@lanes-sh/link 0.7.2 → 0.9.0

package/src/registry/policy-bridge.ts

@@ -1,21 +1,43 @@
-import type { PolicyDocument, PolicyRule } from '#policy';
-import type { Config } from '#profile';
+import type { PolicyDocument, PolicyRule, ProfilePolicy } from '#policy';
+import type { Config, GrantConfig } from '#profile';
 
 /**
- * Turn the config's `policy` block into the document the policy engine
+ * Turn the config's `grants:` rows into the documents the policy engine
  * evaluates.
  *
- * The config format keeps `allow` and `deny` as separate lists because that is
- * what reads clearly in YAML; the engine wants one list carrying an effect,
- * because evaluation must consider both together to make deny win regardless of
- * ordering. Converting here keeps that difference from leaking either way.
+ * Two format differences are reconciled here, and keeping them in one place is
+ * what stops either leaking into the other side.
+ *
+ * The config keeps `allow` and `deny` as separate lists because that is what
+ * reads clearly in YAML; the engine wants one list carrying an effect, because
+ * evaluation must consider both together to make deny win regardless of
+ * ordering.
+ *
+ * And the config is a *sequence* of rows while the engine wants a lookup by
+ * connection (ADR-058). A profile cannot declare the same connection twice —
+ * `assertGrantsResolve` refuses it at load, precisely so that this conversion
+ * has no collision to resolve and no precedence to invent.
+ *
+ * This is the only place `#profile`'s shape meets `#policy`'s. `#policy` may
+ * not import `#profile` and does not need to: it takes a map of rule lists and
+ * knows nothing about YAML, grants, or where a connection was declared.
  */
-export function toPolicyDocument(config: Config): PolicyDocument {
+export function toPolicyDocument(config: Config): ProfilePolicy {
+  const byConnection = new Map<string, PolicyDocument>();
+
+  for (const grant of config.grants) {
+    byConnection.set(grant.connection, { rules: rulesFor(grant) });
+  }
+
+  return { byConnection };
+}
+
+function rulesFor(grant: GrantConfig): PolicyRule[] {
   const rules: PolicyRule[] = [];
 
   for (const [effect, entries] of [
-    ['allow', config.policy.allow],
-    ['deny', config.policy.deny],
+    ['allow', grant.allow],
+    ['deny', grant.deny],
   ] as const) {
     for (const entry of entries) {
       rules.push({
@@ -28,5 +50,5 @@ export function toPolicyDocument(config: Config): PolicyDocument {
     }
   }
 
-  return { rules };
+  return rules;
 }

package/src/registry/reconcile.ts

@@ -144,7 +144,7 @@ export function planIsNoop(plan: ReconcilePlan): boolean {
  * half-configured Gmail account must not stop the other providers from serving.
  */
 export async function planReconcile(
-  config: Config,
+  connections: readonly ConnectionConfig[],
   state: RuntimeState,
   credentials: SecretStore,
   /**
@@ -164,7 +164,7 @@ export async function planReconcile(
   const unauthorized: string[] = [];
   const declared = new Set<string>();
 
-  for (const connection of config.connections) {
+  for (const connection of connections) {
     const key = `${connection.provider}.${connection.id}`;
     declared.add(key);
 
@@ -229,11 +229,11 @@ export async function planReconcile(
 }
 
 export async function applyReconcile(
-  config: Config,
+  connections: readonly ConnectionConfig[],
   state: RuntimeState,
   plan: ReconcilePlan,
 ): Promise<void> {
-  const byKey = new Map(config.connections.map((c) => [`${c.provider}.${c.id}`, c]));
+  const byKey = new Map(connections.map((one) => [`${one.provider}.${one.id}`, one]));
 
   for (const action of plan.actions) {
     if (action.kind === 'unchanged') continue;

package/src/registry/registry.ts

@@ -78,7 +78,7 @@ export class ProviderRegistry {
 
     if (!this.#allowReserved && RESERVED_PROVIDER_IDS.includes(manifest.id)) {
       throw new Error(
-        `Provider id "${manifest.id}" is reserved for the owner layer (memory, skills, vault) and cannot be claimed.`,
+        `Provider id "${manifest.id}" is reserved for the owner layer (the lanes_ surfaces) and cannot be claimed.`,
       );
     }
 

package/src/server/authorization.ts

@@ -0,0 +1,94 @@
+import {
+  IssuedTokenAuthenticator,
+  OAuthServer,
+  OAuthStore,
+  OidcAuthenticator,
+  OidcVerifier,
+  lanesFederation,
+  type Authenticator,
+} from '#auth';
+import type { Logger } from '#connectivity';
+import type { Runtime } from '#cli/runtime.ts';
+import { MCP_PATH } from './index.ts';
+import type { AuthorizationSurface } from './oauth.ts';
+
+/**
+ * Deciding how a remote client proves who it is.
+ *
+ * Its own file, away from the lifecycle in `endpoint.ts`, because the two
+ * answer different questions and only one of them is interesting. Starting an
+ * endpoint is bind, serve, reload, stop. This is which of three models the
+ * profile declared — none, an issuer of its own, or somebody else's — and each
+ * arm carries an argument that has to be read to be changed safely.
+ */
+
+/**
+ * The remote-client gate, if this profile declares one.
+ *
+ * Endpoint-scoped rather than per profile, like the bearer token and for the
+ * same reason (ADR-009): one URL serves every profile in the workspace, so
+ * there is one place a client authorises and one set of tokens.
+ *
+ * Returns null when `auth.authorization` is absent, and everything downstream
+ * treats null as "exactly as before" — no metadata published, no pointer on the
+ * `401`, one authenticator instead of a chain.
+ */
+export async function openAuthorization(
+  primary: Runtime,
+  log: Logger,
+  members: (subject: string) => Promise<readonly string[]>,
+): Promise<{ surface: AuthorizationSurface; authenticator: Authenticator } | null> {
+  const declared = primary.config.auth.authorization;
+  if (!declared) return null;
+
+  const profile = primary.resolution.profile;
+
+  if (declared.mode === 'oidc') {
+    const audience = await primary.credentials.get(declared.client_id_ref);
+    if (!audience) {
+      // Refuse rather than verify without an audience. A verifier that cannot
+      // check who a token was issued for accepts every token the issuer minted
+      // for anything, which is the failure this mode exists to prevent.
+      throw new Error(
+        `auth.authorization.client_id_ref names "${declared.client_id_ref}", which is not in ` +
+          `this target's credential store. Store it with: lanes link secrets set ${declared.client_id_ref}`,
+      );
+    }
+
+    const verifier = new OidcVerifier({
+      issuer: declared.issuer,
+      audience,
+      allowedSubjects: declared.allowed_subjects,
+      ...(declared.introspection_endpoint
+        ? { introspectionEndpoint: declared.introspection_endpoint }
+        : {}),
+    });
+
+    return {
+      // The issuer is somebody else's origin, so it is a constant here rather
+      // than derived from the request.
+      surface: { issuer: () => declared.issuer, mcpPath: MCP_PATH, target: primary.target },
+      authenticator: new OidcAuthenticator(verifier, profile),
+    };
+  }
+
+  const store = new OAuthStore(primary.state.kv);
+
+  const server = new OAuthServer({
+    store,
+    accessTokenTtlMs: declared.access_token_ttl_minutes * 60_000,
+    // So a replayed refresh token leaves a line. It is refused rather than
+    // acted on (ADR-035), and a refusal nobody can see is how a connector
+    // losing its authorization came to need log forensics to explain.
+    log,
+    // Identity comes from lanes.sh, not from a credential pasted into a form on
+    // this machine (ADR-062). What this endpoint decides is the half lanes.sh
+    // cannot know: which of *its* profiles name that person.
+    federation: lanesFederation({ profilesFor: members }),
+  });
+
+  return {
+    surface: { server, issuer: (origin) => origin, mcpPath: MCP_PATH, target: primary.target },
+    authenticator: new IssuedTokenAuthenticator(store, profile),
+  };
+}

package/src/server/edge.ts

@@ -33,11 +33,20 @@ export const FAILED_AUTH_PER_MINUTE = 30;
  *   - `/authorize` compares against the endpoint token, which is another read of
  *     the credential store.
  *   - `/token` reads and writes bucket objects.
+ *   - `/state` and `/audit` verify the pairing token, which on a deployed
+ *     workspace is a Secret Manager call and has no cache behind it at all.
  *
  * `/health` presented with *no* credential is deliberately free: it reads
  * nothing, and it is what a platform probe and `lanes link outputs` send.
  * Metering it would put a ceiling on the one request that costs nothing to
  * answer.
+ *
+ * The read surface is **not** given that exemption, and the asymmetry is the
+ * point: nothing legitimate calls `/state` without a credential — no probe, no
+ * CLI command — so there is no free request to protect. Metering it
+ * unconditionally also means the ceiling does not depend on `readRoutes`
+ * continuing to parse the header before it asks the store anything. That
+ * short-circuit is an optimisation; this is the guarantee.
  */
 export const UNAUTHENTICATED_PER_MINUTE = 30;
 
@@ -141,6 +150,9 @@ export function unauthenticatedRefusal(input: {
   readonly healthPath: string;
   readonly isAuthorizationPath: (pathname: string) => boolean;
   readonly authorizationEnabled: boolean;
+  /** Passed rather than imported, for the reason `isAuthorizationPath` is. */
+  readonly isReadPath: (pathname: string) => boolean;
+  readonly readEnabled: boolean;
 }): Response | undefined {
   // A `/health` carrying no credential reads nothing and is deliberately free —
   // it is what a platform probe and `lanes link outputs` send, and a ceiling on
@@ -149,7 +161,8 @@ export function unauthenticatedRefusal(input: {
   const costly =
     input.pathname === input.healthPath
       ? input.request.headers.get('authorization') !== null
-      : input.authorizationEnabled && input.isAuthorizationPath(input.pathname);
+      : (input.readEnabled && input.isReadPath(input.pathname)) ||
+        (input.authorizationEnabled && input.isAuthorizationPath(input.pathname));
 
   if (!costly) return undefined;
 

package/src/server/endpoint.ts

@@ -1,21 +1,16 @@
-import { MCP_PATH, serve } from './index.ts';
+import { MCP_PATH, serve, type RunningServer } from './index.ts';
 import { serveOverStdio } from './stdio.ts';
 import { Generations, type OpenedWorkspace } from './generations.ts';
 import type { AuthorizationSurface } from './oauth.ts';
 import type { ProfileRuntime } from './mcp/index.ts';
-import {
-  AuthenticatorChain,
-  IssuedTokenAuthenticator,
-  OAuthServer,
-  OAuthStore,
-  OidcAuthenticator,
-  OidcVerifier,
-  tokensMatch,
-  type Authenticator,
-} from '#auth';
+import { AuthenticatorChain } from '#auth';
+import { openAuthorization } from './authorization.ts';
+import { openReadListener } from './read/open.ts';
+import { deployedReadDeps } from './read/deployed.ts';
+import { version } from '#cli/version.ts';
 import type { Logger } from '#connectivity';
 import { silentLogger } from './logging.ts';
-import { listProfiles } from '#profile';
+import { listProfiles, readConnections } from '#profile';
 import {
   applyReconcile,
   formatPlan,
@@ -82,6 +77,8 @@ export interface EndpointOptions {
 export interface RunningEndpoint {
   readonly url: string;
   readonly profiles: readonly string[];
+  /** The dashboard read surface, when this workspace is paired (ADR-063). */
+  readonly readUrl?: string | undefined;
   stop(): Promise<void>;
 }
 
@@ -133,21 +130,33 @@ async function openReconciled(options: {
       }
     }
 
-    for (const [name, runtime] of runtimes) {
-      const result = await planReconcile(
-        runtime.config,
-        runtime.state,
-        runtime.credentials,
-        runtime.manifestFor,
-      );
-      if (!planIsNoop(result)) {
-        reporter.reconciled({
-          profile: name,
-          plan: formatPlan(result),
-          ofMany: runtimes.size > 1,
-        });
-        await applyReconcile(runtime.config, runtime.state, result);
-      }
+    // Once for the workspace, over every connection the workspace holds.
+    //
+    // Runtime state is one store per workspace since contract 3, and reconcile
+    // disables everything in it that the connection list does not declare — so
+    // running it per profile over that profile's *grants* had each pass disable
+    // the connections only the other profiles granted. Two profiles was enough:
+    // the second pass disabled the first's accounts, every later call was
+    // refused `denied_connection_unauthorized`, and restarting flipped which
+    // profile survived.
+    //
+    // The primary's runtime is used for the stores because they are the same
+    // stores for every profile here. `workspaceConnections` is the whole list,
+    // which is what "undeclared" has to be measured against.
+    const declared = primary.workspaceConnections;
+    const result = await planReconcile(
+      declared,
+      primary.state,
+      primary.credentials,
+      primary.manifestFor,
+    );
+    if (!planIsNoop(result)) {
+      reporter.reconciled({
+        profile: primary.resolution.profile,
+        plan: formatPlan(result),
+        ofMany: false,
+      });
+      await applyReconcile(declared, primary.state, result);
     }
 
     return { primary, runtimes };
@@ -167,6 +176,10 @@ function profileRuntimes(runtimes: ReadonlyMap<string, Runtime>): Map<string, Pr
       name,
       {
         config: runtime.config,
+        // For the `connection` argument's description: an id says nothing about
+        // which account it is, and the caller choosing between two of a vendor
+        // has only that description to go on.
+        connections: runtime.connections,
         registry: runtime.registry,
         dispatcher: runtime.dispatcher,
         policy: toPolicyDocument(runtime.config),
@@ -183,80 +196,6 @@ function closeAll(runtimes: ReadonlyMap<string, Runtime>): Promise<unknown> {
   return Promise.all([...runtimes.values()].map((runtime) => runtime.close()));
 }
 
-/**
- * The remote-client gate, if this profile declares one.
- *
- * Endpoint-scoped rather than per profile, like the bearer token and for the
- * same reason (ADR-009): one URL serves every profile in the workspace, so
- * there is one place a client authorises and one set of tokens.
- *
- * Returns null when `auth.authorization` is absent, and everything downstream
- * treats null as "exactly as before" — no metadata published, no pointer on the
- * `401`, one authenticator instead of a chain.
- */
-async function openAuthorization(
-  primary: Runtime,
-  log: Logger,
-): Promise<{ surface: AuthorizationSurface; authenticator: Authenticator } | null> {
-  const declared = primary.config.auth.authorization;
-  if (!declared) return null;
-
-  const profile = primary.resolution.profile;
-
-  if (declared.mode === 'oidc') {
-    const audience = await primary.credentials.get(declared.client_id_ref);
-    if (!audience) {
-      // Refuse rather than verify without an audience. A verifier that cannot
-      // check who a token was issued for accepts every token the issuer minted
-      // for anything, which is the failure this mode exists to prevent.
-      throw new Error(
-        `auth.authorization.client_id_ref names "${declared.client_id_ref}", which is not in ` +
-          `this target's credential store. Store it with: lanes link secrets set ${declared.client_id_ref}`,
-      );
-    }
-
-    const verifier = new OidcVerifier({
-      issuer: declared.issuer,
-      audience,
-      allowedSubjects: declared.allowed_subjects,
-      ...(declared.introspection_endpoint
-        ? { introspectionEndpoint: declared.introspection_endpoint }
-        : {}),
-    });
-
-    return {
-      // The issuer is somebody else's origin, so it is a constant here rather
-      // than derived from the request.
-      surface: { issuer: () => declared.issuer, mcpPath: MCP_PATH, target: primary.target },
-      authenticator: new OidcAuthenticator(verifier, profile),
-    };
-  }
-
-  const store = new OAuthStore(primary.state.kv);
-  const expected = primary.config.auth.token_ref;
-
-  const server = new OAuthServer({
-    store,
-    accessTokenTtlMs: declared.access_token_ttl_minutes * 60_000,
-    // So a replayed refresh token leaves a line. It is refused rather than
-    // acted on (ADR-035), and a refusal nobody can see is how a connector
-    // losing its authorization came to need log forensics to explain.
-    log,
-    // Approval is proof of holding the endpoint token, compared the same way
-    // the request path compares it. There is one person behind this endpoint
-    // and they already have exactly one credential; a second one invented for
-    // the consent screen would be a password to lose.
-    verifyOwner: async (presented) => {
-      const token = await primary.credentials.get(expected);
-      return token !== null && tokensMatch(presented, token);
-    },
-  });
-
-  return {
-    surface: { server, issuer: (origin) => origin, mcpPath: MCP_PATH, target: primary.target },
-    authenticator: new IssuedTokenAuthenticator(store, profile),
-  };
-}
 
 export async function startEndpoint(options: EndpointOptions): Promise<RunningEndpoint> {
   const reporter = options.reporter ?? SILENT;
@@ -278,13 +217,26 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
       if (!token) {
         throw new Error(
           `No profile token at "${primary.config.auth.token_ref}" in this target's credential store. ` +
-            'A deployed instance never mints its own — run `lanes link token rotate --target <target>` ' +
+            'A deployed instance never mints its own — run `lanes link token rotate --workspace <name>` ' +
             'from your machine, or `lanes link secrets push --from local --to cloud`, then redeploy.',
         );
       }
     }
 
-    const gate = await openAuthorization(primary, log);
+    // Read through a holder rather than closed over `runtimes`, because a
+    // reload replaces that map and the gate is deliberately built once
+    // (ADR-029). Without the indirection, a member added after start would
+    // stay invisible until the endpoint was restarted — which is precisely the
+    // thing `profile members add` tells the operator has taken effect.
+    let serving: ReadonlyMap<string, Runtime> = runtimes;
+
+    const gate = await openAuthorization(primary, log, async (subject) =>
+      [...serving]
+        .filter(([, runtime]) =>
+          runtime.config.members.some((member) => member.subject === subject),
+        )
+        .map(([name]) => name),
+    );
 
     // The authenticator and the authorization gate are built once, from the
     // runtime this endpoint booted with, and are deliberately not part of what
@@ -295,6 +247,7 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
       { profiles: profileRuntimes(runtimes), close: () => closeAll(runtimes).then(() => {}) },
       async (): Promise<OpenedWorkspace> => {
         const reopened = await openReconciled(options);
+        serving = reopened.runtimes;
         return {
           profiles: profileRuntimes(reopened.runtimes),
           close: () => closeAll(reopened.runtimes).then(() => {}),
@@ -312,6 +265,12 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
       { primary: primary.resolution.profile, log, ...(gate ? { remoteClients: true } : {}) },
     );
 
+    // Read once. `version()` walks up to the install root and parses
+    // `package.json`; doing it per request would put a synchronous file read on
+    // the read surface's hot path to answer a value that cannot change while
+    // this process lives.
+    const runningVersion = version();
+
     const server = serve({
       generations,
       primary: primary.resolution.profile,
@@ -322,20 +281,46 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
       ...(gate ? { authorization: gate.surface } : {}),
       ...(options.port !== undefined ? { port: options.port } : {}),
       ...(options.host !== undefined ? { host: options.host } : {}),
+      // Offered unconditionally and discarded by `serve()` on a loopback bind,
+      // which is where every other property of the bind address is decided. It
+      // opens nothing and reads no credential, so building it for a bind that
+      // will not use it costs a closure (ADR-064).
+      read: deployedReadDeps({
+        primary,
+        profiles: () => generations.current.profiles,
+        log,
+        version: runningVersion,
+      }),
     });
 
     // After `serve()`, so the record means the socket is bound. Recording it
     // from the constructor claimed an endpoint that a failed bind never served.
     generations.announce();
 
+    // Only when `lanes link pair` has provisioned all three. Absent, this is
+    // simply not served — the read surface is opt-in and its absence is the
+    // default (ADR-063), so an endpoint that was never paired binds one port
+    // exactly as it always did.
+    const read = await openReadListener(
+      primary,
+      server,
+      () => generations.current.profiles,
+      log,
+      runningVersion,
+    );
+
     return {
       url: server.url,
       profiles: [...runtimes.keys()],
+      ...(read ? { readUrl: read.url } : {}),
       // `server.stop()` closes the request handler, which closes whichever
       // generation is current — and a generation owns the runtimes it opened.
       // Closing `runtimes` here too would reach past a reload and close a set
       // nothing is serving from any more.
-      stop: () => server.stop(),
+      stop: async () => {
+        await read?.stop();
+        await server.stop();
+      },
     };
   } catch (error) {
     await closeAll(runtimes);

package/src/server/generation.ts

@@ -189,7 +189,16 @@ export class Generation {
    * a handler outliving its generation is the stale-config bug.
    */
   handlerFor(principal: Principal, clientLabel: string | undefined): McpHttpHandler {
-    const key = `${principal.id}\u0000${clientLabel ?? ''}`;
+    // The delegation list is part of the key, not just the identity.
+    //
+    // `Principal` gained `profiles` this release, and `mergeCapabilities` and
+    // `forProfile` both read it off the *captured* principal — so two tokens for
+    // one subject with different scopes hashed to one entry and whichever
+    // authorized first decided what the other could reach. Removing somebody
+    // from a profile and re-authorizing then served them the profile they had
+    // just lost, or refused one they still had, depending on order.
+    const reach = principal.profiles === undefined ? '*' : [...principal.profiles].sort().join(',');
+    const key = `${principal.id}\u0000${reach}\u0000${clientLabel ?? ''}`;
     const existing = this.#handlers.get(key);
     if (existing) return existing;
 

package/src/server/harness.ts

@@ -5,10 +5,11 @@ import {
   IssuedTokenAuthenticator,
   OAuthServer,
   OAuthStore,
-  tokensMatch,
+  type Federation,
 } from '#auth';
 import { oneProfile, type ProfileRuntime } from './mcp/index.ts';
-import { parseConfig, type Config } from '#profile';
+import {
+  type ConnectionConfig, parseConfig, type Config } from '#profile';
 import { ProviderRegistry, toPolicyDocument } from '#registry';
 import { Dispatcher } from '#dispatch';
 import { createMemoryCredentials, createMemoryState } from '#stores/state/testing.ts';
@@ -33,26 +34,58 @@ import { serveOverStdio } from './stdio.ts';
  * the right calls, and a mocked transport cannot demonstrate that.
  */
 
+/**
+ * The connections a harness config implies, derived from its grants.
+ *
+ * A test config declares grants and no `connections.yaml` — there is no
+ * workspace on disk to read one from. Deriving the rows from the grant refs
+ * keeps the harness honest about the only thing dispatch uses them for, which is
+ * resolving `<provider>.<id>` to a provider and an id. Anything richer (an
+ * account label, a credential ref) belongs to a real workspace and a test that
+ * needs one builds it.
+ */
+function harnessConnections(config: Config): ConnectionConfig[] {
+  return config.grants.map((grant) => {
+    const [provider = '', id = ''] = grant.connection.split('.');
+    return { provider, id, account: grant.connection };
+  });
+}
+
 export const TEST_TOKEN = 'llk_test_token_value';
 
+/** A signed-in person no profile lists. See the federation stub below. */
+export const STRANGER = 'NOBODY_LISTS_THIS_PERSON';
+
+/**
+ * A profile for the harness, from the `allow`/`deny` a test hands over.
+ *
+ * The two `example` accounts are the point: every test here is about a rule
+ * covering both, or one of them, so the harness gives each its own grant row
+ * carrying the same rules (ADR-058). That is what the flat block used to mean,
+ * which keeps every existing test asserting what it was written to assert.
+ */
 export function configFor(profile: string, port: number, policy: string): Config {
+  const rules = policy
+    .split('\n')
+    .filter((line) => line.trim().length > 0)
+    .map((line) => `    ${line.trim()}`)
+    .join('\n');
+
+  const grant = (id: string): string =>
+    `  - connection: example.${id}\n${rules.replace(/^ {4}(allow|deny):/gm, '    $1:')}`;
+
   return parseConfig(`
-contract: 2
+contract: 4
 instance:
   profile: ${profile}
   port: ${port}
 limits:
   requests_per_minute: 1000
   upstream_calls_per_minute: 1000
-connections:
-  - id: a
-    provider: example
-    account: Scratch A
-  - id: b
-    provider: example
-    account: Scratch B
-policy:
-${policy}
+grants:
+${grant('a')}
+${grant('b')}
+members: []
 `).config;
 }
 
@@ -110,6 +143,15 @@ export interface HarnessOptions {
   refreshSkills?: (registry: ProviderRegistry) => Promise<void>;
   /** Serve the `self` authorization flow alongside the bearer token. */
   authorization?: boolean;
+  /**
+   * The identity half of that flow, stubbed.
+   *
+   * The real one talks to lanes.sh and verifies a signature; a test that
+   * exercised it would be testing `AssertionVerifier`, which has its own file
+   * and its own key pair. What a harness test is about is what the endpoint
+   * does *with* an answer, so the answer is injected.
+   */
+  federation?: Partial<Federation>;
   /**
    * What a reload re-reads, standing in for `openReconciled` over a workspace
    * this harness does not have. Throwing is how the "a failed reload keeps
@@ -162,6 +204,8 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
 
   const dispatcher = new Dispatcher({
     config,
+    connections: harnessConnections(config),
+    oauthApps: [],
     registry,
     connectorFor: (providerId): AnyConnector | undefined => {
       const entry = registry.get(providerId);
@@ -199,6 +243,8 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
       policy: extraPolicy,
       dispatcher: new Dispatcher({
         config: extraConfig,
+        connections: harnessConnections(extraConfig),
+        oauthApps: [],
         registry,
         connectorFor: (providerId): AnyConnector | undefined => {
           const entry = registry.get(providerId);
@@ -241,7 +287,19 @@ export function startHarness(options: HarnessOptions): Harness {
             accessTokenTtlMs: 3_600_000,
             log,
             ...(options.now ? { now: options.now } : {}),
-            verifyOwner: (presented) => Promise.resolve(tokensMatch(presented, token)),
+            federation: {
+              consentUrl: 'https://lanes.example/link/authorize',
+              // Anything non-empty verifies, as the subject it spells. Enough to
+              // drive the flow, and obviously not a verifier.
+              verify: async (assertion) =>
+                assertion ? { subject: `lanes:${assertion}`, email: null } : null,
+              // One reserved spelling answers "no profile names them", because
+              // that refusal is a real branch — a person signs in successfully
+              // and still reaches nothing — and there has to be a way to drive it.
+              profilesFor: async (subject) =>
+                subject === `lanes:${STRANGER}` ? [] : [options.profile],
+              ...options.federation,
+            },
           }),
           issuer: (origin: string) => origin,
           mcpPath: '/mcp',