@mcsherrylabs/pi-meerkat 0.7.0 → 0.10.1

package/installer/runtime-control.mjs

@@ -0,0 +1,335 @@
+// Fixed-target installer helper, not an MCP tool or arbitrary URL/shell executor.
+import { mkdir, readFile, writeFile, unlink, lstat } from 'node:fs/promises';
+import { publishSessionPid } from './session-files.mjs';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { loadFacadeConfig, saveFacadeConfig } from '../dist/mcp-config.js';
+const [mode, argument] = process.argv.slice(2);
+const TIMEOUT = 180_000;
+const agentDir = '/meerkat/agent';
+const configPath = join(agentDir, 'facade.json');
+async function json(path, headers) {
+  const response = await fetch(path, { headers: { Accept: 'application/json', ...headers }, signal: AbortSignal.timeout(5000) });
+  if (!response.ok) throw new Error(`read ${new URL(path).pathname}: HTTP ${response.status}`);
+  return response.json();
+}
+async function until(description, check) {
+  const end = Date.now() + TIMEOUT;
+  let reason = 'not observed';
+  while (Date.now() < end) {
+    try { return await check(); } catch (e) { if (e?.permanent) throw e; reason = e instanceof Error ? e.message : 'read failed'; }
+    await new Promise(resolve => setTimeout(resolve, 200));
+  }
+  throw new Error(`${description} not ready within ${TIMEOUT / 1000}s: ${reason}; state retained, nothing reset`);
+}
+
+// DevNet catch-up is long (~14k blocks) and progress stays observable. A fixed short deadline
+// would fail a healthy sync, so this waits generously, fails only on STALLED progress, and reports
+// advancement to stderr only. `readProgress` returns null (not observed yet), `{ done: value }`
+// (finished), or `{ progress: scalar }` (still advancing). Progress must be comparable with `<=`;
+// the wait succeeds only on `done`, and fails on a stall or the whole budget expiring.
+async function untilProgress(description, readProgress, { budgetMs = 45 * 60 * 1000, stallMs = 10 * 60 * 1000 } = {}) {
+  const end = Date.now() + budgetMs;
+  let last = null, lastAt = Date.now(), started = false;
+  while (Date.now() < end) {
+    const value = await readProgress();
+    if (value && value.done !== undefined) return value.done;
+    if (value && value.progress !== undefined) {
+      if (!started) { started = true; lastAt = Date.now(); }
+      if (last === null || value.progress > last) { last = value.progress; lastAt = Date.now(); }
+    }
+    if (started && Date.now() - lastAt > stallMs)
+      throw new Error(`${description} stalled (no progress for ${Math.round((Date.now() - lastAt) / 1000)}s at ${last}); state retained, nothing reset`);
+    if (started && last !== null && Date.now() - lastAt > 30_000) process.stderr.write(`[installer] ${description} at ${last}…\n`);
+    await new Promise(resolve => setTimeout(resolve, 1000));
+  }
+  throw new Error(`${description} not observed within ${Math.round(budgetMs / 1000)}s (last ${last}); state retained, nothing reset`);
+}
+async function child(command, args, env) {
+  await new Promise((resolve, reject) => {
+    const proc = spawn(command, args, { env, stdio: ['ignore', 'ignore', 'pipe'] });
+    let reason = '';
+    proc.stderr.on('data', data => { reason = (reason + String(data)).slice(-8192); });
+    const timer = setTimeout(() => proc.kill('SIGTERM'), TIMEOUT);
+    const hard = setTimeout(() => proc.kill('SIGKILL'), TIMEOUT + 5000);
+    proc.once('error', reject);
+    proc.once('close', code => { clearTimeout(timer); clearTimeout(hard);
+      code === 0 ? resolve() : reject(new Error(`released Evolver bootstrap failed: ${reason}`)); });
+  });
+}
+function parameters() {
+  const args = JSON.parse(argument);
+  if (!/^[A-Za-z0-9]{1,50}$/.test(args.nodeId) || !/^[A-Za-z0-9]{1,50}$/.test(args.identity) ||
+      typeof args.channel !== 'string' || !args.channel) throw new Error('invalid saved deployment parameters');
+  if (args.mode === 'devnet') {
+    if (args.channel !== 'ce.meerkat.announcements') throw new Error('invalid saved devnet channel');
+  } else if (args.mode === 'local') {
+    if (!/^meerkat\.[0-9a-f]{24}\.announcements$/.test(args.channel)) throw new Error('invalid saved local channel');
+    if (!/^[A-Za-z0-9]{1,50}$/.test(args.committeeId)) throw new Error('invalid saved local committee identity');
+  } else {
+    throw new Error('invalid saved installation mode');
+  }
+  if (args.binding && (args.binding.nodeId !== args.nodeId || !/^[0-9a-f]{64}$/.test(args.binding.chainId))) throw new Error('invalid saved binding');
+  return args;
+}
+const sessions = join(agentDir, 'sessions');
+function sessionPath(token) {
+  if (!/^[0-9a-f]{32}$/.test(token)) throw new Error('invalid owned session token');
+  return join(sessions, `${token}.json`);
+}
+async function stopSession(token) {
+  const path = sessionPath(token);
+  let saved;
+  try { saved = JSON.parse(await readFile(path, 'utf8')); }
+  catch (e) { if (e.code === 'ENOENT') return; throw e; }
+  if (!Number.isSafeInteger(saved.pid) || (saved.pid !== 0 && saved.pid < 2)) throw new Error('invalid owned session process');
+  if (saved.pid === 0) {
+    // The host allocated this token before starting exec; cancellation wins the startup race.
+    await writeFile(`${path}.cancel`, '', { flag: 'wx', mode: 0o600 }).catch(e => { if (e.code !== 'EEXIST') throw e; });
+  } else {
+    let cmd;
+    try { cmd = (await readFile(`/proc/${saved.pid}/cmdline`, 'utf8')).split('\0'); }
+    catch (e) {
+      if (e.code === 'ENOENT') {
+        try { await lstat(path); } catch (gone) { if (gone.code === 'ENOENT') return; throw gone; }
+        throw new Error('owned session ended without cleanup; no PID reuse or lock recovery');
+      }
+      throw e;
+    }
+    if (!cmd.includes('serve-session') || !cmd.includes(token)) throw new Error('owned session PID no longer matches; refusing signal');
+    process.kill(saved.pid, 'SIGTERM');
+  }
+  const end = Date.now() + 15_000;
+  while (Date.now() < end) {
+    try {
+      await lstat(path);
+      if (saved.pid === 0 && JSON.parse(await readFile(path, 'utf8')).pid > 0) { await stopSession(token); return; }
+    } catch (e) { if (e.code === 'ENOENT') return; throw e; }
+    await new Promise(resolve => setTimeout(resolve, 25));
+  }
+  throw new Error('owned facade did not finish child/socket cleanup within 15s');
+}
+async function main() {
+  if (mode === 'prepare-session') {
+    await mkdir(sessions, { recursive: true, mode: 0o700 });
+    await writeFile(sessionPath(argument), JSON.stringify({ pid: 0 }), { flag: 'wx', mode: 0o600 });
+    return;
+  }
+  if (mode === 'discard-session') {
+    const path = sessionPath(argument);
+    const saved = JSON.parse(await readFile(path, 'utf8'));
+    if (saved.pid !== 0) throw new Error('cannot discard a running owned session');
+    await unlink(path);
+    return;
+  }
+  if (mode === 'serve-session') {
+    const path = sessionPath(argument);
+    const saved = JSON.parse(await readFile(path, 'utf8'));
+    if (saved.pid !== 0) throw new Error('owned session token is already running');
+    // Import/configuration has a startup interval before the facade installs its handlers.
+    // Install guards BEFORE publishing the PID; publish atomically so a concurrent stop never
+    // sees a truncated/partial descriptor or a live PID with no cleanup handler.
+    let cancelled = false;
+    const earlyStop = () => { cancelled = true; };
+    process.once('SIGTERM', earlyStop); process.once('SIGINT', earlyStop);
+    try {
+      await publishSessionPid(path, process.pid);
+      try { await lstat(`${path}.cancel`); cancelled = true; } catch (e) { if (e.code !== 'ENOENT') throw e; }
+      if (cancelled) return;
+      process.argv = [process.execPath, new URL('../dist/mcp-cli.js', import.meta.url).pathname, '--config', configPath];
+      // The CLI's existing shutdown path handles EOF/signals and awaits its exact private child.
+      const facade = import('../dist/mcp-cli.js');
+      const abort = setInterval(() => { if (cancelled && process.listenerCount('SIGTERM') > 0) process.emit('SIGTERM'); }, 10);
+      try { await facade; } finally { clearInterval(abort); }
+    } finally {
+      process.off('SIGTERM', earlyStop); process.off('SIGINT', earlyStop);
+      await unlink(path);
+      await unlink(`${path}.cancel`).catch(e => { if (e.code !== 'ENOENT') throw e; });
+    }
+    return;
+  }
+  if (mode === 'stop-session') { await stopSession(argument); return; }
+  const args = parameters();
+  if (mode === 'committee-ready') {
+    await until('owned local consensus committee', async () => {
+      const status = await json('http://committee:8440/status');
+      if (status.nodeId && status.nodeId !== args.committeeId) throw Object.assign(new Error('owned committee identity differs'), { permanent: true });
+      if (status.nodeId !== args.committeeId || !Number.isInteger(status.blockHeight) || status.blockHeight < 2 || status.selfQuorumIndex !== 0 || status.appliedRound !== null)
+        throw new Error('committee has not committed/funded its local chain with ordinary apply');
+    });
+    return;
+  }
+  if (mode === 'node-binding') {
+    // DevNet followers sync from block 0 (~14k blocks); wait generously and fail on STALL, not a
+    // short fixed deadline. Local is a fresh committee and becomes ready quickly.
+    const chainId = args.mode === 'devnet' ? 'c8925985ae7948d2e608efcf863928d15476c4b561ad773fdca6f0d53d4fea05' : undefined;
+    const reads = async () => {
+      try {
+        const value = await json('http://node:8440/api/channel/processor-state');
+        if (!value.processing || !/^[0-9a-f]{64}$/.test(value.binding?.chainId)) {
+          // Followers report a synced height while catching up; expose it as stalled-detectable progress.
+          try {
+            const status = await json('http://node:8440/status');
+            if (Number.isInteger(status.blockHeight) && status.blockHeight >= 0) return { progress: status.blockHeight };
+          } catch { /* not up yet */ }
+          return null;
+        }
+        if (value.binding.nodeId !== args.nodeId) throw Object.assign(new Error('owned node identity differs; refusing re-pairing'), { permanent: true });
+        if (args.binding && args.binding.chainId !== value.binding.chainId) throw Object.assign(new Error('saved genesis differs; refusing re-pairing'), { permanent: true });
+        if (chainId && value.binding.chainId !== chainId) throw Object.assign(new Error('devnet chain id differs; refusing pairing'), { permanent: true });
+        return { done: value.binding };
+      } catch (e) { if (e?.permanent) throw e; return null; }
+    };
+    const binding = args.mode === 'devnet'
+      ? await untilProgress('devnet follower catch-up/processing readiness', reads)
+      : await until('owned processing node', async () => {
+          const value = await reads();
+          if (value === null) throw new Error('processing/genesis observation not ready');
+          if (value.done === undefined) throw new Error('processing/genesis observation not ready');
+          return value.done;
+        });
+    process.stdout.write(JSON.stringify(binding) + '\n');
+    return;
+  }
+  if (!args.binding) throw new Error('missing saved node binding');
+  const headers = { 'x-evolver-chain-id': args.binding.chainId, 'x-evolver-node-id': args.binding.nodeId };
+  if (mode === 'ready') {
+    // DevNet's read-only registry must walk the shared channel's full history (~14k blocks of
+    // announcements) before it can serve faithfully; wait on its walk progress, not a fixed deadline.
+    // Local's channel is freshly claimed and walks almost immediately.
+    const check = async () => {
+      const summary = await json('http://127.0.0.1:8090/summary', headers);
+      await json('http://127.0.0.1:8090/inbox', headers);
+      if (summary.channel !== args.channel) throw new Error('registry channel differs');
+      const terms = await json(`http://node:8440/api/explorer/channels/${encodeURIComponent(args.channel)}`);
+      if (!Array.isArray(terms.owners) || !terms.owners.length || terms.writePolicy !== 'open' || terms.da) throw new Error('registry channel not provisioned with open writes/no DA');
+      return summary;
+    };
+    if (args.mode === 'devnet') {
+      await untilProgress('devnet registry channel walk/index', async () => {
+        try {
+          const summary = await check();
+          const asOf = Number(summary.asOfRound), tip = Number(summary.tipRound);
+          if (Number.isSafeInteger(asOf) && Number.isSafeInteger(tip) && tip >= 0) {
+            // Fully caught up (asOf >= tip) with everything else already valid via check().
+            return asOf >= tip ? { done: true } : { progress: asOf };
+          }
+          return null;
+        } catch (e) { if (e?.permanent) throw e; return null; }
+      });
+    } else {
+      await until('Meerkat registry/channel/inbox', async () => { await check(); });
+    }
+    return;
+  }
+  if (mode === 'bootstrap') {
+    const { resolveUpstreamBin } = await import('../dist/mcp-upstream.js');
+    const cli = await resolveUpstreamBin();
+    const devnet = args.mode === 'devnet';
+    const childEnv = {
+      PATH: process.env.PATH, HOME: agentDir, EVOLVER_NODE: 'http://node:8440', EVOLVER_CONTENT_URL: 'http://node:8450',
+      EVOLVER_FAUCET_URL: devnet ? 'https://devnet.mcsherrylabs.com' : 'http://committee:8440',
+      EVOLVER_MCP_STATE_DIR: agentDir, EVOLVER_BOOTSTRAP_CWD: agentDir,
+    };
+    await child(process.execPath, [cli, '--bootstrap', '--target', devnet ? 'devnet' : 'local', '--identity', args.identity], childEnv);
+    const config = { version: 1, url: 'http://node:8440', identity: args.identity, tls: { insecure: false },
+      meerkat: { contentUrl: 'http://node:8450', keyPath: join(agentDir, `${args.identity}.key`), keyType: 'bls',
+        registryUrl: 'http://127.0.0.1:8090', chainId: args.binding.chainId, nodeId: args.nodeId, channel: args.channel,
+        controlSocketPath: '/control/control.sock' } };
+    let existing;
+    try { existing = await loadFacadeConfig(configPath); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    if (existing) { if (JSON.stringify(existing) !== JSON.stringify(config)) throw new Error('unrelated saved facade authority; refusing replacement'); }
+    else await saveFacadeConfig(configPath, config);
+    return;
+  }
+  if (mode === 'claim-channel') {
+    // LOCAL only: the agent identity owns the install's private channel. Claim it ONCE through the
+    // released child's own tools (sign + submit), so the agent key never leaves the child. Read the
+    // terms first; already owned by the agent → done; owned by someone else → refuse; unclaimed →
+    // claim then reconcile by reading (never blind-resend).
+    if (args.mode !== 'local') throw new Error('claim-channel is a local-mode operation only');
+    const { OwnedUpstream } = await import('../dist/mcp-upstream.js');
+    const { claimTxId, submissionResult } = await import('../dist/mcp-announce.js');
+    const facadeConfig = await loadFacadeConfig(configPath);
+    // CHAIN-AGREED view (the local committee), never the processing node: a processing node answers
+    // committed-state reads as of its cursor, so a claim it has not applied yet reads `owners: []`.
+    const termsUrl = () => `http://committee:8440/api/explorer/channels/${encodeURIComponent(args.channel)}`;
+    const readTerms = async () => { const r = await fetch(termsUrl(), { signal: AbortSignal.timeout(10000) }); if (!r.ok) throw new Error(`HTTP ${r.status}`); return r.json(); };
+    const ownersOf = terms => Array.isArray(terms.owners) ? terms.owners : [];
+    // The claim commits asynchronously after submit; poll the terms (up to 180s) so the
+    // reconcile-by-read settles regardless of commit latency, never a single immediate read.
+    const awaitOwned = async () => {
+      const end = Date.now() + 180_000;
+      while (Date.now() < end) {
+        const owners = ownersOf(await readTerms());
+        if (owners.some(o => o.name === args.identity)) return;
+        if (owners.length > 0) throw new Error(`channel ${args.channel} is owned by ${owners.map(o => o.name).join(', ')} — refusing to claim`);
+        await new Promise(resolve => setTimeout(resolve, 1000));
+      }
+      throw new Error(`channel ${args.channel} was not claimed by the agent within 180s — refusing to proceed`);
+    };
+    // Already owned by us (from a prior, possibly crashed, claim) → done, idempotent.
+    if (ownersOf(await readTerms()).some(o => o.name === args.identity)) {
+      process.stderr.write(`[installer] channel ${args.channel} already owned by the agent — nothing to claim\n`);
+      return;
+    }
+    // The processing node refuses submissions (`node_not_ready`) until its own node identity is
+    // established. Wait until the chain-agreed view has that identity before signing anything.
+    const identityEnd = Date.now() + 180_000;
+    for (;;) {
+      const r = await fetch(`http://committee:8440/api/identity/${encodeURIComponent(args.nodeId)}`, { signal: AbortSignal.timeout(10000) }).catch(() => null);
+      if (r?.status === 200) break;
+      if (Date.now() > identityEnd) throw new Error(`node identity ${args.nodeId} not established on chain within 180s; nothing submitted`);
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+    // The processing node submits through an admit filter keyed on the AGENT identity (claimed by
+    // the earlier `bootstrap` mode), and in processing mode its applied state is paced by the
+    // facade's own polls — so the agent identity can lag behind the committee's chain-agreed view.
+    // A submission in that window is refused with `unknown_key` (`admitFilter rejected
+    // (UnknownKey)`), which ordered and charged nothing but is final (never blind-resend). Wait for
+    // the processing node itself to report the agent identity before signing, so the claim is
+    // admitted on the first submission instead of racing its apply.
+    const agentIdentityEnd = Date.now() + 180_000;
+    for (;;) {
+      const r = await fetch(`http://node:8440/api/identity/${encodeURIComponent(args.identity)}`, { signal: AbortSignal.timeout(10000) }).catch(() => null);
+      if (r?.status === 200) break;
+      if (Date.now() > agentIdentityEnd) throw new Error(`agent identity ${args.identity} not applied by the processing node within 180s; nothing submitted`);
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+    // Sign then submit in ONE owned child session, then reconcile by reading (never blind-resend).
+    // Only `node_not_ready` is retried: it is a definite refusal that ordered and charged nothing.
+    // The child blocks repeat submission within a session, so a retry closes that session and signs
+    // afresh in a new one; the refused transaction was never ordered, so this cannot pay twice.
+    const submitEnd = Date.now() + 180_000;
+    let outcome;
+    for (;;) {
+      const upstream = new OwnedUpstream(facadeConfig);
+      await upstream.connect();
+      try {
+        const txId = claimTxId(await upstream.callTool('evolver_sign_claim_channel', { channel: args.channel, writePolicy: 'open' }), args.channel);
+        try {
+          outcome = submissionResult(await upstream.callTool('evolver_submit', { txId }), txId);
+        } catch (e) {
+          // Submit outcome unknown; reconcile by reading, never resend.
+          process.stderr.write(`[installer] claim submit uncertain (${e instanceof Error ? e.message : String(e)}) — reconciling by reading\n`);
+          outcome = undefined;
+        }
+      } finally {
+        await upstream.close();
+      }
+      if (!(outcome?.kind === 'refused' && outcome.reason === 'node_not_ready') || Date.now() > submitEnd) break;
+      process.stderr.write('[installer] node not ready for submissions yet (nothing ordered or charged) — retrying with a fresh claim\n');
+      await new Promise(resolve => setTimeout(resolve, 3000));
+    }
+    // A definite refusal or fine is final: report the chain's own reason, never wait or resend.
+    if (outcome && (outcome.kind === 'refused' || outcome.kind === 'fined'))
+      throw new Error(`channel ${args.channel} claim was ${outcome.kind} by the chain: ${outcome.message}`);
+    if (outcome && outcome.kind !== 'committed')
+      process.stderr.write(`[installer] claim submit outcome ${outcome.kind} — reconciling by reading\n`);
+    await awaitOwned();
+    process.stderr.write(`[installer] channel ${args.channel} claimed (open) by the agent\n`);
+    return;
+  }
+  throw new Error('unknown installer runtime operation');
+}
+await main().catch(error => { console.error(error instanceof Error ? error.message : 'installer runtime failed'); process.exitCode = 1; });

package/installer/session-files.mjs

@@ -0,0 +1,16 @@
+// A remote session PID must become visible all at once; stop-session may read concurrently.
+import { open, rename, unlink } from 'node:fs/promises';
+export async function publishSessionPid(path, pid, prepared = async () => {}) {
+  const temporary = `${path}.${pid}.tmp`;
+  const handle = await open(temporary, 'wx', 0o600);
+  let renamed = false;
+  try {
+    try { await handle.writeFile(JSON.stringify({ pid })); await handle.sync(); }
+    finally { await handle.close(); }
+    await prepared();
+    await rename(temporary, path);
+    renamed = true;
+  } finally {
+    if (!renamed) await unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; });
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcsherrylabs/pi-meerkat",
-  "version": "0.7.0",
-  "description": "Meerkat stdio MCP facade and registry tools, with a private pinned Evolver MCP child. Owns the announcement wire contract and preserves the existing Pi extension.",
+  "version": "0.10.1",
+  "description": "Meerkat zero-parameter DevNet installer (local chain with --local), stdio MCP facade and registry tools, with a private pinned Evolver MCP child. Preserves the announcement contract and existing Pi extension.",
   "bin": {
     "meerkat-mcp": "./dist/mcp-cli.js"
   },
@@ -17,7 +17,7 @@
     }
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node ../../scripts/bundle-installer.mjs",
     "prepack": "npm run build",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
@@ -25,13 +25,13 @@
     "check:surface": "tsx test/surface-checks.ts",
     "test": "npm run build && npm run typecheck && npm run check:contract && npm run check:surface && npm run check:inbox && npm run check:mcp:unit && npm run check:plan-two:client",
     "check:inbox": "tsx test/inbox-tool-checks.ts",
-    "check:mcp:unit": "tsx test/mcp-announce-checks.ts && tsx test/mcp-facade-unit-checks.ts",
+    "check:mcp:unit": "tsx test/mcp-announce-checks.ts && tsx test/mcp-facade-unit-checks.ts && tsx test/installer-checks.ts && tsx test/detail-read-checks.ts && node test/installer-session-checks.mjs",
     "check:plan-two:client": "tsx test/mcp-client-checks.ts"
   },
   "dependencies": {
-    "@mcsherrylabs/evolver-client": "0.22.1",
-    "@mcsherrylabs/evolver-core": "0.1.0",
-    "@mcsherrylabs/evolver-mcp": "0.15.0",
+    "@mcsherrylabs/evolver-client": "0.23.0",
+    "@mcsherrylabs/evolver-core": "0.2.1",
+    "@mcsherrylabs/evolver-mcp": "0.16.0",
     "@modelcontextprotocol/sdk": "1.32.1",
     "typebox": "1.3.32"
   },
@@ -48,6 +48,7 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
+    "installer",
     "extensions",
     "skills",
     "README.md"

package/skills/channel-subscription/SKILL.md

@@ -11,8 +11,8 @@ The shared SDK processor is the node's ONE ordered-stream consumer. Never poll
 ## Subscription management
 
 This extension has no config-file or Docker restart tools. Use the managed MCP
-channel subscribe/unsubscribe/subscriptions tools
-when an operator has paired a private processor control socket with the expected
+channel subscribe/unsubscribe/subscriptions tools on the control socket, which
+the installer provisions automatically on a fresh install against the expected
 node and chain. An unmanaged endpoint cannot be configured by these tools.
 
 Saved choices, including an EMPTY set, override all startup/module defaults.
@@ -26,7 +26,7 @@ Removing its channel parks the module; re-enabling it does not replay old inbox
 
 ## Availability and reads
 
-A channel owner may use `evolver_sign_set_channel_da` to arrange availability through
+A channel owner may use `evolver_sign_channel_da` to arrange availability through
 a DA group containing the NODE identity, not the agent identity. Only the owner may
 change a channel's policy. Without DA, bodies are best effort.