@openparachute/hub 0.7.7-rc.8 → 0.7.7

package/README.md

@@ -342,23 +342,23 @@ Parachute services reserve a block of loopback ports in the canonical range **19
 | ---- | ------------------ |
 | 1939 | parachute-hub (internal proxy + static) |
 | 1940 | parachute-vault    |
-| 1941 | parachute-agent *(renamed from parachute-channel 2026-06-17)* |
-| 1942 | *parachute-notes (archived 2026-05-24 — notes-daemon retired; Notes now bundled in parachute-surface. Slot reclaimable; see [`parachute-notes/DEPRECATED.md`](https://github.com/ParachuteComputer/parachute-notes/blob/main/DEPRECATED.md))* |
+| 1941 | *unassigned (released when parachute-agent retired)* |
+| 1942 | parachute-notes *(archived, reservation retained)* |
 | 1943 | parachute-scribe   |
-| 1944 | *parachute-agent-legacy (the Claude-in-containers module retired 2026-05-20; slot held — NOT the 1941 agent module, which is the renamed channel)* |
-| 1945 | parachute-runner *(shipped; exploration-tier, not committed-core)* |
+| 1944 | parachute-app |
+| 1945 | *unassigned (CLI fallback)* |
 | 1946 | parachute-surface *(committed core; UI host — bundles Notes, hosts custom surfaces)* |
 | 1947–1949 | *unassigned (CLI fallback range)* |
 
 The hub pins 1939 — no fallback. If something else is on 1939 when you run `parachute expose`, the command fails with a pointer to `lsof -iTCP:1939` rather than walking up into another service's slot.
 
-**The CLI is the port authority.** `parachute install <svc>` picks the port at install time and writes `PORT=<port>` into `~/.parachute/<svc>/.env`; lifecycle.start merges that .env into the spawn env so the next daemon boot binds the port the CLI assigned. The algorithm:
+**The CLI is the port authority.** `parachute install <svc>` selects the service port and persists it in `~/.parachute/services.json`. On supervised boot, that manifest entry is authoritative: the hub injects its port into the child environment and ignores a stale per-module `.env` `PORT`. The algorithm:
 
 1. Prefer the canonical slot (e.g. vault → 1940).
-2. On collision, walk the unassigned range (1947–1949).
+2. On collision, walk the unassigned canonical range starting at 1941.
 3. Range exhausted: assign past 1949 with a warning.
 
-Idempotent: an existing `PORT=` in `~/.parachute/<svc>/.env` wins, so re-installs and operator-edited ports survive across upgrades. Services keep their compiled-in fallbacks (vault → 1940 etc.) so a stand-alone `bun run` still works without a CLI-managed .env.
+The resulting `services.json` entry is authoritative for supervised starts. Services retain compiled-in defaults for stand-alone execution without a Hub-managed manifest.
 
 `parachute expose` probes every service's port at bringup. A service that isn't responding still gets exposed, but you get a `⚠ parachute-<svc> (port …) is not responding` line so proxied requests never silently 502 without explanation.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.7-rc.8",
+  "version": "0.7.7",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {
@@ -11,16 +11,8 @@
   "bin": {
     "parachute": "src/cli.ts"
   },
-  "workspaces": [
-    "packages/*"
-  ],
-  "files": [
-    "src",
-    "web/ui/dist",
-    "scripts/git-credential-parachute",
-    "README.md",
-    "LICENSE"
-  ],
+  "workspaces": ["packages/*"],
+  "files": ["src", "web/ui/dist", "scripts/git-credential-parachute", "README.md", "LICENSE"],
   "repository": {
     "type": "git",
     "url": "https://github.com/ParachuteComputer/parachute-hub.git"
@@ -42,7 +34,6 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
-    "@openparachute/door-contract": "workspace:*",
     "@types/bun": "latest",
     "@types/qrcode": "^1.5.6"
   },
@@ -52,6 +43,7 @@
   "dependencies": {
     "@node-rs/argon2": "^2.0.2",
     "@openparachute/depcheck": "0.1.1",
+    "@openparachute/door-contract": "^0.6.0",
     "jose": "^6.2.2",
     "otpauth": "^9.5.0",
     "qrcode": "^1.5.4"

package/src/__tests__/account-api.test.ts

@@ -3,7 +3,12 @@ import { describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { checkAccountDescriptor, validateVaultScopes } from "@openparachute/door-contract";
+import {
+  ACCOUNT_ERROR_CODES,
+  checkAccountDescriptor,
+  checkVaultTokenMintResponse,
+  validateVaultScopes,
+} from "@openparachute/door-contract";
 import {
   handleAccountCapabilities,
   handleAccountCreateVault,
@@ -376,6 +381,13 @@ describe("account API — auth gates", () => {
     try {
       const res = await handleAccountListVaults(withBearer("/account/vaults", null), deps(h));
       expect(res.status).toBe(401);
+      // H1.3 — pin the CURRENT shape: auth-gate failures on /account/* emit
+      // {error, error_description} (door-contract account-contract.ts:244-246),
+      // via the shared `adminAuthErrorResponse` translator.
+      const body = (await res.json()) as { error: string; error_description: string };
+      expect(body.error).toBe("invalid_token");
+      expect(typeof body.error_description).toBe("string");
+      expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
     } finally {
       h.cleanup();
     }
@@ -387,6 +399,10 @@ describe("account API — auth gates", () => {
       const token = await bearer(h, ["vault:beta:read"]);
       const res = await handleAccountListVaults(withBearer("/account/vaults", token), deps(h));
       expect(res.status).toBe(403);
+      const body = (await res.json()) as { error: string; error_description: string };
+      expect(body.error).toBe("insufficient_scope");
+      expect(typeof body.error_description).toBe("string");
+      expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
     } finally {
       h.cleanup();
     }
@@ -594,6 +610,10 @@ describe("handleAccountMintVaultToken", () => {
       };
       expect(body.vault_token.length).toBeGreaterThan(0);
       expect(body.services["vault:field-notes"]?.url).toBe(`${ISSUER}/vault/field-notes`);
+      // H1.2 — door-contract conformance against the live
+      // `POST /account/vaults/<name>/token` success body (V1.4/C1.4 twin
+      // coverage, hub half).
+      expect(checkVaultTokenMintResponse(body, "field-notes")).toEqual([]);
       const validated = await validateAccessToken(h.db, body.vault_token, ISSUER);
       expect(validated.payload.aud).toBe("vault.field-notes");
       expect(validated.payload.scope).toBe("vault:field-notes:read vault:field-notes:write");
@@ -632,7 +652,14 @@ describe("handleAccountMintVaultToken", () => {
         deps(h),
       );
       expect(res.status).toBe(404);
-      expect(((await res.json()) as { error: string }).error).toBe("vault_not_found");
+      const body = (await res.json()) as { error: string; message: string };
+      expect(body.error).toBe("vault_not_found");
+      // H1.3 — pin the CURRENT shape: resource-level failures on /account/*
+      // emit {error, message} (door-contract account-contract.ts:244-246) —
+      // distinct from the auth-gate's {error, error_description} above.
+      expect(typeof body.message).toBe("string");
+      expect(body.message.length).toBeGreaterThan(0);
+      expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
     } finally {
       h.cleanup();
     }

package/src/__tests__/account-session.test.ts

@@ -3,7 +3,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { checkAccountSessionResponse } from "@openparachute/door-contract";
+import { ACCOUNT_ERROR_CODES, checkAccountSessionResponse } from "@openparachute/door-contract";
 import { handleAccountSession } from "../account-session.ts";
 import { CSRF_COOKIE_NAME, buildCsrfCookie, generateCsrfToken, parseCsrfCookie } from "../csrf.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
@@ -227,6 +227,14 @@ describe("handleAccountSession — method + headers", () => {
     const res = handleAccountSession(getReq(undefined, "POST"), { db: harness.db });
     expect(res.status).toBe(405);
     expect(res.headers.get("allow")).toBe("GET");
+    // H1.3 — pin the CURRENT shape: resource-level failures on /account/*
+    // emit {error, message} (door-contract account-contract.ts:244-246). This
+    // is account-session.ts's own `methodNotAllowed`, distinct from
+    // account-token.ts's {error, error_description} 405 (see H1.1/H1.3 PR
+    // notes — a decisions-needed inconsistency, not fixed here).
+    const body = (await res.json()) as { error: string; message: string };
+    expect(body).toEqual({ error: "method_not_allowed", message: "use GET" });
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
   });
 
   test("cache-control: no-store on the 200 path", async () => {

package/src/__tests__/account-token.test.ts

@@ -19,6 +19,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { ACCOUNT_ERROR_CODES, checkAccountTokenMintResponse } from "@openparachute/door-contract";
 // The `/account/*` validator (H2 / cloud) hand-rolls its scope check via
 // scope-guard's hasScope — hub never imports scope-guard at runtime (the
 // issuer/validator boundary), but the test asserts the RS-side inheritance
@@ -118,6 +119,14 @@ describe("handleAccountToken", () => {
     const req = new Request(`${ISSUER}/account/token`, { headers: { cookie } });
     const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
     expect(res.status).toBe(405);
+    // H1.3 — pin the CURRENT shape: account-token.ts emits {error,
+    // error_description} uniformly (its own local `jsonError`), including for
+    // this 405 — DIFFERENT from account-session.ts's 405, which emits {error,
+    // message} (see that file's test). A decisions-needed inconsistency
+    // across /account/*, not fixed here.
+    const body = (await res.json()) as { error: string; error_description: string };
+    expect(body).toEqual({ error: "method_not_allowed", error_description: "use POST" });
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
   });
 
   test("401 when no session cookie is present (unauthenticated → refused)", async () => {
@@ -126,8 +135,13 @@ describe("handleAccountToken", () => {
     const req = postReq("", { [CSRF_FIELD_NAME]: "anything" });
     const res = await handleAccountToken(req, { db: harness.db, issuer: ISSUER });
     expect(res.status).toBe(401);
-    const body = (await res.json()) as { error: string };
+    const body = (await res.json()) as { error: string; error_description: string };
     expect(body.error).toBe("unauthenticated");
+    // H1.3 — pin the CURRENT shape: auth-gate failures on /account/* emit
+    // {error, error_description} (door-contract account-contract.ts:244-246).
+    expect(typeof body.error_description).toBe("string");
+    expect(body.error_description.length).toBeGreaterThan(0);
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
   });
 
   test("401 when the cookie names a deleted session", async () => {
@@ -146,8 +160,11 @@ describe("handleAccountToken", () => {
     rotateSigningKey(harness.db);
     const res = await handleAccountToken(postReq(cookie, {}), { db: harness.db, issuer: ISSUER });
     expect(res.status).toBe(403);
-    const body = (await res.json()) as { error: string };
+    const body = (await res.json()) as { error: string; error_description: string };
     expect(body.error).toBe("csrf_failed");
+    // H1.3 — pin the {error, error_description} shape + ACCOUNT_ERROR_CODES membership.
+    expect(typeof body.error_description).toBe("string");
+    expect(ACCOUNT_ERROR_CODES as readonly string[]).toContain(body.error);
   });
 
   test("403 csrf_failed when the body token doesn't match the cookie token", async () => {
@@ -176,6 +193,10 @@ describe("handleAccountToken", () => {
     const body = (await res.json()) as { error: string; error_description: string };
     expect(body.error).toBe("not_admin");
     expect(body.error_description).toContain("/account/");
+    // H1.3 — DECISIONS-NEEDED (cataloged, not fixed here): "not_admin" is a
+    // real emitted /account/* error code but is NOT a member of door-contract's
+    // ACCOUNT_ERROR_CODES union — a gap in the shared vocabulary. See the PR
+    // body's decisions-needed section rather than asserting membership here.
   });
 
   test("200 mints the account superset with aud=account, validating against the hub keys", async () => {
@@ -201,6 +222,9 @@ describe("handleAccountToken", () => {
       "parachute:host:auth",
     ]);
     expect(body.aud).toBe(ACCOUNT_TOKEN_AUDIENCE);
+    // H1.2 — door-contract conformance against the live `POST /account/token`
+    // success body (V1.4/C1.4 twin coverage, hub half).
+    expect(checkAccountTokenMintResponse(body)).toEqual([]);
 
     // TTL is roughly the 10-min window.
     const skew = new Date(body.expires_at).getTime() - Date.now();

package/src/__tests__/admin-connections-credentials.test.ts

@@ -556,6 +556,26 @@ describe("credential connection — renewal (proof of possession)", () => {
     expect(rec.provisioned.mintedJtis).toEqual([out.credential.jti!]);
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const { fetchImpl, calls } = mockFetch({ "POST /api/credential": () => ok({ ok: true }) });
+    const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
+    const cred = await provision(deps, calls);
+
+    const res = await handleConnections(
+      new Request(`http://127.0.0.1/admin/connections/${cred.connection_id}/renew`, {
+        method: "POST",
+        headers: { authorization: `bearer ${cred.token}` },
+      }),
+      `/${cred.connection_id}/renew`,
+      deps,
+    );
+    expect(res.status).toBe(200);
+    const out = (await res.json()) as { ok: boolean; credential: DeliveredCredential };
+    expect(out.ok).toBe(true);
+    expect(out.credential.op).toBe("renewed");
+  });
+
   test("renewed credential can renew again (the chain extends)", async () => {
     const { fetchImpl, calls } = mockFetch({ "POST /api/credential": () => ok({ ok: true }) });
     const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
@@ -941,6 +961,27 @@ describe("credential connection — claim/reconcile (surface#113)", () => {
     ]);
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("claim: mixed-case bearer scheme (BeArEr) authenticates identically to canonical Bearer", async () => {
+    const { fetchImpl } = mockFetch({});
+    const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));
+    const direct = await mintDirectDelivered({ vault: "default", verb: "read", tags: ["boulder"] });
+
+    const claim = await handleConnections(
+      new Request(`http://127.0.0.1/admin/connections/${CLAIM_ID}/claim`, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `BeArEr ${direct.token}` },
+        body: JSON.stringify(SURFACE_CLAIM),
+      }),
+      `/${CLAIM_ID}/claim`,
+      deps,
+    );
+    expect(claim.status).toBe(202);
+    const claimBody = (await claim.json()) as { ok: boolean; status: string };
+    expect(claimBody.ok).toBe(true);
+    expect(claimBody.status).toBe("pending");
+  });
+
   test("the live docs shape: an UNTAGGED write credential is claimable verbatim (create's write-requires-tags guards NEW grants; the operator's approve sanctions the existing shape)", async () => {
     const { fetchImpl } = mockFetch({});
     const deps = credDeps(fetchImpl, modulesOf(SURFACE_MANIFEST));

package/src/__tests__/admin-lock.test.ts

@@ -21,7 +21,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { handleAgentToken } from "../admin-agent-token.ts";
+
 import { handleHostAdminToken } from "../admin-host-admin-token.ts";
 import {
   DEFAULT_ADMIN_LOCK_IDLE_SECONDS,
@@ -239,10 +239,10 @@ describe("recordLoginUnlock", () => {
 });
 
 // ---------------------------------------------------------------------------
-// The cascade: a locked session refuses ALL four admin-token mints.
+// The cascade: a locked session refuses every admin-token mint.
 // ---------------------------------------------------------------------------
 
-describe("lock cascade through the four admin-token mints", () => {
+describe("lock cascade through the admin-token mints", () => {
   test("host-admin-token: 200 when no PIN, 423 when locked, 200 after unlock", async () => {
     const { cookie, sessionId } = await withAdmin();
     rotateSigningKey(harness.db);
@@ -262,17 +262,6 @@ describe("lock cascade through the four admin-token mints", () => {
     expect((await handleHostAdminToken(mk(), { db: harness.db, issuer: ISSUER })).status).toBe(200);
   });
 
-  test("agent-token cascades (423 when locked)", async () => {
-    const { cookie } = await withAdmin();
-    rotateSigningKey(harness.db);
-    await setPin(harness.db, "4827");
-    const res = await handleAgentToken(
-      new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } }),
-      { db: harness.db, issuer: ISSUER },
-    );
-    expect(res.status).toBe(423);
-  });
-
   test("vault-admin-token cascades (423 when locked)", async () => {
     const { cookie } = await withAdmin();
     rotateSigningKey(harness.db);

package/src/__tests__/admin-module-token.test.ts

@@ -7,7 +7,7 @@
  *   - 401 when the cookie names a deleted session.
  *   - 405 on POST.
  *   - 200 + JWT carrying `aud: "<short>"` and `<short>:admin` for known modules
- *     (scribe / surface / agent).
+ *     (scribe / surface).
  *   - 400 for `vault` (per-instance — points at /admin/vault-admin-token/<name>).
  *   - 404 for an unknown short.
  *   - First-admin gate: 403 for a signed-in non-first-admin (friend).
@@ -114,7 +114,7 @@ describe("handleModuleToken", () => {
   // `<short>:admin` with `aud: <short>`. (runner left this set with its
   // 2026-07-01 registry removal — a LEGACY install still mints via the
   // self-registration gate, pinned below.)
-  for (const short of ["scribe", "surface", "agent"]) {
+  for (const short of ["scribe", "surface"]) {
     test(`200 mints a JWT carrying aud:${short} + ${short}:admin`, async () => {
       const { cookie, userId } = await withSession();
       rotateSigningKey(harness.db);
@@ -321,7 +321,7 @@ describe("handleModuleToken", () => {
     expect(body.error).toBe("use_vault_admin_token");
   });
 
-  test("first-party row resolves through the manifest-name map (parachute-agent ↔ agent)", async () => {
+  test("retired Agent identifiers do not mint even when stale rows are supplied", async () => {
     const { cookie } = await withSession();
     rotateSigningKey(harness.db);
     const installDir = writeManifestDir("agent");
@@ -335,40 +335,20 @@ describe("handleModuleToken", () => {
           version: "0.1.0",
           installDir,
         },
-      ];
-      const req = new Request(urlFor("agent"), { headers: { cookie } });
-      const res = await handleModuleToken(req, "agent", depsWith(services));
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { scopes: string[] };
-      expect(body.scopes).toEqual(["agent:admin"]);
-    } finally {
-      rmSync(installDir, { recursive: true, force: true });
-    }
-  });
-
-  test("a legacy parachute-channel row still resolves to short `agent` (rename back-compat)", async () => {
-    // Un-upgraded operators carry a `parachute-channel` services.json row;
-    // LEGACY_MANIFEST_ALIASES maps it to short `agent` so the agent config UI
-    // can still mint its admin Bearer until the daemon re-registers.
-    const { cookie } = await withSession();
-    rotateSigningKey(harness.db);
-    const installDir = writeManifestDir("agent");
-    try {
-      const services: ServiceEntry[] = [
         {
           name: "parachute-channel",
-          port: 1941,
-          paths: ["/agent"],
+          port: 1942,
+          paths: ["/channel"],
           health: "/health",
           version: "0.1.0",
           installDir,
         },
       ];
-      const req = new Request(urlFor("agent"), { headers: { cookie } });
-      const res = await handleModuleToken(req, "agent", depsWith(services));
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { scopes: string[] };
-      expect(body.scopes).toEqual(["agent:admin"]);
+      for (const short of ["agent", "parachute-agent", "parachute-channel"]) {
+        const req = new Request(urlFor(short), { headers: { cookie } });
+        const res = await handleModuleToken(req, short, depsWith(services));
+        expect(res.status).toBe(404);
+      }
     } finally {
       rmSync(installDir, { recursive: true, force: true });
     }

package/src/__tests__/admin-surfaces.test.ts

@@ -151,6 +151,27 @@ describe("routeAdminSurfaces — register + list", () => {
     }
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const h = await makeHarness();
+    try {
+      const token = await mint(h, ["parachute:host:admin"]);
+      const res = await routeAdminSurfaces(
+        req(
+          "POST",
+          { authorization: `bearer ${token}`, "content-type": "application/json" },
+          { name: "brain", mount: "/surface/brain", mode: "prod" },
+        ),
+        deps(h),
+      );
+      expect(res?.status).toBe(200);
+      const body = (await res?.json()) as { ok: boolean };
+      expect(body.ok).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
   test("POST with a missing name → 400", async () => {
     const h = await makeHarness();
     try {

package/src/__tests__/api-hub-upgrade.test.ts

@@ -510,6 +510,17 @@ describe("GET /api/hub/upgrade/status", () => {
     const res = await handleHubUpgradeStatus(getStatusReq({}), deps);
     expect(res.status).toBe(401);
   });
+
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer (404, not 401)", async () => {
+    const bearer = await mintBearer(harness, ["parachute:host:admin"]);
+    const { deps } = baseDeps(harness);
+    const res = await handleHubUpgradeStatus(
+      getStatusReq({ authorization: `bearer ${bearer}` }),
+      deps,
+    );
+    expect(res.status).toBe(404);
+  });
 });
 
 describe("detectHubUpgradeMode — §5.3 heuristic", () => {

package/src/__tests__/api-mint-token.test.ts

@@ -172,6 +172,31 @@ describe("POST /api/auth/mint-token (hub#212 Phase 1)", () => {
     }
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const h = makeHarness();
+    try {
+      const { db, userId } = await bootstrap(h.dir);
+      try {
+        const op = await mintOperatorToken(db, userId, { issuer: ISSUER });
+        const resp = await handleApiMintToken(
+          jsonRequest(
+            { scope: "scribe:transcribe", expires_in: 3600 },
+            { authorization: `bearer ${op.token}` },
+          ),
+          { db, issuer: ISSUER },
+        );
+        expect(resp.status).toBe(200);
+        const body = (await resp.json()) as { scope: string };
+        expect(body.scope).toBe("scribe:transcribe");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
   // hub#516 parity — the live "mint refused" after `parachute hub set-origin`.
   // An operator/agent credential minted under a PRIOR origin (still a member of
   // the hub's bound-origin set) must keep minting after the canonical issuer

package/src/__tests__/api-modules-ops.test.ts

@@ -208,21 +208,12 @@ describe("parseModulesPath", () => {
     });
   });
 
-  test("accepts any KNOWN module short — agent install now resolves (was the bug)", () => {
-    // Post-2026-06-09 (modular-UI architecture, P2) the install-path gate is
-    // `isKnownModuleShort` (KNOWN_MODULES ∪ FIRST_PARTY_FALLBACKS), NOT the old
-    // CURATED_MODULES whitelist. agent (renamed from channel 2026-06-17) is in
-    // KNOWN_MODULES, so its install path now resolves — fixing the
-    // running-but-uninstallable bug.
-    expect(parseModulesPath("/api/modules/agent/install")).toEqual({
-      short: "agent",
-      rest: "install",
-    });
-    // Other known modules (surface) resolve too.
+  test("accepts supported module shorts and rejects retired Agent", () => {
     expect(parseModulesPath("/api/modules/surface/install")).toEqual({
       short: "surface",
       rest: "install",
     });
+    expect(parseModulesPath("/api/modules/agent/install")).toBeUndefined();
   });
 
   test("rejects unknown shorts (the hub itself + genuinely third-party rows)", () => {
@@ -309,6 +300,29 @@ describe("POST /api/modules/:short/install", () => {
     expect(body.error_description).toContain("parachute:host:admin");
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    const { run } = alwaysOkRun();
+    const bearer = await mintBearer(h, [API_MODULES_OPS_REQUIRED_SCOPE]);
+    const res = await handleInstall(
+      postReq("/api/modules/vault/install", { authorization: `bearer ${bearer}` }),
+      "vault",
+      {
+        db: h.db,
+        issuer: ISSUER,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        supervisor,
+        run,
+        isLinked: TEST_DEFAULT_NOT_LINKED,
+      },
+    );
+    expect(res.status).toBe(202);
+    const body = (await res.json()) as { operation_id: string };
+    expect(body.operation_id).toBeDefined();
+  });
+
   test("202 + operation_id, runs bun add + seeds services.json + spawns", async () => {
     const { supervisor, spawns } = makeIdleSupervisor();
     const { run, calls } = alwaysOkRun();
@@ -1019,16 +1033,12 @@ describe("POST /api/modules/:short/start", () => {
     expect(calls).toEqual([]);
   });
 
-  test("channel#41: start reconciles a drifted services.json port back to canonical (API path)", async () => {
-    // The live signature: the agent (then channel) row carried 19415 instead of
-    // canonical 1941. The API start path (admin SPA / `parachute start agent`)
-    // must apply the SAME reconcile the boot path does — otherwise an
-    // operator-triggered start re-strands the module on the dead port.
+  test("start reconciles a supported module's drifted port back to canonical", async () => {
     writeManifest(h.manifestPath, [
       {
-        name: "parachute-agent",
+        name: "parachute-scribe",
         port: 19415,
-        paths: ["/agent"],
+        paths: ["/scribe"],
         health: "/health",
         version: "0.0.0-linked",
       },
@@ -1038,8 +1048,8 @@ describe("POST /api/modules/:short/start", () => {
     const bearer = await mintBearer(h, [API_MODULES_OPS_REQUIRED_SCOPE]);
 
     const res = await handleStart(
-      postReq("/api/modules/agent/start", { authorization: `Bearer ${bearer}` }),
-      "agent",
+      postReq("/api/modules/scribe/start", { authorization: `Bearer ${bearer}` }),
+      "scribe",
       {
         db: h.db,
         issuer: ISSUER,
@@ -1051,20 +1061,15 @@ describe("POST /api/modules/:short/start", () => {
     );
 
     expect(res.status).toBe(200);
-    // The supervisor child gets PORT=1941 (canonical), not the drifted 19415 —
-    // so it binds + the readiness probe checks the right port.
     expect(spawns.length).toBe(1);
-    expect(spawns[0]?.short).toBe("agent");
-    expect(spawns[0]?.env?.PORT).toBe("1941");
-    // services.json row is rewritten to 1941 → the reverse-proxy (which reads
-    // services.json) routes /agent/* to the live port.
+    expect(spawns[0]?.short).toBe("scribe");
+    expect(spawns[0]?.env?.PORT).toBe("1943");
     const onDisk = JSON.parse(readFileSync(h.manifestPath, "utf8")) as {
       services: { name: string; port: number }[];
     };
-    expect(onDisk.services.find((s) => s.name === "parachute-agent")?.port).toBe(1941);
-    // The reconcile event logged on the API path too (deps.log wired — #41 review).
+    expect(onDisk.services.find((s) => s.name === "parachute-scribe")?.port).toBe(1943);
     expect(
-      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1941")),
+      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1943")),
     ).toBe(true);
   });
 });