@loopingai/core 0.7.0 → 0.7.1

package/README.md

@@ -39,11 +39,12 @@ optional is a plugin. Anything opinionated belongs to your app.
 npx looping-keys
 ```
 
-Set the private JWK as `A2A_SIGNING_KEY` (`.dev.vars` locally, `wrangler secret put`
-when deployed) and the origins you accept calls from as `GATEWAY_ORIGINS`:
+Set the private JWK as `A2A_SIGNING_KEY` (`.env` locally; `wrangler deploy
+--secrets-file .env` or `wrangler secret put` when deployed) and the origins you accept
+calls from as `GATEWAY_ORIGINS`:
 
 ```ini
-# .dev.vars
+# .env
 A2A_SIGNING_KEY={"crv":"Ed25519","d":"…","x":"…","kty":"OKP","kid":"a2a-2026-08-01"}
 GATEWAY_ORIGINS=["https://gateway.example.com"]
 ```
@@ -268,6 +269,38 @@ makes the served document a fixed point under the repeated decoding a verifier
 performs. A gateway pins the card's `kid` + `jku` on first registration
 (Trust-On-First-Use).
 
+### Calling out, and knowing your own origin
+
+The same key proves this agent to services that are not the gateway — an inference
+proxy, another agent. `signCallerToken` mints the short-lived token for that: `iss` is
+this deployment's origin, `jku` is derived from it, and the audience is normalized to a
+bare origin because the far side compares it byte-for-byte.
+
+Its `iss` is **not** something to configure. Inside a Durable Object it is:
+
+```ts
+protected override modelRuntime(model: ModelConfig): ModelRuntime {
+  return myProvider(this.env, model, () => this.requireSelfOrigin());
+}
+```
+
+`requireSelfOrigin()` (and `selfOrigin()`, which returns `undefined` instead of
+throwing) answer with the origin core already delivers: the executor computes the
+callback `jku` from `new URL(request.url).origin`, and it rides every turn into the DO
+and on into each subagent facet. A `SELF_ORIGIN` secret only restates that, and has to
+be kept byte-identical with the verifier's allowlist by hand in every environment.
+
+The first turn an instance serves **pins** it, and nothing is persisted. Pinning is
+what makes it safe to read: turns run concurrently in one Durable Object and a
+credential thunk fires several frames below the turn that set the value, so a mutable
+field could hand one turn another's origin. An agent has one endpoint anyway — the one
+its card advertises and a verifier allowlists — and a fresh isolate on deploy re-learns
+it.
+
+It is known **inside a turn or a chunk**: `onStart`, a constructor and a scheduled
+callback all run before any request has said what this deployment is called, and
+`requireSelfOrigin()` throws there saying so.
+
 ---
 
 ## Plugins

package/dist/a2a/caller-token.d.ts

@@ -5,6 +5,12 @@ export interface CallerTokenOptions {
      * This agent's own origin. It becomes `iss`, and `jku` is derived from it, and
      * the two must agree: a verifier that accepts a `jku` on a different origin
      * than `iss` lets one allowlisted origin impersonate another.
+     *
+     * **Not something to configure.** Inside a Durable Object it is
+     * `requireSelfOrigin()` — see {@link file://./self-origin.ts SelfOrigin},
+     * which learns it from the `jku` every turn already carries. A `SELF_ORIGIN`
+     * secret restates what the request path knows and has to be kept
+     * byte-identical with the verifier's allowlist by hand.
      */
     issuer: string;
     /**

package/dist/a2a/index.d.ts

@@ -24,6 +24,7 @@ export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publi
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { deliverTerminalTask, type DeliverTerminalOptions } from "./deliver.js";
 export { signCallerToken, type CallerTokenOptions } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
 export { callerContext } from "./caller.js";
 export { createPushChannel, type PushChannel, type TurnPushContext } from "./push.js";
 export { taskStateLabel, type PlainArtifact, type PlainMessage, type PlainPart, type PlainStatus, type PlainTask } from "./task.js";

package/dist/a2a/index.js

@@ -24,6 +24,7 @@ export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publi
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { deliverTerminalTask } from "./deliver.js";
 export { signCallerToken } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
 export { callerContext } from "./caller.js";
 export { createPushChannel } from "./push.js";
 export { taskStateLabel } from "./task.js";

package/dist/a2a/self-origin.d.ts

@@ -0,0 +1,91 @@
+/**
+ * This deployment's own public origin — learned from the request path, never
+ * configured.
+ *
+ * ## Why an agent needs it at all
+ *
+ * A Worker that only *answers* never needs to know its own name.
+ * {@link file://../worker/index.ts createA2AWorker} derives its audience, its
+ * card and its `jku` from `new URL(request.url).origin`, and none of it outlives
+ * the request. An agent that **calls out** mint-signed does need it:
+ * {@link file://./caller-token.ts signCallerToken} puts it in `iss` and derives
+ * the token's `jku` from it. That call happens inside a Durable Object, where
+ * there is no `Request` — which is the whole difficulty.
+ *
+ * The obvious answer is a `SELF_ORIGIN` secret, and it is the wrong one. It
+ * restates a value the request already carries, and it has to be kept
+ * byte-identical by hand with the origin allowlist on the far side, in every
+ * environment, forever. Both siblings that tried it took it back out:
+ * `looping-anthropic-proxy` deleted `PROXY_AUDIENCE` in favour of `url.origin`,
+ * and `looping-gateway` discovers its own origin from the first
+ * signature-verified request rather than being told.
+ *
+ * ## Where the value comes from
+ *
+ * Core already sends the origin into the Durable Object on every turn, one field
+ * short of this use. `A2AExecutor` computes `jku` as `${origin}${jwksPath}` and
+ * it rides {@link file://./push.ts TurnPushContext} through the Workflow into
+ * `runTaskTurn` and `executeSubtaskChunk`.
+ *
+ * That is the same origin `signCallerToken` needs, and not by coincidence: a
+ * caller token's `jku` **must** be the JWKS the verifier fetches, and `iss` must
+ * agree with it — the third check in {@link file://./verify.ts verify.ts}. An
+ * origin derived from anywhere else is exactly what that check exists to catch,
+ * so deriving it from the `jku` core already serves makes the agreement
+ * structural instead of clerical.
+ *
+ * ## Pinned on the first turn, and in memory
+ *
+ * The first origin an isolate is told wins, and later ones are ignored. That is
+ * not laziness about staleness — it is what makes the value safe to *read*.
+ *
+ * A Durable Object's input gate stays open across a non-storage await, and this
+ * package runs concurrent RPCs into one object by design (`round/workflow.ts`
+ * runs a round's branches under `Promise.all`). Mutable instance state can
+ * therefore change while a turn is awaiting a model call, and the credential
+ * thunks that read this are lazy — they run several frames below the turn, when
+ * the client is built. Pinned, the field is immutable after its first write, so
+ * every concurrent reader in the isolate gets the same string and no turn can
+ * sign as another turn's origin.
+ *
+ * The cost of pinning is what an agent does not have: several identities. An
+ * agent has one endpoint — the one its card advertises, the one a gateway calls
+ * and a verifier allowlists — so there is nothing to follow. Note the asymmetry
+ * with `looping-anthropic-proxy`, which derives its audience per request and
+ * refuses to cache: a *verifier* must accept every hostname it answers on, while
+ * a *signer* needs one stable identity.
+ *
+ * Nothing is persisted, which is what keeps a pin from outliving its truth. An
+ * isolate is fresh on every `wrangler deploy` and recycles on its own, so a moved
+ * deployment re-learns its origin from the next turn it serves.
+ */
+export declare class SelfOrigin {
+    private observed?;
+    /**
+     * Offer the origin of an absolute URL seen on the request path — a `jku`, an
+     * endpoint, or a bare origin. Only `.origin` is kept, so a path or a trailing
+     * slash cannot reach a token claim.
+     *
+     * **The first usable value wins**; every later call is a no-op, including one
+     * naming a different origin. Called at each RPC entry and again when the push
+     * channel is built, so most calls are already no-ops — but the reason for the
+     * pin is the read side, not the write side. See the note above the class.
+     *
+     * Silently ignores anything unusable (absent, relative, or a scheme that has
+     * no meaningful origin), and an unusable value never pins: the parse comes
+     * first and the field is assigned only on success. This runs at the top of a
+     * turn, where a diagnostic value must never be the thing that fails it; the
+     * throw belongs at {@link require}, where something actually wanted the value.
+     */
+    note(url: string | undefined): void;
+    /** The pinned origin, or `undefined` when nothing has carried one yet. */
+    peek(): string | undefined;
+    /**
+     * The pinned origin, for a caller that cannot proceed without it.
+     *
+     * Throws naming the timing, because that is what the mistake always is: the
+     * value arrives with a turn, so `onStart`, a constructor and a scheduled
+     * callback all run before any request has said what this deployment is called.
+     */
+    require(): string;
+}

package/dist/a2a/self-origin.js

@@ -0,0 +1,114 @@
+/**
+ * This deployment's own public origin — learned from the request path, never
+ * configured.
+ *
+ * ## Why an agent needs it at all
+ *
+ * A Worker that only *answers* never needs to know its own name.
+ * {@link file://../worker/index.ts createA2AWorker} derives its audience, its
+ * card and its `jku` from `new URL(request.url).origin`, and none of it outlives
+ * the request. An agent that **calls out** mint-signed does need it:
+ * {@link file://./caller-token.ts signCallerToken} puts it in `iss` and derives
+ * the token's `jku` from it. That call happens inside a Durable Object, where
+ * there is no `Request` — which is the whole difficulty.
+ *
+ * The obvious answer is a `SELF_ORIGIN` secret, and it is the wrong one. It
+ * restates a value the request already carries, and it has to be kept
+ * byte-identical by hand with the origin allowlist on the far side, in every
+ * environment, forever. Both siblings that tried it took it back out:
+ * `looping-anthropic-proxy` deleted `PROXY_AUDIENCE` in favour of `url.origin`,
+ * and `looping-gateway` discovers its own origin from the first
+ * signature-verified request rather than being told.
+ *
+ * ## Where the value comes from
+ *
+ * Core already sends the origin into the Durable Object on every turn, one field
+ * short of this use. `A2AExecutor` computes `jku` as `${origin}${jwksPath}` and
+ * it rides {@link file://./push.ts TurnPushContext} through the Workflow into
+ * `runTaskTurn` and `executeSubtaskChunk`.
+ *
+ * That is the same origin `signCallerToken` needs, and not by coincidence: a
+ * caller token's `jku` **must** be the JWKS the verifier fetches, and `iss` must
+ * agree with it — the third check in {@link file://./verify.ts verify.ts}. An
+ * origin derived from anywhere else is exactly what that check exists to catch,
+ * so deriving it from the `jku` core already serves makes the agreement
+ * structural instead of clerical.
+ *
+ * ## Pinned on the first turn, and in memory
+ *
+ * The first origin an isolate is told wins, and later ones are ignored. That is
+ * not laziness about staleness — it is what makes the value safe to *read*.
+ *
+ * A Durable Object's input gate stays open across a non-storage await, and this
+ * package runs concurrent RPCs into one object by design (`round/workflow.ts`
+ * runs a round's branches under `Promise.all`). Mutable instance state can
+ * therefore change while a turn is awaiting a model call, and the credential
+ * thunks that read this are lazy — they run several frames below the turn, when
+ * the client is built. Pinned, the field is immutable after its first write, so
+ * every concurrent reader in the isolate gets the same string and no turn can
+ * sign as another turn's origin.
+ *
+ * The cost of pinning is what an agent does not have: several identities. An
+ * agent has one endpoint — the one its card advertises, the one a gateway calls
+ * and a verifier allowlists — so there is nothing to follow. Note the asymmetry
+ * with `looping-anthropic-proxy`, which derives its audience per request and
+ * refuses to cache: a *verifier* must accept every hostname it answers on, while
+ * a *signer* needs one stable identity.
+ *
+ * Nothing is persisted, which is what keeps a pin from outliving its truth. An
+ * isolate is fresh on every `wrangler deploy` and recycles on its own, so a moved
+ * deployment re-learns its origin from the next turn it serves.
+ */
+export class SelfOrigin {
+    observed;
+    /**
+     * Offer the origin of an absolute URL seen on the request path — a `jku`, an
+     * endpoint, or a bare origin. Only `.origin` is kept, so a path or a trailing
+     * slash cannot reach a token claim.
+     *
+     * **The first usable value wins**; every later call is a no-op, including one
+     * naming a different origin. Called at each RPC entry and again when the push
+     * channel is built, so most calls are already no-ops — but the reason for the
+     * pin is the read side, not the write side. See the note above the class.
+     *
+     * Silently ignores anything unusable (absent, relative, or a scheme that has
+     * no meaningful origin), and an unusable value never pins: the parse comes
+     * first and the field is assigned only on success. This runs at the top of a
+     * turn, where a diagnostic value must never be the thing that fails it; the
+     * throw belongs at {@link require}, where something actually wanted the value.
+     */
+    note(url) {
+        if (this.observed || !url)
+            return;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return;
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+            return;
+        this.observed = parsed.origin;
+    }
+    /** The pinned origin, or `undefined` when nothing has carried one yet. */
+    peek() {
+        return this.observed;
+    }
+    /**
+     * The pinned origin, for a caller that cannot proceed without it.
+     *
+     * Throws naming the timing, because that is what the mistake always is: the
+     * value arrives with a turn, so `onStart`, a constructor and a scheduled
+     * callback all run before any request has said what this deployment is called.
+     */
+    require() {
+        if (!this.observed) {
+            throw new Error("this deployment's own origin is not known on this instance yet: it is " +
+                "learned from the `jku` that arrives with every turn, so it is " +
+                "available inside a turn or a subtask chunk — not from onStart, a " +
+                "constructor or a scheduled callback");
+        }
+        return this.observed;
+    }
+}

package/dist/host/agent.d.ts

@@ -69,6 +69,17 @@ export declare abstract class LoopingAgent<TEnv extends Cloudflare.Env & AiEnv &
      * not depend on it surviving.
      */
     private identityKey?;
+    /**
+     * This deployment's own public origin, learned from the `jku` every turn
+     * carries and **pinned on the first one** this instance serves.
+     *
+     * Unlike {@link identityKey} this is shared by concurrent turns — the object
+     * is keyed by caller, not by origin — so it is pinned rather than
+     * last-write-wins: an immutable field cannot change under a credential thunk
+     * that reads it while a turn awaits a model call. See {@link SelfOrigin} for
+     * the full argument, and for why nothing is persisted.
+     */
+    private readonly selfOriginMemo;
     /**
      * Test-only model injection. A **field**, not a constructor argument or an RPC
      * parameter, so it never appears on the generated DO stub: production callers
@@ -197,6 +208,31 @@ export declare abstract class LoopingAgent<TEnv extends Cloudflare.Env & AiEnv &
      * exists.
      */
     protected requireIdentityKey(): string;
+    /**
+     * Offer this deployment's own origin from a value that carries it. The first
+     * usable one is kept for the life of the instance.
+     *
+     * Called wherever a {@link TurnPushContext} arrives — here for every agent
+     * shape, and at the entry of `RoundAgentBase`'s two RPCs, where the origin is
+     * needed *before* this channel would be built. All three matter because any of
+     * them can be the call that wakes a fresh isolate. Cheap and unfailing: past
+     * the first turn it is one truthiness check, and an unusable value is ignored
+     * rather than thrown, because a turn must not fail over this.
+     */
+    protected noteSelfOrigin(url: string | undefined): void;
+    /**
+     * This deployment's own public origin, if a turn has carried it to this
+     * instance yet. Constant once set, so it reads the same from any turn running
+     * on this object. See {@link SelfOrigin}.
+     */
+    protected selfOrigin(): string | undefined;
+    /**
+     * The same, for a caller that cannot proceed without it — signing a caller
+     * token with {@link file://../a2a/caller-token.ts signCallerToken} above all,
+     * whose `iss` this is. Throws naming the timing rather than producing a token
+     * with a nonsense issuer.
+     */
+    protected requireSelfOrigin(): string;
     /** The gateway callback channel for one turn. See {@link PushChannel}. */
     protected push(context: TurnPushContext): PushChannel;
     /**

package/dist/host/agent.js

@@ -5,6 +5,7 @@ import { resolveConfig } from "../config.js";
 import { AgentDB, stateOf } from "../db/index.js";
 import { callerContext } from "../a2a/caller.js";
 import { createPushChannel } from "../a2a/push.js";
+import { SelfOrigin } from "../a2a/self-origin.js";
 import { buildAgentSession } from "../agent/session.js";
 import { workersAIModels } from "../agent/workers-ai/index.js";
 /**
@@ -64,6 +65,17 @@ export class LoopingAgent extends Agent {
      * not depend on it surviving.
      */
     identityKey;
+    /**
+     * This deployment's own public origin, learned from the `jku` every turn
+     * carries and **pinned on the first one** this instance serves.
+     *
+     * Unlike {@link identityKey} this is shared by concurrent turns — the object
+     * is keyed by caller, not by origin — so it is pinned rather than
+     * last-write-wins: an immutable field cannot change under a credential thunk
+     * that reads it while a turn awaits a model call. See {@link SelfOrigin} for
+     * the full argument, and for why nothing is persisted.
+     */
+    selfOriginMemo = new SelfOrigin();
     /**
      * Test-only model injection. A **field**, not a constructor argument or an RPC
      * parameter, so it never appears on the generated DO stub: production callers
@@ -254,8 +266,40 @@ export class LoopingAgent extends Agent {
         }
         return (this.identityKey = key);
     }
+    /**
+     * Offer this deployment's own origin from a value that carries it. The first
+     * usable one is kept for the life of the instance.
+     *
+     * Called wherever a {@link TurnPushContext} arrives — here for every agent
+     * shape, and at the entry of `RoundAgentBase`'s two RPCs, where the origin is
+     * needed *before* this channel would be built. All three matter because any of
+     * them can be the call that wakes a fresh isolate. Cheap and unfailing: past
+     * the first turn it is one truthiness check, and an unusable value is ignored
+     * rather than thrown, because a turn must not fail over this.
+     */
+    noteSelfOrigin(url) {
+        this.selfOriginMemo.note(url);
+    }
+    /**
+     * This deployment's own public origin, if a turn has carried it to this
+     * instance yet. Constant once set, so it reads the same from any turn running
+     * on this object. See {@link SelfOrigin}.
+     */
+    selfOrigin() {
+        return this.selfOriginMemo.peek();
+    }
+    /**
+     * The same, for a caller that cannot proceed without it — signing a caller
+     * token with {@link file://../a2a/caller-token.ts signCallerToken} above all,
+     * whose `iss` this is. Throws naming the timing rather than producing a token
+     * with a nonsense issuer.
+     */
+    requireSelfOrigin() {
+        return this.selfOriginMemo.require();
+    }
     /** The gateway callback channel for one turn. See {@link PushChannel}. */
     push(context) {
+        this.noteSelfOrigin(context.jku);
         return createPushChannel(this.env.A2A_SIGNING_KEY, context);
     }
     /**

package/dist/round/agent.js

@@ -83,6 +83,9 @@ export class RoundAgentBase extends LoopingAgent {
      * number, and none can report the wrong one.
      */
     async runTaskTurn(input) {
+        // Before anything can reach a model: a round that calls out mint-signed
+        // needs this deployment's own origin, and this is where it arrives.
+        this.noteSelfOrigin(input.push?.jku);
         const budget = newTurnBudget(input.turnsRemaining);
         const verdict = await this.decideRound(input, budget);
         return { ...verdict, turns: budget.spent };
@@ -300,6 +303,10 @@ export class RoundAgentBase extends LoopingAgent {
      * not outcomes.
      */
     async executeSubtaskChunk(id, chunk, push) {
+        // Recorded here rather than left to `this.push(push)` below, which runs only
+        // after the chunk has already executed — and the child is handed this
+        // origin on the way in.
+        this.noteSelfOrigin(push?.jku);
         const prepared = await this.prepareChunk(id);
         if (prepared.kind === "terminal") {
             return { done: true, status: prepared.subtask.status, progress: [] };
@@ -482,9 +489,18 @@ export class RoundAgentBase extends LoopingAgent {
      * a second mismatch is a genuine lifecycle bug and must surface).
      */
     async executeChunkInChild(name, request, chunk, runtime) {
+        // A facet has no request path of its own: it is reached only from here, so
+        // this is the only way it can learn what this deployment is called. Passed
+        // as its own argument, never folded into `request`, for the same reason
+        // `chunk` is — the request is fingerprinted, and this is not part of what
+        // the execution *is*, so it must not be able to make a retry look like a
+        // different one. Pinned on both sides, so it cannot change under a run;
+        // undefined only on an instance no turn has reached, where the facet's own
+        // `requireSelfOrigin` produces the readable error.
+        const selfOrigin = this.selfOrigin();
         const child = await this.subAgent(this.subagentClass(), name);
         try {
-            return await child.executeChunk(request, chunk, runtime);
+            return await child.executeChunk(request, chunk, runtime, selfOrigin);
         }
         catch (err) {
             if (!String(err).includes(FINGERPRINT_MISMATCH))
@@ -492,7 +508,7 @@ export class RoundAgentBase extends LoopingAgent {
             console.warn("[agent] stale subagent state, recreating", { name });
             await this.deleteSubAgent(this.subagentClass(), name);
             const fresh = await this.subAgent(this.subagentClass(), name);
-            return await fresh.executeChunk(request, chunk, runtime);
+            return await fresh.executeChunk(request, chunk, runtime, selfOrigin);
         }
     }
     /** Let the owning plugin release whatever `resolveRuntime` acquired. */

package/dist/subagent/index.d.ts

@@ -102,6 +102,14 @@ export declare abstract class RecipeSubagentBase<TEnv extends Cloudflare.Env = C
      * to interrupt. See {@link abortRun}.
      */
     private inflight?;
+    /**
+     * This deployment's own public origin, as the parent DO passes it on every
+     * chunk, pinned from the first. In memory for the same reason {@link inflight}
+     * is: a facet is reached only through {@link executeChunk}, so an instance that
+     * lost it is an instance that will be told again before it can run anything.
+     * See {@link SelfOrigin}.
+     */
+    private readonly selfOriginMemo;
     onStart(): Promise<void>;
     /**
      * Idempotent schema bootstrap. Also called lazily from the RPCs so
@@ -111,17 +119,30 @@ export declare abstract class RecipeSubagentBase<TEnv extends Cloudflare.Env = C
     private ensureTables;
     /** The recipe's durable workspace, backed by this facet's own SQLite storage. */
     private workspace;
+    /**
+     * This deployment's own public origin, if the parent has passed it to this
+     * instance yet. See {@link SelfOrigin}.
+     */
+    protected selfOrigin(): string | undefined;
+    /**
+     * The same, for a caller that cannot proceed without it — a facet that signs
+     * its own caller tokens, above all. Mirrors `LoopingAgent.requireSelfOrigin`,
+     * because a facet must run on the same provider, and so the same credential
+     * path, as the parent that delegated to it.
+     */
+    protected requireSelfOrigin(): string;
     /**
      * Execute one durable chunk of a Subtask under the parent's resolved Recipe.
      *
      * A terminal outcome (completed / failed) is cached and replayed on retry. A
      * mid-run chunk persists its rolling state to `run_state` and returns a
-     * `done: false` yield for the Workflow to run another chunk. `chunk` is a
-     * separate argument — never part of `request` — so every chunk fingerprints
-     * identically and the cache/resume keys line up. Only transient platform faults
-     * throw (nothing cached), so a Workflow retry resumes from the last checkpoint.
+     * `done: false` yield for the Workflow to run another chunk. `chunk` and
+     * `selfOrigin` are separate arguments — never part of `request` — so every
+     * chunk fingerprints identically and the cache/resume keys line up. Only
+     * transient platform faults throw (nothing cached), so a Workflow retry
+     * resumes from the last checkpoint.
      */
-    executeChunk(request: RecipeExecutionRequest, _chunk: number, runtime?: SubtaskRuntime): Promise<RecipeChunkResult>;
+    executeChunk(request: RecipeExecutionRequest, _chunk: number, runtime?: SubtaskRuntime, selfOrigin?: string): Promise<RecipeChunkResult>;
     /**
      * Interrupt the chunk running here right now, so a cancellation lands on the
      * current model call instead of at the next chunk boundary (up to `chunkSoftMs`

package/dist/subagent/index.js

@@ -4,6 +4,7 @@ import { CHUNK_SOFT_MS } from "../platform.js";
 import { buildRecipeTools } from "../runtime/tool-families.js";
 import { RecipeValidationError, validateRecipe } from "../contract/validation.js";
 import { SubtaskParamsError } from "../subtasks/subtask-types.js";
+import { SelfOrigin } from "../a2a/self-origin.js";
 import { renderSubagentPrompt } from "./prompt.js";
 import { makeWorkspaceHandle } from "./workspace.js";
 import { fingerprintRequest } from "./fingerprint.js";
@@ -77,6 +78,14 @@ export class RecipeSubagentBase extends Agent {
      * to interrupt. See {@link abortRun}.
      */
     inflight;
+    /**
+     * This deployment's own public origin, as the parent DO passes it on every
+     * chunk, pinned from the first. In memory for the same reason {@link inflight}
+     * is: a facet is reached only through {@link executeChunk}, so an instance that
+     * lost it is an instance that will be told again before it can run anything.
+     * See {@link SelfOrigin}.
+     */
+    selfOriginMemo = new SelfOrigin();
     async onStart() {
         this.ensureTables();
     }
@@ -107,18 +116,39 @@ export class RecipeSubagentBase extends Agent {
     workspace() {
         return (this._workspace ??= this.subagentRuntime().workspaceBacking(this.ctx.storage.sql, () => this.name));
     }
+    /**
+     * This deployment's own public origin, if the parent has passed it to this
+     * instance yet. See {@link SelfOrigin}.
+     */
+    selfOrigin() {
+        return this.selfOriginMemo.peek();
+    }
+    /**
+     * The same, for a caller that cannot proceed without it — a facet that signs
+     * its own caller tokens, above all. Mirrors `LoopingAgent.requireSelfOrigin`,
+     * because a facet must run on the same provider, and so the same credential
+     * path, as the parent that delegated to it.
+     */
+    requireSelfOrigin() {
+        return this.selfOriginMemo.require();
+    }
     /**
      * Execute one durable chunk of a Subtask under the parent's resolved Recipe.
      *
      * A terminal outcome (completed / failed) is cached and replayed on retry. A
      * mid-run chunk persists its rolling state to `run_state` and returns a
-     * `done: false` yield for the Workflow to run another chunk. `chunk` is a
-     * separate argument — never part of `request` — so every chunk fingerprints
-     * identically and the cache/resume keys line up. Only transient platform faults
-     * throw (nothing cached), so a Workflow retry resumes from the last checkpoint.
+     * `done: false` yield for the Workflow to run another chunk. `chunk` and
+     * `selfOrigin` are separate arguments — never part of `request` — so every
+     * chunk fingerprints identically and the cache/resume keys line up. Only
+     * transient platform faults throw (nothing cached), so a Workflow retry
+     * resumes from the last checkpoint.
      */
-    async executeChunk(request, _chunk, runtime = {}) {
+    async executeChunk(request, _chunk, runtime = {}, selfOrigin) {
         this.ensureTables();
+        // Before `subagentRuntime()`, which is where a host builds its model runtime
+        // — and a facet running on a provider it authenticates to mint-signed reads
+        // this origin from there.
+        this.selfOriginMemo.note(selfOrigin);
         const rt = this.subagentRuntime();
         const fingerprint = await fingerprintRequest(request);
         // A terminal result already exists → replay it (idempotent retry).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loopingai/core",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Shared, mandatory foundation for Looping agents on Cloudflare Workers: zero-trust A2A, durable task lifecycle, delegation and subagent runtime, test harness.",
   "keywords": [
     "a2a",

package/scripts/generate-keys.mjs

@@ -7,7 +7,7 @@
  * registration (Trust-On-First-Use). No secret is shared in either direction —
  * see `src/a2a/verify.ts` for the other half of the contract.
  *
- *   node scripts/generate-keys.mjs              # print both halves
+ *   node scripts/generate-keys.mjs              # print the private JWK
  *   node scripts/generate-keys.mjs --kid my-key # choose the key id
  *
  * The `kid` is required, not decorative: it goes in the JWS protected header and
@@ -24,30 +24,25 @@ const kid =
     ? args[kidFlag + 1]
     : `a2a-${new Date().toISOString().slice(0, 10)}`;
 
-// `extractable` is required to export the private half at all.
-const { privateKey, publicKey } = await generateKeyPair("EdDSA", {
+// `extractable` is required to export the private half at all. Only the
+// private half is printed: the public one is derived from it at runtime and
+// served at the JWKS route, so there is nothing to copy anywhere.
+const { privateKey } = await generateKeyPair("EdDSA", {
   crv: "Ed25519",
   extractable: true
 });
 
 const priv = { ...(await exportJWK(privateKey)), kid };
-const pub = { ...(await exportJWK(publicKey)), kid, use: "sig", alg: "EdDSA" };
 
-console.log("A2A_SIGNING_KEY (private — set as a secret, never commit):\n");
-console.log(JSON.stringify(priv));
+console.log(`\nGenerated Ed25519 keypair (kid: ${kid})\n`);
 console.log(
-  "\nPublic JWKS (served at the card's `jku`, derived at runtime):\n"
+  "Add this line to .env — it is the private half, never commit it:\n"
+);
+console.log(`A2A_SIGNING_KEY=${JSON.stringify(priv)}\n`);
+console.log(
+  "To deploy it, push the whole file or just this one secret:\n\n" +
+    "  npx wrangler deploy --secrets-file .env\n" +
+    "  npx wrangler secret put A2A_SIGNING_KEY\n\n" +
+    "The public half is not configured anywhere — the Worker derives it from\n" +
+    "the private key and serves it at the JWKS route.\n"
 );
-console.log(JSON.stringify({ keys: [pub] }, null, 2));
-console.log(`
-Next:
-
-  # local
-  echo 'A2A_SIGNING_KEY=<the private JSON above>' >> .dev.vars
-
-  # deployed
-  npx wrangler secret put A2A_SIGNING_KEY
-
-The public half is not configured anywhere — the Worker derives it from the
-private key and serves it at the JWKS route.
-`);