@cotal-ai/auth 0.93.0 → 0.94.0

package/dist/service-host-ops.js

@@ -1,8 +1,9 @@
 /** Package-internal service host operations: register admission, decide (approve or refuse),
- * revoke, create-only name binding, the operation and proposal reads and one owner's assignment
- * state, over closed per-key records in the auth bucket. The index does not export it; only the
- * owner-proved public authority door calls register. It grants no serving, registration, caller
- * policy, restore, terminal retirement or KICK.
+ * revoke, create-only name binding, caller grants and caller revocation up to deny-new and its
+ * cutoff marker, the operation, proposal and caller-policy reads and one owner's assignment state,
+ * over closed per-key records in the auth bucket. The index does not export it; only the
+ * owner-proved public authority door calls register. It grants no serving, registration, issuance
+ * from caller policy, terminal caller revocation, restore, terminal retirement or KICK.
  *
  * Every write is one zero-history create or one exact-revision CAS on one key, issued through the
  * shared custody writer (service-write.ts) under the same plane-claim hold check and fatal latch as
@@ -13,17 +14,21 @@
  * what a later invocation reads. The invocation limit and the original deadline are limits, never
  * waits, fences or proof that an earlier write cannot still land. */
 import { createHash } from "node:crypto";
-import { EpEnvelopeError, GOVERN_HEAD, RECORD_KINDS, assertDerivedOwnerToken, assertLifecycleToken, canonicalJson, contractArtifactCanonicalBytes, contractDigest, contractStoreContext, endpointRegistrationBarrier, endpointToken, epgateKey, isContractDigest, mintLifecycleUid, parseEndpointCapabilities, parseNativeUidCustody, parseServiceSpec, parseServiceStatus, publishContractArtifact, recordAtomicKey, recordSpecKey, recordStatusKey, registerServiceInstance, serviceEndpointActor, serviceGateApprovalLive, serviceWitnessDigest, verifyClusterManifest, verifyClusterRoot, writeServiceStatus, } from "@cotal-ai/core";
+import { EpEnvelopeError, GOVERN_HEAD, RECORD_KINDS, assertBoundedOwner, assertDerivedOwnerToken, assertLifecycleToken, canonicalJson, contractArtifactCanonicalBytes, contractDigest, contractStoreContext, endpointCapabilitiesWithin, endpointRegistrationBarrier, endpointToken, epgateKey, isContractDigest, mintLifecycleUid, parseEndpointCapabilities, parseNativeUidCustody, parseServiceSpec, parseServiceStatus, publishContractArtifact, recordAtomicKey, recordSpecKey, recordStatusKey, registerServiceInstance, serviceEndpointActor, serviceGateApprovalLive, serviceWitnessDigest, verifyClusterManifest, verifyClusterRoot, writeServiceStatus, } from "@cotal-ai/core";
 import { SERVICE_HOST_INVOCATION_MS, openAuthorityClient, serviceHostEffectGrants, serviceHostEffectLabel } from "./authority-client.js";
-import { findInteractiveActor } from "./ledger.js";
-import { openLifecycleRegistry, registryStores } from "./lifecycle-registry.js";
+import { callerParentRefs } from "./service-caller-ancestry.js";
+import { findActorUnified, findInteractiveActor } from "./ledger.js";
+import { openLifecycleRegistry, registryMaxPayload, registryServerId, registryStores } from "./lifecycle-registry.js";
 import { activatedServiceGateRow, approvedServiceGateRow, assertApprovableServiceGate } from "./native-service-gate.js";
 import { nativeServiceNameAuthority, readNativeServiceName, serviceNameKey, serviceNameRowBytes } from "./native-service-name.js";
+import { genuinePlaneHold, readPlaneClaim } from "./plane-claim.js";
+import { SERVICE_CALLER_PAYLOAD_KEY, parseServiceCallerPayloadRecord, serviceCallerPayloadCheck, serviceCallerWriteFits, } from "./service-caller-payload.js";
+import { callerAppendStep, callerBeginStep, callerCutoffStep, immutableGrantView, parseNativeServiceCallerPolicy, parseServiceCallerGrant, servicePolicyKey, } from "./service-caller-policy.js";
 import { encodeRoundTrip } from "./service-custody-shapes.js";
 import { cancelServiceCustody, runServiceBootstrap, sealServiceBootstrapIntent, sealServiceCancelIntent, serviceAssignmentGate, serviceCustodyKeys, serviceReservationKeys, } from "./service-custody.js";
 import { parseServiceHostRequest, parseServiceProposalClusters, parseServiceProposalCommands, } from "./service-host-contract.js";
 import { readRegistryServiceRoot } from "./service-root-reader.js";
-import { HOSTS, Held, bounded, context, endpoint, held, leader, message, openServiceCustodyHost, readyAfter, readyBefore, scopeCovers, write, } from "./service-write.js";
+import { HOSTS, Held, S1_REQUEST_TIMEOUT_MS, bounded, context, endpoint, held, leader, message, openServiceCustodyHost, readyAfter, readyBefore, scopeCovers, write, } from "./service-write.js";
 /** Original authority limit of one approve, refuse or register, from its admission. */
 export const S2A_OPERATION_TTL_MS = 600_000;
 /** Per-invocation limit for reads, bookkeeping, settlement and native cancellation, and the
@@ -38,6 +43,9 @@ export const S2A_MAX_PROPOSAL_BYTES = 256 * 1024;
 export const S2A_MAX_REDECIDE = 4;
 /** Serving request intents one instance keeps (SPEC 13.1): never pruned or reused in this cut. */
 export const S3_MAX_INTENTS_PER_INSTANCE = 64;
+/** Index entries one service instance may ever hold: every caller grant written for it, active,
+ *  revoking or orphaned by a grant attempt refused after its index write. Nothing is pruned. */
+export const S3_MAX_CALLER_GRANTS_PER_INSTANCE = 256;
 const ADMISSION_KEY = "svchost.admission";
 const CAPACITY_KEY = "svccap.space";
 const opKey = (operationId) => `svcop.${operationId}`;
@@ -45,6 +53,8 @@ const proposalKey = (proposalId) => `svcprop.${proposalId}`;
 const assignmentKey = (endpoint, instanceId) => `svcasg.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}`;
 const intentKey = (operationId) => `svcint.${hexN(operationId, 32)}`;
 const intentIndexKey = (endpoint, instanceId) => `svcintx.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}`;
+const callerIndexKey = (endpoint, instanceId) => `svcpolx.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}`;
+const cutoffKey = (operationId) => `svccut.${hexN(operationId, 32)}`;
 const enc = new TextEncoder();
 const seconds = (ms) => Math.floor(ms / 1000);
 // ---- identities ---------------------------------------------------------------------------------
@@ -53,6 +63,8 @@ const hex32 = (tag, space, value) => createHash("sha256").update(`${tag}\0${spac
 export const serviceHostOperationId = (space, requestId) => hex32("cotal-service-host-op", space, requestId);
 /** The native cancel identity an expiry settlement derives from recorded facts only. */
 const expiryOperationId = (space, approveOperationId) => hex32("cotal-service-host-expiry", space, approveOperationId);
+/** A caller grant's id, from its operation: one grant per bound grant request, never reused. */
+const callerGrantId = (space, operationId) => hex32("cotal-service-caller-grant", space, operationId);
 const expiryRequestDigest = (operationId, assignmentDigest) => contractDigest({ v: 1, kind: "service-approval-expiry", operationId, assignmentDigest });
 const requestDigestOf = (r) => contractDigest({ v: r.v, kind: r.kind, requestId: r.requestId, operation: r.operation, input: r.input, granter: r.granter });
 const proposalIdOf = (proposalDigest, registerRequestId) => contractDigest({ v: 1, kind: "service-proposal-id", proposalDigest, registerRequestId }).slice("sha256:".length);
@@ -92,6 +104,20 @@ const endpointName = (raw) => { if (typeof raw !== "string")
     bad("expected an endpoint"); grammar(() => endpointToken(raw)); return raw; };
 const token = (raw, what) => { if (typeof raw !== "string")
     bad(`expected ${what}`); return grammar(() => assertLifecycleToken(raw, what)); };
+/** A caller-ceiling entry an approval may carry: pinned to the proposal's own instance with
+ *  `instanceOnly`, on a declared command, with exactly the target presence and mode that command
+ *  admits. `any` and `ledger` need an operator target policy, which stock does not wire. Containment
+ *  then compares instance rails directly; no class entry is re-read as an instance one. */
+const ceilingEntryAdmitted = (c, p) => {
+    if (c.endpoint !== p.endpoint || c.instanceId !== p.instanceId || c.instanceOnly !== true)
+        return false;
+    const k = p.commands.find((x) => x.name === c.command);
+    if (k === undefined)
+        return false;
+    if (!k.targeted)
+        return c.target === undefined;
+    return c.target !== undefined && c.target.mode !== "any" && c.target.mode !== "ledger" && k.modes.includes(c.target.mode);
+};
 const CAUSES = ["owner-request", "membership-removal", "operator-request", "restore-quarantine", "approval-expired"];
 const REFUSALS = ["conflict", "expired", "revoked", "superseded", "custody-refused", "admission-closed",
     "resource-exhausted", "selector-pending", "selector-bound", "name-owned", "restore", "owner", "operator"];
@@ -132,6 +158,20 @@ function cancelOf(raw) {
     const o = closed(raw, ["operationId", "requestDigest", "cause"]);
     return { operationId: token(o.operationId, "operationId"), requestDigest: digest(o.requestDigest), cause: pick(o.cause, CAUSES) };
 }
+function principalOf(raw) {
+    const o = closed(raw, ["owner", "actor", "lifecycleUid"]);
+    if (typeof o.actor !== "string")
+        bad("expected an actor");
+    return { owner: owner(o.owner), actor: grammar(() => assertBoundedOwner(o.actor, "actor")), lifecycleUid: token(o.lifecycleUid, "lifecycleUid") };
+}
+/** A grant body: the stored grant syntax with the status left out. */
+function grantBody(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || Object.hasOwn(raw, "status"))
+        bad("expected a grant body");
+    const { status: _status, ...body } = grammar(() => parseServiceCallerGrant({ ...raw, status: { state: "active" } }));
+    return body;
+}
+const withStatus = (body, status) => ({ ...body, status });
 function plan(raw) {
     const o = raw;
     switch (o?.kind) {
@@ -149,6 +189,27 @@ function plan(raw) {
         case "revoke":
             closed(raw, ["kind", "endpoint", "instanceId", "expectedAssignmentDigest", "cause"]);
             return { kind: "revoke", endpoint: endpointName(o.endpoint), instanceId: token(o.instanceId, "instanceId"), expectedAssignmentDigest: digest(o.expectedAssignmentDigest), cause: pick(o.cause, CAUSES) };
+        case "caller-grant": {
+            closed(raw, ["kind", "grantee", "assignmentDigest", "approvalDigest", "nameAuthorityRevision", "expectedPolicyRevision", "request", "grant"]);
+            const p = { kind: "caller-grant", grantee: principalOf(o.grantee), assignmentDigest: digest(o.assignmentDigest), approvalDigest: digest(o.approvalDigest),
+                nameAuthorityRevision: ms(o.nameAuthorityRevision), expectedPolicyRevision: ms(o.expectedPolicyRevision),
+                request: structuredClone(o.request), grant: grantBody(o.grant) };
+            const src = p.grant.source;
+            if (src.kind !== "service-owner" || src.approvalDigest !== p.approvalDigest || src.nameAuthorityRevision !== p.nameAuthorityRevision
+                || p.grant.endpoint !== p.request?.service?.endpoint || p.grant.instanceId !== p.request?.service?.instanceId || p.approvalDigest !== p.request?.service?.approvalDigest
+                || canonicalJson(p.grantee) !== canonicalJson(p.request?.grantee) || p.expectedPolicyRevision !== p.request?.expectedPolicyRevision)
+                bad("the caller grant plan does not match its request");
+            return p;
+        }
+        case "caller-revoke": {
+            closed(raw, ["kind", "grantee", "grantId", "expectedPolicyRevision", "request", "grant"]);
+            const p = { kind: "caller-revoke", grantee: principalOf(o.grantee), grantId: hexN(o.grantId, 32), expectedPolicyRevision: ms(o.expectedPolicyRevision),
+                request: structuredClone(o.request), grant: grantBody(o.grant) };
+            if (p.grant.grantId !== p.grantId || p.grantId !== p.request?.grantId || canonicalJson(p.grantee) !== canonicalJson(p.request?.grantee)
+                || p.expectedPolicyRevision !== p.request?.expectedPolicyRevision)
+                bad("the caller revoke plan does not match its request");
+            return p;
+        }
         default: return bad("unknown plan");
     }
 }
@@ -172,6 +233,10 @@ function approvalResult(raw) {
         approvedGateRevision: o.approvedGateRevision === null ? null : ms(o.approvedGateRevision) };
 }
 function result(raw, operation, decision) {
+    if (operation === "grant") {
+        const o = closed(raw, ["grant", "revision"]);
+        return { grant: grammar(() => parseServiceCallerGrant(o.grant)), revision: ms(o.revision) };
+    }
     if (operation === "register") {
         const o = closed(raw, ["proposalId", "revision", "expiresAtMs"]);
         return { proposalId: hexN(o.proposalId, 64), revision: ms(o.revision), expiresAtMs: ms(o.expiresAtMs) };
@@ -203,20 +268,32 @@ const terminalDecision = (operation, outcome) => operation !== "decide" ? null :
 export function parseServiceHostOperationRecord(raw) {
     const o = raw;
     const common = (x) => ({ operationId: token(x.operationId, "operationId"), requestId: hexN(x.requestId, 32), requestDigest: digest(x.requestDigest),
-        operation: pick(x.operation, ["register", "decide", "revoke"]), account: account(x.account), granter: granter(x.granter), admittedAtMs: ms(x.admittedAtMs), projection: projection(x.projection) });
+        operation: pick(x.operation, ["register", "decide", "revoke", "grant"]), account: account(x.account), granter: granter(x.granter), admittedAtMs: ms(x.admittedAtMs), projection: projection(x.projection) });
     if (o?.kind === "service-host-operation") {
         closed(raw, ["v", "kind", "operationId", "requestId", "requestDigest", "operation", "account", "granter", "admittedAtMs", "notAfterMs", "admissionEpoch", "projection", "plan", "progress", "debt"]);
         if (o.v !== 1)
             bad("unknown version");
         const c = common(o), p = plan(o.plan);
-        if ((c.operation === "register") !== (p.kind === "register") || (c.operation === "revoke") !== (p.kind === "revoke"))
+        if ((c.operation === "register") !== (p.kind === "register") || (c.operation === "revoke") !== (p.kind === "revoke" || p.kind === "caller-revoke")
+            || (c.operation === "grant") !== (p.kind === "caller-grant"))
             bad("plan does not match its operation");
+        // A caller plan carries its request's exact input; the record binds only if that input reproduces the digest.
+        if (p.kind === "caller-grant" || p.kind === "caller-revoke") {
+            const request = { v: 1, kind: "service-endpoint-host", requestId: c.requestId, operation: p.kind, input: p.request, granter: c.granter };
+            grammar(() => parseServiceHostRequest(request));
+            if (requestDigestOf(request) !== c.requestDigest)
+                bad("the stored request does not reproduce the request digest");
+        }
         const g = o.progress;
         let progress;
         if (g?.state === "admitted") {
             closed(g, ["state"]);
             progress = { state: "admitted" };
         }
+        else if (g?.state === "issued") {
+            closed(g, ["state", "step", "key", "atRevision"]);
+            progress = { state: "issued", step: word(g.step), key: word(g.key, 512), atRevision: ms(g.atRevision) };
+        }
         else if (g?.state === "custody") {
             closed(g, ["state", "step"]);
             progress = { state: "custody", step: word(g.step) };
@@ -330,6 +407,46 @@ export function parseServiceAdmissionRecord(raw) {
         bad("admission epochs start at 1");
     return { v: 1, kind: "service-host-admission", state: pick(o.state, ["open", "quarantined"]), epoch, restoreId: o.restoreId === null ? null : hexN(o.restoreId, 32) };
 }
+export function parseServiceCallerIndexRecord(raw) {
+    const o = closed(raw, ["v", "kind", "entries"]);
+    if (o.v !== 1 || o.kind !== "service-caller-grant-index")
+        bad("unknown version or kind");
+    if (!Array.isArray(o.entries) || o.entries.length > S3_MAX_CALLER_GRANTS_PER_INSTANCE)
+        bad("invalid caller grant index");
+    const entries = o.entries.map((x) => { const e = closed(x, ["granteeUid", "grantId"]); return { granteeUid: token(e.granteeUid, "granteeUid"), grantId: hexN(e.grantId, 32) }; });
+    if (entries.some((e, i) => i > 0 && !(byEntry(entries[i - 1], e) < 0)))
+        bad("caller grant index entries must be unique and sorted");
+    return { v: 1, kind: "service-caller-grant-index", entries };
+}
+const byEntry = (a, b) => a.granteeUid < b.granteeUid ? -1 : a.granteeUid > b.granteeUid ? 1 : a.grantId < b.grantId ? -1 : a.grantId > b.grantId ? 1 : 0;
+export function parseServiceCutoffMarkerRecord(raw) {
+    const o = closed(raw, ["v", "kind", "accountPublicKey", "space", "operationId", "target", "authorityDigest"]);
+    if (o.v !== 1 || o.kind !== "service-cutoff-marker")
+        bad("unknown version or kind");
+    const t = closed(o.target, ["kind", "grantee", "grantId", "endpoint", "instanceId"]);
+    pick(t.kind, ["caller-grant"]);
+    const a = account({ accountPublicKey: o.accountPublicKey, space: o.space });
+    return { v: 1, kind: "service-cutoff-marker", ...a, operationId: hexN(o.operationId, 32),
+        target: { kind: "caller-grant", grantee: principalOf(t.grantee), grantId: hexN(t.grantId, 32), endpoint: endpointName(t.endpoint), instanceId: token(t.instanceId, "instanceId") },
+        authorityDigest: digest(o.authorityDigest) };
+}
+/** ceil(T) in epoch seconds for the server's raw stored-message time, or undefined unless it is
+ *  exactly `YYYY-MM-DDTHH:MM:SS[.d{1,9}]Z` naming a real calendar second. The whole second is
+ *  formatted back and compared, so a normalized date or a leap second never passes, and any
+ *  non-zero fractional digit rounds up. No double or Date carries the fraction. */
+export function serviceMarkerCeilSeconds(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?Z$/.exec(raw);
+    if (!m)
+        return undefined;
+    const at = Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]), Number(m[4]), Number(m[5]), Number(m[6]));
+    if (!Number.isSafeInteger(at) || at < 0 || new Date(at).toISOString().slice(0, 19) !== raw.slice(0, 19))
+        return undefined;
+    return at / 1000 + (m[7] !== undefined && /[1-9]/.test(m[7]) ? 1 : 0);
+}
+/** The canonical cutoff deadline after the marker's time: ceil(T) + 60 + 2*5 + 1 seconds. */
+export const SERVICE_CUTOFF_MARGIN_S = 71;
 /** Leader-read one S2-A key. A deletion marker or spent tombstone holds under a key-specific
  *  reason and is never recreated; anything its closed parser refuses holds as malformed. */
 async function read(ctx, key, what, parse) {
@@ -487,6 +604,18 @@ export function serviceHostScopeKeys(account, t) {
                 bad("a name binding scope names its endpoint");
             auth.push(serviceNameKey(t.endpoint));
             break;
+        // A caller operation writes its op, the grantee's policy row and the payload precondition's
+        // withdrawal, plus the instance index for a grant or the cutoff marker for a revoke. No custody key.
+        case "caller-grant":
+            if (t.endpoint === null || t.instanceId === null || t.granteeUid === undefined)
+                bad("a caller grant scope names its selector and grantee");
+            auth.push(opKeyOf(), servicePolicyKey(t.granteeUid), callerIndexKey(t.endpoint, t.instanceId), SERVICE_CALLER_PAYLOAD_KEY);
+            break;
+        case "caller-revoke":
+            if (t.granteeUid === undefined || t.cutoffOperationId === undefined)
+                bad("a caller revoke scope names its grantee and cutoff operation");
+            auth.push(opKeyOf(), servicePolicyKey(t.granteeUid), cutoffKey(t.cutoffOperationId), SERVICE_CALLER_PAYLOAD_KEY);
+            break;
         case "serve": {
             // A serving request writes its intent and its instance's index, then only its own effect's keys.
             if (t.endpoint === null || t.instanceId === null || t.serve === undefined)
@@ -599,11 +728,10 @@ export async function openServiceHostOperations(opts) {
     /** One invocation: an effect connection for the discovered scope and its original deadline, one
      *  custody host over it sharing the process hold and writing only the scope's keys, and the
      *  engine latch. The connection's loss trips the host. Every awaited call returns before close. */
-    async function invoke(target, run) {
+    async function invoke(target, run, deadlineMs = Date.now() + S2A_INVOCATION_MS) {
         if (tripped !== undefined)
             throw new Held("readiness", "open", `the service host is fenced: ${tripped}`);
         const keys = serviceHostScopeKeys({ accountPublicKey, space }, target), reads = serviceHostScopeReads(target);
-        const deadlineMs = Date.now() + S2A_INVOCATION_MS;
         const scope = Object.freeze({ ...target, keys, reads, deadlineMs });
         let effect;
         try {
@@ -1017,7 +1145,7 @@ export async function openServiceHostOperations(opts) {
             if (name.revision !== req.input.expectedNameRevision)
                 return out(denied("conflict"));
             const ceiling = parseEndpointCapabilities(req.input.callerCeiling);
-            if (ceiling.some((c) => c.endpoint !== p.endpoint || !p.commands.some((k) => k.name === c.command) || (c.instanceId !== undefined && c.instanceId !== p.instanceId)))
+            if (ceiling.some((c) => !ceilingEntryAdmitted(c, p)))
                 return out(denied("bad-request"));
             const reservation = { v: 1, kind: "native-service-uid", native: { accountPublicKey, space, lifecycleUid },
                 assignment: { owner: p.owner, actor: serviceEndpointActor({ accountPublicKey, space, owner: p.owner, endpoint: p.endpoint, instanceId: p.instanceId }),
@@ -1467,6 +1595,657 @@ export async function openServiceHostOperations(opts) {
             }
         }
     }
+    // ---- caller policy: grant, revoke and the policy reads ------------------------------------------
+    const readPolicy = (ctx, uid) => read(ctx, servicePolicyKey(uid), "policy", parseNativeServiceCallerPolicy);
+    const readCallerIndex = (ctx, e, i) => read(ctx, callerIndexKey(e, i), "caller-index", parseServiceCallerIndexRecord);
+    const readPayload = (ctx) => read(ctx, SERVICE_CALLER_PAYLOAD_KEY, "payload", parseServiceCallerPayloadRecord);
+    /** Whether a row at a grantee's key is bound to that grantee in this account and space. */
+    const boundTo = (row, g) => row.accountPublicKey === accountPublicKey && row.space === space && canonicalJson(row.grantee) === canonicalJson(g);
+    const emptyPolicy = (g) => ({ v: 1, accountPublicKey, space, grantee: g, grants: [] });
+    /** This connection's live limits: its server's `max_payload` and the auth stream's `max_msg_size`. */
+    async function payloadLimits(ctx) {
+        const maxPayload = registryMaxPayload(ctx.h.registry);
+        const r = await bounded(ctx, () => ctx.jsm.streams.info(`KV_${ctx.bucket.auth}`));
+        const size = r.ok ? r.value.config.max_msg_size : undefined;
+        return { maxPayload: Number.isSafeInteger(maxPayload) ? maxPayload : undefined, authMaxMsgSize: Number.isSafeInteger(size) ? size : undefined };
+    }
+    /** Withdraw an asserted payload precondition after a failed live check or a write that would not
+     *  fit; only an operator's assertion records it again. A withdrawal whose own write does not land
+     *  is made again by the next writer that sees the same failure. */
+    async function withdrawPayload(ctx, rec, reason, operationId) {
+        if (rec.state !== "value" || rec.row.state !== "asserted")
+            return;
+        const step = ctx.step;
+        try {
+            await put(ctx, SERVICE_CALLER_PAYLOAD_KEY, { v: 1, kind: "service-caller-payload", state: "withdrawn", reason, operationId, atMs: Date.now() }, parseServiceCallerPayloadRecord, rec);
+        }
+        catch (e) {
+            if (!(e instanceof Held))
+                throw e;
+        }
+        finally {
+            ctx.step = step;
+        }
+    }
+    /** Whether the payload precondition holds now, from its durable record and this connection's live limits. */
+    async function payloadHolds(ctx, operationId) {
+        const rec = await readPayload(ctx), check = serviceCallerPayloadCheck(rec.state === "value" ? rec.row : undefined, await payloadLimits(ctx));
+        if (check.holds && rec.state === "value" && rec.row.state === "asserted" && rec.row.broker) {
+            const broker = rec.row.broker, proof = genuinePlaneHold(opts.hold);
+            if (!proof || broker.serverId !== registryServerId(ctx.h.registry))
+                return false;
+            const observed = await bounded(ctx, () => readPlaneClaim(registryStores(ctx.h.registry).authKv, space));
+            if (!observed.ok || !observed.value || observed.value.state !== "held" || observed.value.claimId !== broker.claimId || observed.value.generation !== broker.claimGeneration)
+                return false;
+            const held = await bounded(ctx, () => proof.assertHeld("after"));
+            if (!held.ok)
+                return false;
+        }
+        if (!check.holds && (check.why === "server-limit" || check.why === "stream-limit"))
+            await withdrawPayload(ctx, rec, "live-check", operationId);
+        return check.holds;
+    }
+    /** Before a policy row write: a row that would not fit the live limits is never issued. The step
+     *  holds `payload-precondition`, a known non-issue, never an unknown outcome. */
+    async function assertWriteFits(ctx, row, operationId) {
+        if (serviceCallerWriteFits(encodeRoundTrip(row, parseNativeServiceCallerPolicy).length, await payloadLimits(ctx)))
+            return;
+        await withdrawPayload(ctx, await readPayload(ctx), "payload-precondition", operationId);
+        held("payload-precondition", ctx.step, "the policy row write would not fit the live payload limits; nothing was issued");
+    }
+    /** Containment within the approval's ceiling image for grantee G. The image keeps only entries on
+     *  this endpoint pinned to this instance with `instanceOnly`, and drops `any` and `ledger` entries
+     *  (no operator target policy is wired) and `owner` or `child` entries for another owner, which can
+     *  never cover G. Mode filtering of stored entries waits on grant-time command declarations. A
+     *  lowering throw counts as not contained. */
+    const withinCeiling = (ceiling, capabilities, g, sel) => {
+        const image = ceiling.filter((c) => {
+            const t = c.target;
+            return c.endpoint === sel.endpoint && c.instanceId === sel.instanceId && c.instanceOnly === true && t?.mode !== "any" && t?.mode !== "ledger"
+                && !((t?.mode === "owner" || t?.mode === "child") && t.tOwner !== g.owner);
+        });
+        const caller = { owner: g.owner, actor: g.actor, uid: g.lifecycleUid };
+        try {
+            return endpointCapabilitiesWithin({ space, child: { caller, capabilities }, parent: { caller, capabilities: image } });
+        }
+        catch {
+            return false;
+        }
+    };
+    const grantedArm = (r) => { const g = r; return { state: "granted", grant: structuredClone(g.grant), revision: g.revision }; };
+    /** caller-grant (G1-G6): an interactive owner grants a current exact-lifecycle grantee rights on
+     *  its own approved instance, within the approval's ceiling and covering managed ancestry. A grant
+     *  records policy only; the separately composed callout establishes effective authority. */
+    async function callerGrant(req, authorized) {
+        // Authorization precedes every request-key read, and its refusal is one answer whether or not the request is bound.
+        if (!authorized)
+            return unread(req.requestId, "permission-denied", "authorize");
+        const operationId = serviceHostOperationId(space, req.requestId), requestDigest = requestDigestOf(req);
+        const granterOwner = req.granter.kind === "owner" ? req.granter.owner : badRequest("a caller grant requires an owner decision");
+        const { grantee, service, expectedPolicyRevision } = req.input;
+        // The scope comes from the input alone, so a grant has no discovery read.
+        const scope = { operation: "caller-grant", operationId, proposalId: null, owner: granterOwner, endpoint: service.endpoint,
+            instanceId: service.instanceId, lifecycleUid: null, granteeUid: grantee.lifecycleUid };
+        try {
+            return await invoke(scope, async (inv) => {
+                inv.operationId = operationId;
+                try {
+                    const ctx = readCtx(inv, "G1-binding");
+                    for (let n = 0;; n++) {
+                        if (n >= S2A_MAX_REDECIDE)
+                            held("contention", ctx.step);
+                        const op = await readOp(ctx, operationId);
+                        if (op.state === "value")
+                            return op.row.requestDigest === requestDigest ? await advanceGrant(inv, op.row) : denied("conflict");
+                        inv.bound = false;
+                        const admitted = await admitGrant(inv, ctx);
+                        if (admitted.kind !== "service-host-operation")
+                            return admitted.out;
+                        // The create may be issued from here, so a held step names the operation.
+                        inv.bound = true;
+                        if ((await put(ctx, opKey(operationId), admitted, parseServiceHostOperationRecord)) !== "moved")
+                            return await advanceGrant(inv, admitted);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof Held)
+                        return heldArm(inv, err);
+                    throw err;
+                }
+            });
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return unread(req.requestId, err.reason, err.step);
+            throw err;
+        }
+        /** G2: the payload precondition, then each eligibility check from one leader read, point in
+         *  time. Every refusal is a zero-write denial; the only write before binding is the precondition's
+         *  withdrawal after a failed live check. */
+        async function admitGrant(inv, ctx) {
+            const out = (o) => ({ kind: "out", out: o });
+            ctx.step = "G2-precondition";
+            if (!(await payloadHolds(ctx, null)))
+                return out(denied("unsupported"));
+            ctx.step = "G2-eligibility";
+            const adm = await readAdmission(ctx);
+            if (adm.state === "absent" || adm.row.state !== "open")
+                return out(denied("admission-closed"));
+            let row;
+            try {
+                row = findActorUnified(opts.ledgerDir, grantee.owner, grantee.actor);
+            }
+            catch {
+                return out(denied("not-found"));
+            }
+            if (row === undefined)
+                return out(denied("not-found"));
+            if (row.kind === "interactive" && row.parent !== undefined)
+                return out(denied("unsupported"));
+            if (row.kind === "managed-agent" && row.parent === undefined)
+                return out(denied("unsupported"));
+            if (row.lifecycleUid !== grantee.lifecycleUid)
+                return out(denied("not-found"));
+            const asg = await readAssignment(ctx, service.endpoint, service.instanceId);
+            if (asg.state === "absent" || asg.row.owner !== granterOwner || asg.row.state !== "bound" || asg.row.cancel !== null)
+                return out(denied("not-found"));
+            const a = asg.row;
+            const gate = await endpoint(ctx, serviceAssignmentGate(inv.host, a.reservation));
+            if (gate.kind !== "approved" || gate.row.serviceAuthority.approvalDigest !== service.approvalDigest)
+                return out(denied("conflict"));
+            const now = Date.now();
+            if (!serviceGateApprovalLive(gate.row.serviceAuthority, seconds(now)))
+                return out(denied("expired"));
+            const name = await nameOf(ctx, service.endpoint);
+            if (name === undefined || name.owner !== granterOwner || name.revision !== gate.row.nameAuthorityRevision)
+                return out(denied("conflict"));
+            const capabilities = parseEndpointCapabilities(req.input.capabilities);
+            if (capabilities.length === 0 || capabilities.some((c) => c.endpoint !== service.endpoint || c.instanceId !== service.instanceId || c.instanceOnly !== true))
+                return out(denied("bad-request"));
+            // A journal row has no instance segment, so it would reach the command's journal on every instance.
+            if (capabilities.some((c) => c.journal === true))
+                return out(denied("unsupported"));
+            if (capabilities.some((c) => c.target?.mode === "any" || c.target?.mode === "ledger"))
+                return out(denied("permission-denied"));
+            if (!withinCeiling(gate.row.serviceAuthority.callerCeiling, capabilities, grantee, service))
+                return out(denied("permission-denied"));
+            let parentRefs;
+            try {
+                parentRefs = await callerParentRefs({ space, ledgerDir: opts.ledgerDir, grantee, capabilities, service,
+                    readPolicy: async (p) => {
+                        const read = await readPolicy(ctx, p.lifecycleUid);
+                        if (read.state === "absent")
+                            return undefined;
+                        if (!boundTo(read.row, p))
+                            throw new EpEnvelopeError("permission-denied", "parent policy has another exact principal");
+                        return read.row;
+                    } });
+            }
+            catch (e) {
+                if (e instanceof EpEnvelopeError)
+                    return out(denied("permission-denied"));
+                throw e;
+            }
+            const policy = await readPolicy(ctx, grantee.lifecycleUid);
+            if (policy.state === "value" && !boundTo(policy.row, grantee))
+                return out(denied("conflict"));
+            if ((policy.state === "value" ? policy.revision : 0) !== expectedPolicyRevision)
+                return out(denied("conflict"));
+            const body = { grantId: callerGrantId(space, operationId), endpoint: service.endpoint, instanceId: service.instanceId,
+                serviceApprovalDigest: service.approvalDigest, capabilities,
+                source: { kind: "service-owner", owner: granterOwner, approvalDigest: service.approvalDigest, nameAuthorityRevision: gate.row.nameAuthorityRevision }, parentRefs };
+            const step = callerAppendStep(policy.state === "value" ? { row: policy.row, revision: policy.revision } : undefined, emptyPolicy(grantee), expectedPolicyRevision, withStatus(body, { state: "active" }));
+            if (step.kind === "headroom")
+                return out(denied("resource-exhausted"));
+            if (step.kind !== "write")
+                return out(denied("conflict"));
+            const index = await readCallerIndex(ctx, service.endpoint, service.instanceId);
+            if (index.state === "value" && index.row.entries.length >= S3_MAX_CALLER_GRANTS_PER_INSTANCE)
+                return out(denied("resource-exhausted"));
+            ctx.step = "G3-binding";
+            return { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "grant", account: { accountPublicKey, space },
+                granter: req.granter, admittedAtMs: now, notAfterMs: now + S2A_OPERATION_TTL_MS, admissionEpoch: adm.row.epoch,
+                projection: { subjectOwner: granterOwner, endpoint: service.endpoint, instanceId: service.instanceId, proposalId: a.proposalId },
+                plan: { kind: "caller-grant", grantee, assignmentDigest: a.assignmentDigest, approvalDigest: service.approvalDigest,
+                    nameAuthorityRevision: gate.row.nameAuthorityRevision, expectedPolicyRevision, request: req.input, grant: body },
+                progress: { state: "admitted" }, debt: [] };
+        }
+        /** G4-G6 from the stored plan. A positive write is recorded `issued` first; past `notAfterMs`
+         *  a replay makes no positive write and settles from one read of the policy row. */
+        async function advanceGrant(inv, first) {
+            const ctx = readCtx(inv, "G-replay");
+            const stored = outcomeOf(first);
+            if (stored !== undefined)
+                return stored.state === "complete" ? grantedArm(stored.result) : finalArm(operationId, stored, debtOf(first));
+            let op = first;
+            const p = op.plan, uid = p.grantee.lifecycleUid, candidate = withStatus(p.grant, { state: "active" });
+            const view = immutableGrantView(candidate), indexKey = callerIndexKey(p.grant.endpoint, p.grant.instanceId), policyKey = servicePolicyKey(uid);
+            const mine = (e) => e.granteeUid === uid && e.grantId === p.grant.grantId;
+            const finish = async (f) => {
+                const s = await settle(ctx, operationId, f, []), o = outcomeOf(s.op);
+                return o.state === "complete" ? grantedArm(o.result) : finalArm(operationId, o, debtOf(s.op));
+            };
+            const refuse = (reason) => finish({ state: "refused", reason });
+            const adopt = (grant, revision) => finish({ state: "complete", result: { grant, revision } });
+            /** Move the live progress from what this invocation last saw; another invocation's record holds. */
+            const progressTo = async (next) => {
+                const seen = canonicalJson(op.progress), want = canonicalJson(next);
+                const r = await updateOp(ctx, operationId, (cur) => {
+                    const now = canonicalJson(cur.progress);
+                    if (isFinal(cur.progress) || now === want)
+                        return undefined;
+                    if (now !== seen)
+                        held("contention", ctx.step, "another invocation advanced this operation");
+                    return { ...cur, progress: next };
+                });
+                if (r.op.kind !== "service-host-operation" || isFinal(r.op.progress))
+                    held("contention", ctx.step, "the operation settled under another invocation");
+                op = r.op;
+            };
+            /** Record the write as issued, never with too little of the authority window left to start it:
+             *  an open record is settled only by a later read, so one without its write holds until the key moves. */
+            const issue = async (step, key, atRevision) => {
+                if (Date.now() + 2 * S1_REQUEST_TIMEOUT_MS >= Math.min(inv.endMs, op.notAfterMs))
+                    held("deadline", step, "too little of the authority window remains to issue the write");
+                await progressTo({ state: "issued", step, key, atRevision });
+            };
+            /** The grant in the row from one read: present with this plan's immutable view, or absent. Anything else holds. */
+            const lookup = async () => {
+                const pol = await readPolicy(ctx, uid);
+                if (pol.state === "value" && !boundTo(pol.row, p.grantee))
+                    held("witness-mismatch", ctx.step, "the policy row at the grantee key is bound to another principal");
+                const grant = pol.state === "value" ? pol.row.grants.find((x) => x.grantId === p.grant.grantId) : undefined;
+                if (grant !== undefined && immutableGrantView(grant) !== view)
+                    held("witness-mismatch", ctx.step, "the stored grant differs from the operation's witness");
+                return { pol, grant, revision: pol.state === "value" ? pol.revision : 0 };
+            };
+            // An open issued write: one read of its own key settles it, or its outcome stays unknown.
+            if (op.progress.state === "issued") {
+                const iss = op.progress;
+                ctx.step = iss.step;
+                if (iss.key === policyKey) {
+                    const found = await lookup();
+                    if (found.grant !== undefined)
+                        return adopt(found.grant, found.revision);
+                    if (found.revision <= iss.atRevision)
+                        held("outcome-unknown", ctx.step, "the issued append's outcome stays unknown until its key moves");
+                    await progressTo({ state: "custody", step: "G5-not-landed" });
+                }
+                else {
+                    const idx = await readCallerIndex(ctx, p.grant.endpoint, p.grant.instanceId);
+                    const landed = idx.state === "value" && idx.row.entries.some(mine);
+                    if (!landed && (idx.state === "value" ? idx.revision : 0) <= iss.atRevision)
+                        held("outcome-unknown", ctx.step, "the issued index write's outcome stays unknown until its key moves");
+                    await progressTo({ state: "custody", step: landed ? "G4-indexed" : "G4-not-landed" });
+                }
+            }
+            // Past the operation's bound: no positive write. Adopt a landed grant, else the attempt expired.
+            if (Date.now() >= op.notAfterMs) {
+                ctx.step = "G-expired";
+                const found = await lookup();
+                return found.grant !== undefined ? adopt(found.grant, found.revision) : refuse("expired");
+            }
+            // A bound grant whose precondition stopped holding holds before G4 or G5; nothing is issued.
+            ctx.step = "G4-precondition";
+            if (!(await payloadHolds(ctx, operationId)))
+                held("payload-precondition", ctx.step, "the payload precondition does not hold; nothing was issued");
+            for (let n = 0;; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", "G4-index");
+                ctx.step = "G4-index";
+                const idx = await readCallerIndex(ctx, p.grant.endpoint, p.grant.instanceId);
+                if (idx.state === "value" && idx.row.entries.some(mine)) {
+                    if (op.progress.state === "issued")
+                        await progressTo({ state: "custody", step: "G4-indexed" });
+                    break;
+                }
+                if (idx.state === "value" && idx.row.entries.length >= S3_MAX_CALLER_GRANTS_PER_INSTANCE)
+                    return refuse("resource-exhausted");
+                const entries = [...(idx.state === "value" ? idx.row.entries : []), { granteeUid: uid, grantId: p.grant.grantId }].sort(byEntry);
+                await issue("G4-index", indexKey, idx.state === "value" ? idx.revision : 0);
+                const wrote = await put(authorityCtx(inv, op.notAfterMs, "G4-index"), indexKey, { v: 1, kind: "service-caller-grant-index", entries }, parseServiceCallerIndexRecord, idx.state === "value" ? idx : undefined);
+                if (wrote !== "moved") {
+                    await progressTo({ state: "custody", step: "G4-indexed" });
+                    break;
+                }
+                // A lost write: the next read of the same key settles it before anything is issued again.
+            }
+            // G5: the grant may already be in the row; otherwise re-check the approval's authority, then append.
+            ctx.step = "G5-recheck";
+            const found = await lookup();
+            if (found.grant !== undefined)
+                return adopt(found.grant, found.revision);
+            const asg = await readAssignment(ctx, p.grant.endpoint, p.grant.instanceId);
+            if (asg.state === "absent" || asg.row.assignmentDigest !== p.assignmentDigest || asg.row.owner !== op.projection.subjectOwner)
+                return refuse("conflict");
+            if (asg.row.state === "fenced" || asg.row.cancel !== null)
+                return refuse("revoked");
+            const gate = await endpoint(ctx, serviceAssignmentGate(inv.host, asg.row.reservation));
+            if (gate.kind === "revoked")
+                return refuse("revoked");
+            if (gate.kind !== "approved" || gate.row.serviceAuthority.approvalDigest !== p.approvalDigest || gate.row.nameAuthorityRevision !== p.nameAuthorityRevision)
+                return refuse("conflict");
+            if (!serviceGateApprovalLive(gate.row.serviceAuthority, seconds(Date.now())))
+                return refuse("expired");
+            const name = await nameOf(ctx, p.grant.endpoint);
+            if (name === undefined || name.owner !== op.projection.subjectOwner || name.revision !== p.nameAuthorityRevision)
+                return refuse("conflict");
+            try {
+                const refs = await callerParentRefs({ space, ledgerDir: opts.ledgerDir, grantee: p.grantee, capabilities: p.grant.capabilities, expectedRefs: p.grant.parentRefs,
+                    service: { endpoint: p.grant.endpoint, instanceId: p.grant.instanceId, approvalDigest: p.approvalDigest },
+                    readPolicy: async (parent) => {
+                        const read = await readPolicy(ctx, parent.lifecycleUid);
+                        if (read.state === "absent")
+                            return undefined;
+                        if (!boundTo(read.row, parent))
+                            throw new EpEnvelopeError("permission-denied", "parent policy binding changed");
+                        return read.row;
+                    } });
+                if (canonicalJson(refs) !== canonicalJson(p.grant.parentRefs))
+                    return refuse("revoked");
+            }
+            catch (e) {
+                if (e instanceof EpEnvelopeError)
+                    return refuse("revoked");
+                throw e;
+            }
+            const step = callerAppendStep(found.pol.state === "value" ? { row: found.pol.row, revision: found.pol.revision } : undefined, emptyPolicy(p.grantee), p.expectedPolicyRevision, candidate);
+            if (step.kind === "moved")
+                return refuse("conflict");
+            if (step.kind === "headroom")
+                return refuse("resource-exhausted");
+            if (step.kind !== "write")
+                held("witness-mismatch", ctx.step, "the stored grant differs from the operation's witness");
+            ctx.step = "G5-precondition";
+            if (!(await payloadHolds(ctx, operationId)))
+                held("payload-precondition", ctx.step, "the payload precondition does not hold; nothing was issued");
+            await issue("G5-append", policyKey, p.expectedPolicyRevision);
+            const wrote = await put(authorityCtx(inv, op.notAfterMs, "G5-append"), policyKey, step.row, parseNativeServiceCallerPolicy, found.pol.state === "value" ? found.pol : undefined);
+            if (wrote !== "moved")
+                return adopt(candidate, wrote);
+            ctx.step = "G5-append";
+            const after = await lookup();
+            if (after.grant !== undefined)
+                return adopt(after.grant, after.revision);
+            if (after.revision > p.expectedPolicyRevision)
+                return refuse("conflict");
+            return held("outcome-unknown", ctx.step, "the issued append's outcome stays unknown until its key moves");
+        }
+    }
+    /** caller-revoke (K0-K3): deny-new, the op-bound cutoff marker and its fixed deadline. It answers
+     *  `pending` and never completes here: a terminal caller revocation needs the post-cutoff receipt
+     *  inventory and absence proof this host does not build. */
+    async function callerRevoke(req, authorized) {
+        if (!authorized)
+            return unread(req.requestId, "permission-denied", "authorize");
+        const operationId = serviceHostOperationId(space, req.requestId), requestDigest = requestDigestOf(req);
+        const { grantee, grantId, expectedPolicyRevision } = req.input;
+        const scope = { operation: "caller-revoke", operationId, proposalId: null, owner: null, endpoint: null, instanceId: null,
+            lifecycleUid: null, granteeUid: grantee.lifecycleUid, cutoffOperationId: operationId };
+        let found;
+        // Discovery, read only: the cutoff operation is the one the grant's revoking status names, else this request's own.
+        try {
+            const dctx = discoveryCtx("discover");
+            found = await readOp(dctx, operationId);
+            const pol = await readPolicy(dctx, grantee.lifecycleUid);
+            const g = pol.state === "value" ? pol.row.grants.find((x) => x.grantId === grantId) : undefined;
+            if (g !== undefined && g.status.state !== "active")
+                scope.cutoffOperationId = g.status.operationId;
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, err);
+            throw err;
+        }
+        const deadlineMs = Date.now() + S2A_INVOCATION_MS;
+        try {
+            const first = await invoke(scope, (inv) => attempt(inv, scope.cutoffOperationId), deadlineMs);
+            if (!("rescope" in first))
+                return first;
+            // Another operation landed deny-new first. Every write this invocation issued had a known
+            // outcome and its effect closed; reopen once, under the same deadline, for that operation's marker.
+            if (Date.now() >= deadlineMs)
+                return { state: "held", operationId, reason: "reconcile-pending", phase: "K1-rescope" };
+            const second = await invoke({ ...scope, cutoffOperationId: first.rescope }, (inv) => attempt(inv, first.rescope), deadlineMs);
+            return "rescope" in second ? { state: "held", operationId, reason: "scope-mismatch", phase: "K1-rescope" } : second;
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return discoveryHeld(operationId, requestDigest, found, err);
+            throw err;
+        }
+        async function attempt(inv, cutoff) {
+            inv.operationId = operationId;
+            try {
+                const ctx = readCtx(inv, "K0-binding");
+                for (let n = 0;; n++) {
+                    if (n >= S2A_MAX_REDECIDE)
+                        held("contention", ctx.step);
+                    const op = await readOp(ctx, operationId);
+                    if (op.state === "value" && op.row.requestDigest === requestDigest) {
+                        // The digest covers the granter, so a replay is by the recorded granter: an operator, or an
+                        // owner who is the witness's source owner or grantee owner.
+                        if (req.granter.kind === "owner" && op.row.kind === "service-host-operation" && op.row.plan.kind === "caller-revoke") {
+                            const w = op.row.plan;
+                            if (!((w.grant.source.kind === "service-owner" && w.grant.source.owner === req.granter.owner) || w.grantee.owner === req.granter.owner))
+                                return { state: "held", operationId, reason: "permission-denied", phase: "authorize" };
+                        }
+                        return await advanceCallerRevoke(inv, op.row, cutoff);
+                    }
+                    if (op.state === "value")
+                        return denied("conflict");
+                    inv.bound = false;
+                    ctx.step = "K0-admit";
+                    const pol = await readPolicy(ctx, grantee.lifecycleUid);
+                    const g = pol.state === "value" && boundTo(pol.row, grantee) ? pol.row.grants.find((x) => x.grantId === grantId) : undefined;
+                    if (g === undefined)
+                        return denied("not-found");
+                    // A delegated source is never written here, and only a source or grantee owner may revoke as an owner.
+                    if (g.source.kind !== "service-owner")
+                        return denied("unsupported");
+                    if (req.granter.kind === "owner" && req.granter.owner !== g.source.owner && req.granter.owner !== grantee.owner)
+                        return denied("not-found");
+                    if (g.status.state === "revoked")
+                        return denied("conflict");
+                    if (g.status.state === "active" && pol.revision !== expectedPolicyRevision)
+                        return denied("conflict");
+                    const adm = await readAdmission(ctx), now = Date.now();
+                    const { status: _status, ...body } = g;
+                    ctx.step = "K0-binding";
+                    const binding = { v: 1, kind: "service-host-operation", operationId, requestId: req.requestId, requestDigest, operation: "revoke",
+                        account: { accountPublicKey, space }, granter: req.granter, admittedAtMs: now, notAfterMs: now + S2A_OPERATION_TTL_MS,
+                        admissionEpoch: adm.state === "value" ? adm.row.epoch : 0,
+                        projection: { subjectOwner: g.source.owner, endpoint: g.endpoint, instanceId: g.instanceId, proposalId: null },
+                        plan: { kind: "caller-revoke", grantee, grantId, expectedPolicyRevision, request: req.input, grant: body }, progress: { state: "admitted" }, debt: [] };
+                    inv.bound = true;
+                    if ((await put(ctx, opKey(operationId), binding, parseServiceHostOperationRecord)) !== "moved")
+                        return await advanceCallerRevoke(inv, binding, cutoff);
+                }
+            }
+            catch (err) {
+                if (err instanceof Held)
+                    return heldArm(inv, err);
+                throw err;
+            }
+        }
+        /** K1-K3 from the stored witness. Each step narrows authority only, so none is bounded by the
+         *  operation's `notAfterMs`; each still ends at its invocation's deadline. */
+        async function advanceCallerRevoke(inv, first, cutoff) {
+            const ctx = readCtx(inv, "K-replay");
+            const stored = outcomeOf(first);
+            if (stored !== undefined)
+                return stored.state === "complete" ? held("operation-malformed", ctx.step, "a caller revoke never completes") : finalArm(operationId, stored, debtOf(first));
+            const p = first.plan, policyKey = servicePolicyKey(p.grantee.lifecycleUid);
+            const witness = immutableGrantView(withStatus(p.grant, { state: "active" }));
+            /** The grant from one read; anything but the witness's immutable view holds and writes nothing. */
+            const lookup = async () => {
+                const pol = await readPolicy(ctx, p.grantee.lifecycleUid);
+                const grant = pol.state === "value" && boundTo(pol.row, p.grantee) ? pol.row.grants.find((x) => x.grantId === p.grantId) : undefined;
+                if (grant === undefined || immutableGrantView(grant) !== witness)
+                    return held("witness-mismatch", ctx.step, "the grant no longer matches the operation's witness");
+                return { pol: pol, grant };
+            };
+            // K1: deny-new under this operation, or the operation that already holds the grant's intent.
+            let holder;
+            for (let n = 0; holder === undefined; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", "K1-deny-new");
+                ctx.step = "K1-deny-new";
+                const { pol, grant } = await lookup();
+                if (grant.status.state === "revoked")
+                    held("terminal-unsupported", ctx.step, "a terminal caller revocation is outside this host");
+                const step = callerBeginStep(pol.row, p.grantId, operationId);
+                if (step.kind === "held") {
+                    holder = step.operationId;
+                    break;
+                }
+                if (step.kind !== "write")
+                    held("witness-mismatch", ctx.step, "the grant no longer matches the operation's witness");
+                await assertWriteFits(ctx, step.row, operationId);
+                if ((await put(ctx, policyKey, step.row, parseNativeServiceCallerPolicy, pol)) !== "moved")
+                    holder = operationId;
+            }
+            if (holder !== cutoff)
+                return { rescope: holder };
+            // K2: the holder's marker, created once from the witness; identical bytes are adopted.
+            ctx.step = "K2-marker";
+            const markerKey = cutoffKey(holder);
+            const marker = { v: 1, kind: "service-cutoff-marker", accountPublicKey, space, operationId: holder,
+                target: { kind: "caller-grant", grantee: p.grantee, grantId: p.grantId, endpoint: p.grant.endpoint, instanceId: p.grant.instanceId },
+                authorityDigest: contractDigest({ v: 1, kind: "service-caller-grant-authority", accountPublicKey, space, grantee: p.grantee, grant: p.grant }) };
+            let m = await leader(ctx, "auth", markerKey);
+            if (m.state === "absent") {
+                await put(ctx, markerKey, marker, parseServiceCutoffMarkerRecord);
+                m = await leader(ctx, "auth", markerKey);
+            }
+            if (m.state === "marker")
+                held("marker-tombstone", ctx.step, `${markerKey} carries a ${m.op} marker`);
+            let same = false;
+            if (m.state === "value") {
+                try {
+                    same = contractDigest(parseServiceCutoffMarkerRecord(m.value)) === contractDigest(marker);
+                }
+                catch {
+                    same = false;
+                }
+            }
+            if (m.state !== "value" || !same)
+                return held("marker-conflict", ctx.step, "the cutoff marker key holds another value; it is never overwritten");
+            const at = serviceMarkerCeilSeconds(m.timestamp);
+            if (at === undefined)
+                return held("marker-time-unknown", ctx.step, "the marker's stored time is not a readable server time; now is never substituted");
+            const cut = { operationId: holder, markerKey, markerRevision: m.revision, notBefore: at + SERVICE_CUTOFF_MARGIN_S };
+            // K3: the deadline, recorded once and never reset.
+            for (let n = 0;; n++) {
+                if (n >= S2A_MAX_REDECIDE)
+                    held("contention", "K3-deadline");
+                ctx.step = "K3-deadline";
+                const { pol } = await lookup();
+                const step = callerCutoffStep(pol.row, p.grantId, cut);
+                if (step.kind === "same")
+                    break;
+                if (step.kind === "conflict")
+                    held("marker-conflict", ctx.step, step.detail);
+                if (step.kind !== "write")
+                    held("witness-mismatch", ctx.step, "the grant no longer matches the operation's witness");
+                await assertWriteFits(ctx, step.row, operationId);
+                if ((await put(ctx, policyKey, step.row, parseNativeServiceCallerPolicy, pol)) !== "moved")
+                    break;
+            }
+            await updateOp(ctx, operationId, (cur) => (cur.progress.state === "custody" && cur.progress.step === "cutoff-recorded" ? undefined
+                : isFinal(cur.progress) ? undefined : { ...cur, progress: { state: "custody", step: "cutoff-recorded" } })).catch((err) => { if (!(err instanceof Held))
+                throw err; });
+            // The phase is advisory, in the gate's whole-second convention; a terminal proof compares broker time.
+            return { state: "pending", operationId, phase: seconds(Date.now()) < cut.notBefore ? "cutoff-wait" : "awaiting-terminal-proof", notBefore: cut.notBefore, denyNew: "landed" };
+        }
+    }
+    /** A view of one row; a filtered view carries only that service's grants, and the revision is always the whole row's. */
+    const policyView = (row, service) => ({
+        grantee: { ...row.grantee }, service: service === null ? null : { endpoint: service.endpoint, instanceId: service.instanceId },
+        grants: structuredClone(service === null ? row.grants : row.grants.filter((g) => g.endpoint === service.endpoint && g.instanceId === service.instanceId))
+    });
+    /** caller-policy-read: an operator reads any grantee; an owner reads its own grantees in full or
+     *  filtered, and another owner's grantee only filtered to a service the owner holds. */
+    async function callerPolicyRead(req) {
+        try {
+            const ctx = discoveryCtx("caller-policy-read");
+            const { grantee, service } = req.input, g = req.granter;
+            if (g.kind === "owner" && grantee.owner !== g.owner) {
+                if (service === null)
+                    return { state: "absent" };
+                const asg = await readAssignment(ctx, service.endpoint, service.instanceId);
+                if (asg.state === "absent" || asg.row.owner !== g.owner)
+                    return { state: "absent" };
+            }
+            const pol = await readPolicy(ctx, grantee.lifecycleUid);
+            if (pol.state === "absent")
+                return { state: "absent" };
+            if (!boundTo(pol.row, grantee))
+                return denied("conflict");
+            return { state: "present", record: { value: policyView(pol.row, service), revision: pol.revision } };
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return denied("unavailable");
+            throw err;
+        }
+    }
+    const listCursor = (service, ownerFilter, after) => Buffer.from(canonicalJson({ v: 1, op: "caller-policy-list", accountPublicKey, space, service, owner: ownerFilter, after }), "utf8").toString("base64url");
+    /** caller-policy-list: one service's grantees, from its instance index, in uid order. Space-wide
+     *  enumeration is unsupported. An owner lists only a service it holds; an operator any. Orphan
+     *  entries are skipped, and an unreadable row fails the whole page. */
+    async function callerPolicyList(req) {
+        const { service, owner: ownerFilter, cursor, limit } = req.input;
+        if (service === null)
+            return denied("unsupported");
+        const sel = { endpoint: service.endpoint, instanceId: service.instanceId };
+        let after = null;
+        if (cursor !== null) {
+            try {
+                after = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"))?.after;
+            }
+            catch {
+                return denied("bad-request");
+            }
+            if (typeof after !== "string" || listCursor(sel, ownerFilter, after) !== cursor)
+                return denied("bad-request");
+        }
+        try {
+            const ctx = discoveryCtx("caller-policy-list");
+            const empty = { state: "page", records: [], nextCursor: null };
+            if (req.granter.kind === "owner") {
+                const asg = await readAssignment(ctx, sel.endpoint, sel.instanceId);
+                if (asg.state === "absent" || asg.row.owner !== req.granter.owner)
+                    return empty;
+            }
+            const idx = await readCallerIndex(ctx, sel.endpoint, sel.instanceId);
+            const uids = [...new Set((idx.state === "value" ? idx.row.entries : []).map((e) => e.granteeUid))].filter((u) => after === null || u > after);
+            const records = [];
+            let last, more = false;
+            for (const uid of uids) {
+                const pol = await readPolicy(ctx, uid);
+                if (pol.state === "absent")
+                    continue;
+                if (pol.row.grantee.lifecycleUid !== uid || pol.row.accountPublicKey !== accountPublicKey || pol.row.space !== space)
+                    return denied("unavailable");
+                const value = policyView(pol.row, sel);
+                if (value.grants.length === 0 || (ownerFilter !== null && pol.row.grantee.owner !== ownerFilter))
+                    continue;
+                if (records.length === limit) {
+                    more = true;
+                    break;
+                }
+                records.push({ value, revision: pol.revision });
+                last = uid;
+            }
+            return { state: "page", records, nextCursor: more && last !== undefined ? listCursor(sel, ownerFilter, last) : null };
+        }
+        catch (err) {
+            if (err instanceof Held)
+                return denied("unavailable");
+            throw err;
+        }
+    }
     async function operationRead(req) {
         try {
             const ctx = discoveryCtx("operation-read");
@@ -1480,11 +2259,14 @@ export async function openServiceHostOperations(opts) {
             if (o.kind === "service-host-operation-terminal")
                 return { state: "present", record: { value: { operationId: o.operationId, requestDigest: o.requestDigest, operation: o.operation, projection, outcome: finalView(o.outcome) }, revision: op.revision } };
             const p = o.plan, assignmentDigest = p.kind === "approve" ? serviceAssignmentGate(discovery.host, p.reservation).binding.assignmentDigest : p.kind === "revoke" ? p.expectedAssignmentDigest : null;
+            const target = p.kind === "caller-grant" || p.kind === "caller-revoke" ? { kind: "caller", grantee: { ...p.grantee } }
+                : { kind: "service", endpoint: o.projection.endpoint, instanceId: o.projection.instanceId, assignmentDigest };
             const g2 = o.progress;
-            const progress = g2.state === "admitted" ? { state: "pending", phase: "admitted" } : g2.state === "custody" ? { state: "pending", phase: g2.step }
-                : g2.state === "held" ? { state: "held", reason: g2.reason, phase: g2.phase } : finalView(g2);
+            const progress = g2.state === "admitted" ? { state: "pending", phase: "admitted" }
+                : g2.state === "custody" || g2.state === "issued" ? { state: "pending", phase: g2.step }
+                    : g2.state === "held" ? { state: "held", reason: g2.reason, phase: g2.phase } : finalView(g2);
             return { state: "present", record: { value: { operationId: o.operationId, requestDigest: o.requestDigest, operation: o.operation,
-                        target: { kind: "service", endpoint: o.projection.endpoint, instanceId: o.projection.instanceId, assignmentDigest }, projection, progress, debt: o.debt.map((d) => ({ ...d })) }, revision: op.revision } };
+                        target, projection, progress, debt: o.debt.map((d) => ({ ...d })) }, revision: op.revision } };
         }
         catch (err) {
             if (err instanceof Held)
@@ -2141,9 +2923,9 @@ export async function openServiceHostOperations(opts) {
         const out = (r) => ({ ...env, ...r });
         // The latch comes before the ledger and every broker read. A request that could bind holds under its
         // operation coordinate, with no deny-new claim because no gate was read; a read never binds.
+        const binds = req.operation === "decide" || req.operation === "revoke" || req.operation === "name-bind" || req.operation === "caller-grant" || req.operation === "caller-revoke";
         if (tripped !== undefined || closed)
-            return out(req.operation === "decide" || req.operation === "revoke" || req.operation === "name-bind"
-                ? unread(req.requestId, "readiness", "open", req.operation === "revoke" ? req.input.expectedAssignmentDigest : undefined) : denied("unavailable"));
+            return out(binds ? unread(req.requestId, "readiness", "open", req.operation === "revoke" ? req.input.expectedAssignmentDigest : undefined) : denied("unavailable"));
         const authorized = req.granter.kind === "operator" || interactive(req.granter.owner);
         switch (req.operation) {
             case "decide": return out(await decide(req, authorized));
@@ -2151,6 +2933,10 @@ export async function openServiceHostOperations(opts) {
             case "name-bind": return out(await nameBind(req));
             case "operation-read": return out(authorized ? await operationRead(req) : denied("permission-denied"));
             case "proposal-read": return out(authorized ? await proposalRead(req) : denied("permission-denied"));
+            case "caller-grant": return out(await callerGrant(req, authorized));
+            case "caller-revoke": return out(await callerRevoke(req, authorized));
+            case "caller-policy-read": return out(authorized ? await callerPolicyRead(req) : denied("permission-denied"));
+            case "caller-policy-list": return out(authorized ? await callerPolicyList(req) : denied("permission-denied"));
             default: return out(denied("unsupported"));
         }
     }