@mmmbuto/nexuscrew 0.9.23 → 0.9.25

package/lib/fleet/cell-exec.js

@@ -9,7 +9,8 @@ const path = require('node:path');
 const { spawn } = require('node:child_process');
 const { MAX_PAYLOAD } = require('./launch-broker.js');
 const {
-  validDaemonChallenge, identityErrorCode, IDENTITY_FRAME_LIMIT, IDENTITY_TIMEOUT_MS,
+  validDaemonChallenge, validVerifyExpected, identityErrorCode,
+  IDENTITY_FRAME_LIMIT, IDENTITY_TIMEOUT_MS,
 } = require('./lease-client.js');
 
 const DEFAULT_SUPERVISE = Object.freeze({
@@ -110,9 +111,14 @@ function validLease(value) {
 
 function validPayload(payload) {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
-  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt', 'lease', 'identity'].includes(key))) return false;
+  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt', 'lease', 'identity', 'identityChannel'].includes(key))) return false;
   if (typeof payload.command !== 'string' || !payload.command || !Array.isArray(payload.args)) return false;
   if (!payload.env || typeof payload.env !== 'object' || Array.isArray(payload.env)) return false;
+  // Il launcher decide se il canale identita' esiste (managed.js) e lo dichiara
+  // nel payload con `identityChannel`: il supervisore non lo ricalcola. La chiave
+  // va quindi ammessa qui, e SOLO come booleano: un valore di altro tipo e' un
+  // payload malformato, non un "canale assente" (assente = caller precedente).
+  if (payload.identityChannel !== undefined && typeof payload.identityChannel !== 'boolean') return false;
   return payload.args.every((v) => typeof v === 'string')
     && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string')
     && validSupervise(payload.supervise)
@@ -176,20 +182,44 @@ function identityErrorResponse(id, code, message) {
   };
 }
 
+const IDENTITY_METHODS = new Set([
+  'nexuscrew/identity/challengeProof',
+  'nexuscrew/identity/verify',
+]);
+
 function validIdentityRequest(msg) {
   if (!msg || typeof msg !== 'object' || Array.isArray(msg)) return false;
   const keys = Object.keys(msg);
   if (keys.length !== 4 || !['jsonrpc', 'id', 'method', 'params'].every((key) => Object.hasOwn(msg, key))) return false;
-  if (msg.jsonrpc !== '2.0' || msg.method !== 'nexuscrew/identity/challengeProof') return false;
+  if (msg.jsonrpc !== '2.0' || !IDENTITY_METHODS.has(msg.method)) return false;
   if (!Number.isSafeInteger(msg.id) || msg.id < 0) return false;
   return true;
 }
 
+//  schema chiuso del metodo verify (v1). Il proof viene VERIFICATO
+// online dall'authority (C2): il daemon non valuta nulla da solo.
+function validVerifyRequest(msg, channelGeneration) {
+  if (msg.method !== 'nexuscrew/identity/verify') return false;
+  const params = msg.params;
+  if (!params || typeof params !== 'object' || Array.isArray(params)) return false;
+  // Verify v1.1: la tupla attesa {nonce, connectionId, daemonBootId, audience}
+  // e' opzionale (retro-compat v1) ma, se presente, ha schema chiuso.
+  if (Object.keys(params).length !== 3 && Object.keys(params).length !== 4) return false;
+  if (!Object.hasOwn(params, 'v') || !Object.hasOwn(params, 'generation')
+    || !Object.hasOwn(params, 'proof')) return false;
+  if (Object.hasOwn(params, 'expected') && !validVerifyExpected(params.expected)) return false;
+  if (params.v !== 1) return false;
+  if (!Number.isSafeInteger(params.generation) || params.generation !== channelGeneration) return false;
+  if (!params.proof || typeof params.proof !== 'object' || Array.isArray(params.proof)) return false;
+  return true;
+}
+
 function createIdentityChannel({
   request,
   response,
   generation,
   relay,
+  relayVerify,
   cancel = () => {},
   setTimeout: setTimer = (...args) => setTimeout(...args),
   clearTimeout: clearTimer = (timer) => { if (timer) clearTimeout(timer); },
@@ -264,12 +294,37 @@ function createIdentityChannel({
       return;
     }
     if (!validIdentityRequest(msg)
-      || !msg.params || typeof msg.params !== 'object' || Array.isArray(msg.params)
-      || Object.keys(msg.params).length !== 1 || !Object.hasOwn(msg.params, 'challenge')
-      || !validDaemonChallenge(msg.params.challenge)) {
+      || !msg.params || typeof msg.params !== 'object' || Array.isArray(msg.params)) {
       sendError(validIdentityRequest(msg) ? msg.id : 0, 'IDENTITY_UNVERIFIED', 'invalid request');
       return;
     }
+    if (msg.method === 'nexuscrew/identity/verify') {
+      if (typeof relayVerify !== 'function') {
+        sendError(msg.id, 'IDENTITY_UNVERIFIED', 'verify-unsupported');
+        return;
+      }
+      if (!validVerifyRequest(msg, generation)) {
+        sendError(msg.id, 'IDENTITY_UNVERIFIED', 'invalid request');
+        return;
+      }
+      const verifyRequestId = `g${generation}-v${nextRequestId}`;
+      nextRequestId += 1;
+      pending = {
+        requestId: verifyRequestId, rpcId: msg.id, generation, done: false,
+        timer: null, verify: true,
+      };
+      pending.timer = setTimer(() => settleVerify({ ok: false, reason: 'timeout' }), IDENTITY_TIMEOUT_MS);
+      if (pending.timer && typeof pending.timer.unref === 'function') pending.timer.unref();
+      Promise.resolve(relayVerify(verifyRequestId, msg.params.proof, msg.params.expected)).then(settleVerify, (error) => {
+        settleVerify({ ok: false, reason: error && error.code ? error.code : 'authority-unavailable' });
+      });
+      return;
+    }
+    if (Object.keys(msg.params).length !== 1 || !Object.hasOwn(msg.params, 'challenge')
+      || !validDaemonChallenge(msg.params.challenge)) {
+      sendError(msg.id, 'IDENTITY_UNVERIFIED', 'invalid request');
+      return;
+    }
     const requestId = `g${generation}-r${nextRequestId}`;
     nextRequestId += 1;
     pending = {
@@ -282,6 +337,26 @@ function createIdentityChannel({
     });
   };
 
+  //  esito del verify come RISULTATO JSON-RPC (ok:false e' una risposta
+  // valida, non un errore di trasporto). Solo un 'revoked' chiude il canale:
+  // il lease/generazione non c'e' piu', il daemon deve ribindare da zero.
+  const settleVerify = (outcome) => {
+    if (closed) return;
+    const current = pending;
+    if (!current || current.done) return;
+    current.done = true;
+    clearTimer(current.timer);
+    pending = null;
+    const ok = outcome && outcome.ok === true;
+    const payload = ok
+      ? { ok: true, v: 1, claims: outcome.claims }
+      : { ok: false, v: 1, reason: outcome && typeof outcome.reason === 'string' ? outcome.reason : 'identity-unverified' };
+    try {
+      response.write(`${JSON.stringify({ jsonrpc: '2.0', id: current.rpcId, result: payload })}\n`);
+    } catch (_) {}
+    if (!ok && payload.reason === 'revoked') close('REVOKED', 'revoked', current.rpcId, false);
+  };
+
   request.on('data', (chunk) => {
     if (closed) return;
     buffer += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
@@ -452,7 +527,16 @@ async function main(argv = process.argv.slice(2), seams = {}) {
   const sleep = seams.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const proc = seams.process || process;
   const writeError = seams.writeError || seams.stderrWrite || ((message) => process.stderr.write(message));
-  const childEnv = { ...payload.env, NEXUSCREW_IDENTITY_FD: '3:4' };
+  // Il canale identita' nasce SOLO se il launcher lo ha deciso: la stessa
+  // risoluzione che decide CODEX_APP_SERVER_IDENTITY_REQUIRED in managed.js
+  // viaggia nel payload come `identityChannel`. Derivarlo qui (aggiungere
+  // sempre fd 3:4) permetteva ai due di divergere: una cella standalone
+  // riceveva il canale, avviava l'handshake contro un lease server legacy che
+  // rispondeva 'revoked', e moriva. Un payload senza il campo (caller
+  // precedenti) conserva il comportamento di prima.
+  const identityChannel = payload.identityChannel !== false;
+  const childEnv = { ...payload.env };
+  if (identityChannel) childEnv.NEXUSCREW_IDENTITY_FD = '3:4';
   // tmux injects these only after the broker ticket was created. Preserve them
   // for the actual TUI and bind NexusCrew MCP callbacks to the owning session.
   if (process.env.TMUX) childEnv.TMUX = process.env.TMUX;
@@ -542,7 +626,11 @@ async function main(argv = process.argv.slice(2), seams = {}) {
       const promptCtl = startGenerationPrompt(payload.restartPrompt, generation, childState, seams);
       current = spawnImpl(payload.command, payload.args, {
         env: childEnv,
-        stdio: ['inherit', 'inherit', 'inherit', 'pipe', 'pipe'],
+        // Senza canale non si creano nemmeno le pipe: fd 3 e 4 chiusi nel
+        // child (non pipe aperte e inutilizzate).
+        stdio: identityChannel
+          ? ['inherit', 'inherit', 'inherit', 'pipe', 'pipe']
+          : ['inherit', 'inherit', 'inherit'],
       });
       // R1a (fix5): exit/error del figlio contano SUBITO, prima di qualunque
       // await — se il figlio esce durante l'handshake di generazione, l'evento
@@ -579,7 +667,15 @@ async function main(argv = process.argv.slice(2), seams = {}) {
           ),
           childExit.then(() => 'exited'),
         ]);
-        if (raced === 'ok' && !childSettled) {
+        if (!identityChannel) {
+          // Nessun canale da aprire: la transizione di generazione resta
+          // annunciata al lease (bookkeeping), ma l'identita' non esiste e
+          // non c'e' nessun fd da chiudere. L'uscita del figlio resta
+          // diagnostica.
+          if (raced === 'exited') {
+            writeError(`nexuscrew cell: figlio uscito durante l'handshake di generazione (gen ${generation})\n`);
+          }
+        } else if (raced === 'ok' && !childSettled) {
           identityCtl = createIdentityChannel({
             request: current && current.stdio && current.stdio[3],
             response: current && current.stdio && current.stdio[4],
@@ -587,6 +683,9 @@ async function main(argv = process.argv.slice(2), seams = {}) {
             relay: leaseCtl
               ? (requestId, challenge) => leaseCtl.challengeProof({ requestId, generation, challenge })
               : async () => ({ ok: false, reason: 'lease-down' }),
+            relayVerify: leaseCtl
+              ? (requestId, proof, expected) => leaseCtl.verifyProof({ requestId, generation, proof, expected })
+              : async () => ({ ok: false, reason: 'lease-down' }),
             cancel: leaseCtl
               ? (requestId) => leaseCtl.cancelIdentityChallenge(requestId)
               : () => {},
@@ -598,7 +697,7 @@ async function main(argv = process.argv.slice(2), seams = {}) {
         } else {
           writeError(`nexuscrew cell: generazione ${generation} senza identita' (${raced})\n`);
         }
-      } else {
+      } else if (identityChannel) {
         identityCtl = createIdentityChannel({
           request: current && current.stdio && current.stdio[3],
           response: current && current.stdio && current.stdio[4],
@@ -606,6 +705,9 @@ async function main(argv = process.argv.slice(2), seams = {}) {
           relay: leaseCtl
             ? (requestId, challenge) => leaseCtl.challengeProof({ requestId, generation, challenge })
             : async () => ({ ok: false, reason: 'lease-down' }),
+          relayVerify: leaseCtl
+            ? (requestId, proof, expected) => leaseCtl.verifyProof({ requestId, generation, proof, expected })
+            : async () => ({ ok: false, reason: 'lease-down' }),
           cancel: leaseCtl
             ? (requestId) => leaseCtl.cancelIdentityChallenge(requestId)
             : () => {},
@@ -676,5 +778,5 @@ if (require.main === module) {
 module.exports = {
   DEFAULT_SUPERVISE, LEASE_LOST_KILL_ESCALATION_MS, parseArgs, validSupervise, validRestartPrompt, validPayload, validLease,
   receivePayload, sanitizeSpawnError, normalizeSupervise, waitChild, startGenerationPrompt,
-  createIdentityChannel, validIdentityRequest, main,
+  createIdentityChannel, validIdentityRequest, validVerifyRequest, main,
 };

package/lib/fleet/cell-lease-server.js

@@ -43,7 +43,7 @@ const crypto = require('node:crypto');
 const L = require('./cell-lease.js');
 const { runtimeDir, ensureRuntimeDir } = require('./launch-broker.js');
 const { loadOrCreateVerifier, signProof, verifyProof, PROOF_TTL_MS } = require('./lease-verifier.js');
-const { validDaemonChallenge } = require('./lease-client.js');
+const { validDaemonChallenge, validVerifyExpected } = require('./lease-client.js');
 
 function sanitizeCell(cellId) {
   return String(cellId).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 64);
@@ -269,6 +269,10 @@ function createLeaseManager(cfg = {}, seams = {}) {
         handleChallengeProof(cellId, entry, socket, msg);
         return;
       }
+      if (msg.type === 'verify') {
+        handleVerify(cellId, entry, socket, msg);
+        return;
+      }
       if (msg.type === 'generation') {
         handleGeneration(cellId, entry, socket, msg);
         return;
@@ -365,6 +369,19 @@ function createLeaseManager(cfg = {}, seams = {}) {
     return true;
   }
 
+  //  il canale verify espone l'enum COMPLETO del contratto v1
+  // (docs/identity/verify-channel-v1.md): a differenza del relay
+  // challenge-proof (che collassa i motivi sensibili), qui la diagnostica
+  // puntuale e' parte del contratto — il daemon decide il fail-closed.
+  function identityVerifyReason(reason) {
+    const known = new Set([
+      'malformed', 'expired', 'bad-proof', 'replay', 'challenge-replay',
+      'revoked', 'generation', 'ownerInstanceId', 'cellId',
+      'incarnationId', 'launchEpoch', 'challenge_mismatch',
+    ]);
+    return known.has(reason) ? reason : 'identity-unverified';
+  }
+
   function identityRelayReason(reason) {
     if (reason === 'expired') return 'expired';
     if (reason === 'replay' || reason === 'challenge-replay') return 'replay';
@@ -417,7 +434,24 @@ function createLeaseManager(cfg = {}, seams = {}) {
     writeSafe(socket, { type: 'generationAck', generation: msg.generation });
   }
 
-  function handleChallengeProof(cellId, entry, socket, msg) {
+  function validCellRequestId(value) {
+  return (typeof value === 'string' && value.length > 0 && value.length <= 128)
+    || Number.isSafeInteger(value);
+}
+
+function validVerifyRequest(msg) {
+  if (!msg || typeof msg !== 'object' || Array.isArray(msg)) return false;
+  if (!validCellRequestId(msg.requestId)) return false;
+  if (msg.v !== 1) return false;
+  if (!Number.isSafeInteger(msg.generation) || msg.generation < 0) return false;
+  if (!msg.proof || typeof msg.proof !== 'object' || Array.isArray(msg.proof)) return false;
+  // Verify v1.1: la tupla attesa {nonce, connectionId, daemonBootId, audience}
+  // e' opzionale (retro-compat v1) ma, se presente, ha schema chiuso.
+  if (Object.hasOwn(msg, 'expected') && !validVerifyExpected(msg.expected)) return false;
+  return true;
+}
+
+function handleChallengeProof(cellId, entry, socket, msg) {
     if (!validChallengeProofRequest(msg)) {
       writeSafe(socket, { type: 'challengeProofResult', requestId: msg && msg.requestId, ok: false, reason: 'identity-unverified' });
       return;
@@ -436,6 +470,7 @@ function createLeaseManager(cfg = {}, seams = {}) {
     const issued = identityAuthority.issueConnectionProof({
       subject: { ...entry.subject },
       challenge: msg.challenge,
+      generation: msg.generation,
     });
     if (!issued || issued.ok !== true) {
       const reason = identityRelayReason(issued && issued.reason);
@@ -445,6 +480,73 @@ function createLeaseManager(cfg = {}, seams = {}) {
     writeSafe(socket, { type: 'challengeProofResult', requestId: msg.requestId, ok: true, proof: issued.proof });
   }
 
+  //  verifica ONLINE di un identity proof presso l'authority. Il proof
+  // viaggia, ma la decisione resta qui: l'authority ri-calcola l'HMAC, la
+  // finestra temporale, il replay (nonce single-use) e la revoca (jti), e i
+  // claims vengono confrontati col SUBJECT AUTENTICATO del lancio — mai con
+  // campi del messaggio (C7-bis). Fail-closed: qualunque esito non ok resta
+  // una negazione motivata, il canale non apre nulla.
+  function handleVerify(cellId, entry, socket, msg) {
+    if (!validVerifyRequest(msg)) {
+      writeSafe(socket, { type: 'verifyResult', requestId: msg && msg.requestId, ok: false, v: 1, reason: 'identity-unverified' });
+      return;
+    }
+    const current = cells.get(cellId);
+    if (!current || current !== entry || entry.socket !== socket
+      || !entry.lease || !L.isLive(entry.lease)
+      || entry.lease.generation !== msg.generation || !entry.subject) {
+      writeSafe(socket, { type: 'verifyResult', requestId: msg.requestId, ok: false, v: 1, reason: 'revoked' });
+      return;
+    }
+    if (!identityAuthority || typeof identityAuthority.verifyChallengeProof !== 'function') {
+      writeSafe(socket, { type: 'verifyResult', requestId: msg.requestId, ok: false, v: 1, reason: 'authority-unavailable' });
+      return;
+    }
+    const subject = entry.subject;
+    const checked = identityAuthority.verifyChallengeProof(msg.proof, {
+      ownerInstanceId: subject.ownerInstanceId,
+      cellId: subject.cellId,
+      incarnationId: subject.incarnationId,
+      launchEpoch: subject.launchEpoch,
+      // Verify v1.1: la tupla attesa del daemon viaggia nella richiesta e
+      // vincola il proof alla challenge emessa (mai claims del client).
+      ...(msg.expected ? msg.expected : {}),
+    });
+    if (!checked || checked.ok !== true) {
+      const reason = identityVerifyReason(checked && checked.reason);
+      writeSafe(socket, { type: 'verifyResult', requestId: msg.requestId, ok: false, v: 1, reason });
+      return;
+    }
+    const c = checked.claims;
+    writeSafe(socket, {
+      type: 'verifyResult', requestId: msg.requestId, ok: true, v: 1,
+      // Verify v1.1: TUTTI i campi che entrano nel binding VL, gia'
+      // normalizzati (nessun campo puo' arrivare dal client). issuerOwner =
+      // ownerInstanceId (mappatura legacy remote.rs:384), notBefore =
+      // issuedAt, origin e' il contesto del canale lease locale; tmuxSession,
+      // bindingId e scopes arrivano dal proof firmato dell'authority.
+      claims: {
+        ownerInstanceId: c.ownerInstanceId,
+        issuerOwner: c.ownerInstanceId,
+        cellId: c.cellId,
+        audience: c.audience,
+        incarnationId: c.incarnationId,
+        launchEpoch: c.launchEpoch,
+        daemonBootId: c.daemonBootId,
+        connectionId: c.connectionId,
+        nonce: c.nonce,
+        issuedAt: c.issuedAt,
+        notBefore: c.issuedAt,
+        expiresAt: c.expiresAt,
+        generation: c.generation,
+        tmuxSession: c.tmuxSession,
+        bindingId: c.bindingId,
+        scopes: c.scopes,
+        origin: 'local_tui',
+      },
+    });
+  }
+
   function onStableConnection(cellId, socket) {
     // Endpoint stabile: reconnect (R3.3.2-4). Legge identita' + proof, valida.
     let buf = '';

package/lib/fleet/identity-authority.js

@@ -9,6 +9,7 @@
 const crypto = require('node:crypto');
 const os = require('node:os');
 const path = require('node:path');
+const { tmuxSessionForCell } = require('./definitions.js');
 const { loadOrCreateVerifier } = require('./lease-verifier.js');
 
 const CHALLENGE_TTL_MS = 15_000;
@@ -24,8 +25,13 @@ const GRANT_FIELDS = Object.freeze([
   'jti', 'issuedAt', 'expiresAt',
 ]);
 const PROOF_FIELDS = Object.freeze([
-  ...GRANT_FIELDS.slice(0, 9), 'nonce', 'parentJti', 'jti', 'issuedAt', 'expiresAt', 'generation',
+  ...GRANT_FIELDS.slice(0, 9), 'nonce', 'parentJti', 'jti', 'issuedAt', 'expiresAt',
+  'authorityGeneration', 'generation', 'tmuxSession', 'bindingId', 'scopes',
 ]);
+// Tupla attesa della connessione (verify v1.1): il daemon la dichiara nella
+// richiesta verify; l'authority rifiuta 'challenge_mismatch' se il proof non
+// corrisponde a questa tupla o se il nonce non e' una challenge emessa.
+const TUPLE_EXPECTED_FIELDS = Object.freeze(['nonce', 'connectionId', 'daemonBootId', 'audience']);
 
 function nonEmpty(value) { return typeof value === 'string' && value.length > 0; }
 
@@ -125,7 +131,7 @@ function createIdentityAuthority({
   // Fresh per authority incarnation and never persisted: a restart of the
   // authority changes it, so every proof issued before the restart fails
   // closed instead of surviving with the persisted HMAC key.
-  const generation = hexNonce(randomBytes);
+  const authorityGeneration = hexNonce(randomBytes);
   const challenges = new Map();
   // Bounded stores: every entry carries its own expiry, saturated stores
   // reject instead of evicting valid entries, and only expired entries are
@@ -228,7 +234,8 @@ function createIdentityAuthority({
     return { ok: true, grant: sign(verifier, GRANT_FIELDS, claims) };
   }
 
-  function issueChallengeProof({ launchGrant, challenge, nonce: candidateNonce, expiresAt: candidateExpiresAt } = {}) {
+  function issueChallengeProof({ launchGrant, challenge, nonce: candidateNonce, expiresAt: candidateExpiresAt, generation = 0 } = {}) {
+    if (!Number.isSafeInteger(generation) || generation < 0) return { ok: false, reason: 'generation' };
     const checked = verify(verifier, GRANT_FIELDS, launchGrant, { now, expected: { kind: 'launch-grant', challenge } });
     if (!checked.ok) return checked;
     const record = challenges.get(challenge);
@@ -260,8 +267,14 @@ function createIdentityAuthority({
       jti: hexNonce(randomBytes),
       issuedAt,
       expiresAt,
+      authorityGeneration,
       generation,
+      tmuxSession: tmuxSessionForCell(checked.claims.cellId),
+      bindingId: null,
+      scopes: ['thread/start'],
     };
+    claims.bindingId = claims.jti;
+    if (!claims.tmuxSession) return { ok: false, reason: 'claims' };
     return { ok: true, proof: sign(verifier, PROOF_FIELDS, claims) };
   }
 
@@ -272,6 +285,7 @@ function createIdentityAuthority({
     launcherCredential,
     serviceCredential,
     expiresAt: externalExpiresAt,
+    generation = 0,
   } = {}) {
     if (!challenge || typeof challenge !== 'object') return { ok: false, reason: 'challenge' };
     if (!nonEmpty(challenge.nonce)) return { ok: false, reason: 'challenge' };
@@ -316,17 +330,61 @@ function createIdentityAuthority({
       challenge: challengeKey,
       nonce: challenge.nonce,
       expiresAt: effectiveExpiresAt,
+      generation,
     });
     return proof;
   }
 
+  // Verify v1.1: la tupla attesa dal daemon {nonce, connectionId,
+  // daemonBootId, audience} lega il proof alla challenge EMESSA da questa
+  // authority: il nonce deve essere una challenge registrata e ogni campo
+  // della tupla deve coincidere sia con l'emissione sia con il proof.
+  // Mismatch sulla tupla -> 'challenge_mismatch' (enum chiusa del contratto
+  // verify); i subject field restano rifiuti per nome campo (v1).
   function verifyChallengeProof(proof, expected = {}) {
-    const checked = verify(verifier, PROOF_FIELDS, proof, { now, expected: { kind: 'identity-proof', ...expected } });
-    if (!checked.ok) return checked;
-    if (!safeEqual(checked.claims.generation, generation)) return { ok: false, reason: 'generation' };
+    const subjectExpected = {};
+    const tupleExpected = {};
+    for (const field of ['ownerInstanceId', 'cellId', 'incarnationId', 'launchEpoch']) {
+      if (expected[field] !== undefined) subjectExpected[field] = expected[field];
+    }
+    for (const field of TUPLE_EXPECTED_FIELDS) {
+      if (expected[field] !== undefined) tupleExpected[field] = expected[field];
+    }
+    // v1.1 solo con la tupla COMPLETA (i quattro campi, nonce incluso):
+    // i vincoli parziali restano semantics v1 (rifiuto per nome campo),
+    // perche' i chiamanti v1 usano expected come vincoli per-campo.
+    const tupleRequired = TUPLE_EXPECTED_FIELDS.every((field) => expected[field] !== undefined);
+    if (tupleRequired && !TUPLE_EXPECTED_FIELDS.every((field) => nonEmpty(tupleExpected[field]))) {
+      return { ok: false, reason: 'malformed' };
+    }
+    if (tupleRequired) {
+      sweepExpired();
+      const record = challenges.get(tupleExpected.nonce);
+      if (!record
+        || record.audience !== tupleExpected.audience
+        || record.daemonBootId !== tupleExpected.daemonBootId
+        || record.connectionId !== tupleExpected.connectionId) {
+        return { ok: false, reason: 'challenge_mismatch' };
+      }
+    }
+    const checked = verify(verifier, PROOF_FIELDS, proof, { now, expected: { kind: 'identity-proof', ...subjectExpected, ...tupleExpected } });
+    if (!checked.ok) {
+      if (TUPLE_EXPECTED_FIELDS.includes(checked.reason)) return { ok: false, reason: 'challenge_mismatch' };
+      return checked;
+    }
+    if (!safeEqual(checked.claims.authorityGeneration, authorityGeneration)) return { ok: false, reason: 'generation' };
     if (revoked.has(checked.claims.jti) || revoked.has(checked.claims.parentJti)) {
       return { ok: false, reason: 'revoked' };
     }
+    // Verify v1.1: il nonce restituito nei claims e' quello del RECORD di
+    // emissione (nonce della challenge per cui il proof e' stato emesso),
+    // mai un valore di input: se la challenge non e' piu' nel registro si
+    // rifiuta (fail-closed) invece di fidarsi del campo del proof.
+    sweepExpired();
+    const emitted = challenges.get(checked.claims.challenge);
+    if (!emitted || emitted.challenge !== checked.claims.nonce) {
+      return { ok: false, reason: 'challenge_mismatch' };
+    }
     const reserved = reserveReplay(checked.claims.nonce, Number(checked.claims.expiresAt));
     if (!reserved.ok) return { ok: false, reason: reserved.reason };
     return checked;
@@ -364,4 +422,5 @@ module.exports = {
   CHALLENGE_TTL_MS,
   GRANT_TTL_MS,
   NONCE_BYTES,
+  TUPLE_EXPECTED_FIELDS,
 };

package/lib/fleet/identity-provision.js

@@ -0,0 +1,142 @@
+'use strict';
+// Provisioning dell'authority mode. Genera le DUE credenziali distinte
+// (daemon + launcher) nella directory dell'authority, con permessi 0700/0600,
+// e attiva `fleet.identity.mode = "authority"` nella config. Idempotente:
+// credenziali esistenti non vengono MAI sovrascritte senza --force.
+//
+// Nessun valore di credenziale torna nel ritorno e nessun valore finisce nei
+// log: il ritorno descrive solo percorsi e azioni.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const CREDENTIAL_FILES = Object.freeze({
+  identityDaemonCredential: 'daemon.credential',
+  identityLauncherCredential: 'launcher.credential',
+});
+
+// Le due credenziali devono essere DISTINTE (stessa regola di
+// identity-authority a runtime): confronto a tempo costante sui byte.
+function credentialsDistinct(daemonCredential, launcherCredential) {
+  if (typeof daemonCredential !== 'string' || !daemonCredential
+    || typeof launcherCredential !== 'string' || !launcherCredential) return false;
+  const daemon = Buffer.from(daemonCredential);
+  const launcher = Buffer.from(launcherCredential);
+  if (daemon.length !== launcher.length) return true;
+  return !crypto.timingSafeEqual(daemon, launcher);
+}
+
+function defaultAuthorityDir(home) {
+  return path.join(home || require('node:os').homedir(), '.nexuscrew', 'identity-authority');
+}
+
+function assertSafeMode(filePath, expectedMode) {
+  const st = fs.lstatSync(filePath);
+  if (!st.isFile()) throw new Error(`identity provision: ${filePath} non e' un file regolare`);
+  if ((st.mode & 0o777) !== expectedMode) {
+    throw new Error(`identity provision: ${filePath} ha permessi ${(st.mode & 0o777).toString(8)} (attesi ${expectedMode.toString(8)})`);
+  }
+}
+
+function existingCredentials(dir) {
+  const found = [];
+  for (const name of Object.values(CREDENTIAL_FILES)) {
+    const filePath = path.join(dir, name);
+    try {
+      const st = fs.lstatSync(filePath);
+      if (st.isFile() && st.size > 0) found.push(filePath);
+    } catch (_) { /* assente: ok */ }
+  }
+  return found;
+}
+
+function provisionIdentityAuthority({
+  home,
+  dir,
+  force = false,
+  writeConfig = true,
+  configPath,
+  randomBytes = crypto.randomBytes,
+  fsImpl = fs,
+  now = new Date,
+} = {}) {
+  const targetDir = dir || defaultAuthorityDir(home);
+  fsImpl.mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+
+  const preExisting = existingCredentials(targetDir);
+  if (preExisting.length && !force) {
+    return {
+      ok: false, code: 'ALREADY_PROVISIONED', dir: targetDir,
+      existing: preExisting,
+      message: 'identity authority already provisioned; pass --force to regenerate',
+    };
+  }
+
+  const written = [];
+  let daemonValue = randomBytes(32).toString('hex');
+  let launcherValue = randomBytes(32).toString('hex');
+  // Rigenera finché le due credenziali sono distinte (confronto a tempo
+  // costante, stessa regola di identity-authority). Con una fonte casuale
+  // sana la prima iterazione passa; con randomBytes iniettati degeneri il
+  // provisioning viene RIFIUTATO anche con --force, senza scrivere nulla.
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    if (credentialsDistinct(daemonValue, launcherValue)) break;
+    launcherValue = randomBytes(32).toString('hex');
+    if (attempt === 7 && !credentialsDistinct(daemonValue, launcherValue)) {
+      return {
+        ok: false, code: 'IDENTICAL_CREDENTIALS', dir: targetDir,
+        message: 'identity provision: generated credentials are identical; nothing written',
+      };
+    }
+  }
+  for (const [name, value] of [
+    [CREDENTIAL_FILES.identityDaemonCredential, daemonValue],
+    [CREDENTIAL_FILES.identityLauncherCredential, launcherValue],
+  ]) {
+    const filePath = path.join(targetDir, name);
+    fsImpl.writeFileSync(filePath, `${value}\n`, { mode: 0o600 });
+    written.push(filePath);
+  }
+  // I permessi espliciti valgono anche su filesystem che ignorano mode in
+  // writeFileSync (umask larghe): rinforza dopo la scrittura.
+  fsImpl.chmodSync(targetDir, 0o700);
+  for (const filePath of written) fsImpl.chmodSync(filePath, 0o600);
+  for (const filePath of written) assertSafeMode(filePath, 0o600);
+
+  const resolvedConfigPath = configPath
+    || (process.env.NEXUSCREW_CONFIG_FILE
+      || path.join(home || require('node:os').homedir(), '.nexuscrew', 'config.json'));
+
+  let configUpdated = false;
+  let configInstructions = null;
+  if (writeConfig) {
+    let config = {};
+    try {
+      config = JSON.parse(fsImpl.readFileSync(resolvedConfigPath, 'utf8'));
+      if (!config || typeof config !== 'object' || Array.isArray(config)) config = {};
+    } catch (_) { config = {}; }
+    config.fleet = { ...(config.fleet || {}), identity: { ...(config.fleet?.identity || {}), mode: 'authority' } };
+    fsImpl.mkdirSync(path.dirname(resolvedConfigPath), { recursive: true });
+    fsImpl.writeFileSync(resolvedConfigPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    configUpdated = true;
+  } else {
+    configInstructions = [
+      'Set the following keys in the NexusCrew config (fleet.identity.mode = "authority")',
+      `and keep the two credential files in place under ${targetDir}:`,
+      ...Object.values(CREDENTIAL_FILES).map((name) => `  ${path.join(targetDir, name)}`),
+    ].join('\n');
+  }
+
+  return {
+    ok: true, dir: targetDir, written, configUpdated, configInstructions,
+    mode: 'authority',
+  };
+}
+
+module.exports = {
+  provisionIdentityAuthority,
+  defaultAuthorityDir,
+  credentialsDistinct,
+  CREDENTIAL_FILES,
+};