@modelprofile.com/authswitch 6.4.0 → 6.5.0

package/ts/classes.authorityclient.ts

@@ -47,6 +47,21 @@ const post = (path: string, payload: ITypedRequest, signal?: AbortSignal): Promi
     });
 };
 
+/** A snapshot is usable only while state is current; lastVerifiedAt is the last successful daemon proof. */
+export interface IAuthSwitchSubscriptionStatus {
+  state: 'current' | 'unavailable' | 'closed';
+  reason: 'initial' | 'snapshot' | 'event' | 'heartbeat' | 'disconnect' | 'resync' | 'abort' | 'consumer_error';
+  epoch: string | null;
+  revision: number | null;
+  lastVerifiedAt: string | null;
+}
+
+export interface IAuthSwitchSubscriptionOptions {
+  onStatus?: (status: IAuthSwitchSubscriptionStatus) => void | Promise<void>;
+  /** Bounded long-poll interval; defaults to 30 seconds. */
+  heartbeatMs?: number;
+}
+
 /** Node-only client for the per-user daemon. Each request has its own bounded Unix connection. */
 export class AuthSwitchClient {
   private readonly target: plugins.typedrequest.TypedTarget;
@@ -105,39 +120,93 @@ export class AuthSwitchClient {
     return this.request<IReq_AuthSwitchEvents>('authswitch.authority.events', { epoch, afterRevision, waitMs }, waitMs + 5_000, false, signal);
   }
 
-  /** Always obtains a fresh snapshot after reconnect or an event-log gap. */
+  /** Snapshot callback runs after every known change; onStatus invalidates it on disconnect, resync or abort. */
   public async subscribe(onSnapshot: (snapshot: IAuthSwitchSnapshot) => void | Promise<void>,
-    onEvent: (event: IAuthSwitchAccountEvent) => void | Promise<void>, signal: AbortSignal): Promise<void> {
+    onEvent: (event: IAuthSwitchAccountEvent) => void | Promise<void>, signal: AbortSignal,
+    options: IAuthSwitchSubscriptionOptions = {}): Promise<void> {
+    const heartbeatMs = options.heartbeatMs ?? 30_000;
+    if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 50 || heartbeatMs > 30_000) {
+      throw new Error('Authswitch subscription heartbeat must be 50–30000 ms.');
+    }
     const retry = () => new Promise<void>(resolve => {
       const timer = setTimeout(() => { signal.removeEventListener('abort', aborted); resolve(); }, 250);
       const aborted = () => { clearTimeout(timer); resolve(); };
       signal.addEventListener('abort', aborted, { once: true });
     });
     let snapshot: IAuthSwitchSnapshot | undefined;
-    while (!signal.aborted) {
-      if (!snapshot) {
-        try { snapshot = await this.snapshotAll({ signal }); }
+    let available = false;
+    let lastVerifiedAt: string | null = null;
+    let lastEpoch: string | null = null;
+    let lastRevision: number | null = null;
+    const status = async (state: IAuthSwitchSubscriptionStatus['state'],
+      reason: IAuthSwitchSubscriptionStatus['reason']): Promise<void> => {
+      await options.onStatus?.({ state, reason, epoch: lastEpoch, revision: lastRevision, lastVerifiedAt });
+    };
+    const invalidate = async (reason: 'disconnect' | 'resync'): Promise<void> => {
+      snapshot = undefined;
+      if (available) { available = false; await status('unavailable', reason); }
+    };
+    try {
+      if (!signal.aborted) await status('unavailable', 'initial');
+      while (!signal.aborted) {
+        if (!snapshot) {
+          let fresh: IAuthSwitchSnapshot;
+          try { fresh = await this.snapshotAll({ signal }); }
+          catch {
+            if (signal.aborted) break;
+            await invalidate('disconnect');
+            await retry();
+            continue;
+          }
+          snapshot = fresh;
+          await onSnapshot(fresh);
+          available = true;
+          lastEpoch = fresh.epoch;
+          lastRevision = fresh.revision;
+          lastVerifiedAt = new Date().toISOString();
+          await status('current', 'snapshot');
+        }
+        let result: IReq_AuthSwitchEvents['response'];
+        try { result = await this.events(snapshot.epoch, snapshot.revision, heartbeatMs, signal); }
         catch {
           if (signal.aborted) break;
+          await invalidate('disconnect');
           await retry();
           continue;
         }
-        await onSnapshot(snapshot);
-      }
-      let result: IReq_AuthSwitchEvents['response'];
-      try { result = await this.events(snapshot.epoch, snapshot.revision, 30_000, signal); }
-      catch {
-        if (signal.aborted) break;
-        snapshot = undefined;
-        await retry();
-        continue;
-      }
-      if (result.resyncRequired || result.epoch !== snapshot.epoch) {
-        snapshot = undefined;
-        continue;
+        if (result.resyncRequired || result.epoch !== snapshot.epoch
+          || (result.events.length === 0 && result.revision !== snapshot.revision)) {
+          await invalidate('resync');
+          continue;
+        }
+        if (result.events.length) {
+          let fresh: IAuthSwitchSnapshot;
+          try { fresh = await this.snapshotAll({ signal }); }
+          catch {
+            if (signal.aborted) break;
+            await invalidate('disconnect');
+            await retry();
+            continue;
+          }
+          if (fresh.epoch !== result.epoch || fresh.revision < result.revision) {
+            await invalidate('resync');
+            continue;
+          }
+          snapshot = fresh;
+          await onSnapshot(fresh);
+          for (const event of result.events) await onEvent(event);
+          lastEpoch = fresh.epoch;
+          lastRevision = fresh.revision;
+          lastVerifiedAt = new Date().toISOString();
+          await status('current', 'event');
+        } else {
+          lastVerifiedAt = new Date().toISOString();
+          await status('current', 'heartbeat');
+        }
       }
-      for (const event of result.events) await onEvent(event);
-      snapshot = { ...snapshot, revision: result.revision };
+    } finally {
+      available = false;
+      await status('closed', signal.aborted ? 'abort' : 'consumer_error');
     }
   }
 

package/ts/classes.authoritydaemon.ts

@@ -10,6 +10,7 @@ import { AuthSwitchAuthorityBroker, type IAuthSwitchAuthorityBrokerOptions } fro
 import { AuthSwitchAuthorityDatabase, type IAuthSwitchAuthorityDatabaseOptions } from './classes.authoritydatabase.js';
 import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes,
   maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
+import { AuthSwitchManagedCodex, findManagedCodexProcess, type IAuthSwitchManagedCodexOptions } from './classes.codexmanaged.js';
 
 export interface IAuthSwitchAuthorityDaemonOptions extends IAuthSwitchAuthorityDatabaseOptions {
   authoritySocketPath: string;
@@ -31,6 +32,14 @@ export class AuthSwitchAuthorityDaemon {
   private managementServer?: plugins.net.Server;
   private runtimeServer?: plugins.net.Server;
   private readonly sockets = new Set<plugins.net.Socket>();
+  private readonly managedCodex = new Map<string, Promise<{ runtime: AuthSwitchManagedCodex; bindingId: string;
+    capability: string; homeId: string; runId: string }>>();
+  private readonly managedCodexHomes = new Set<string>();
+  private readonly managedCodexAccountIds = new Map<string, string>();
+  private readonly drainingAccounts = new Set<string>();
+  private readonly managedCodexStops = new Map<string, Promise<void>>();
+  private readonly managedCodexFailures: unknown[] = [];
+  private closing = false;
 
   constructor(private readonly options: IAuthSwitchAuthorityDaemonOptions) {
     this.database = new AuthSwitchAuthorityDatabase(options);
@@ -59,7 +68,14 @@ export class AuthSwitchAuthorityDaemon {
     this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_AuthSwitchBeginReauth>(
       'authswitch.authority.reauth', async request => {
         if (!hasKeys(request, ['accountId', 'flow']) || request.flow !== 'device' || typeof request.accountId !== 'string') invalid();
-        return { operation: await this.broker.beginReauthOpenAi(request.accountId) };
+        if (this.drainingAccounts.has(request.accountId)) throw new Error('Account runtime drain is already in progress.');
+        this.drainingAccounts.add(request.accountId);
+        try {
+          await this.drainManagedCodexAccount(request.accountId);
+          const operation = await this.broker.beginReauthOpenAi(request.accountId);
+          void this.broker.waitOperation(operation.id).finally(() => this.drainingAccounts.delete(request.accountId)).catch(() => {});
+          return { operation };
+        } catch (error) { this.drainingAccounts.delete(request.accountId); throw error; }
       }));
     this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_AuthSwitchGetOperation>(
       'authswitch.authority.operation', async request => {
@@ -81,7 +97,12 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.remove', async request => {
         if (!hasKeys(request, ['accountId', 'expectedRevision']) || typeof request.accountId !== 'string'
           || typeof request.expectedRevision !== 'number') invalid();
-        return { account: await this.broker.removeAccount(request.accountId, request.expectedRevision) };
+        if (this.drainingAccounts.has(request.accountId)) throw new Error('Account runtime drain is already in progress.');
+        this.drainingAccounts.add(request.accountId);
+        try {
+          await this.drainManagedCodexAccount(request.accountId);
+          return { account: await this.broker.removeAccount(request.accountId, request.expectedRevision) };
+        } finally { this.drainingAccounts.delete(request.accountId); }
       }));
     this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_AuthSwitchBindAccount>(
       'authswitch.authority.bind', async request => {
@@ -92,10 +113,15 @@ export class AuthSwitchAuthorityDaemon {
       }));
     this.runtimeRouter.addTypedHandler(new plugins.typedrequest.TypedHandler<IReq_AuthSwitchResolveAccess>(
       'authswitch.authority.resolveAccess', async request => {
-        if (!hasKeys(request, ['bindingId', 'capability', 'minValidityMs'])
+        if ((typeof request !== 'object' || request === null || Array.isArray(request))
+          || !['bindingId', 'capability', 'minValidityMs'].every(key => Object.hasOwn(request, key))
+          || Object.keys(request).some(key => !['bindingId', 'capability', 'minValidityMs',
+            'rejectedGrantGeneration'].includes(key))
           || typeof request.bindingId !== 'string' || typeof request.capability !== 'string'
-          || typeof request.minValidityMs !== 'number') invalid();
-        return this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs);
+          || typeof request.minValidityMs !== 'number'
+          || (request.rejectedGrantGeneration !== undefined && typeof request.rejectedGrantGeneration !== 'number')) invalid();
+        return this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs,
+          request.rejectedGrantGeneration);
       }));
   }
 
@@ -122,6 +148,156 @@ export class AuthSwitchAuthorityDaemon {
     }
   }
 
+  /** Trusted in-process SDK admission; management RPC exposure belongs to the later CLI cutover. */
+  private async drainManagedCodexAccount(accountId: string): Promise<void> {
+    const scopes = [...this.managedCodexAccountIds]
+      .filter(([, assignedAccountId]) => assignedAccountId === accountId).map(([scopeId]) => scopeId);
+    const results = await Promise.allSettled(scopes.map(scopeId => this.stopManagedCodex(scopeId)));
+    const failed = results.filter((result): result is PromiseRejectedResult => result.status === 'rejected');
+    if (failed.length) throw new AggregateError(failed.map(result => result.reason), 'Managed Codex account drain failed.');
+  }
+
+  public async startManagedCodex(input: { accountId: string; scopeId: string; workspaceDirectory: string;
+    codexHomeDirectory: string;
+    executable?: string; onNotification?: IAuthSwitchManagedCodexOptions['onNotification'];
+    onServerRequest?: IAuthSwitchManagedCodexOptions['onServerRequest'] }): Promise<AuthSwitchManagedCodex> {
+    if (!plugins.path.isAbsolute(input.codexHomeDirectory)
+      || plugins.path.normalize(input.codexHomeDirectory) !== input.codexHomeDirectory) {
+      throw new Error('Managed Codex requires a normalized absolute state home.');
+    }
+    const homeId = plugins.crypto.createHash('sha256').update(JSON.stringify(['authswitch-codex-home-v1', input.codexHomeDirectory])).digest('hex');
+    if (this.closing || !this.managementServer || !this.runtimeServer
+      || this.managedCodex.has(input.scopeId) || this.managedCodexStops.has(input.scopeId)
+      || this.managedCodexHomes.has(homeId) || this.drainingAccounts.has(input.accountId)) {
+      throw new Error('Managed Codex scope is unavailable.');
+    }
+    this.managedCodexHomes.add(homeId);
+    this.managedCodexAccountIds.set(input.scopeId, input.accountId);
+    const runId = plugins.crypto.randomUUID();
+    const task = (async () => {
+      let bound: Awaited<ReturnType<typeof this.broker.bindAccount>> | undefined;
+      let runtime: AuthSwitchManagedCodex | undefined;
+      let claimed = false;
+      try {
+        const home = input.codexHomeDirectory;
+        const parent = plugins.path.dirname(home);
+        const parentStat = await plugins.fs.promises.lstat(parent);
+        if (!parentStat.isDirectory() || parentStat.isSymbolicLink() || parentStat.uid !== process.getuid?.()
+          || (parentStat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(parent) !== parent) {
+          throw new Error('Managed Codex home parent must be private and owned by this user.');
+        }
+        const nativeHomes = [plugins.path.join(plugins.os.homedir(), '.codex'), process.env.CODEX_HOME]
+          .filter((value): value is string => typeof value === 'string' && plugins.path.isAbsolute(value));
+        if (nativeHomes.some(native => home === native || home.startsWith(native + plugins.path.sep)
+          || native.startsWith(home + plugins.path.sep))) {
+          throw new Error('Managed Codex cannot adopt an active native Codex home.');
+        }
+        const existing = await this.database.readCodexHome(homeId);
+        if (existing && (existing.accountId !== input.accountId || existing.scopeId !== input.scopeId)) {
+          throw new Error('Managed Codex home already belongs to another account or scope.');
+        }
+        let homeExists = false;
+        try {
+          const stat = await plugins.fs.promises.lstat(home);
+          if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+            || (stat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(home) !== home) {
+            throw new Error('Managed Codex home is not a private owned directory.');
+          }
+          homeExists = true;
+        } catch (error) {
+          if (!(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')) throw error;
+        }
+        if (!existing && homeExists && (await plugins.fs.promises.readdir(home)).length) {
+          throw new Error('An existing Codex home needs explicit native-owner handoff before enrollment.');
+        }
+        await this.database.reserveCodexHome(input.accountId, input.scopeId, homeId, plugins.crypto.randomUUID());
+        if (!homeExists) await plugins.fs.promises.mkdir(home, { mode: 0o700 });
+        bound = await this.broker.bindAccount({ accountId: input.accountId, runtime: 'codex',
+          scopeId: input.scopeId, incarnationId: plugins.crypto.randomUUID() });
+        runtime = new AuthSwitchManagedCodex({
+          runtimeDirectory: plugins.path.join(plugins.path.dirname(plugins.path.dirname(this.options.authoritySocketPath)), 'managed-codex'),
+          codexHomeDirectory: home, workspaceDirectory: input.workspaceDirectory, executable: input.executable,
+          onNotification: input.onNotification, onServerRequest: input.onServerRequest,
+          broker: this.broker, bindingId: bound.binding.id, capability: bound.capability,
+          onPreparedRun: async socketPath => {
+            const assigned = await this.database.readCodexHome(homeId);
+            if (!assigned || assigned.accountId !== input.accountId || assigned.scopeId !== input.scopeId) {
+              throw new Error('Managed Codex home assignment changed.');
+            }
+            if (assigned.activeRun) {
+              const survivor = await findManagedCodexProcess(assigned.activeRun.socketPath);
+              if (survivor) throw new Error('Managed Codex home still has a live app-server owner.');
+              await this.database.changeCodexRun(homeId, assigned.activeRun.id, null, plugins.crypto.randomUUID());
+            }
+            await this.database.changeCodexRun(homeId, null,
+              { id: runId, socketPath, pid: null, startedAt: null }, plugins.crypto.randomUUID());
+            claimed = true;
+          },
+          onChildSpawned: async (pid, startedAt) => {
+            const assigned = await this.database.readCodexHome(homeId);
+            if (assigned?.activeRun?.id !== runId || assigned.activeRun.pid !== null) {
+              throw new Error('Managed Codex run registration changed before process verification.');
+            }
+            await this.database.changeCodexRun(homeId, runId,
+              { ...assigned.activeRun, pid, startedAt }, plugins.crypto.randomUUID());
+          },
+          onUnavailable: () => {
+            void this.stopManagedCodex(input.scopeId).catch(error => {
+              this.managedCodexFailures.push(error);
+              process.stderr.write('Managed Codex cleanup failed after its control connection closed.\n');
+            });
+          },
+        });
+        await runtime.start();
+        if (this.closing) throw new Error('Managed Codex admission closed during startup.');
+        return { runtime, bindingId: bound.binding.id, capability: bound.capability, homeId, runId };
+      } catch (error) {
+        const cleanupErrors: unknown[] = [];
+        if (runtime) try { await runtime.close(); } catch (cleanupError) { cleanupErrors.push(cleanupError); }
+        if (claimed && cleanupErrors.length === 0) try {
+          await this.database.changeCodexRun(homeId, runId, null, plugins.crypto.randomUUID());
+        } catch (cleanupError) { cleanupErrors.push(cleanupError); }
+        if (bound) try { await this.broker.revokeBinding(bound.binding.id, bound.capability); }
+        catch (cleanupError) { cleanupErrors.push(cleanupError); }
+        if (cleanupErrors.length === 0) {
+          this.managedCodexHomes.delete(homeId);
+          this.managedCodexAccountIds.delete(input.scopeId);
+        }
+        if (cleanupErrors.length) throw new AggregateError([error, ...cleanupErrors], 'Managed Codex admission cleanup failed.');
+        throw error;
+      }
+    })();
+    this.managedCodex.set(input.scopeId, task);
+    try { return (await task).runtime; }
+    catch (error) { this.managedCodex.delete(input.scopeId); throw error; }
+  }
+
+  public stopManagedCodex(scopeId: string): Promise<void> {
+    const existing = this.managedCodexStops.get(scopeId);
+    if (existing) return existing;
+    const task = this.managedCodex.get(scopeId);
+    if (!task) return Promise.resolve();
+    this.managedCodex.delete(scopeId);
+    const stopping = (async () => {
+      let entry: Awaited<typeof task>;
+      try { entry = await task; }
+      catch { /* Failed admission already closed its process and revoked its binding. */ return; }
+      const { runtime, bindingId, capability, homeId, runId } = entry;
+      const errors: unknown[] = [];
+      try { await runtime.close(); } catch (error) { errors.push(error); }
+      if (errors.length === 0) try {
+        await this.database.changeCodexRun(homeId, runId, null, plugins.crypto.randomUUID());
+        this.managedCodexHomes.delete(homeId);
+        this.managedCodexAccountIds.delete(scopeId);
+      } catch (error) { errors.push(error); }
+      try { await this.broker.revokeBinding(bindingId, capability); } catch (error) { errors.push(error); }
+      if (errors.length) throw new AggregateError(errors, 'Managed Codex shutdown was incomplete.');
+    })();
+    this.managedCodexStops.set(scopeId, stopping);
+    void stopping.finally(() => { if (this.managedCodexStops.get(scopeId) === stopping) this.managedCodexStops.delete(scopeId); }).catch(() => {});
+    return stopping;
+  }
+
   private async listen(path: string, router: plugins.typedrequest.TypedRouter): Promise<plugins.net.Server> {
     const directory = plugins.path.dirname(path);
     await plugins.fs.promises.mkdir(directory, { recursive: true, mode: 0o700 });
@@ -201,7 +377,15 @@ export class AuthSwitchAuthorityDaemon {
   }
 
   public async close(): Promise<void> {
+    this.closing = true;
     const errors: unknown[] = [];
+    for (const scopeId of [...this.managedCodex.keys()]) {
+      try { await this.stopManagedCodex(scopeId); } catch (error) { errors.push(error); }
+    }
+    for (const stopping of [...this.managedCodexStops.values()]) {
+      try { await stopping; } catch (error) { errors.push(error); }
+    }
+    errors.push(...this.managedCodexFailures);
     try { await this.broker.close(); } catch (error) { errors.push(error); }
     const management = this.managementServer;
     const runtime = this.runtimeServer;

package/ts/classes.authoritydatabase.ts

@@ -1,11 +1,11 @@
 import * as plugins from './plugins.js';
 import {
-  AuthSwitchAuthorityAccountModel, AuthSwitchAuthorityBindingModel, AuthSwitchAuthorityEnrollmentModel,
+  AuthSwitchAuthorityAccountModel, AuthSwitchAuthorityBindingModel, AuthSwitchAuthorityCodexHomeModel, AuthSwitchAuthorityEnrollmentModel,
   AuthSwitchAuthorityEventModel, AuthSwitchAuthorityGrantModel, AuthSwitchAuthorityHandoffModel,
   AuthSwitchAuthorityMetaModel, AuthSwitchAuthorityMigrationLedgerModel, assertStoredAuthorityAccount,
   assertStoredAuthorityBinding, assertStoredAuthorityEnrollment, assertStoredAuthorityGrant,
   assertStoredAuthorityHandoff, assertStoredAuthorityMigrationLedger,
-  type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityEnrollment,
+  type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment,
   type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff,
   type IStoredAuthorityMeta, type IStoredAuthorityMigrationLedger,
 } from './classes.authoritymodels.js';
@@ -46,17 +46,17 @@ export class AuthSwitchAuthorityDatabase {
       const database = new plugins.smartdata.SmartdataDb({ mongoDbUrl: connection.connectionUri, mongoDbName: 'authswitch' });
       this.database = database;
       for (const model of [AuthSwitchAuthorityMetaModel, AuthSwitchAuthorityAccountModel,
-        AuthSwitchAuthorityGrantModel, AuthSwitchAuthorityBindingModel, AuthSwitchAuthorityEnrollmentModel,
+        AuthSwitchAuthorityGrantModel, AuthSwitchAuthorityBindingModel, AuthSwitchAuthorityCodexHomeModel, AuthSwitchAuthorityEnrollmentModel,
         AuthSwitchAuthorityHandoffModel, AuthSwitchAuthorityMigrationLedgerModel, AuthSwitchAuthorityEventModel]) {
         plugins.smartdata.setDefaultManagerForDoc({ db: database }, model);
       }
       await database.init();
       await Promise.all([AuthSwitchAuthorityMetaModel.init(), AuthSwitchAuthorityAccountModel.init(),
-        AuthSwitchAuthorityGrantModel.init(), AuthSwitchAuthorityBindingModel.init(),
+        AuthSwitchAuthorityGrantModel.init(), AuthSwitchAuthorityBindingModel.init(), AuthSwitchAuthorityCodexHomeModel.init(),
         AuthSwitchAuthorityEnrollmentModel.init(), AuthSwitchAuthorityHandoffModel.init(),
         AuthSwitchAuthorityMigrationLedgerModel.init(), AuthSwitchAuthorityEventModel.init()]);
       await Promise.all([AuthSwitchAuthorityMetaModel.exact.prepare(), AuthSwitchAuthorityAccountModel.exact.prepare(),
-        AuthSwitchAuthorityGrantModel.exact.prepare(), AuthSwitchAuthorityBindingModel.exact.prepare(),
+        AuthSwitchAuthorityGrantModel.exact.prepare(), AuthSwitchAuthorityBindingModel.exact.prepare(), AuthSwitchAuthorityCodexHomeModel.exact.prepare(),
         AuthSwitchAuthorityEnrollmentModel.exact.prepare(), AuthSwitchAuthorityHandoffModel.exact.prepare(),
         AuthSwitchAuthorityMigrationLedgerModel.exact.prepare(), AuthSwitchAuthorityEventModel.exact.prepare()]);
       const initial: IStoredAuthorityMeta = {
@@ -105,6 +105,77 @@ export class AuthSwitchAuthorityDatabase {
     return stored ? AuthSwitchAuthorityBindingModel.exact.toPersisted(stored) : null;
   }
 
+  public async readCodexHome(id: string): Promise<IStoredAuthorityCodexHome | null> {
+    this.db();
+    const stored = await AuthSwitchAuthorityCodexHomeModel.exact.findStoredOne({ id });
+    return stored ? AuthSwitchAuthorityCodexHomeModel.exact.toPersisted(stored) : null;
+  }
+
+  /** Home path identity is hashed by the caller; no vendor files or raw paths enter SmartData. */
+  public async reserveCodexHome(accountId: string, scopeId: string, homeId: string,
+    updateId: string): Promise<{ newlyRegistered: boolean }> {
+    try {
+      return await this.transaction(async session => {
+        const accountStored = await AuthSwitchAuthorityAccountModel.exact.findStoredOne({ id: accountId }, { session });
+        const account = accountStored ? AuthSwitchAuthorityAccountModel.exact.toPersisted(accountStored) : null;
+        const grantStored = account?.primaryGrantId
+          ? await AuthSwitchAuthorityGrantModel.exact.findStoredOne({ id: account.primaryGrantId }, { session }) : null;
+        const grant = grantStored ? AuthSwitchAuthorityGrantModel.exact.toPersisted(grantStored) : null;
+        if (!account || account.removed || account.providerId !== 'openai' || grant?.owner !== 'daemon'
+          || grant.purpose !== 'openai_managed' || grant.accountId !== accountId || grant.state === 'removed') {
+          throw new Error('Managed Codex requires a daemon-owned OpenAI account.');
+        }
+        const used = await AuthSwitchAuthorityCodexHomeModel.exact.findStoredOne({ id: homeId }, { session });
+        if (used) {
+          if (used.accountId !== accountId || used.scopeId !== scopeId) {
+            throw new Error('Managed Codex home already belongs to another account or scope.');
+          }
+          return { newlyRegistered: false };
+        }
+        const record: IStoredAuthorityCodexHome = { id: homeId, accountId, scopeId, activeRun: null,
+          createdAt: new Date().toISOString(), updateId };
+        const inserted = await AuthSwitchAuthorityCodexHomeModel.exact.insert(record, { session });
+        if (inserted.status !== 'inserted') throw new Error('Managed Codex home changed during admission.');
+        return { newlyRegistered: true };
+      });
+    } catch (error) {
+      if (error instanceof plugins.smartdata.SmartdataExactPersistenceError
+        && (error.code === 'ambiguous_write' || error.code === 'unique_conflict')) {
+        const assigned = await AuthSwitchAuthorityCodexHomeModel.exact.findStoredOne({ id: homeId });
+        if (assigned?.accountId === accountId && assigned.scopeId === scopeId
+          && assigned.updateId === updateId) return { newlyRegistered: true };
+        throw new Error('Managed Codex home registration changed concurrently; refresh before retrying.');
+      }
+      throw error;
+    }
+  }
+
+  /** Pre-spawn claim is durable; the exact socket lets a later daemon detect a child born before PID readback. */
+  public async changeCodexRun(homeId: string, expectedRunId: string | null,
+    activeRun: IStoredAuthorityCodexHome['activeRun'], updateId: string): Promise<void> {
+    try {
+      await this.transaction(async session => {
+        const current = await AuthSwitchAuthorityCodexHomeModel.exact.findStoredOne({ id: homeId }, { session });
+        if (!current || current.activeRun?.id !== (expectedRunId ?? undefined)) {
+          throw new Error('Managed Codex home run changed concurrently.');
+        }
+        if (activeRun && expectedRunId !== null && activeRun.id !== expectedRunId) {
+          throw new Error('Managed Codex run identity cannot change.');
+        }
+        const draft = { ...AuthSwitchAuthorityCodexHomeModel.exact.toPersisted(current), activeRun, updateId };
+        const result = await AuthSwitchAuthorityCodexHomeModel.exact.transition({ current,
+          change: model => Object.assign(model, draft) }, { session });
+        if (result.status !== 'transitioned') throw new Error('Managed Codex home run changed concurrently.');
+        return true;
+      });
+    } catch (error) {
+      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      const current = await this.readCodexHome(homeId);
+      if (current?.updateId === updateId && JSON.stringify(current.activeRun) === JSON.stringify(activeRun)) return;
+      throw new Error('Managed Codex home run outcome is unknown.');
+    }
+  }
+
   /** One consistent authorization view. Callers must not combine separate binding and grant reads. */
   public async readBindingContext(id: string): Promise<{
     binding: IStoredAuthorityBinding | null;
@@ -557,6 +628,28 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
+  /** Closing an owned runtime revokes only its exact capability/incarnation. */
+  public async revokeBinding(updateId: string, bindingId: string, capabilityHash: string): Promise<boolean> {
+    try {
+      return await this.transaction(async session => {
+        const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' }, { session });
+        if (!metaStored) throw new Error('Authswitch authority metadata is missing.');
+        const current = await AuthSwitchAuthorityBindingModel.exact.findStoredOne({ id: bindingId }, { session });
+        if (!current || current.capabilityHash !== capabilityHash) return false;
+        const result = await AuthSwitchAuthorityBindingModel.exact.delete({ current }, { session });
+        if (result.status !== 'deleted') throw new Error('Runtime binding changed during revocation.');
+        await this.appendEvent(session, AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored),
+          updateId, 'binding', current.accountId);
+        return true;
+      });
+    } catch (error) {
+      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
+      if (event && !(await this.readBinding(bindingId))) return true;
+      throw new Error('Authswitch binding revocation outcome is unknown.');
+    }
+  }
+
   /** Enrollment metadata is sealed by the caller and cannot become detached from an account. */
   public async changeEnrollment(updateId: string, enrollmentId: string, accountId: string,
     change: (current: IStoredAuthorityEnrollment | null) => IStoredAuthorityEnrollment): Promise<IStoredAuthorityEnrollment> {

package/ts/classes.authoritymodels.ts

@@ -71,6 +71,16 @@ export interface IStoredAuthorityEnrollment {
   updateId: string;
 }
 
+/** An immutable assignment of one private native Codex state home to one account and runtime scope. */
+export interface IStoredAuthorityCodexHome {
+  id: string;
+  accountId: string;
+  scopeId: string;
+  activeRun: { id: string; socketPath: string; pid: number | null; startedAt: string | null } | null;
+  createdAt: string;
+  updateId: string;
+}
+
 /** Journal for a native-home handoff. A prepared grant is never usable. */
 export interface IStoredAuthorityHandoff {
   id: string;
@@ -191,6 +201,23 @@ export const assertStoredAuthorityEnrollment: (value: unknown) => asserts value
     || !revision(value.revision) || !uuid(value.updateId)) throw new Error('Invalid authswitch enrollment record.');
 };
 
+export const assertStoredAuthorityCodexHome: (value: unknown) => asserts value is IStoredAuthorityCodexHome = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'accountId', 'scopeId', 'activeRun', 'createdAt', 'updateId'])
+    || !hash(value.id) || !hash(value.accountId) || !bounded(value.scopeId)
+    || !iso(value.createdAt) || !uuid(value.updateId)) {
+    throw new Error('Invalid managed Codex home assignment.');
+  }
+  if (value.activeRun !== null && (!object(value.activeRun)
+    || !exactKeys(value.activeRun, ['id', 'socketPath', 'pid', 'startedAt'])
+    || !uuid(value.activeRun.id) || !bounded(value.activeRun.socketPath, 1024)
+    || (value.activeRun.pid !== null && (typeof value.activeRun.pid !== 'number'
+      || !Number.isSafeInteger(value.activeRun.pid) || value.activeRun.pid <= 0))
+    || (value.activeRun.startedAt !== null && !iso(value.activeRun.startedAt))
+    || (value.activeRun.pid === null) !== (value.activeRun.startedAt === null))) {
+    throw new Error('Invalid managed Codex run assignment.');
+  }
+};
+
 export const assertStoredAuthorityHandoff: (value: unknown) => asserts value is IStoredAuthorityHandoff = value => {
   if (!object(value) || !exactKeys(value, ['id', 'accountId', 'grantId', 'nativeHomeId', 'direction', 'phase',
     'operationId', 'sourceDigest', 'verifiedSourceDigest', 'backupDigest', 'revision', 'statusObservedAt', 'updateId'])
@@ -315,6 +342,19 @@ export class AuthSwitchAuthorityEnrollmentModel extends plugins.smartdata.SmartD
   @plugins.smartdata.svDb() public updateId!: string;
 }
 
+@plugins.smartdata.compoundIndex({ name: 'authority_codex_home_account_id', key: { accountId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_codex_homes' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityCodexHome })
+export class AuthSwitchAuthorityCodexHomeModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityCodexHomeModel, IStoredAuthorityCodexHome> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityCodexHomeModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public accountId!: string;
+  @plugins.smartdata.svDb() public scopeId!: string;
+  @plugins.smartdata.svDb() public activeRun!: IStoredAuthorityCodexHome['activeRun'];
+  @plugins.smartdata.svDb() public createdAt!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
 @plugins.smartdata.compoundIndex({ name: 'authority_handoff_grant_id', key: { grantId: 1, id: 1 } })
 @plugins.smartdata.managed({ collectionName: 'authswitch_authority_handoffs' })
 @plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityHandoff })