@cotal-ai/auth 0.91.0 → 0.92.0

package/dist/service.js

@@ -29,7 +29,8 @@ import { createToolResultConsentSigner, makeToolResultConsentRecorder } from "./
  * 127.0.0.1; TLS terminates at a reverse proxy — in-process TLS was rejected: it duplicates cert
  * renewal and forks deploy). It serves ONLY `GET /health`, `GET /jwks`, `POST /exchange`,
  * `POST /manager-service-authority`, and `GET /.well-known/cotal-mesh` (the generated discovery
- * bundle); everything else 404s. Its
+ * bundle), plus, only with `serviceEndpoints`, `/service-endpoint-authority` on both faces;
+ * everything else 404s. Its
  * `/exchange` demands NO capability — honestly: the 0600 cap is a same-uid file-ACL boundary with
  * no remote meaning, so requiring its bytes from a remote caller would prove nothing. The proof on
  * the public face is the credential itself: the human arm presents an EdDSA IdP JWT verified
@@ -62,7 +63,7 @@ import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { CotalEndpoint, deprovisionAgent, dlvDurable, dlvStream, dmDurable, dmStream, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRevocation, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance, epgateKey, isCasLoss, sameManagedGrantCustody } from "@cotal-ai/core";
+import { CotalEndpoint, deprovisionAgent, dlvDurable, dlvStream, dmDurable, dmStream, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRevocation, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance, parseServiceAuthorityEnvelope, SERVICE_AUTHORITY_MAX_BYTES, epgateKey, isCasLoss, sameManagedGrantCustody, parseServiceRegistrationWitness, serviceWitnessDigest } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
@@ -71,11 +72,11 @@ import { OwnedConnections } from "./owned-connections.js";
 import { makePlatformSupervisorAuthority, makePlatformSupervisorEnd, platformSupervisorEnded, requirePlatformSupervisorAdmin } from "./platform-supervisor.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof } from "./idp.js";
-import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim } from "./token.js";
+import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim, validateUserToken } from "./token.js";
 import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, holdsRunFence, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest, parseRemoteRunRevokeRequest, revokeRemoteRun } from "./manager-authority.js";
+import { handleRemoteRunCancel, parseRemoteRunCancelRequest, admitRemoteRun, handleRemoteRunSubmission, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, holdsRunFence, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest, parseRemoteRunRevokeRequest, revokeRemoteRun } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
 import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
@@ -83,12 +84,16 @@ import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 import { validateRetainedManagedAgent } from "./continuity.js";
 import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster, remoteManagerSurface } from "./manager-contract.js";
-import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, registrationExecutorGrants, servedRunRequestSubjects } from "./authority-client.js";
+import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, registrationExecutorGrants, servedRunRequestSubjects, servedRunCancelRequestSubject, serviceCalloutWriterGrants, serviceHostDiscoveryGrants } from "./authority-client.js";
+import { createNativeServiceCalloutAuthority } from "./native-service-callout.js";
 import { authorizeConnectCredential } from "./connect-reader.js";
 import { chatAwareAclResolver, openChatSessionAuthority } from "./chat-session-authority.js";
 import { makeNativeIssuanceRecorder, pruneNativeIssuance } from "./native-issuance.js";
 import { ensureRootCredential } from "./root-credential.js";
 import { activateLifecycleAtUid, observeGate, openLifecycleRegistry, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
+import { openServiceHostEffect, openServiceHostOperations } from "./service-host-ops.js";
+import { SERVICE_ENDPOINT_AUTHORITY_PATH, answerServiceAuthority, serviceAuthorityDenied, serviceAuthorityInfo } from "./service-endpoint-authority.js";
+import { validateServiceRenewalProof } from "./service-renewal.js";
 import { openAuthLedgerScannerCandidate } from "./ledger-scanner.js";
 import { openRecordsScannerCandidate } from "./records-scanner.js";
 import { acquirePlaneClaim, makeDeliveryAdminPlaneOracle, makeDeliveryAdminPrincipalOracle, scannerDeathCopy, planeClaimRefusal } from "./plane-claim.js";
@@ -98,6 +103,8 @@ import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-b
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
 import { serializedFor } from "./serialized.js";
+import { RunCancelObservations } from "./run-cancel-observation.js";
+import { readCancellationAdmission } from "@cotal-ai/core";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
@@ -254,6 +261,28 @@ function runtimeSelection(options) {
 export async function openAuthAuthorityPlane(opts) {
     return await openAuthAuthorityPlaneWithCustody(opts);
 }
+/** The hosted door over a plane's service endpoint host: refused before entry unless the context is
+ *  ready, and mapped to the same engine so the internal accessor still finds it. */
+function hostedServiceEndpoints(host, ready) {
+    const door = async (request) => { ready(); return await host(request); };
+    const engine = SERVICE_HOST_ENGINES.get(host), callout = SERVICE_CALLOUTS.get(host);
+    if (engine !== undefined)
+        SERVICE_HOST_ENGINES.set(door, engine);
+    if (callout !== undefined)
+        SERVICE_CALLOUTS.set(door, callout);
+    return door;
+}
+/** Package-internal (not exported from the package index): the engine behind a plane's service
+ *  endpoint host, whose register admission only a later owner-verifying route may call. */
+const SERVICE_HOST_ENGINES = new WeakMap();
+export function serviceHostEngineOf(host) {
+    return SERVICE_HOST_ENGINES.get(host);
+}
+/** Package-internal: the native service callout authority composed with a plane's service host. */
+const SERVICE_CALLOUTS = new WeakMap();
+export function serviceHostCalloutOf(host) {
+    return SERVICE_CALLOUTS.get(host);
+}
 /** The context's custody callback is private. Failed construction unwinds from one place. */
 async function openAuthAuthorityPlaneWithCustody(opts, onConnection) {
     const unwind = [];
@@ -270,6 +299,7 @@ async function openAuthAuthorityPlaneWithCustody(opts, onConnection) {
 async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     const interactiveManagerSelection = runtimeSelection(opts);
     const { server, space, dataAccount, log } = opts;
+    const cancelObservations = new RunCancelObservations(space, opts.runCancelLimits);
     const standingTtl = opts.standingRenewableTtlSeconds ?? STANDING_RENEWABLE_TTL_SEC;
     if (!Number.isSafeInteger(standingTtl) || standingTtl < 5 || standingTtl > STANDING_RENEWABLE_TTL_SEC) {
         throw new Error(`standingRenewableTtlSeconds must be an integer between 5 and ${STANDING_RENEWABLE_TTL_SEC} seconds (got ${standingTtl})`);
@@ -367,12 +397,17 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     // Mid-life disconnect = the FENCING event (security req: an owned scanner that dies must not
     // leave the plane half-running). First death wins: fence the guard with the ux state-3 copy,
     // close the sibling so a successor's reclaim isn't blocked by a half-dead pair, log loud.
+    let serviceHost;
     const fenceOnDeath = (role, sibling) => {
-        if (closing)
-            return;
         const copy = scannerDeathCopy(space, role);
+        // A closing plane does not go fatal, but a service host call it is still draining stops here.
+        if (closing) {
+            serviceHost?.trip(copy);
+            return;
+        }
         hold?.fence(copy);
         fatalReason = fatalReason ?? copy;
+        serviceHost?.trip(copy);
         fireFatal(copy);
         log(`auth-plane: ${copy}`);
         void sibling().catch(() => { });
@@ -477,11 +512,15 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return;
         pruneTimer = setTimeout(() => {
             pruneFlight = pruneNativeIssuance(registry, Math.floor(Date.now() / 1000)).then(schedulePrune, (e) => {
-                if (closing)
-                    return;
                 const copy = `native-issuance cleanup failed: ${e instanceof Error ? e.message : String(e)}`;
+                // As for a scanner death: a closing plane does not go fatal, but a call it is draining stops.
+                if (closing) {
+                    serviceHost?.trip(copy);
+                    return;
+                }
                 hold?.fence(copy);
                 fatalReason = fatalReason ?? copy;
+                serviceHost?.trip(copy);
                 fireFatal(copy);
                 log(`auth-plane: ${copy}`);
             });
@@ -490,6 +529,84 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     const stopPrune = async () => { clearTimeout(pruneTimer); await pruneFlight; };
     unwind.push(async () => { closing = true; await stopPrune(); });
     schedulePrune();
+    // The service endpoint host, default off. Its discovery client only reads, on the ordinary
+    // renewing profile: a broker loss makes its reads fail until it reconnects, and a renewal failure
+    // closes it for good, after which decide and revoke answer unavailable until the plane is opened
+    // again. The engine shares this plane's hold; both fatal sites above trip it.
+    let discoveryClient, calloutWriter;
+    // Every effect connection the host opened whose close has not succeeded, kept past its call's
+    // settlement: plane close and a failed construction close it again and fail while any remains.
+    const openEffects = new Set();
+    const closeEffects = async () => {
+        const failed = [];
+        for (const e of [...openEffects]) {
+            try {
+                await e.close();
+            }
+            catch (err) {
+                failed.push(err);
+            }
+        }
+        if (failed.length > 0)
+            throw new AggregateError(failed, `${failed.length} service host effect connection(s) did not close`);
+    };
+    if (opts.serviceEndpoints !== undefined) {
+        const label = `cotal:service-host-discovery:${space}`;
+        const d = discoveryClient = await openAuthorityClient({ onConnection, server, space, dataAccount, label, grants: (id) => serviceHostDiscoveryGrants(space, id), log,
+            onRenewalFailure: () => {
+                log(`${label}: credential renewal failed - service host discovery is closed until the auth plane is opened again`);
+                void discoveryClient?.close().catch(() => { });
+            } });
+        unwind.push(() => d.close());
+        unwind.push(() => closeEffects());
+        const discovery = await openLifecycleRegistry(d.nc, space);
+        await opts.probeServiceHost?.discovery?.({ registry: discovery, kill: () => d.close() });
+        const probeEffect = opts.probeServiceHost?.effect;
+        // Serving reads registered closures from the contract store on the issuer's connection, which
+        // holds only the store's exact-subject Direct Get.
+        const contractStore = await contractStoreContext(remoteIssuer.nc, space);
+        const readContractArtifact = async (digest) => {
+            const bytes = await fetchContractArtifact(contractStore, contractRefToHex(digest));
+            if (!bytes)
+                throw new EpEnvelopeError("failed-precondition", `the registered contract artifact ${digest} is not readable`);
+            return JSON.parse(new TextDecoder().decode(bytes));
+        };
+        const engine = await openServiceHostOperations({
+            discovery, hold: hold, accountPublicKey: dataAccount.pub, ledgerDir: opts.dir, startup: opts.serviceEndpoints.startup,
+            serving: { readContractArtifact },
+            openEffect: async (scope) => {
+                const opened = await openServiceHostEffect({ onConnection, server, space, dataAccount, log }, scope);
+                const effect = { ...opened, close: async () => { await opened.close(); openEffects.delete(effect); } };
+                openEffects.add(effect);
+                if (probeEffect !== undefined) {
+                    try {
+                        await probeEffect(effect, scope);
+                    }
+                    catch (e) {
+                        await effect.close().catch(() => { });
+                        throw e;
+                    }
+                }
+                return effect;
+            },
+        });
+        unwind.push(() => engine.close());
+        serviceHost = engine;
+        SERVICE_HOST_ENGINES.set(engine.handle, engine);
+        // A fence while the engine was opening latches it now.
+        if (fatalReason !== undefined)
+            engine.trip(fatalReason);
+        // The native service callout: a service bearer's connect mints only for the current bound
+        // assignment its witness names, read from the engine, on a writer that stages and touches the
+        // endpoint gate and credential rows. A fenced plane or a latched engine refuses it.
+        const calloutLabel = `cotal:service-callout:${space}`;
+        const cw = calloutWriter = await openAuthorityClient({ onConnection, server, space, dataAccount, label: calloutLabel, grants: (id) => serviceCalloutWriterGrants(space, id), log });
+        unwind.push(() => cw.close());
+        SERVICE_CALLOUTS.set(engine.handle, createNativeServiceCalloutAuthority({
+            registry: await openLifecycleRegistry(cw.nc, space), reader: () => reader.current(), dataAccount,
+            resolveAssignment: (witness) => engine.serviceBinding(witness), readClusterArtifact: readContractArtifact, assertOpen: () => refuseIfFenced(),
+        }));
+    }
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
     const authKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
     const managerIssuanceGate = (instanceId) => serveIssuanceGateKv(authKv, space, { endpoint: "manager", instanceId });
@@ -633,6 +750,12 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     // envelope asked (SPEC 14.8): the forward's coordinates are the manager's word. The manager
     // forwards from inside the handler serving the request, so an observation older than the window
     // has no forward left to bind; the window also bounds the table.
+    remoteIssuer.nc.subscribe(servedRunCancelRequestSubject(space), {
+        callback: (error, message) => {
+            if (!error)
+                cancelObservations.observe(message.subject, message.data);
+        },
+    });
     const observedRunRequests = new Map();
     for (const subject of servedRunRequestSubjects(space))
         remoteIssuer.nc.subscribe(subject, {
@@ -1457,6 +1580,34 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 observeManagerGate: observeLegacyManagerGate,
             });
         },
+        submitManagerRun: async ({ request, ...holder }) => {
+            refuseIfFenced();
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'keyed run submission needs scope "supervise"');
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, session => handleRemoteRunSubmission({
+                request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
+                observeManagerGate: observeLegacyManagerGate, issued: session.store, sourceIsLive: composedSourceIsLive(session),
+                takeObserved: takeObservedRunRequest,
+                registeredCommand: async (instanceId, registrationRevision, command) => {
+                    const registered = remoteManagerSurface(await registeredManagerCluster(owner, instanceId, { registrationRevision }))[command];
+                    if (!registered)
+                        throw new EpEnvelopeError("failed-precondition", "registered manager has no keyed contract");
+                    return registered;
+                },
+                withStore: async (runId, submission, work) => {
+                    const nc = await connect({ servers: server, ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId, submission }, expiresInSeconds: 60 }), tls: false,
+                        }), maxReconnectAttempts: 0 });
+                    onConnection?.(nc, `cotal:keyed-admitter:${space}`);
+                    try {
+                        return await work(await new Kvm(nc).open(admissionBucket(space)), await jetstreamManager(nc));
+                    }
+                    finally {
+                        await nc.drain().catch(() => nc.close());
+                    }
+                },
+            }));
+        },
         admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const { owner } = holder;
@@ -1489,6 +1640,46 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 }
             });
         },
+        cancelManagerRun: async ({ request, ...holder }) => {
+            refuseIfFenced();
+            const req = parseRemoteRunCancelRequest(request);
+            requireManagerAuthorityHolder(holder, req.instanceId, 'manager run cancellation needs scope "supervise"');
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, session => handleRemoteRunCancel({
+                request: req, owner: holder.owner, space, endpoint: "manager", accountPublicKey: dataAccount.pub,
+                proofSecret: dataAccount.signingSeed, observeManagerGate: observeLegacyManagerGate,
+                observations: cancelObservations, flush: () => remoteIssuer.nc.flush(), assertServing: refuseIfFenced,
+                issued: session.store, sourceIsLive: composedSourceIsLive(session),
+                interactiveScope: async (caller, sources) => {
+                    if (sources.length !== 1 || sources[0].space !== space)
+                        return undefined;
+                    const source = parseActorLedgerSource(sources[0]);
+                    if (!source || source.owner !== caller.owner || source.actor !== caller.actor || source.lifecycleUid !== caller.uid)
+                        return undefined;
+                    const row = findActorUnified(opts.dir, caller.owner, caller.actor);
+                    return row?.kind === "interactive" && row.lifecycleUid === caller.uid ? [...row.scope] : undefined;
+                },
+                registeredCommand: async (instanceId, registrationRevision, command) => {
+                    const registered = remoteManagerSurface(await registeredManagerCluster(holder.owner, instanceId, { registrationRevision }))[command];
+                    if (!registered)
+                        throw new EpEnvelopeError("failed-precondition", "registered manager has no run-cancel contract");
+                    return registered;
+                },
+                readAdmission: runId => readCancellationAdmission(recordsJsm, space, "manager", runId),
+                readRevocation: runId => readRunRevocation(recordsJsm, space, "manager", runId),
+                withStore: async (runId, work) => {
+                    const nc = await connect({ servers: server, ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }), tls: false,
+                        }), maxReconnectAttempts: 0 });
+                    onConnection?.(nc, `cotal:run-cancel:${space}`);
+                    try {
+                        return await work(await new Kvm(nc).open(admissionBucket(space)));
+                    }
+                    finally {
+                        await nc.drain().catch(() => nc.close());
+                    }
+                },
+            }));
+        },
         revokeManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const req = parseRemoteRunRevokeRequest(request);
@@ -1658,14 +1849,24 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return await serveIssuanceGateKv(authKv, space, { endpoint, instanceId }).observe();
         },
         fenced,
+        ...(serviceHost !== undefined ? { serviceEndpointHost: serviceHost.handle } : {}),
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
             // clients down, then `held → released` (never released while either scanner can still
             // act), then the barrier that wrote it. An unreachable release keeps the barrier alive
             // for a later close retry; successful scanner teardown is not run a second time.
             closing = true;
+            // Before the first await: no service host call enters once close has begun.
+            serviceHost?.refuse();
             await stopPrune();
             await stopChatSweep();
+            // Every service host call that entered returns, discovery and effects included, then every
+            // effect connection that did not close is closed again, before discovery closes and before
+            // the claim is released. A failure here rejects with the claim still held; close retries it.
+            await serviceHost?.close();
+            await closeEffects();
+            await calloutWriter?.close();
+            await discoveryClient?.close();
             const scannerFlight = closeScanners ??= (async () => {
                 await authAdmin?.close();
                 const results = await Promise.allSettled([reader.close(), recordsScanner.close(), scanner.close()]);
@@ -1851,6 +2052,7 @@ export async function runAuthService(args, store, options = {}) {
         // selection exactly as before. A hosted context passes no local manager at all.
         localManager: () => loadManagerInstanceIdentity(root, space),
         ...(interactiveManagerSelection !== undefined ? { interactiveManagerSelection } : {}),
+        ...(options.runCancelLimits !== undefined ? { runCancelLimits: options.runCancelLimits } : {}),
     });
     // All planes bound — NOW write the discovery file (its existence is the readiness signal).
     const { url, publicUrl, cap } = started.handle;
@@ -1955,6 +2157,7 @@ export async function startAuthService(inputs) {
         ...(inputs.platformSupervisor !== undefined ? { platformSupervisor: inputs.platformSupervisor } : {}),
         ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
         ...(inputs.toolResultConsents !== undefined ? { toolResultConsents: inputs.toolResultConsents } : {}),
+        ...(inputs.serviceEndpoints !== undefined ? { serviceEndpoints: inputs.serviceEndpoints } : {}),
     });
     return { ...started.handle, readiness: () => ({ ...started.status(), context: inputs.context }) };
 }
@@ -1995,7 +2198,9 @@ async function startAuthContext(o) {
         log: (l) => console.error(l),
         localManager: o.localManager,
         ...(o.interactiveManagerSelection !== undefined ? { interactiveManagerSelection: o.interactiveManagerSelection } : {}),
+        ...(o.runCancelLimits !== undefined ? { runCancelLimits: o.runCancelLimits } : {}),
         ...(o.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: o.standingRenewableTtlSeconds } : {}),
+        ...(o.serviceEndpoints !== undefined ? { serviceEndpoints: o.serviceEndpoints } : {}),
     }, onConnection);
     let nc;
     let http;
@@ -2020,7 +2225,9 @@ async function startAuthContext(o) {
             name: `cotal:auth-service:${space}`,
         });
         onConnection(nc, `cotal:auth-service:${space}`);
+        const serviceCallout = plane.serviceEndpointHost !== undefined ? serviceHostCalloutOf(plane.serviceEndpointHost) : undefined;
         startAuthCallout(nc, {
+            ...(serviceCallout !== undefined ? { serviceAuthority: serviceCallout } : {}),
             xkeySeed: callout.xkey.seed,
             authAccount: { pub: callout.account.pub, signingSeed: callout.account.signingSeed },
             dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
@@ -2057,8 +2264,10 @@ async function startAuthContext(o) {
             space, accountPublicKey: keys.dataAccount.pub, dir, store: secrets, idp: bridgeIdp, ownerSecret,
             signer: o.toolResultConsents, record: plane.recordToolResultConsent,
         });
+        const serviceEngine = plane.serviceEndpointHost !== undefined ? serviceHostEngineOf(plane.serviceEndpointHost) : undefined;
         const ctx = {
             ...(issueToolResultConsent ? { issueToolResultConsent } : {}),
+            ...(serviceEngine !== undefined ? { serviceAuthority: { space, accountPublicKey: keys.dataAccount.pub, engine: serviceEngine, material: issuer } } : {}),
             issuer,
             bridge,
             bridgeIdp,
@@ -2078,7 +2287,9 @@ async function startAuthContext(o) {
             scanManagerGoalIndex: plane.scanManagerGoalIndex,
             authorizeManagerAdmin: plane.authorizeManagerAdmin,
             admitManagerRun: plane.admitManagerRun,
+            submitManagerRun: plane.submitManagerRun,
             revokeManagerRun: plane.revokeManagerRun,
+            cancelManagerRun: plane.cancelManagerRun,
             issueManagerRunAttempt: plane.issueManagerRunAttempt,
             secrets,
             retireInteractiveLifecycle: plane.retireInteractiveLifecycle,
@@ -2263,6 +2474,7 @@ async function startAuthContext(o) {
             cap,
             closed: owned.closed,
             connections: () => owned.connections(),
+            ...(plane.serviceEndpointHost !== undefined ? { serviceEndpointHost: hostedServiceEndpoints(plane.serviceEndpointHost, refuseUnlessReady) } : {}),
             ...(o.platformSupervisor !== undefined ? {
                 platformSupervisorAuthority: async (owner) => {
                     refuseUnlessReady();
@@ -2293,6 +2505,7 @@ async function startAuthContext(o) {
                             case "manager-goal-index-scan": return plane.scanManagerGoalIndex({ ...holder, request });
                             case "manager-admin-authorization": return plane.authorizeManagerAdmin({ ...holder, request });
                             case "manager-run-admission": return plane.admitManagerRun({ ...holder, request });
+                            case "manager-run-submission": return plane.submitManagerRun({ ...holder, request });
                             case "manager-run-attempt": return plane.issueManagerRunAttempt({ ...holder, request });
                             case "manager-retained-agent-validation": return validateRetainedForHolder(holder, request);
                         }
@@ -2389,6 +2602,16 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
         return ctx.authorizeManagerAdmin({ owner, scope: row.scope ?? [], request: body.request });
     if (request.kind === "manager-run-admission")
         return ctx.admitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    if (request.kind === "manager-run-submission") {
+        if (!ctx.submitManagerRun)
+            throw new EpEnvelopeError("unimplemented", "issuing host has no keyed submission handler");
+        return ctx.submitManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    }
+    if (request.kind === "manager-run-cancel") {
+        if (!ctx.cancelManagerRun)
+            throw new EpEnvelopeError("unimplemented", "this issuing host has no run-cancel handler");
+        return ctx.cancelManagerRun({ owner, scope: row.scope ?? [], request: body.request });
+    }
     if (request.kind === "manager-run-revoke") {
         if (ctx.revokeManagerRun === undefined)
             throw new EpEnvelopeError("unimplemented", "this issuing host has no run revoke handler");
@@ -2503,6 +2726,7 @@ const ROUTES = new Map([
     ["/exchange", (req, res, ctx) => handleExchange(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-service-authority", (req, res, ctx) => handleManagerServiceAuthority(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-instances", (req, res, ctx) => handleManagerInstances(req, res, ctx, LOOPBACK_POLICY)],
+    [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, ctx) => handleServiceEndpointAuthority(req, res, ctx, LOOPBACK_POLICY)],
     [INTERACTIVE_RETIRE_PATH, handleInteractiveLifecycleRetirement],
     [MANAGED_RETIRE_PATH, handleManagedLifecycleRetirement],
     [VERIFY_ENROLLMENT_PATH, handleVerifyManagedAgentEnrollment],
@@ -2988,6 +3212,80 @@ async function handleManagerInstances(req, res, ctx, policy) {
         return send(res, 503, { error: `the manager instance list is unavailable: ${e instanceof Error ? e.message : String(e)}` });
     }
 }
+/** A service renewal or access proof, verified against this context's own signing keys: the
+ *  signed witness it binds. A request that carries a witness must name the proof's; a status query
+ *  carries none, so its proof's own witness is the expected one. Current native state is the
+ *  engine's check, never the proof's. */
+async function verifyServiceProof(proof, request, issuer, space) {
+    const key = issuer.localKeySet();
+    if (proof.kind === "service-renewal") {
+        const expected = "witness" in request ? request.witness : parseServiceRegistrationWitness(decodeJwt(proof.token).witness);
+        return (await validateServiceRenewalProof(proof.token, { issuer: issuer.issuer, key, witness: expected })).witness;
+    }
+    const token = await validateUserToken(proof.token, { issuer: issuer.issuer, audience: space, key });
+    if (token.act.view !== "service-endpoint" || token.act.service?.duty !== "serve")
+        throw new Error("the access proof is not a service bearer");
+    const witness = parseServiceRegistrationWitness(token.act.service.witness);
+    if (token.owner !== witness.principal.owner || token.act.owner !== witness.principal.owner || token.act.actor !== witness.principal.actor
+        || token.act.lifecycleUid !== witness.principal.lifecycleUid || token.credentialId !== witness.rootCredentialId)
+        throw new Error("the access proof does not bind its witness");
+    if ("witness" in request && serviceWitnessDigest(request.witness) !== serviceWitnessDigest(witness))
+        throw new Error("the access proof binds another witness");
+    return witness;
+}
+/** The public service endpoint authority route, on both faces and only with `serviceEndpoints`: GET
+ *  reads the account info, POST takes one `{request, proof}` envelope. The proof is the credential on
+ *  either face; the loopback capability is never read or accepted here. An IdP proof verifies against
+ *  the pinned issuer and exact audience, and its subject derives the owner. A service renewal or
+ *  access proof verifies against this context's own issuer and binds a witness, never an owner's
+ *  authority. A refused proof counts against the face's refusal budget; a valid proof does not,
+ *  whatever the answer. */
+async function handleServiceEndpointAuthority(req, res, ctx, policy) {
+    const door = ctx.serviceAuthority;
+    if (door === undefined)
+        return send(res, 404, { error: "service endpoint authority is not enabled for this space" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    const noStore = { "cache-control": "no-store" };
+    if (req.method === "GET")
+        return send(res, 200, serviceAuthorityInfo(door), noStore);
+    if (req.method !== "POST")
+        return send(res, 405, { error: "GET or POST only" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    const peer = policy.peerKey(req);
+    const peerThrottled = policy.throttled(ctx, peer);
+    let envelope;
+    try {
+        envelope = parseServiceAuthorityEnvelope(await readJsonBody(req, SERVICE_AUTHORITY_MAX_BYTES));
+    }
+    catch (e) {
+        return sendRequestError(res, e);
+    }
+    const { request, proof } = envelope;
+    const answer = (r) => send(res, r.status, r.body, noStore);
+    if (request.space !== door.space || request.accountPublicKey !== door.accountPublicKey)
+        return answer(serviceAuthorityDenied(request, "account-mismatch"));
+    let caller;
+    try {
+        caller = proof.kind === "idp"
+            ? { kind: "idp", owner: deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, (await verifyIdpToken(proof.token, ctx.bridgeIdp)).sub) }
+            : { kind: "service", witness: await verifyServiceProof(proof, request, ctx.issuer, door.space) };
+    }
+    catch (e) {
+        policy.recordFailure(ctx, peer);
+        console.error(`auth-service: refused a service endpoint authority proof: ${e instanceof Error ? e.message : String(e)}`);
+        return answer(serviceAuthorityDenied(request, peerThrottled ? "rate-limited" : "unauthenticated"));
+    }
+    try {
+        return answer(await answerServiceAuthority(door, request, caller));
+    }
+    catch (e) {
+        // After the proof, a register may already be bound: an unexpected failure is an unknown effect.
+        console.error(`auth-service: service endpoint authority ${request.operation} failed: ${e instanceof Error ? e.message : String(e)}`);
+        return send(res, 503, { error: "service endpoint authority did not complete; the request may be bound, so retain its request identity" }, noStore);
+    }
+}
 /** The typed manager authority exchange, served on both faces. The face's policy decides whether the
  *  loopback capability is demanded; on the public face the verified IdP JWT is the proof, and the
  *  dispatcher reads the caller's scope from the ledger either way. */
@@ -3194,6 +3492,7 @@ function makePublicHandler(ctx, policy, bundle) {
         ["/exchange", (req, res, c) => handleExchange(req, res, c, policy)],
         ["/manager-service-authority", (req, res, c) => handleManagerServiceAuthority(req, res, c, policy)],
         ["/manager-instances", (req, res, c) => handleManagerInstances(req, res, c, policy)],
+        [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, c) => handleServiceEndpointAuthority(req, res, c, policy)],
         [CHAT_SESSION_PATHS.open, (req, res, c) => handleChatSession(req, res, c, policy, "open")],
         [CHAT_SESSION_PATHS.bearer, (req, res, c) => handleChatSession(req, res, c, policy, "bearer")],
         [CHAT_SESSION_PATHS.retire, (req, res, c) => handleChatSession(req, res, c, policy, "retire")],
@@ -3240,16 +3539,16 @@ function makePublicHandler(ctx, policy, bundle) {
     };
 }
 /** Read + parse a small JSON body, bounded — the exchange payload is an IdP JWT plus an actor name;
- *  64 KB clears any sane JWT while keeping the loopback surface un-floodable. */
-function readJsonBody(req) {
-    const MAX = 64 * 1024;
+ *  64 KB clears any sane JWT while keeping the loopback surface un-floodable. A route with a larger
+ *  protocol envelope passes its own bound. */
+function readJsonBody(req, max = 64 * 1024) {
     return new Promise((resolve, reject) => {
         let size = 0;
         let tooLarge = false;
         const chunks = [];
         req.on("data", (c) => {
             size += c.length;
-            if (size > MAX) {
+            if (size > max) {
                 // Stop retaining bytes immediately, but keep draining the request so the client receives
                 // the explicit 413 JSON response. Destroying the socket hid the server's decision behind
                 // an undici transport error and made the size-bound smoke unable to prove this guard.
@@ -3262,7 +3561,7 @@ function readJsonBody(req) {
         });
         req.on("end", () => {
             if (tooLarge)
-                return reject(new RequestBodyError(413, "request body too large (maximum 65536 bytes)"));
+                return reject(new RequestBodyError(413, `request body too large (maximum ${max} bytes)`));
             try {
                 resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
             }