 fireFatal(copy);
                 log(`auth-plane: ${copy}`);
             });
@@ -468,6 +529,84 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     const stopPrune = async () => { clearTimeout(pruneTimer); await pruneFlight; };
     unwind.push(async () => { closing = true; await stopPrune(); });
     schedulePrune();
+    // The service endpoint host, default off. Its discovery client only reads, on the ordinary
+    // renewing profile: a broker loss makes its reads fail until it reconnects, and a renewal failure
+    // closes it for good, after which decide and revoke answer unavailable until the plane is opened
+    // again. The engine shares this plane's hold; both fatal sites above trip it.
+    let discoveryClient, calloutWriter;
+    // Every effect connection the host opened whose close has not succeeded, kept past its call's
+    // settlement: plane close and a failed construction close it again and fail while any remains.
+    const openEffects = new Set();
+    const closeEffects = async () => {
+        const failed = [];
+        for (const e of [...openEffects]) {
+            try {
+                await e.close();
+            }
+            catch (err) {
+                failed.push(err);
+            }
+        }
+        if (failed.length > 0)
+            throw new AggregateError(failed, `${failed.length} service host effect connection(s) did not close`);
+    };
+    if (opts.serviceEndpoints !== undefined) {
+        const label = `cotal:service-host-discovery:${space}`;
+        const d = discoveryClient = await openAuthorityClient({ onConnection, server, space, dataAccount, label, grants: (id) => serviceHostDiscoveryGrants(space, id), log,
+            onRenewalFailure: () => {
+                log(`${label}: credential renewal failed - service host discovery is closed until the auth plane is opened again`);
+                void discoveryClient?.close().catch(() => { });
+            } });
+        unwind.push(() => d.close());
+        unwind.push(() => closeEffects());
+        const discovery = await openLifecycleRegistry(d.nc, space);
+        await opts.probeServiceHost?.discovery?.({ registry: discovery, kill: () => d.close() });
+        const probeEffect = opts.probeServiceHost?.effect;
+        // Serving reads registered closures from the contract store on the issuer's connection, which
+        // holds only the store's exact-subject Direct Get.
+        const contractStore = await contractStoreContext(remoteIssuer.nc, space);
+        const readContractArtifact = async (digest) => {
+            const bytes = await fetchContractArtifact(contractStore, contractRefToHex(digest));
+            if (!bytes)
+                throw new EpEnvelopeError("failed-precondition", `the registered contract artifact ${digest} is not readable`);
+            return JSON.parse(new TextDecoder().decode(bytes));
+        };
+        const engine = await openServiceHostOperations({
+            discovery, hold: hold, accountPublicKey: dataAccount.pub, ledgerDir: opts.dir, startup: opts.serviceEndpoints.startup,
+            serving: { readContractArtifact },
+            openEffect: async (scope) => {
+                const opened = await openServiceHostEffect({ onConnection, server, space, dataAccount, log }, scope);
+                const effect = { ...opened, close: async () => { await opened.close(); openEffects.delete(effect); } };
+                openEffects.add(effect);
+                if (probeEffect !== undefined) {
+                    try {
+                        await probeEffect(effect, scope);
+                    }
+                    catch (e) {
+                        await effect.close().catch(() => { });
+                        throw e;
+                    }
+                }
+                return effect;
+            },
+        });
+        unwind.push(() => engine.close());
+        serviceHost = engine;
+        SERVICE_HOST_ENGINES.set(engine.handle, engine);
+        // A fence while the engine was opening latches it now.
+        if (fatalReason !== undefined)
+            engine.trip(fatalReason);
+        // The native service callout: a service bearer's connect mints only for the current bound
+        // assignment its witness names, read from the engine, on a writer that stages and touches the
+        // endpoint gate and credential rows. A fenced plane or a latched engine refuses it.
+        const calloutLabel = `cotal:service-callout:${space}`;
+        const cw = calloutWriter = await openAuthorityClient({ onConnection, server, space, dataAccount, label: calloutLabel, grants: (id) => serviceCalloutWriterGrants(space, id), log });
+        unwind.push(() => cw.close());
+        SERVICE_CALLOUTS.set(engine.handle, createNativeServiceCalloutAuthority({
+            registry: await openLifecycleRegistry(cw.nc, space), reader: () => reader.current(), dataAccount,
+            resolveAssignment: (witness) => engine.serviceBinding(witness), readClusterArtifact: readContractArtifact, assertOpen: () => refuseIfFenced(),
+        }));
+    }
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
     const authKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
     const managerIssuanceGate = (instanceId) => serveIssuanceGateKv(authKv, space, { endpoint: "manager", instanceId });
@@ -561,6 +700,24 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 throw new Error(`manager instance ${instanceId} is ${verdict}`);
             return instanceId;
         }
+        // A trusted host may choose the local Manager up front for human defaults. Explicit pins
+        // above and managed-agent calls keep their existing selection; no remote is a substitute.
+        if (caller === "human" && interactiveManagerSelection === "local-primary") {
+            let local;
+            try {
+                local = loadLocalManager();
+            }
+            catch {
+                throw new Error("interactive local-primary manager identity could not be read");
+            }
+            if (!local)
+                throw new Error("interactive local-primary manager identity is absent");
+            const instanceId = assertLifecycleToken(local.instanceId, "managerInstanceId");
+            const verdict = await managerGate(owner, instanceId);
+            if (verdict !== "candidate")
+                throw new Error(`interactive local-primary manager instance ${instanceId} is ${verdict}`);
+            return instanceId;
+        }
         const { instances } = await listManagerInstances(owner);
         const remoteInstances = instances.filter((i) => i.placement === "remote").map((i) => i.instanceId);
         const remoteLive = instances.filter((i) => i.placement === "remote" && i.state === "candidate").map((i) => i.instanceId);
@@ -593,6 +750,12 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     // envelope asked (SPEC 14.8): the forward's coordinates are the manager's word. The manager
     // forwards from inside the handler serving the request, so an observation older than the window
     // has no forward left to bind; the window also bounds the table.
+    remoteIssuer.nc.subscribe(servedRunCancelRequestSubject(space), {
+        callback: (error, message) => {
+            if (!error)
+                cancelObservations.observe(message.subject, message.data);
+        },
+    });
     const observedRunRequests = new Map();
     for (const subject of servedRunRequestSubjects(space))
         remoteIssuer.nc.subscribe(subject, {
@@ -626,12 +789,94 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         const creds = await mintCreds(issuerAuth(), newIdentity(), "deprovisioner", { deprovisionTarget: { principal: targetId, lifecycleUid, memberChannels } });
         await deprovisionAgent({ servers: server, space, targetId, lifecycleUid, memberChannels, creds });
     };
+    // A chat session's footprint (admission a7): its own bind-only DM and DELIVER durables and the
+    // read-ACL row the delivery daemon authorizes its history and durable joins from, written by a
+    // short-lived provisioner and read back on that same connection (part of a8).
+    const provisionChatFootprint = async ({ owner, actor, lifecycleUid, read }) => {
+        const identity = newIdentity();
+        let conn;
+        const provisioner = new CotalEndpoint({
+            space,
+            servers: server,
+            onConnection: (nc) => { conn = nc; onConnection?.(nc, `cotal:chat-provisioner:${space}`); },
+            channels: [],
+            creds: await mintCreds(issuerAuth(), identity, "provisioner"),
+            card: { id: identity.id, name: "provisioner", role: "provisioner", kind: "endpoint" },
+            registerPresence: false,
+            watchPresence: false,
+            watchChannels: false,
+            consume: false,
+        });
+        await provisioner.start();
+        try {
+            await provisionAgentDurables(provisioner, { owner, actor, lifecycleUid }, { subscribe: [], allowSubscribe: read });
+            if (conn === undefined)
+                throw new EpEnvelopeError("unavailable", "the chat provisioner connection is unavailable for the read-back", undefined, "unknown");
+            const jsm = await jetstreamManager(conn);
+            await jsm.consumers.info(dmStream(space), dmDurable(owner, actor, lifecycleUid));
+            await jsm.consumers.info(dlvStream(space), dlvDurable(owner, actor, lifecycleUid));
+            const acl = await provisioner.aclForOwner(principalKey(owner, actor).key, lifecycleUid);
+            if (acl === undefined || JSON.stringify(acl) !== JSON.stringify(read))
+                throw new EpEnvelopeError("unavailable", `the chat session's read-ACL row did not read back for ${lifecycleUid}`, undefined, "unknown");
+        }
+        finally {
+            await provisioner.stop();
+        }
+    };
+    const chat = openChatSessionAuthority({
+        space,
+        dir: opts.dir,
+        registry,
+        managerInstance: `auth-service:${space}`,
+        retireLifecycle: async ({ owner, actor, lifecycleUid, opId }) => {
+            const flight = joinOrStartRetirement(retirementFlights, barrierReg, { owner, actor, lifecycleUid, opId, frontierStreams: retirementFrontierStreams(space) }, retirement);
+            if (flight === undefined)
+                throw new EpEnvelopeError("conflict", `chat retirement operation ${opId} is already in flight for different coordinates`);
+            await flight;
+        },
+        provisionFootprint: provisionChatFootprint,
+        deprovisionFootprint: ({ owner, actor, lifecycleUid, memberChannels }) => deprovisionManagedFootprint(owner, actor, lifecycleUid, memberChannels),
+        now: Date.now,
+        log,
+    });
+    // One bounded chat sweep pass per interval. A failed pass is logged and the next one retries; it
+    // never fences the plane, because every chat authority decision re-reads its own records.
+    const chatSweepMs = opts.chatSweepMs ?? 60_000;
+    if (!Number.isSafeInteger(chatSweepMs) || chatSweepMs < 100 || chatSweepMs > 3_600_000)
+        throw new Error(`chatSweepMs must be an integer between 100 and 3600000 (got ${chatSweepMs})`);
+    let chatSweepTimer;
+    let chatSweepFlight = Promise.resolve();
+    const scheduleChatSweep = () => {
+        if (closing || fatalReason !== undefined)
+            return;
+        chatSweepTimer = setTimeout(() => {
+            chatSweepFlight = chat.sweepPass().catch((e) => {
+                if (!closing)
+                    log(`auth-plane: chat sweep pass failed: ${e instanceof Error ? e.message : String(e)}`);
+            }).then(scheduleChatSweep);
+        }, chatSweepMs);
+    };
+    const stopChatSweep = async () => { clearTimeout(chatSweepTimer); await chatSweepFlight; };
+    unwind.push(async () => { closing = true; await stopChatSweep(); });
+    scheduleChatSweep();
     return {
         authorizeConnect: async (t) => {
             refuseIfFenced();
-            fileArm(t);
+            await connectArm(t);
             await authorizeConnectCredential(reader.current(), t, Date.now);
         },
+        openChatSession: async (args) => {
+            refuseIfFenced();
+            return chat.admit(args);
+        },
+        chatSessionBearer: async (args) => {
+            refuseIfFenced();
+            return chat.exchange(args);
+        },
+        retireChatSession: async (args) => {
+            refuseIfFenced();
+            return chat.retire(args);
+        },
         recordIssuance: (i) => {
             refuseIfFenced();
             return recordIssuance(i);
@@ -696,11 +941,18 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             }, principal, claim);
         },
         retireInteractiveLifecycle: async (args) => {
-            refuseIfFenced();
-            const owner = assertDerivedOwnerToken(args.owner);
-            const actor = assertValidOwnerToken(args.actor);
-            const lifecycleUid = assertLifecycleToken(args.lifecycleUid);
-            const head = await readLifecycleHeadForOperation(barrierReg, owner, actor);
+            // Everything before the barrier only reads, so a refusal there retired nothing.
+            let owner, actor, lifecycleUid;
+            try {
+                refuseIfFenced();
+                owner = assertDerivedOwnerToken(args.owner);
+                actor = assertValidOwnerToken(args.actor);
+                lifecycleUid = assertLifecycleToken(args.lifecycleUid);
+            }
+            catch (e) {
+                throw notExecuted(e, "bad-request");
+            }
+            const head = await readLifecycleHeadForOperation(barrierReg, owner, actor).catch((e) => { throw notExecuted(e, "unavailable"); });
             if (head === undefined)
                 return { retired: false, lifecycleUid, notStarted: true };
             if (head.mapping.lifecycleUid !== lifecycleUid) {
@@ -709,7 +961,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 // An active/retiring foreign uid is different: the ledger and authority disagree, so fail.
                 if (head.mapping.state === "retired")
                     return { retired: false, lifecycleUid, notStarted: true };
-                throw new EpEnvelopeError("conflict", `interactive lifecycle retirement for "${owner}/${actor}" names ${lifecycleUid}, but the authority head is ${head.mapping.state} at ${head.mapping.lifecycleUid}`);
+                throw new EpEnvelopeError("conflict", `interactive lifecycle retirement for "${owner}/${actor}" names ${lifecycleUid}, but the authority head is ${head.mapping.state} at ${head.mapping.lifecycleUid}`, undefined, "not-executed");
             }
             if (head.mapping.state === "retired")
                 return { retired: true, lifecycleUid, alreadyRetired: true };
@@ -1157,31 +1409,48 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             const t = r.target;
             const subscribe = t.subscribe ?? [];
             const { lifecycleUid, row } = await serializedForAlias(opts.dir, owner, t.actor, async () => {
-                // The token digest names one enrollment. A held row with this request's digest is that
-                // enrollment retried, so it answers the same uid; any other held row is a lifecycle that
-                // still runs, and taking its grant would strand it.
-                const held = findManagedActor(opts.dir, owner, t.actor);
-                if (held !== undefined && held.tokenHash !== t.tokenHash)
-                    throw new EpEnvelopeError("conflict", `managed agent "${t.actor}" is enrolled at lifecycle ${held.lifecycleUid}; prepare that lifecycle's retirement before enrolling a successor`);
-                // A fresh uid is never one a retirement tombstoned, and only the host can make that promise.
-                const lifecycleUid = held?.lifecycleUid ?? mintLifecycleUid();
-                // The grant first: its envelope walk against the supervising actor refuses an over-wide
-                // request before any durable exists. A retry walks the held grant again: its spawner chain
-                // may have narrowed since the first answer, and provisioning would restore what it took away.
-                if (held !== undefined)
-                    assertWithinSpawnerGrant(opts.dir, held, "spawn");
-                const row = held ?? grantManagedActor(opts.dir, {
-                    owner,
-                    actor: t.actor,
-                    scope: t.capabilities ?? [],
-                    allowSubscribe: t.allowSubscribe ?? [],
-                    allowPublish: t.allowPublish ?? [],
-                    ...(t.role !== undefined ? { role: t.role } : {}),
-                    ...(t.label !== undefined ? { label: t.label } : {}),
-                    parent: principalKey(owner, r.actor).key,
-                    lifecycleUid,
-                    tokenHash: t.tokenHash,
+                // The custody this enrollment attests: the instance the authorized request names, checked
+                // against its current registration above. Never a field of the participant's target.
+                const custody = { kind: "remote-manager", instanceId: r.instanceId };
+                // ONE synchronous transaction for the read, the decision and the write, so an
+                // enrollment in another process (or a provider grant) cannot land between them.
+                const decided = withManagedGrantTransaction(opts.dir, (tx) => {
+                    const current = tx.read(owner, t.actor);
+                    const held = current?.kind === "managed-agent" ? current : undefined;
+                    // The token digest names one enrollment. A held row with this request's digest is that
+                    // enrollment retried, so it answers the same uid; any other held row is a lifecycle that
+                    // still runs, and taking its grant would strand it.
+                    if (held !== undefined && held.tokenHash !== t.tokenHash)
+                        throw new EpEnvelopeError("conflict", `managed agent "${t.actor}" is enrolled at lifecycle ${held.lifecycleUid}; prepare that lifecycle's retirement before enrolling a successor`);
+                    // A retry is this enrollment only if the held row records this exact custody. A row with
+                    // none, or with another, is never upgraded or adopted here.
+                    if (held !== undefined && (held.custody === undefined || !sameManagedGrantCustody(held.custody, custody)))
+                        throw new EpEnvelopeError("conflict", `managed agent "${t.actor}" is held at lifecycle ${held.lifecycleUid} under another custody; it was not adopted by this enrollment`);
+                    // A retry walks the held grant again: its spawner chain may have narrowed since the
+                    // first answer, and provisioning would restore what it took away.
+                    if (held !== undefined) {
+                        assertWithinSpawnerGrant(opts.dir, held, "spawn");
+                        return { lifecycleUid: held.lifecycleUid, row: held, wrote: false };
+                    }
+                    // A fresh uid is never one a retirement tombstoned, and only the host can make that
+                    // promise. The grant's envelope walk refuses an over-wide request before any durable exists.
+                    const lifecycleUid = mintLifecycleUid();
+                    const row = tx.grantManaged({
+                        owner,
+                        actor: t.actor,
+                        scope: t.capabilities ?? [],
+                        allowSubscribe: t.allowSubscribe ?? [],
+                        allowPublish: t.allowPublish ?? [],
+                        ...(t.role !== undefined ? { role: t.role } : {}),
+                        ...(t.label !== undefined ? { label: t.label } : {}),
+                        parent: principalKey(owner, r.actor).key,
+                        lifecycleUid,
+                        tokenHash: t.tokenHash,
+                        custody,
+                    });
+                    return { lifecycleUid, row, wrote: true };
                 });
+                const { lifecycleUid, row } = decided;
                 try {
                     const identity = newIdentity();
                     const provisioner = new CotalEndpoint({
@@ -1207,9 +1476,10 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 catch (e) {
                     // A retried enrollment's first answer may already have reached the participant, so its
                     // grant stays. A grant this call wrote gave the participant no uid, so it can never be
-                    // retired: it and any durable it got must go now.
-                    if (held === undefined) {
-                        revokeManagedActorAt(opts.dir, owner, t.actor, lifecycleUid);
+                    // retired: it and any durable it got must go now. The revoke removes only the row this
+                    // call wrote: same uid AND same custody, read under the grant lock.
+                    if (decided.wrote) {
+                        revokeManagedActorIf(opts.dir, owner, t.actor, { lifecycleUid, custody });
                         await deprovisionManagedFootprint(owner, t.actor, lifecycleUid, []).catch((err) => opts.log(`auth-service: refused enrollment of ${owner}/${t.actor} left durables at ${lifecycleUid}: ${err instanceof Error ? err.message : String(err)}`));
                     }
                     throw e;
@@ -1249,8 +1519,17 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 const row = findManagedActor(opts.dir, owner, actor);
                 if (row?.lifecycleUid === lifecycleUid) {
                     // Footprint before grant: while the row stands, a retry still knows which channels to purge.
+                    // The footprint work is async, so it runs outside the grant lock.
                     await deprovisionManagedFootprint(owner, actor, lifecycleUid, row.allowSubscribe.filter(isConcreteChannel));
-                    revokeManagedActorAt(opts.dir, owner, actor, lifecycleUid);
+                    // The decision and the write are one transaction: the row removed is the one read above
+                    // only if it still names this uid and the custody it carried then. A row written before
+                    // custody existed is removed by uid alone, as before.
+                    withManagedGrantTransaction(opts.dir, (tx) => {
+                        if (row.custody !== undefined)
+                            tx.revokeManagedIf(owner, actor, { lifecycleUid, custody: row.custody });
+                        else
+                            tx.revokeManagedAt(owner, actor, lifecycleUid);
+                    });
                 }
             });
             return {
@@ -1301,6 +1580,34 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 observeManagerGate: observeLegacyManagerGate,
             });
         },
+        submitManagerRun: async ({ request, ...holder }) => {
+            refuseIfFenced();
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'keyed run submission needs scope "supervise"');
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, session => handleRemoteRunSubmission({
+                request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
+                observeManagerGate: observeLegacyManagerGate, issued: session.store, sourceIsLive: composedSourceIsLive(session),
+                takeObserved: takeObservedRunRequest,
+                registeredCommand: async (instanceId, registrationRevision, command) => {
+                    const registered = remoteManagerSurface(await registeredManagerCluster(owner, instanceId, { registrationRevision }))[command];
+                    if (!registered)
+                        throw new EpEnvelopeError("failed-precondition", "registered manager has no keyed contract");
+                    return registered;
+                },
+                withStore: async (runId, submission, work) => {
+                    const nc = await connect({ servers: server, ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId, submission }, expiresInSeconds: 60 }), tls: false,
+                        }), maxReconnectAttempts: 0 });
+                    onConnection?.(nc, `cotal:keyed-admitter:${space}`);
+                    try {
+                        return await work(await new Kvm(nc).open(admissionBucket(space)), await jetstreamManager(nc));
+                    }
+                    finally {
+                        await nc.drain().catch(() => nc.close());
+                    }
+                },
+            }));
+        },
         admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const { owner } = holder;
@@ -1333,6 +1640,46 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 }
             });
         },
+        cancelManagerRun: async ({ request, ...holder }) => {
+            refuseIfFenced();
+            const req = parseRemoteRunCancelRequest(request);
+            requireManagerAuthorityHolder(holder, req.instanceId, 'manager run cancellation needs scope "supervise"');
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, session => handleRemoteRunCancel({
+                request: req, owner: holder.owner, space, endpoint: "manager", accountPublicKey: dataAccount.pub,
+                proofSecret: dataAccount.signingSeed, observeManagerGate: observeLegacyManagerGate,
+                observations: cancelObservations, flush: () => remoteIssuer.nc.flush(), assertServing: refuseIfFenced,
+                issued: session.store, sourceIsLive: composedSourceIsLive(session),
+                interactiveScope: async (caller, sources) => {
+                    if (sources.length !== 1 || sources[0].space !== space)
+                        return undefined;
+                    const source = parseActorLedgerSource(sources[0]);
+                    if (!source || source.owner !== caller.owner || source.actor !== caller.actor || source.lifecycleUid !== caller.uid)
+                        return undefined;
+                    const row = findActorUnified(opts.dir, caller.owner, caller.actor);
+                    return row?.kind === "interactive" && row.lifecycleUid === caller.uid ? [...row.scope] : undefined;
+                },
+                registeredCommand: async (instanceId, registrationRevision, command) => {
+                    const registered = remoteManagerSurface(await registeredManagerCluster(holder.owner, instanceId, { registrationRevision }))[command];
+                    if (!registered)
+                        throw new EpEnvelopeError("failed-precondition", "registered manager has no run-cancel contract");
+                    return registered;
+                },
+                readAdmission: runId => readCancellationAdmission(recordsJsm, space, "manager", runId),
+                readRevocation: runId => readRunRevocation(recordsJsm, space, "manager", runId),
+                withStore: async (runId, work) => {
+                    const nc = await connect({ servers: server, ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }), tls: false,
+                        }), maxReconnectAttempts: 0 });
+                    onConnection?.(nc, `cotal:run-cancel:${space}`);
+                    try {
+                        return await work(await new Kvm(nc).open(admissionBucket(space)));
+                    }
+                    finally {
+                        await nc.drain().catch(() => nc.close());
+                    }
+                },
+            }));
+        },
         revokeManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const req = parseRemoteRunRevokeRequest(request);
@@ -1502,13 +1849,24 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return await serveIssuanceGateKv(authKv, space, { endpoint, instanceId }).observe();
         },
         fenced,
+        ...(serviceHost !== undefined ? { serviceEndpointHost: serviceHost.handle } : {}),
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
             // clients down, then `held → released` (never released while either scanner can still
             // act), then the barrier that wrote it. An unreachable release keeps the barrier alive
             // for a later close retry; successful scanner teardown is not run a second time.
             closing = true;
+            // Before the first await: no service host call enters once close has begun.
+            serviceHost?.refuse();
             await stopPrune();
+            await stopChatSweep();
+            // Every service host call that entered returns, discovery and effects included, then every
+            // effect connection that did not close is closed again, before discovery closes and before
+            // the claim is released. A failure here rejects with the claim still held; close retries it.
+            await serviceHost?.close();
+            await closeEffects();
+            await calloutWriter?.close();
+            await discoveryClient?.close();
             const scannerFlight = closeScanners ??= (async () => {
                 await authAdmin?.close();
                 const results = await Promise.allSettled([reader.close(), recordsScanner.close(), scanner.close()]);
@@ -1609,19 +1967,8 @@ async function resumeOpenOperations(reg, evictPrincipal, retirement, log) {
         }
     }
 }
-/** Run the auth service. Flags: `--space` (required), `--server` (broker URL, required), `--port`
- *  (loopback HTTP port; default ephemeral). All persisted material must already exist (the
- *  provider's `prepareServer` ran at `cotal up`) — a missing piece is a fail-loud config error
- *  naming the fix, never a silent partial service; this daemon LOADS the four secret kinds and
- *  never generates them.
- *
- *  `store` is the hosted composition's injection point for the space's SECRET material (callout
- *  account, issuer keys, owner secret, service key projection) — when given, it is those kinds'
- *  ONLY source (no flag or path can point this daemon at other secret material; an absent key is
- *  the hard error below). Absent, the daemon composes the local workspace store over `.cotal/`.
- *  NON-SEAM state (the actor ledger, the IdP pin, the discovery file) still lives in the local
- *  state dir either way — hosting those is a later, separate seam. */
-export async function runAuthService(args, store) {
+/** Pure native daemon input validation, shared with its explicit service launch plan. */
+export function authServiceConfiguration(args) {
     const v = args.values;
     const space = v.space;
     if (!space)
@@ -1652,9 +1999,27 @@ export async function runAuthService(args, store) {
     const badFace = publicFace && checkPublicFace(publicFace);
     if (badFace)
         throw new Error(badFace);
+    return { space, server, port, publicFace };
+}
+/** Run the auth service. Flags: `--space` (required), `--server` (broker URL, required), `--port`
+ *  (loopback HTTP port; default ephemeral). All persisted material must already exist (the
+ *  provider's `prepareServer` ran at `cotal up`) — a missing piece is a fail-loud config error
+ *  naming the fix, never a silent partial service; this daemon LOADS the four secret kinds and
+ *  never generates them.
+ *
+ *  `store` is the hosted composition's injection point for the space's SECRET material (callout
+ *  account, issuer keys, owner secret, service key projection) — when given, it is those kinds'
+ *  ONLY source (no flag or path can point this daemon at other secret material; an absent key is
+ *  the hard error below). Absent, the daemon composes the local workspace store over `.cotal/`.
+ *  NON-SEAM state (the actor ledger, the IdP pin, the discovery file) still lives in the local
+ *  state dir either way — hosting those is a later, separate seam. */
+export async function runAuthService(args, store, options = {}) {
+    const interactiveManagerSelection = runtimeSelection(options);
+    const lifecycle = "root" in options ? options : undefined;
+    const { space, server, port, publicFace } = authServiceConfiguration(args);
     // The provider's space-scoped state dir for NON-SEAM material (ledger, IdP pin, discovery). The
     // layout fact is workspace-owned (userAuthStateDir); this daemon never touches `.cotal/auth/auth.json`.
-    const root = findCotalRoot();
+    const root = lifecycle?.root ?? findCotalRoot();
     const dir = userAuthStateDir(root, space);
     const secrets = store ?? workspaceSecretStore(root);
     // Scrub any stale discovery file FIRST — a dead prior daemon's entry must never satisfy a
@@ -1686,25 +2051,44 @@ export async function runAuthService(args, store) {
         // The CLI composition's local manager is this workspace root's persisted instance, re-read per
         // selection exactly as before. A hosted context passes no local manager at all.
         localManager: () => loadManagerInstanceIdentity(root, space),
+        ...(interactiveManagerSelection !== undefined ? { interactiveManagerSelection } : {}),
+        ...(options.runCancelLimits !== undefined ? { runCancelLimits: options.runCancelLimits } : {}),
     });
     // All planes bound — NOW write the discovery file (its existence is the readiness signal).
     const { url, publicUrl, cap } = started.handle;
     saveAuthServiceInfo(dir, { url, pid: process.pid, cap, ...(publicUrl !== undefined ? { publicUrl } : {}) });
-    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${url}${publicUrl !== undefined ? `, public exchange at ${publicUrl}` : ""}`);
+    if (!lifecycle?.quiet)
+        console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${url}${publicUrl !== undefined ? `, public exchange at ${publicUrl}` : ""}`);
     // The CLI wrapper, not the context, owns process signals and exit codes.
-    const stop = async () => {
+    let stopping;
+    const stop = () => stopping ??= (async () => {
         clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
         try {
             await started.handle.close();
+            await lifecycle?.onClosed();
         }
         catch (e) {
-            console.error(`✗ auth-service: ${e.message} - exiting`);
+            console.error(lifecycle ? "✗ native auth-service shutdown did not confirm completion; custody was retained" : `✗ auth-service: ${e.message} - exiting`);
             process.exit(1);
         }
         process.exit(0);
-    };
+    })();
     process.on("SIGINT", () => void stop());
     process.on("SIGTERM", () => void stop());
+    if (lifecycle) {
+        try {
+            await lifecycle.onReady();
+        }
+        catch {
+            clearAuthServiceInfo(dir);
+            try {
+                await started.handle.close();
+                await lifecycle.onClosed();
+            }
+            catch { /* Unknown close keeps custody. */ }
+            throw new Error("the native auth-service startup receipt was not published; no new launch was retried");
+        }
+    }
     // A dropped broker connection is fatal-loud, not a zombie: the supervising `up`/`down` lifecycle
     // owns restarts, and a callout that silently stopped answering would hang every user connect.
     // A FENCED plane is equally fatal (SPEC 13.13): its scanners are no longer whole, every authority
@@ -1713,13 +2097,14 @@ export async function runAuthService(args, store) {
     const ended = await started.ended;
     clearAuthServiceInfo(dir);
     if (ended.kind === "fenced") {
-        console.error(`✗ auth-service: ${ended.cause} - exiting`);
+        console.error(lifecycle ? "✗ native auth-service authority was fenced; custody was retained" : `✗ auth-service: ${ended.cause} - exiting`);
         process.exit(1);
     }
     if (ended.cause !== undefined) {
-        console.error(`✗ auth-service: broker connection closed (${ended.cause}) - exiting`);
+        console.error(lifecycle ? "✗ native auth-service broker connection closed; custody was retained" : `✗ auth-service: broker connection closed (${ended.cause}) - exiting`);
         process.exit(1);
     }
+    await lifecycle?.onClosed();
     process.exit(0);
 }
 /** Start one account-scoped auth-service context. Every input is explicit: the state dir, the
@@ -1772,6 +2157,7 @@ export async function startAuthService(inputs) {
         ...(inputs.platformSupervisor !== undefined ? { platformSupervisor: inputs.platformSupervisor } : {}),
         ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
         ...(inputs.toolResultConsents !== undefined ? { toolResultConsents: inputs.toolResultConsents } : {}),
+        ...(inputs.serviceEndpoints !== undefined ? { serviceEndpoints: inputs.serviceEndpoints } : {}),
     });
     return { ...started.handle, readiness: () => ({ ...started.status(), context: inputs.context }) };
 }
@@ -1811,7 +2197,10 @@ async function startAuthContext(o) {
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
+        ...(o.interactiveManagerSelection !== undefined ? { interactiveManagerSelection: o.interactiveManagerSelection } : {}),
+        ...(o.runCancelLimits !== undefined ? { runCancelLimits: o.runCancelLimits } : {}),
         ...(o.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: o.standingRenewableTtlSeconds } : {}),
+        ...(o.serviceEndpoints !== undefined ? { serviceEndpoints: o.serviceEndpoints } : {}),
     }, onConnection);
     let nc;
     let http;
@@ -1836,7 +2225,9 @@ async function startAuthContext(o) {
             name: `cotal:auth-service:${space}`,
         });
         onConnection(nc, `cotal:auth-service:${space}`);
+        const serviceCallout = plane.serviceEndpointHost !== undefined ? serviceHostCalloutOf(plane.serviceEndpointHost) : undefined;
         startAuthCallout(nc, {
+            ...(serviceCallout !== undefined ? { serviceAuthority: serviceCallout } : {}),
             xkeySeed: callout.xkey.seed,
             authAccount: { pub: callout.account.pub, signingSeed: callout.account.signingSeed },
             dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
@@ -1844,7 +2235,9 @@ async function startAuthContext(o) {
             token: { key: issuer.localKeySet(), issuer: issuer.issuer },
             authorizeActor: plane.authorizeConnect,
             recordIssuance: plane.recordIssuance,
-            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller, plane.verifySession, plane.issueUserCaller),
+            // A chat principal resolves from its closed row (the agent leaf, no role); every other
+            // principal from the grant ledger.
+            permissionsFor: calloutPermissions(chatAwareAclResolver(dir, ledgerAclResolver(dir)), plane.authorizeManagerCaller, plane.verifySession, plane.issueUserCaller),
             log: (l) => console.error(l),
         });
         // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a
@@ -1859,6 +2252,7 @@ async function startAuthContext(o) {
             issuer,
             authorizeActor: ledgerAuthorizeGrant(dir),
             mintConnectCredential: plane.mintConnectCredential,
+            ...(idp.dmReaderAudience !== undefined ? { dmReaderAudience: idp.dmReaderAudience } : {}),
         });
         const cap = randomBytes(32).toString("hex"); // per-start exchange capability (rotates with the daemon)
         // Set once the public face binds. An enrolled child's bearer exchanges there without the
@@ -1870,8 +2264,10 @@ async function startAuthContext(o) {
             space, accountPublicKey: keys.dataAccount.pub, dir, store: secrets, idp: bridgeIdp, ownerSecret,
             signer: o.toolResultConsents, record: plane.recordToolResultConsent,
         });
+        const serviceEngine = plane.serviceEndpointHost !== undefined ? serviceHostEngineOf(plane.serviceEndpointHost) : undefined;
         const ctx = {
             ...(issueToolResultConsent ? { issueToolResultConsent } : {}),
+            ...(serviceEngine !== undefined ? { serviceAuthority: { space, accountPublicKey: keys.dataAccount.pub, engine: serviceEngine, material: issuer } } : {}),
             issuer,
             bridge,
             bridgeIdp,
@@ -1891,7 +2287,9 @@ async function startAuthContext(o) {
             scanManagerGoalIndex: plane.scanManagerGoalIndex,
             authorizeManagerAdmin: plane.authorizeManagerAdmin,
             admitManagerRun: plane.admitManagerRun,
+            submitManagerRun: plane.submitManagerRun,
             revokeManagerRun: plane.revokeManagerRun,
+            cancelManagerRun: plane.cancelManagerRun,
             issueManagerRunAttempt: plane.issueManagerRunAttempt,
             secrets,
             retireInteractiveLifecycle: plane.retireInteractiveLifecycle,
@@ -1905,6 +2303,9 @@ async function startAuthContext(o) {
             selectManagerInstance: plane.selectManagerInstance,
             listManagerInstances: plane.listManagerInstances,
             verifySession: plane.verifySession,
+            openChatSession: plane.openChatSession,
+            chatSessionBearer: plane.chatSessionBearer,
+            retireChatSession: plane.retireChatSession,
         };
         const loopback = createServer((req, res) => void handle(req, res, ctx));
         http = loopback;
@@ -2073,6 +2474,7 @@ async function startAuthContext(o) {
             cap,
             closed: owned.closed,
             connections: () => owned.connections(),
+            ...(plane.serviceEndpointHost !== undefined ? { serviceEndpointHost: hostedServiceEndpoints(plane.serviceEndpointHost, refuseUnlessReady) } : {}),
             ...(o.platformSupervisor !== undefined ? {
                 platformSupervisorAuthority: async (owner) => {
                     refuseUnlessReady();
@@ -2103,6 +2505,7 @@ async function startAuthContext(o) {
                             case "manager-goal-index-scan": return plane.scanManagerGoalIndex({ ...holder, request });
                             case "manager-admin-authorization": return plane.authorizeManagerAdmin({ ...holder, request });
                             case "manager-run-admission": return plane.admitManagerRun({ ...holder, request });
+                            case "manager-run-submission": return plane.submitManagerRun({ ...holder, request });
                             case "manager-run-attempt": return plane.issueManagerRunAttempt({ ...holder, request });
                             case "manager-retained-agent-validation": return validateRetainedForHolder(holder, request);
                         }
@@ -2199,6 +2602,16 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
         return ctx.authorizeManagerAdmin({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-run-admission")
         return ctx.admitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    if (request.kind === "manager-run-submission") {
+        if (!ctx.submitManagerRun)
+            throw new EpEnvelopeError("unimplemented", "issuing host has no keyed submission handler");
+        return ctx.submitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    }
+    if (request.kind === "manager-run-cancel") {
+        if (!ctx.cancelManagerRun)
+            throw new EpEnvelopeError("unimplemented", "this issuing host has no run-cancel handler");
+        return ctx.cancelManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    }
     if (request.kind === "manager-run-revoke") {
         if (ctx.revokeManagerRun === undefined)
             throw new EpEnvelopeError("unimplemented", "this issuing host has no run revoke handler");
@@ -2283,6 +2696,13 @@ class RequestBodyError extends Error {
         this.status = status;
     }
 }
+/** `e`, raised before any write, as a refusal that states so (SPEC 13.3). An envelope error keeps
+ *  its code; any other error takes `code`. */
+function notExecuted(e, code) {
+    return e instanceof EpEnvelopeError
+        ? new EpEnvelopeError(e.code, e.message, e.details, "not-executed")
+        : new EpEnvelopeError(code, e instanceof Error ? e.message : String(e), undefined, "not-executed");
+}
 function sendRequestError(res, e) {
     if (e instanceof RequestBodyError)
         return send(res, e.status, { error: e.message });
@@ -2306,18 +2726,22 @@ const ROUTES = new Map([
     ["/exchange", (req, res, ctx) => handleExchange(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-service-authority", (req, res, ctx) => handleManagerServiceAuthority(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-instances", (req, res, ctx) => handleManagerInstances(req, res, ctx, LOOPBACK_POLICY)],
+    [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, ctx) => handleServiceEndpointAuthority(req, res, ctx, LOOPBACK_POLICY)],
     [INTERACTIVE_RETIRE_PATH, handleInteractiveLifecycleRetirement],
     [MANAGED_RETIRE_PATH, handleManagedLifecycleRetirement],
     [VERIFY_ENROLLMENT_PATH, handleVerifyManagedAgentEnrollment],
     [TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultHumanProof],
     [TOOL_RESULT_CONSENT_PATH, handleToolResultConsent],
+    [CHAT_SESSION_PATHS.open, (req, res, ctx) => handleChatSession(req, res, ctx, LOOPBACK_POLICY, "open")],
+    [CHAT_SESSION_PATHS.bearer, (req, res, ctx) => handleChatSession(req, res, ctx, LOOPBACK_POLICY, "bearer")],
+    [CHAT_SESSION_PATHS.retire, (req, res, ctx) => handleChatSession(req, res, ctx, LOOPBACK_POLICY, "retire")],
 ]);
 /** Route one HTTP request against the loopback route table. Errors are JSON `{ error }`. */
 async function handle(req, res, ctx) {
     try {
         const route = ROUTES.get(req.url ?? "");
         if (!route)
-            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /manager-service-authority/verify-enrollment, /interactive-lifecycle/retire, /managed-lifecycle/retire" });
+            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /manager-service-authority/verify-enrollment, /interactive-lifecycle/retire, /managed-lifecycle/retire, /chat-session/open, /chat-session/bearer, /chat-session/retire" });
         await route(req, res, ctx);
     }
     catch (e) {
@@ -2325,34 +2749,50 @@ async function handle(req, res, ctx) {
     }
 }
 const INTERACTIVE_RETIRE_KEYS = new Set(["owner", "actor", "lifecycleUid"]);
+/** The interactive retirement door. Every refusal before the barrier starts retired nothing and
+ *  answers `outcome: "not-executed"` (SPEC 13.3), with the plane's native `code` when the plane
+ *  raised it. A failure inside the barrier answers 400 with no outcome, which reads as unknown. */
 async function handleInteractiveLifecycleRetirement(req, res, ctx) {
+    const before = { outcome: "not-executed" };
     if (req.method !== "POST")
-        return send(res, 405, { error: "POST only" });
+        return send(res, 405, { error: "POST only", ...before });
     if (req.headers.origin !== undefined)
-        return send(res, 403, { error: "browser-origin requests are not served here" });
+        return send(res, 403, { error: "browser-origin requests are not served here", ...before });
     if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
-        return send(res, 415, { error: "content-type must be application/json" });
+        return send(res, 415, { error: "content-type must be application/json", ...before });
     if (req.headers.authorization !== `Bearer ${ctx.cap}`)
-        return send(res, 401, { error: "missing/invalid exchange capability - interactive lifecycle retirement is a loopback operator action" });
+        return send(res, 401, { error: "missing/invalid exchange capability - interactive lifecycle retirement is a loopback operator action", ...before });
     const body = await readJsonBody(req);
     if (body === null || typeof body !== "object" || Array.isArray(body))
-        return send(res, 400, { error: "interactive lifecycle retirement needs { owner, actor, lifecycleUid }" });
+        return send(res, 400, { error: "interactive lifecycle retirement needs { owner, actor, lifecycleUid }", ...before });
     for (const key of Object.keys(body))
         if (!INTERACTIVE_RETIRE_KEYS.has(key))
-            return send(res, 400, { error: `interactive lifecycle retirement carries the unknown field "${key}"` });
+            return send(res, 400, { error: `interactive lifecycle retirement carries the unknown field "${key}"`, ...before });
     const raw = body;
     if (typeof raw.owner !== "string" || typeof raw.actor !== "string" || typeof raw.lifecycleUid !== "string")
-        return send(res, 400, { error: "interactive lifecycle retirement needs string { owner, actor, lifecycleUid }" });
-    const owner = assertDerivedOwnerToken(raw.owner);
-    const actor = assertValidOwnerToken(raw.actor);
-    const lifecycleUid = assertLifecycleToken(raw.lifecycleUid);
+        return send(res, 400, { error: "interactive lifecycle retirement needs string { owner, actor, lifecycleUid }", ...before });
+    let owner, actor, lifecycleUid;
+    try {
+        owner = assertDerivedOwnerToken(raw.owner);
+        actor = assertValidOwnerToken(raw.actor);
+        lifecycleUid = assertLifecycleToken(raw.lifecycleUid);
+    }
+    catch (e) {
+        return send(res, 400, { error: e instanceof Error ? e.message : String(e), ...before });
+    }
     const row = findInteractiveActor(ctx.dir, owner, actor);
     if (!row)
-        return send(res, 404, { error: `interactive actor "${owner}/${actor}" is not granted` });
+        return send(res, 404, { error: `interactive actor "${owner}/${actor}" is not granted`, ...before });
     if (row.lifecycleUid !== lifecycleUid)
-        return send(res, 409, { error: `interactive actor "${owner}/${actor}" is current at lifecycle ${row.lifecycleUid ?? "<missing>"}, not ${lifecycleUid}` });
-    const result = await ctx.retireInteractiveLifecycle({ owner, actor, lifecycleUid });
-    return send(res, 200, result);
+        return send(res, 409, { error: `interactive actor "${owner}/${actor}" is current at lifecycle ${row.lifecycleUid ?? "<missing>"}, not ${lifecycleUid}`, ...before });
+    try {
+        return send(res, 200, await ctx.retireInteractiveLifecycle({ owner, actor, lifecycleUid }));
+    }
+    catch (e) {
+        if (e instanceof EpEnvelopeError && e.outcome === "not-executed")
+            return send(res, REFUSAL_STATUS[e.code] ?? 500, { error: e.message, code: e.code, outcome: e.outcome });
+        throw e;
+    }
 }
 /** The host's terminal step for a managed lifecycle whose remote manager is gone: the same request
  *  guards as the interactive door, but it requires the managed grant to be REVOKED first (the
@@ -2487,15 +2927,15 @@ async function handleVerifyManagedAgentEnrollment(req, res, ctx) {
 }
 /** Refuse a missing/invalid loopback capability, audited and counted in its own window (see
  *  BAD_CAP_PER_MIN): 401 with `reason` until the window is full, then 429. */
-function refuseCapability(res, ctx, reason) {
+function refuseCapability(res, ctx, reason, extra = {}) {
     const now = Date.now();
     while (ctx.badCaps.length && now - ctx.badCaps[0] > 60_000)
         ctx.badCaps.shift();
     ctx.badCaps.push(now);
     console.error("auth-service: rejected an exchange with a missing/invalid capability");
     if (ctx.badCaps.length > BAD_CAP_PER_MIN)
-        return send(res, 429, { error: "too many invalid-capability attempts - wait a minute and retry" });
-    send(res, 401, { error: reason });
+        return send(res, 429, { error: "too many invalid-capability attempts - wait a minute and retry", ...extra });
+    send(res, 401, { error: reason, ...extra });
 }
 /** The exchange body, shared by every face; `policy` says how this face proves and attributes the
  *  caller. Behavior on the loopback face is unchanged from the pre-route-table handler. */
@@ -2646,6 +3086,93 @@ async function handleExchange(req, res, ctx, policy) {
         return send(res, 401, { error: reason });
     }
 }
+/** Each chat-session route's CLOSED body: an unknown or missing field refuses before any read. */
+const CHAT_SESSION_FIELDS = {
+    open: { required: ["idpToken", "holderHash", "read", "post", "ttlSec"], optional: ["label"] },
+    bearer: { required: ["idpToken", "actor", "holderProof"], optional: [] },
+    retire: { required: ["idpToken", "actor", "lifecycleUid", "holderProof"], optional: [] },
+};
+/** HTTP status for a door refusal's native code; the body carries the code itself. */
+const REFUSAL_STATUS = {
+    "bad-request": 400, unauthenticated: 401, "permission-denied": 403, "not-found": 404, conflict: 409,
+    "failed-precondition": 412, "resource-exhausted": 429, unimplemented: 501, unavailable: 503,
+};
+/**
+ * The chat-session routes, on both faces. The owner is derived from a fresh IdP proof exactly as
+ * `/exchange` derives it; the body never names one. `open` admits, `bearer` exchanges the holder
+ * proof for one short bearer, `retire` retires. Every refusal answers `{ error, code, outcome }`:
+ * `not-executed` when nothing was written, `executed` when this request wrote before refusing, and
+ * `unknown` when a write may have landed (a retry with the SAME holder resolves it). The holder proof
+ * and the bearer never reach a log line.
+ */
+async function handleChatSession(req, res, ctx, policy, op) {
+    // Every answer before the dispatch is refused with nothing read or written.
+    const before = { outcome: "not-executed" };
+    if (req.method !== "POST")
+        return send(res, 405, { error: "POST only", code: "bad-request", ...before });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here", code: "permission-denied", ...before });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json", code: "bad-request", ...before });
+    if (policy.requireCapability && (req.headers.authorization ?? "") !== `Bearer ${ctx.cap}`)
+        return refuseCapability(res, ctx, "missing/invalid exchange capability - read it from the space's auth-service.json", { code: "unauthenticated", ...before });
+    const peer = policy.peerKey(req);
+    const peerThrottled = policy.throttled(ctx, peer);
+    const body = await readJsonBody(req);
+    const malformed = (why) => send(res, 400, { error: `chat-session ${op}: ${why}`, code: "bad-request", ...before });
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return malformed("the body must be a JSON object");
+    const b = body;
+    const fields = CHAT_SESSION_FIELDS[op];
+    const extra = Object.keys(b).find((k) => !fields.required.includes(k) && !fields.optional.includes(k));
+    if (extra !== undefined)
+        return malformed(`unknown field "${extra}"`);
+    const missing = fields.required.find((k) => !Object.hasOwn(b, k));
+    if (missing !== undefined)
+        return malformed(`missing field "${missing}"`);
+    if (typeof b.idpToken !== "string" || b.idpToken === "")
+        return malformed("idpToken must be a non-empty string");
+    if (op === "open" && (typeof b.holderHash !== "string" || !Array.isArray(b.read) || !Array.isArray(b.post) || typeof b.ttlSec !== "number" || (b.label !== undefined && typeof b.label !== "string")))
+        return malformed("open takes { idpToken, holderHash: string, read: string[], post: string[], ttlSec: number, label?: string }");
+    if (op !== "open" && (typeof b.actor !== "string" || typeof b.holderProof !== "string" || (op === "retire" && typeof b.lifecycleUid !== "string")))
+        return malformed(op === "bearer" ? "bearer takes { idpToken, actor: string, holderProof: string }" : "retire takes { idpToken, actor: string, lifecycleUid: string, holderProof: string }");
+    // A refusal keeps the effect outcome its source stated; one that states none is unknown.
+    const refuse = (status, message, code, outcome = "unknown") => {
+        policy.recordFailure(ctx, peer);
+        console.error(`auth-service: refused a chat-session ${op}: ${message}`);
+        if (peerThrottled)
+            return send(res, 429, { error: "too many refused exchanges - wait a minute and retry", code: "resource-exhausted", outcome });
+        return send(res, status, { error: message, code, outcome });
+    };
+    let owner;
+    let idpExp;
+    try {
+        const verified = await verifyIdpToken(b.idpToken, ctx.bridgeIdp);
+        owner = deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, verified.sub);
+        idpExp = verified.exp;
+    }
+    catch (e) {
+        return refuse(401, e instanceof Error ? e.message : String(e), "unauthenticated", "not-executed");
+    }
+    try {
+        if (op === "open")
+            return send(res, 200, await ctx.openChatSession({
+                owner, holderHash: b.holderHash, read: b.read, post: b.post, ttlSec: b.ttlSec,
+                ...(typeof b.label === "string" ? { label: b.label } : {}),
+            }));
+        if (op === "bearer") {
+            const minted = await ctx.chatSessionBearer({ owner, actor: b.actor, holderProof: b.holderProof, idpExp, issuer: ctx.issuer });
+            return send(res, 200, { token: minted.token, owner, exp: minted.exp });
+        }
+        return send(res, 200, await ctx.retireChatSession({ owner, actor: b.actor, lifecycleUid: b.lifecycleUid, holderProof: b.holderProof }));
+    }
+    catch (e) {
+        if (e instanceof EpEnvelopeError)
+            return refuse(REFUSAL_STATUS[e.code] ?? 500, e.message, e.code, e.outcome ?? "unknown");
+        // Anything else came from a store, broker or file read partway through: its effect is unknown.
+        return refuse(503, e instanceof Error ? e.message : String(e), "unavailable", "unknown");
+    }
+}
 /** The signed-in person's own Manager instances, read-only, on both faces. The proof is the IdP JWT
  *  the human exchange verifies, and the owner is derived from it the same way, so a caller lists only
  *  its own owner's gates. A browser-origin request is refused as on every exchange route; an
@@ -2685,6 +3212,80 @@ async function handleManagerInstances(req, res, ctx, policy) {
         return send(res, 503, { error: `the manager instance list is unavailable: ${e instanceof Error ? e.message : String(e)}` });
     }
 }
+/** A service renewal or access proof, verified against this context's own signing keys: the
+ *  signed witness it binds. A request that carries a witness must name the proof's; a status query
+ *  carries none, so its proof's own witness is the expected one. Current native state is the
+ *  engine's check, never the proof's. */
+async function verifyServiceProof(proof, request, issuer, space) {
+    const key = issuer.localKeySet();
+    if (proof.kind === "service-renewal") {
+        const expected = "witness" in request ? request.witness : parseServiceRegistrationWitness(decodeJwt(proof.token).witness);
+        return (await validateServiceRenewalProof(proof.token, { issuer: issuer.issuer, key, witness: expected })).witness;
+    }
+    const token = await validateUserToken(proof.token, { issuer: issuer.issuer, audience: space, key });
+    if (token.act.view !== "service-endpoint" || token.act.service?.duty !== "serve")
+        throw new Error("the access proof is not a service bearer");
+    const witness = parseServiceRegistrationWitness(token.act.service.witness);
+    if (token.owner !== witness.principal.owner || token.act.owner !== witness.principal.owner || token.act.actor !== witness.principal.actor
+        || token.act.lifecycleUid !== witness.principal.lifecycleUid || token.credentialId !== witness.rootCredentialId)
+        throw new Error("the access proof does not bind its witness");
+    if ("witness" in request && serviceWitnessDigest(request.witness) !== serviceWitnessDigest(witness))
+        throw new Error("the access proof binds another witness");
+    return witness;
+}
+/** The public service endpoint authority route, on both faces and only with `serviceEndpoints`: GET
+ *  reads the account info, POST takes one `{request, proof}` envelope. The proof is the credential on
+ *  either face; the loopback capability is never read or accepted here. An IdP proof verifies against
+ *  the pinned issuer and exact audience, and its subject derives the owner. A service renewal or
+ *  access proof verifies against this context's own issuer and binds a witness, never an owner's
+ *  authority. A refused proof counts against the face's refusal budget; a valid proof does not,
+ *  whatever the answer. */
+async function handleServiceEndpointAuthority(req, res, ctx, policy) {
+    const door = ctx.serviceAuthority;
+    if (door === undefined)
+        return send(res, 404, { error: "service endpoint authority is not enabled for this space" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    const noStore = { "cache-control": "no-store" };
+    if (req.method === "GET")
+        return send(res, 200, serviceAuthorityInfo(door), noStore);
+    if (req.method !== "POST")
+        return send(res, 405, { error: "GET or POST only" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    const peer = policy.peerKey(req);
+    const peerThrottled = policy.throttled(ctx, peer);
+    let envelope;
+    try {
+        envelope = parseServiceAuthorityEnvelope(await readJsonBody(req, SERVICE_AUTHORITY_MAX_BYTES));
+    }
+    catch (e) {
+        return sendRequestError(res, e);
+    }
+    const { request, proof } = envelope;
+    const answer = (r) => send(res, r.status, r.body, noStore);
+    if (request.space !== door.space || request.accountPublicKey !== door.accountPublicKey)
+        return answer(serviceAuthorityDenied(request, "account-mismatch"));
+    let caller;
+    try {
+        caller = proof.kind === "idp"
+            ? { kind: "idp", owner: deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, (await verifyIdpToken(proof.token, ctx.bridgeIdp)).sub) }
+            : { kind: "service", witness: await verifyServiceProof(proof, request, ctx.issuer, door.space) };
+    }
+    catch (e) {
+        policy.recordFailure(ctx, peer);
+        console.error(`auth-service: refused a service endpoint authority proof: ${e instanceof Error ? e.message : String(e)}`);
+        return answer(serviceAuthorityDenied(request, peerThrottled ? "rate-limited" : "unauthenticated"));
+    }
+    try {
+        return answer(await answerServiceAuthority(door, request, caller));
+    }
+    catch (e) {
+        // After the proof, a register may already be bound: an unexpected failure is an unknown effect.
+        console.error(`auth-service: service endpoint authority ${request.operation} failed: ${e instanceof Error ? e.message : String(e)}`);
+        return send(res, 503, { error: "service endpoint authority did not complete; the request may be bound, so retain its request identity" }, noStore);
+    }
+}
 /** The typed manager authority exchange, served on both faces. The face's policy decides whether the
  *  loopback capability is demanded; on the public face the verified IdP JWT is the proof, and the
  *  dispatcher reads the caller's scope from the ledger either way. */
@@ -2891,6 +3492,10 @@ function makePublicHandler(ctx, policy, bundle) {
         ["/exchange", (req, res, c) => handleExchange(req, res, c, policy)],
         ["/manager-service-authority", (req, res, c) => handleManagerServiceAuthority(req, res, c, policy)],
         ["/manager-instances", (req, res, c) => handleManagerInstances(req, res, c, policy)],
+        [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, c) => handleServiceEndpointAuthority(req, res, c, policy)],
+        [CHAT_SESSION_PATHS.open, (req, res, c) => handleChatSession(req, res, c, policy, "open")],
+        [CHAT_SESSION_PATHS.bearer, (req, res, c) => handleChatSession(req, res, c, policy, "bearer")],
+        [CHAT_SESSION_PATHS.retire, (req, res, c) => handleChatSession(req, res, c, policy, "retire")],
         [
             "/.well-known/cotal-mesh",
             (req, res) => {
@@ -2923,7 +3528,7 @@ function makePublicHandler(ctx, policy, bundle) {
             try {
                 const route = routes.get(req.url ?? "");
                 if (!route)
-                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /.well-known/cotal-mesh" });
+                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /chat-session/open, /chat-session/bearer, /chat-session/retire, /.well-known/cotal-mesh" });
                 await route(req, res, ctx);
             }
             catch (e) {
@@ -2934,16 +3539,16 @@ function makePublicHandler(ctx, policy, bundle) {
     };
 }
 /** Read + parse a small JSON body, bounded — the exchange payload is an IdP JWT plus an actor name;
- *  64 KB clears any sane JWT while keeping the loopback surface un-floodable. */
-function readJsonBody(req) {
-    const MAX = 64 * 1024;
+ *  64 KB clears any sane JWT while keeping the loopback surface un-floodable. A route with a larger
+ *  protocol envelope passes its own bound. */
+function readJsonBody(req, max = 64 * 1024) {
     return new Promise((resolve, reject) => {
         let size = 0;
         let tooLarge = false;
         const chunks = [];
         req.on("data", (c) => {
             size += c.length;
-            if (size > MAX) {
+            if (size > max) {
                 // Stop retaining bytes immediately, but keep draining the request so the client receives
                 // the explicit 413 JSON response. Destroying the socket hid the server's decision behind
                 // an undici transport error and made the size-bound smoke unable to prove this guard.
@@ -2956,7 +3561,7 @@ function readJsonBody(req) {
         });
         req.on("end", () => {
             if (tooLarge)
-                return reject(new RequestBodyError(413, "request body too large (maximum 65536 bytes)"));
+                return reject(new RequestBodyError(413, `request body too large (maximum ${max} bytes)`));
             try {
                 resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
             }