@runuai/host 0.9.150 → 0.9.152

package/src/main.ts

@@ -16,7 +16,7 @@ import { join } from "node:path";
 import WebSocket, { type RawData } from "ws";
 
 import { env } from "../lib/env";
-import { getDb, migrateHostDb } from "../lib/db";
+import { getDb, migrateHostDb, schema } from "../lib/db";
 import {
   markCloudError,
   markConnected,
@@ -25,8 +25,11 @@ import {
 } from "../lib/cloud-state";
 import {
   applyTerminalHistoryRetention,
+  closeTaskRunAssignment,
   getHostTask,
   hasInFlightHostTaskLifecycle,
+  readTaskRunEpochState,
+  upsertHostTask,
 } from "../lib/runtime-state";
 import {
   StoppedTaskStatusQueue,
@@ -39,12 +42,14 @@ import {
   requestRuntimeRecovery,
   resumeRuntimeDeferredAgentWork,
   runtimeRecoveryVerdict,
+  type StoppedTaskStatusTarget,
   waitForRuntimeRecovery,
 } from "../lib/orchestrator";
 import {
   claimGithubCredentialGeneration,
   connectedUserIds,
   GitHubRepositoryAccessError,
+  GitHubTokenUnreadableError,
   isTransientGithubError,
   listUserInstallationIds,
   listUserInstallationRepositoryIds,
@@ -66,9 +71,9 @@ import {
   reinjectGrokRunningTasks,
   watchCodexAuth,
 } from "../lib/codex-auth";
-import { startCredentialStorePickup } from "../lib/credential-store-pickup";
-import { ImmutableParameterConflictError } from "../lib/credential-store";
-import { configureTokenBroker, startTokenBrokerLoop } from "../lib/token-broker-local";
+import { startCredentialStorePickup, stopCredentialStorePickup } from "../lib/credential-store-pickup";
+import { configuredCredentialStore, ImmutableParameterConflictError, storeFailureKind } from "../lib/credential-store";
+import { configureTokenBroker, startTokenBrokerLoop, stopTokenBrokerLoop } from "../lib/token-broker-local";
 import {
   ensureKeyForUser as ensureSshKeyForUser,
   getPublicKey as getSshPublicKey,
@@ -76,12 +81,40 @@ import {
 import {
   deleteProjectEnvVar,
   listProjectEnvKeys,
+  noteProjectEnvViewChange,
   onProjectEnvChange,
   setProjectEnvVar,
   noteProjectOrg,
 } from "../lib/host-env";
+import { cancelMcpCapture, completeMcpCapture, probeMcpCapture } from "../lib/mcp-capture";
+import { captureGithub, mintSsh, readGithubRevision, revokeGithub } from "../lib/person-capture";
 import { handleMcpOp } from "../lib/mcp-connections";
-import { registerTaskGatewayTlsHandler, startMcpGateway } from "../lib/mcp-gateway";
+import {
+  ENGINE_CREDENTIAL_FILES,
+  ENGINE_ENV_CREDENTIAL_KEYS,
+  HOST_CLOUD_CREDENTIALS_FEATURE,
+  parseCredentialsActivateResultFrame,
+  runEpochFromWire,
+  SIGNIN_BOX_CAPTURE_FLOWS_FEATURE,
+  type CredentialsActivateResultFrame,
+  type CredentialsActivationPhase,
+  SIGNIN_BOX_MCP_CAPTURE_FEATURE,
+  SIGNIN_BOX_PERSON_CREDENTIALS_FEATURE,
+  isPersonGithubParameter,
+  parseGithubCaptureFrame,
+  parseGithubRevokeFrame,
+  parseMcpCaptureCancelFrame,
+  parseMcpCaptureCompleteFrame,
+  parseMcpCaptureProbeFrame,
+  parseSshMintFrame,
+  parseCredentialChangedFrame,
+  parseCredentialRefreshResultFrame,
+  parseLeaseGrantV1Frame,
+  parseLeaseStaleFrame,
+  parseLeaseUnavailableFrame,
+} from "./cloud-credentials";
+import { captureEngineAccount } from "../lib/capture-flow";
+import { registerTaskGatewayTlsHandler, setMcpGatewayLeaseOnly, startMcpGateway } from "../lib/mcp-gateway";
 import { setActiveSecretsProxy, startSecretsProxyHost, type SecretsProxyHost } from "../lib/secrets-proxy/host";
 import {
   createTaskProxyPolicySource,
@@ -92,7 +125,7 @@ import { quiesceTaskProxyMutations } from "../lib/secrets-proxy/task-trust";
 import { resolveWithSystem, resolverIgnoringHostsFile, secretsProxyEnabled } from "../lib/secrets-proxy/runtime";
 import { reinstallTrustInRunningTasks, unpinRunningTasks } from "../lib/secrets-proxy/trust-watch";
 import { currentTaskGatewayRegistration } from "../lib/task-gateway-state";
-import { proxyTaskEnvSnapshot } from "../lib/task-env-source";
+import { followLeavingLegacy, proxyTaskEnvSnapshot } from "../lib/task-env-source";
 import { recoverActiveTaskGateways } from "../lib/task-gateway-recovery";
 import { addHostBreadcrumb, initHostObs, setHostObsTag } from "../lib/obs";
 import {
@@ -104,6 +137,7 @@ import {
   uiPortFilePath,
 } from "./paths";
 import { dockerMemoryBytes, startUiServer } from "./ui/server";
+import { outboundFrameJson } from "./outbound-frame";
 import { parsePreviewPortRuntimes } from "../lib/preview-ports";
 import { dockerCli } from "../lib/docker-exec";
 import {
@@ -122,6 +156,7 @@ import {
   containerRuntimeBecameReady,
   containerRuntimeCapabilityState,
   containerRuntimeEpochIsCurrent,
+  containerRuntimeGenerationOperational,
   containerRuntimeProblem,
   containerRuntimeReadinessEpoch,
   containerRuntimeState,
@@ -129,12 +164,17 @@ import {
   initializeContainerRuntime,
   markContainerRuntimeOperational,
   onContainerRuntimeChange,
+  containerRuntimeRecheckRequester,
+  setContainerRuntimeRecheckRequester,
   startContainerRuntimeAutoRecheck,
   suspendContainerRuntime,
   containerRuntimeMachineIdentity,
+  pinnedContainerRuntimeMachineIdentity,
   publishActivationPhase,
+  rejectContainerRuntimeSelection,
+  reprobeContainerRuntimeMachineIdentity,
 } from "../lib/container-runtime";
-import { reconstructPersistedTaskEnvironment } from "../lib/task-environment";
+import { persistedTaskEnvironmentsMatchMachine, reconstructPersistedTaskEnvironment } from "../lib/task-environment";
 import { logVnodePressure } from "../lib/vnode-pressure";
 import { resolveAppleTunnelRoute } from "./apple-tunnel-route";
 import {
@@ -154,15 +194,21 @@ import {
 import { inspectTunnelContainer } from "../lib/tunnel-runtime";
 import { TunnelRegistry } from "../lib/tunnel-registry";
 import { newId } from "../lib/ulid";
+import { RUNNER_BOOT_ID } from "../lib/runner-boot";
 import {
   capabilities as agentKindCapabilities,
   onChange as onRegistryChange,
   setAdvertisementFallback,
+  setLeasedAdvertisement,
 } from "../lib/agents/registry";
 import { canAdvertiseTypedSecretaryDispatch } from "../lib/agents/mode";
 import {
   MANAGED_UPDATE_RESTART_EXIT_CODE,
+  claimCredentialsCapabilityFloor,
   claimManagedRuntimeCapabilityFloor,
+  credentialsCapabilityFloorExists,
+  CREDENTIALS_ACTIVATION_RECORD,
+  commitCredentialsSwitchLocally,
   managedRuntimeAdmissionBlocker,
   reclaimAbandonedMaintenanceCheck,
 } from "../lib/managed-runtime";
@@ -288,6 +334,10 @@ import {
   isHostConfigGetFrame,
   isHostConfigSetFrame,
   isHostLogsStartFrame,
+  isProjectEnvReplicaV1ApplyFrame,
+  isProjectEnvReplicaV1BeginFrame,
+  isProjectEnvReplicaV1CommitFrame,
+  isProjectEnvReplicaV1PageFrame,
   isHostLogsStopFrame,
   isProjectEnvBindingSetFrame,
   isProjectEnvDeleteFrame,
@@ -302,14 +352,18 @@ import {
   isProjectEnvReplicaPageFrame,
   isProjectEnvSetFrame,
   isProjectEnvStagingPutFrame,
+  isProjectEnvLegacyTagFrame,
+  PROJECT_ENV_LEGACY_TAGS_PROTOCOL_FEATURE,
   type TaskAgent,
   type TaskCommandProject,
   type TaskCommandTask,
   type TaskDiffInput,
   type TaskDownInput,
   type TaskLaunchInput,
+  type TaskStopInput,
   type TaskLease,
   type FilesOpInput,
+  type GitHubRepositoryAccessErrorCode,
   engineAccountScopeFromWire,
   isEngineAccountLabel,
   isEngineConnectKind,
@@ -323,6 +377,38 @@ import {
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager, leaseScope } from "../lib/lease";
 import { markSidecarReady, sidecarMode, sidecarPoolMode, sidecarTaskId } from "../lib/sidecar";
+import {
+  activationPassOnCredentials,
+  cloudCredentialsActivated,
+  cloudCredentialsRecovered,
+  cloudCredentialsSwept,
+  credentialsMode,
+  leaveLegacy,
+  localStopCredentials,
+  onCloudCredentialsActivated,
+  onLeavingLegacy,
+  onOwnCredentials,
+  pauseLegacyStarts,
+  recoverCloudCredentials,
+  setCloudCredentialRuntime,
+  setCredentialsModeSource,
+  setRecoveredRuntimeSetup,
+} from "../lib/cloud-credential-host";
+import {
+  CredentialsActivationAuthority,
+  type ActivationAnswer,
+  type StoppedReport,
+} from "../lib/credentials-activation-authority";
+import { purgeLocalCredentialStores } from "../lib/credentials-purge";
+import {
+  planLegacyTaskRuntimeRetirement,
+  retireLegacyTaskRuntimes,
+  type RetirementPlan,
+  type RetirementPlanDeps,
+} from "../lib/legacy-runtime-retirement";
+import { taskContainerBackend, taskContainerCli } from "../lib/task-container-cli";
+import { CloudCredentialRuntime } from "../lib/cloud-credential-runtime";
+import { ProjectEnvTaskReplicaManager } from "../lib/project-env-task-replica";
 import {
   purgeDefaultEngineSlots,
   SIGN_IN_BOX_TASK_REFUSAL,
@@ -340,9 +426,11 @@ import {
   ProjectEnvStagingInvalidError,
   writeProjectEnvStaging,
 } from "../lib/project-env-staging";
+import { queueProjectEnvLegacyTag } from "../lib/project-env-legacy-tags";
 import { loadGithubTokenIntoCache } from "../lib/github-tokens";
 import { ensureSshKeyStoreFirst } from "../lib/ssh";
 import { classifySidecarTaskView, resumeSidecarTask } from "../lib/sidecar-resume";
+import { revalidateRuntimeOnConnect } from "../lib/runtime-reconnect";
 import { declareAgentClisReady } from "../lib/standard-image";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -438,32 +526,49 @@ async function waitForRemoteOperationCleanups(): Promise<void> {
 
 let pendingBinaryTunnelId: string | null = null;
 const pendingRuntimeIsolationStatuses = new StoppedTaskStatusQueue(
-  (taskId) => getHostTask(taskId)?.statusMirror,
+  (taskId) => {
+    const task = getHostTask(taskId);
+    // The assignment floor, not the reusable runtime row, is the generation
+    // authority. taskUp advances it before it may rewrite the task row, so a
+    // queued N stop cannot be mistaken for N+1 in that admission window.
+    const assignment = readTaskRunEpochState(taskId);
+    return task?.statusMirror
+      ? {
+          status: task.statusMirror,
+          runEpoch: assignment?.highestRunEpoch ?? 0,
+        }
+      : null;
+  },
 );
 let stopRuntimeAutoRecheck = (): void => {};
 const runtimeActivationTail = new RuntimeActivationTail({
   isCurrent: runtimeActivationIsCurrent,
-  onError: (error) =>
-    console.warn(
-      `[host-agent] container runtime activation failed: ${error instanceof Error ? error.message : String(error)}`,
-    ),
-  onExhausted: (_epoch, attempts) =>
+  onError: reportRuntimeActivationError,
+  onExhausted: (_epoch, attempts) => {
     console.warn(
       `[host-agent] container runtime recovery remained unresolved after ${attempts} follow-up attempt(s); leaving the host in checking until the next runtime recheck`,
-    ),
+    );
+    // ADR-154: a runner already on cloud credentials still needs its boot
+    // sweep to say so; the activation authority retries it from here.
+    if (!stopping) credentialsActivation.sweepItself();
+  },
 });
 const tunnels = new TunnelRegistry();
 
-// ADR-103: event outbox. BOOT_ID scopes seqs to this process lifetime; the
+// ADR-103: event outbox. RUNNER_BOOT_ID scopes seqs to this process lifetime;
+// ADR-154's task replicas use this exact singleton too. The
 // cloud's replay watermark only applies within a matching boot. Events are
 // enqueued by a PROCESS-level subscription (below, before connect()) so a
 // dropped WSS no longer drops events — they drain on reconnect, after the
 // cloud names its watermark via event.resume.
-const BOOT_ID = newId();
 const eventOutbox = new EventOutbox();
 // Transmission is held per-connection until the cloud's event.resume sets the
 // replay cursor (or the fallback timer concedes the cloud predates ADR-103).
 let eventFlushEnabled = false;
+/** ADR-154: the cloud answered this bridge's auth (event.resume), so a
+ *  credential frame sent now is not lost in its pre-verdict window. Set
+ *  before anyone asks again, independently of the event flush. */
+let credentialFramesReady = false;
 let resumeFallbackTimer: NodeJS.Timeout | null = null;
 let eventFlushBackpressureTimer: NodeJS.Timeout | null = null;
 const RESUME_FALLBACK_MS = 3_000;
@@ -554,6 +659,61 @@ try {
   );
 }
 migrateHostDb();
+// ADR-154 §13: the activation authority, before anything reads the mode
+// (the refreshers, the v0 lease, the runtime's recovery, the first
+// capability frame). It moves only owned runners in this release: a task
+// machine needs its run's Files session on v1 first, and the sign-in box
+// runs no task.
+const credentialsActivation = new CredentialsActivationAuthority({
+  recordPath: join(env.dataDir, CREDENTIALS_ACTIVATION_RECORD),
+  floorClaimed: () => credentialsCapabilityFloorExists(),
+  eligible: () => !sidecarMode() && !signInBoxMode(),
+  ask: askCredentialsActivation,
+  pauseLegacyStarts,
+  planRetirement: () => planLegacyTaskRuntimeRetirement(retirementPlanDeps()),
+  commitLocally: (record) => commitCredentialsSwitchLocally(record),
+  retire: retireTaskRuntimesForCloudCredentials,
+  reportStopped: reportRetiredTasksStopped,
+  claimFloor: claimCredentialsCapabilityFloor,
+  leaveLegacy,
+  purge: purgeCredentialStores,
+  swept: cloudCredentialsSwept,
+  sweep: recoverCloudCredentials,
+  onActive: cloudCredentialsActive,
+  // Pending again: the next capability frame advertises no v1.
+  onActiveWithdrawn: () => sendCapabilities(),
+  restart: (why) => {
+    console.warn(`[credentials] ${why}: restarting`);
+    requestManagedHostRestart();
+  },
+  log: (line) => console.warn(line),
+});
+setCredentialsModeSource(() => credentialsActivation.mode());
+/** ADR-154 §13: how often a runner not yet on cloud credentials asks again,
+ *  so the operator turning them on reaches it within minutes. */
+const CREDENTIALS_ACTIVATION_RETRY_MS = 5 * 60_000;
+const CREDENTIALS_ACTIVATION_ANSWER_MS = 60_000;
+const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
+  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
+  ...Object.keys(ENGINE_CREDENTIAL_FILES),
+]);
+// Started here, first fired long after the bridge's state exists.
+const credentialsActivationTimer = setInterval(() => {
+  if (stopping || !credentialFramesReady) return;
+  // Active: the purge reported again. The cloud acknowledges none and keeps
+  // the first, so a report its database failed to record is not lost until
+  // the next reconnect, and the runner is not refused tasks meanwhile. And
+  // in every mode, the stopped reports still owed go again.
+  if (credentialsMode() === "active") reportCredentialsPurged();
+  void credentialsActivation.advance();
+}, CREDENTIALS_ACTIVATION_RETRY_MS);
+credentialsActivationTimer.unref?.();
+
+const credentialsActivationAsks = new Map<
+  string,
+  { phase: CredentialsActivationPhase; resolve: (answer: ActivationAnswer) => void; timer: NodeJS.Timeout }
+>();
+
 // A task-machine process starts fail-closed. The prior process may have died
 // after opening its replica, and no task loader or proxy may serve that view
 // until this authenticated socket completes a fresh whole-task snapshot.
@@ -737,9 +897,7 @@ async function startSignInBox(): Promise<void> {
 if (signInBoxMode()) {
   await startSignInBox();
 } else if (!sidecarMode()) {
-  startTokenBrokerLoop();
-  startCredentialStorePickup({ repush: repushBrokeredCopies });
-  void reconcileStores();
+  startOwnedRefreshers();
 }
 /**
  * ADR-133 sidecar: the task-scoped AWS lease. Requested when the bridge is
@@ -747,6 +905,49 @@ if (signInBoxMode()) {
  * reconciles and the S3 file mounts run. A denial means the task is no
  * longer ours to run — exit 3 and let the cloud's sweep reclaim the machine.
  */
+// ADR-154: the composer for tasks on cloud credentials. Nothing runs on it
+// until the runner's activation authority makes cloud credentials its
+// tasks' only ones (lib/cloud-credential-host.ts).
+const cloudCredentials = new CloudCredentialRuntime({
+  runnerKind: sidecarMode() ? "task-machine" : "owned",
+  send: sendCredentialFrame,
+  quiesceProcesses: (request) => getOrchestrator().quiesceLeasedEngineAgents(request),
+  // The task-keyed env replica the cloud streams for each run. A change to
+  // it, or to what the composer serves from it, makes the proxy's trust
+  // delivery look again; /env reads it afresh on every command.
+  envReplica: new ProjectEnvTaskReplicaManager({ onChange: () => noteProjectEnvViewChange() }),
+  envServedChanged: () => noteProjectEnvViewChange(),
+});
+// Leaving its own credentials ends every task's env from the runner's
+// stores at once, and makes the proxy's trust delivery look again.
+followLeavingLegacy();
+// ADR-154 on a task machine: once its recovered task's grant opens the
+// gate, the task's loader, proxy and editor again (its shared files come
+// from its own run's Files session, never the runner's v0 lease); and the
+// proxy's upkeep from activation on, with no v0 first grant to start it.
+if (sidecarMode()) {
+  setRecoveredRuntimeSetup(async (_run, signal) => {
+    const resumed = await resumeSidecarTask({ remountFiles: false, signal });
+    if (resumed.outcome === "resumed") {
+      console.log(
+        `[sidecar] task ${sidecarTaskId()} resumed on cloud credentials: loader, proxy and editor re-asserted` +
+          (resumed.warnings.length > 0 ? ` (${resumed.warnings.join("; ")})` : ""),
+      );
+    }
+  });
+  onCloudCredentialsActivated(() => {
+    if (!stopping) startSecretsProxyUpkeep();
+  });
+}
+setCloudCredentialRuntime(cloudCredentials);
+// A runner that was already on cloud credentials follows them from here:
+// once its boot recovery sweep (the container runtime's own pass) is done.
+credentialsActivation.booted();
+void cloudCredentialsRecovered().then(() => {
+  if (!stopping) void credentialsActivation.advance();
+});
+let cloudCredentialsStopped = false;
+
 // A POOL-mode sidecar requests no lease: it has no task to scope one to,
 // and the cloud would refuse it anyway (docs/machine-warm-pool.md).
 const leaseManager: LeaseManager | null = sidecarTaskId()
@@ -758,33 +959,11 @@ const leaseManager: LeaseManager | null = sidecarTaskId()
         return true;
       },
       onFirstGrant: () => {
+        // ADR-154: none of this once the runner is leaving its own
+        // credentials (the manager is stopped then, and this drained).
+        if (!onOwnCredentials()) return;
         console.log("[lease] granted — reconciling the credential store");
-        void reconcileStores().finally(() => {
-          // Task-up waits for this: only now are engine accounts, GitHub
-          // tokens, and project env on the machine (lib/sidecar.ts).
-          markSidecarReady();
-          console.log("[lease] credential store reconciled — the task may start");
-          // A runner that came back on a machine whose task is already up
-          // re-asserts the mounts and the editor (lib/sidecar-resume.ts).
-          void resumeSidecarTask()
-            .then((resumed) => {
-              if (resumed.outcome !== "resumed") return;
-              console.log(
-                `[sidecar] task ${sidecarTaskId()} resumed after a runner restart: shared files and editor re-asserted` +
-                  (resumed.warnings.length > 0 ? ` (${resumed.warnings.join("; ")})` : ""),
-              );
-            })
-            .catch((error: unknown) => {
-              console.warn(
-                `[sidecar] resume failed: ${error instanceof Error ? error.message : String(error)}`,
-              );
-            })
-            // A sidecar runs no container-runtime activation: its task is
-            // reconciled by the resume (or by task-up), and kept there from now.
-            .finally(() => {
-              if (!stopping) startSecretsProxyUpkeep();
-            });
-        });
+        sidecarFirstGrant = sidecarFirstGrantWork();
         startCredentialStorePickup({ repush: repushBrokeredCopies });
       },
       onGrant: (lease) => {
@@ -798,6 +977,9 @@ const leaseManager: LeaseManager | null = sidecarTaskId()
       },
     })
   : null;
+/** The v0 lease's first-grant work under way (sidecarFirstGrantWork). */
+let sidecarFirstGrant: Promise<void> | null = null;
+if (leaseManager) onLeavingLegacy(stopV0Lease);
 if (sidecarMode()) declareAgentClisReady();
 // ADR-153 machines: the task's row is held unless its hosts-view record
 // proves it, before connect() can bring any command for it.
@@ -860,6 +1042,15 @@ const engineLoginManager = createEngineLoginManager({
             addCapturedConfigDirAccountToStore("codex", label, authJson, scope),
           addGrokAccount: (label, authJson, scope) =>
             addCapturedConfigDirAccountToStore("grok", label, authJson, scope),
+          // ADR-154: a capture flow becomes one revision of a cloud credential.
+          captureEngineAccount: (flow, engine, material) =>
+            captureEngineAccount(
+              configuredCredentialStore(),
+              flow,
+              engine,
+              material,
+              engine === "claude" ? "Claude" : engine === "codex" ? "Codex" : "Grok",
+            ),
         },
       }
     : {}),
@@ -875,6 +1066,8 @@ const engineConnectManager = createEngineConnectManager({
     ? {
         addLabeledAccount: (kind, label, secret, scope) =>
           addEngineAccountToStore(kind, label, { token: secret }, scope),
+        captureAccount: (flow, kind, material) =>
+          captureEngineAccount(configuredCredentialStore(), flow, kind, material, kind),
       }
     : {}),
 });
@@ -1017,6 +1210,18 @@ const stopMcpGatewaySubscription = mcpGateway.subscribe(() =>
 const stopAgentClisReadySubscription = onAgentClisReady(() =>
   sendCapabilities(),
 );
+// ADR-154 §13: the bridge's writes of the runner's own credentials (an
+// engine sign-in, a GitHub token or SSH key, an MCP connection, an env value)
+// are work on them too. Once leaving begins none is admitted
+// (rejectCredentialFrameOffOwnCredentials), and leaving waits for every one
+// admitted before, through its acknowledgement, so none lands after the
+// purge: the sign-in flows stop, and the mutations and queued operations
+// drain.
+onLeavingLegacy(async () => {
+  engineConnectManager.stopAll();
+  await Promise.all([engineLoginManager.stopAll(), engineConnectManager.idle()]);
+  await Promise.all([managedMutationDrain.idle(), waitForRemoteOperationCleanups()]);
+});
 void connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.
@@ -1070,13 +1275,43 @@ async function startLocalUi(): Promise<void> {
         // ADR-121: a stopped machine loses its memoised address (same
         // before-and-after discipline as the cloud's taskStop command).
         invalidateMachineTunnelRoute(taskId);
+        // ADR-154: the start under way ends before Stop queues behind it.
+        const credentials = localStopCredentials(taskId);
         try {
-          const result = await getOrchestrator().stopTask(taskId);
+          const stopped = await getOrchestrator().stopTask(taskId, {
+            ...credentials,
+            // A local operator means "whatever this runner currently owns".
+            // Resolve that assignment only after taking the lifecycle slot;
+            // a persisted runtime row may still name the preceding epoch
+            // while a new task-up is being admitted.
+            admitAssignment: () => {
+              const assignment = readTaskRunEpochState(taskId);
+              if (assignment === null) return { kind: "legacy" };
+              const closed = closeTaskRunAssignment(
+                taskId,
+                assignment.highestRunEpoch,
+              );
+              return closed.kind === "closed" ||
+                closed.kind === "already_closed"
+                ? { kind: "closed", runEpoch: assignment.highestRunEpoch }
+                : { kind: "stale" };
+            },
+          });
+          const result = stopped.ok
+            ? { ok: true as const }
+            : { ok: false as const, error: stopped.error ?? "stop failed" };
           // A PERSON pressed Stop on this machine's own UI — ADR-028. Labelled
           // as such because the cloud otherwise cannot tell it apart from the
           // quarantine sweeps below, which reach the bridge through this same
           // frame, and ADR-144 turns that difference into who may undo it.
-          if (result.ok) queueStoppedTaskStatus(taskId, "manual");
+          if (result.ok) {
+            queueStoppedTaskStatus(
+              stopped.stoppedRunEpoch === undefined
+                ? { taskId }
+                : { taskId, runEpoch: stopped.stoppedRunEpoch },
+              "manual",
+            );
+          }
           return result;
         } finally {
           invalidateMachineTunnelRoute(taskId);
@@ -1128,6 +1363,17 @@ function buildCapabilities(): HostCapabilities {
         ? [SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE]
         : []),
       ...(projectEnvBindings === null ? [] : [projectEnvBindings.feature]),
+      // ADR-154 §13: the runner reads cloud credentials, its stores purged.
+      ...(credentialsMode() === "active" ? [HOST_CLOUD_CREDENTIALS_FEATURE] : []),
+      // ADR-154: only the sign-in box writes cloud credentials.
+      ...(signInBoxMode()
+        ? [
+            SIGNIN_BOX_CAPTURE_FLOWS_FEATURE,
+            SIGNIN_BOX_MCP_CAPTURE_FEATURE,
+            SIGNIN_BOX_PERSON_CREDENTIALS_FEATURE,
+            PROJECT_ENV_LEGACY_TAGS_PROTOCOL_FEATURE,
+          ]
+        : []),
     ],
     ...(projectEnvBindings === null
       ? {}
@@ -1256,26 +1502,360 @@ function sendCapabilities(): void {
   }
 }
 
+/**
+ * ADR-133: what the v0 lease's first grant does on a task machine, as one
+ * piece that leaving the runner's own credentials waits for (ADR-154): the
+ * machine's stores reconciled, the task let start, a task already up
+ * resumed, then the proxy's upkeep. After the reconcile, each step only
+ * while the runner is still on its own credentials.
+ */
+async function sidecarFirstGrantWork(): Promise<void> {
+  await reconcileStores();
+  // Task-up waits for this: only now are engine accounts, GitHub tokens,
+  // and project env on the machine (lib/sidecar.ts).
+  markSidecarReady();
+  if (!onOwnCredentials()) return;
+  console.log("[lease] credential store reconciled — the task may start");
+  // A runner that came back on a machine whose task is already up
+  // re-asserts the mounts and the editor (lib/sidecar-resume.ts).
+  try {
+    const resumed = await resumeSidecarTask();
+    if (resumed.outcome === "resumed") {
+      console.log(
+        `[sidecar] task ${sidecarTaskId()} resumed after a runner restart: shared files and editor re-asserted` +
+          (resumed.warnings.length > 0 ? ` (${resumed.warnings.join("; ")})` : ""),
+      );
+    }
+  } catch (error) {
+    console.warn(`[sidecar] resume failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  // A sidecar runs no container-runtime activation: its task is reconciled
+  // by the resume (or by task-up), and kept there from now.
+  if (!stopping && onOwnCredentials()) startSecretsProxyUpkeep();
+}
+
+/**
+ * ADR-135 on a runner that is not a sidecar: its refresh loop (owned) or
+ * store pickup (Uai-operated), and the reconcile of its stores. ADR-154 §7:
+ * only while the runner is on its own credentials. Leaving them stops the
+ * loop and the pickup at once, and waits for the cycle, pickup or reconcile
+ * under way: no runner refreshes, and nothing writes a local copy after.
+ */
+function startOwnedRefreshers(): void {
+  if (!onOwnCredentials()) return;
+  startTokenBrokerLoop();
+  startCredentialStorePickup({ repush: repushBrokeredCopies });
+  const storesReconciled = reconcileStores();
+  onLeavingLegacy(async () => {
+    const results = await Promise.allSettled([stopTokenBrokerLoop(), stopCredentialStorePickup(), storesReconciled]);
+    const failures = results.flatMap((result) => (result.status === "rejected" ? [result.reason as unknown] : []));
+    if (failures.length > 0) throw new AggregateError(failures, "the runner's own refreshers did not stop");
+  });
+}
+
+/** ADR-154: leaving its own credentials stops the v0 lease at once (no
+ *  request, no grant, no denial acted on after) and its first-grant work:
+ *  the store pickup stops, and the reconcile and resume under way drain. */
+async function stopV0Lease(): Promise<void> {
+  // Each stop attempted at once, in order, one throwing never skipping the
+  // next; then each waited for. Any failure fails the stop, so the runner
+  // stays pending.
+  const attempt = (stop: () => unknown): Promise<unknown> => {
+    try {
+      return Promise.resolve(stop());
+    } catch (error) {
+      return Promise.reject(error);
+    }
+  };
+  const results = await Promise.allSettled([
+    attempt(() => leaseManager?.stop()),
+    attempt(() => stopCredentialStorePickup()),
+    sidecarFirstGrant,
+  ]);
+  const failures = results.flatMap((result) => (result.status === "rejected" ? [result.reason as unknown] : []));
+  if (failures.length > 0) throw new AggregateError(failures, "the v0 lease's work did not stop");
+}
+
+/** ADR-154: a lease or refresh request, or an env replica ack, to the cloud:
+ *  only on a bridge the cloud has answered. False when not sent now; the
+ *  composer asks again once the bridge is back. */
+function sendCredentialFrame(frame: Parameters<typeof send>[1]): boolean {
+  if (!ws || ws.readyState !== WebSocket.OPEN || !credentialFramesReady) return false;
+  send(ws, frame);
+  return true;
+}
+
+/**
+ * ADR-133/154: the cloud's first frame after a verified auth. A lease
+ * request sent any earlier lands in the bridge's pre-verdict window, where
+ * only auth/ping/result frames survive (live 2026-09-10, hostless smoke 5:
+ * the first request vanished, the machine sat three minutes without
+ * credentials). From here credential frames go, and whoever holds leases
+ * asks again in this same turn: the v0 manager while the runner is on its
+ * own credentials, the composer once it is on cloud ones. Pending asks
+ * nothing: the v0 manager is stopped, and activation asks once it is done.
+ */
+function bridgeResumed(): void {
+  credentialFramesReady = true;
+  const mode = credentialsMode();
+  if (mode === "legacy") leaseManager?.reconnected();
+  else if (mode === "active") {
+    cloudCredentials.bridgeAuthenticated();
+    reportCredentialsPurged();
+  }
+  // ADR-154 §13: a runner not yet on cloud credentials asks again on every
+  // connection (and on a timer, CREDENTIALS_ACTIVATION_RETRY_MS).
+  if (!stopping) void credentialsActivation.advance();
+}
+
+/** One phase of ADR-154 §13's handshake, asked of the cloud. */
+function askCredentialsActivation(phase: CredentialsActivationPhase): Promise<ActivationAnswer> {
+  return new Promise<ActivationAnswer>((resolve, reject) => {
+    const opId = newId();
+    const timer = setTimeout(() => {
+      credentialsActivationAsks.delete(opId);
+      reject(new Error(`the cloud did not answer ${phase} in time`));
+    }, CREDENTIALS_ACTIVATION_ANSWER_MS);
+    timer.unref?.();
+    credentialsActivationAsks.set(opId, { phase, resolve, timer });
+    if (!sendCredentialFrame({ kind: "credentials.activate", opId, phase })) {
+      clearTimeout(timer);
+      credentialsActivationAsks.delete(opId);
+      reject(new Error("the bridge is not connected"));
+    }
+  });
+}
+
+function settleCredentialsActivation(frame: CredentialsActivateResultFrame): void {
+  const asked = credentialsActivationAsks.get(frame.opId);
+  if (asked === undefined || asked.phase !== frame.phase) return;
+  credentialsActivationAsks.delete(frame.opId);
+  clearTimeout(asked.timer);
+  asked.resolve(frame.ok ? { ok: true } : { ok: false, error: frame.error ?? "refused" });
+}
+
+/** ADR-154 §13: the purge is done. The cloud acknowledges nothing and keeps
+ *  the first report, so it goes on every connection and every activation
+ *  tick. */
+function reportCredentialsPurged(): void {
+  sendCredentialFrame({ kind: "credentials.activated", opId: newId() });
+}
+
+/** ADR-154 §13: what the retirement reads (lib/legacy-runtime-retirement.ts):
+ *  the task rows once, the identity fence over those same rows, the pinned
+ *  engine. */
+function retirementPlanDeps(): RetirementPlanDeps {
+  return {
+    snapshot: () => {
+      const rows = getDb().select().from(schema.hostTasks).all();
+      const machine = pinnedContainerRuntimeMachineIdentity();
+      return {
+        tasks: rows.map((row) => ({
+          taskId: row.taskId,
+          provider: row.environmentProvider,
+          composeProject: row.composeProject,
+          worktreePath: row.worktreePath,
+          hasRuntime: row.environmentLocator !== null || row.composeProject !== null,
+        })),
+        runtimeProblem: containerRuntimeProblem(),
+        fence: machine === null ? { ok: false, detail: "no container runtime is pinned" } : persistedTaskEnvironmentsMatchMachine(rows, machine),
+        machine,
+      };
+    },
+    apple: taskContainerBackend().apple,
+    docker: dockerCli,
+    appleCli: taskContainerCli,
+    fileExists: existsSync,
+  };
+}
+
+/** Why the live engine, or `taskId`'s row, no longer matches the engine
+ *  `plan` was made against; null while it does. The process's pin never
+ *  changes, so the daemon behind it is re-probed (a replaced daemon at the
+ *  same socket has another engine id), and a mismatch quarantines the
+ *  selection as runtime-bootstrap.ts's fence does. A row gone or cleared
+ *  since the plan (its task went down) stops the plan: the next one decides. */
+async function retirementNoLongerCurrent(plan: RetirementPlan, taskId: string | null): Promise<string | null> {
+  const problem = containerRuntimeProblem();
+  if (problem !== null) return `the container runtime is not ready (${problem})`;
+  const machine = pinnedContainerRuntimeMachineIdentity();
+  if (!sameMachine(machine, plan.machine)) return "the container runtime changed since the retirement was planned";
+  const live = await reprobeContainerRuntimeMachineIdentity();
+  if (!sameMachine(live, plan.machine)) {
+    rejectContainerRuntimeSelection("The selected container runtime daemon identity changed while task runtimes were being retired.");
+    return "the container runtime's daemon changed since the retirement was planned";
+  }
+  if (taskId === null) return null;
+  const row = getHostTask(taskId);
+  if (row === null) return `task ${taskId}'s row is gone since the retirement was planned`;
+  if (row.environmentLocator === null && row.composeProject === null) {
+    return `task ${taskId} names no runtime since the retirement was planned`;
+  }
+  const verdict = persistedTaskEnvironmentsMatchMachine([row], plan.machine as NonNullable<typeof machine>);
+  return verdict.ok ? null : (verdict.detail ?? `task ${taskId} no longer matches the container runtime`);
+}
+
+function sameMachine(
+  machine: { backend: string; endpoint: string; engineId: string } | null,
+  plan: { backend: string; endpoint: string; engineId: string },
+): boolean {
+  return (
+    machine !== null &&
+    machine.backend === plan.backend &&
+    machine.endpoint === plan.endpoint &&
+    machine.engineId === plan.engineId
+  );
+}
+
+/** ADR-154 §13: each owed stopped report again, at its exact run epoch;
+ *  returns those still owed. One is moot once its task's row is gone, or the
+ *  task has an assignment newer than the run it reports (a report with no
+ *  epoch: any assignment at all), since the cloud has moved on from it. */
+function reportRetiredTasksStopped(owed: readonly StoppedReport[]): StoppedReport[] {
+  const still: StoppedReport[] = [];
+  for (const report of owed) {
+    if (getHostTask(report.taskId) === null) continue;
+    const assignment = readTaskRunEpochState(report.taskId);
+    if (assignment !== null && (report.runEpoch === null || assignment.highestRunEpoch > report.runEpoch)) continue;
+    queueStoppedTaskStatus(
+      report.runEpoch === null ? { taskId: report.taskId } : { taskId: report.taskId, runEpoch: report.runEpoch },
+    );
+    still.push(report);
+  }
+  return still;
+}
+
+/** ADR-154 §13, from the local commit on: every task runtime goes, its
+ *  worktree kept, each checked in its lifecycle slot against the engine the
+ *  plan was made against. Each retired task is owed a stopped report at the
+ *  exact run epoch it stopped at (the authority keeps them). */
+async function retireTaskRuntimesForCloudCredentials(
+  plan: RetirementPlan,
+): Promise<{ stopped: StoppedReport[]; problem: string | null }> {
+  const report = await retireLegacyTaskRuntimes(plan, {
+    ...retirementPlanDeps(),
+    current: (taskId) => retirementNoLongerCurrent(plan, taskId),
+    // In the slot the retirement holds, right after it re-proved the engine.
+    stop: async (taskId) => {
+      invalidateMachineTunnelRoute(taskId);
+      const stopped = await getOrchestrator().stopTaskInHeldLifecycle(taskId, {
+        // The daemon proven again after the channel drained, before previews
+        // or the runtime are touched.
+        beforeRuntimeMutation: () => retirementNoLongerCurrent(plan, taskId),
+        // What this runner owns now, as a local Stop resolves it.
+        admitAssignment: () => {
+          const assignment = readTaskRunEpochState(taskId);
+          if (assignment === null) return { kind: "legacy" };
+          const closed = closeTaskRunAssignment(taskId, assignment.highestRunEpoch);
+          return closed.kind === "closed" || closed.kind === "already_closed"
+            ? { kind: "closed", runEpoch: assignment.highestRunEpoch }
+            : { kind: "stale" };
+        },
+      });
+      return stopped.ok ? { ok: true } : { ok: false, error: stopped.error ?? "stop failed" };
+    },
+    inLifecycle: (taskId, work) => getOrchestrator().runTaskLifecycle(taskId, work),
+    log: (line) => console.warn(line),
+  });
+  const stopped: StoppedReport[] = [];
+  for (const taskId of report.retired) {
+    // Its runtime is gone, whatever its Stop said: the mirror says so, as
+    // the queue's flush requires.
+    if (getHostTask(taskId) === null) continue;
+    upsertHostTask(taskId, { statusMirror: "stopped" });
+    stopped.push({ taskId, runEpoch: readTaskRunEpochState(taskId)?.highestRunEpoch ?? null });
+  }
+  console.warn(
+    `[credentials] retired ${report.retired.length} task runtime(s)` +
+      (report.orphans.length > 0 ? ` and ${report.orphans.length} no task named` : ""),
+  );
+  return {
+    stopped,
+    problem:
+      report.problems.length > 0 ? `task runtimes were not all retired: ${report.problems.join("; ").slice(0, 1200)}` : null,
+  };
+}
+
+/** ADR-154 §13, after the cloud commit: every runner-local credential store. */
+async function purgeCredentialStores(): Promise<void> {
+  const report = await purgeLocalCredentialStores();
+  const rows = Object.values(report.rows).reduce((sum, count) => sum + count, 0);
+  console.warn(
+    `[credentials] purged ${rows} credential row(s), ${report.dirs.length} dir(s), ` +
+      `${report.files.length} file(s) and ${report.envKeys.length} env key(s)`,
+  );
+}
+
+/**
+ * ADR-154 §13: the runner's tasks run on cloud credentials from here. The
+ * authority calls this once its `active` record is durable and the recovery
+ * sweep is done, so nothing here asks for a grant, or advertises v1, before
+ * that sweep; `mode()` reads `active` while it runs. Each step is idempotent:
+ * should one throw, the authority withdraws (the capabilities sent again,
+ * pending) and calls this again later.
+ */
+function cloudCredentialsActive(how: "transition" | "boot"): void {
+  // MCP is served only from leases: never the local store, which is gone.
+  setMcpGatewayLeaseOnly(true);
+  // Every task that survived this process's start asks for its run's
+  // credentials (once per process); its requests go out once the bridge can.
+  cloudCredentialsActivated();
+  // The bridge told now; else its next hello and bridgeResumed tell it.
+  if (credentialFramesReady) {
+    sendCapabilities();
+    reportCredentialsPurged();
+    cloudCredentials.bridgeAuthenticated();
+  }
+  console.warn(`[credentials] the runner is on cloud credentials (${how})`);
+}
+
+/**
+ * ADR-133's v0 lease frames, to the v0 manager only while the runner is on
+ * its own credentials. From `pending` on that manager is stopped, and a v0
+ * denial (a runner floored to v1 is refused its epoch-less request) never
+ * reaches its exit. Once active, a denial of the composer's own request is
+ * the composer's.
+ */
+function routeV0LeaseFrame(frame: Extract<CloudToHost, { kind: "lease.grant" | "lease.deny" }>): void {
+  const mode = credentialsMode();
+  if (mode === "legacy") leaseManager?.handle(frame);
+  else if (mode === "active" && frame.kind === "lease.deny") void cloudCredentials.handleFrame(frame);
+}
+
 /** Keep a rolling-isolation/local-UI stop from remaining cloud-ghost-running
  * merely because the bridge was between connections at the transition. */
 function queueStoppedTaskStatus(
-  taskId: string,
+  target: StoppedTaskStatusTarget,
   reason?: StoppedTaskReason,
 ): void {
-  pendingRuntimeIsolationStatuses.enqueue(taskId, reason);
+  pendingRuntimeIsolationStatuses.enqueue(
+    target.taskId,
+    reason,
+    target.runEpoch,
+  );
   flushStoppedTaskStatuses();
 }
 
 function flushStoppedTaskStatuses(socket: WebSocket | null = ws): void {
   if (!socket || socket.readyState !== WebSocket.OPEN) return;
-  pendingRuntimeIsolationStatuses.flush((taskId, reason) => {
-    send(socket, { kind: "task.status", taskId, status: "stopped", reason });
+  pendingRuntimeIsolationStatuses.flush((taskId, reason, runEpoch) => {
+    send(socket, {
+      kind: "task.status",
+      taskId,
+      status: "stopped",
+      reason,
+      ...(runEpoch === undefined ? {} : { runEpoch }),
+    });
   });
 }
 
 // ADR-131 D3: a stored account (any scope) makes a kind advertisable even
 // when the host's own credential is absent — see hasStoredEngineAccounts.
 setAdvertisementFallback((kind) => hasStoredEngineAccounts(kind));
+// ADR-154: on cloud credentials the runner holds none of its own, so a kind
+// is advertised when the cloud can lease an account for it (Kimi, with no
+// lane yet, is not), whatever this process's env says.
+setLeasedAdvertisement(() => (credentialsMode() === "active" ? LEASED_ENGINE_KINDS : null));
 onRegistryChange(() => sendCapabilities());
 onContainerRuntimeChange((next, previous) => {
   if (stopping) return;
@@ -1298,6 +1878,7 @@ onContainerRuntimeChange((next, previous) => {
   }
 });
 stopRuntimeAutoRecheck = startContainerRuntimeAutoRecheck();
+installContainerRuntimeRecheckRequester();
 // Re-advertise when a gh token is added/removed (ADR-033) so the host page's
 // per-host connected state updates promptly.
 onGithubChange(() => sendCapabilities());
@@ -1334,8 +1915,33 @@ async function activateContainerRuntime(
 ): Promise<RuntimeActivationAttemptResult> {
   publishActivationPhase("joining in-flight recovery");
   await waitForRuntimeRecovery();
+  // ADR-154: one begun on the runner's own credentials stops the moment
+  // leaving them begins, through publication; the next pass sweeps first,
+  // and recovers afresh.
+  return activationPassOnCredentials({
+    isRuntimeCurrent: () => runtimeActivationIsCurrent(epoch),
+    runtimeOperational: () => containerRuntimeGenerationOperational(epoch),
+    recover,
+    freshRecover: requestRuntimeRecovery,
+    pass: (isCurrent, recoverOnCredentials) => activateRuntimePass(epoch, isCurrent, recoverOnCredentials),
+    onError: reportRuntimeActivationError,
+  });
+}
+
+function reportRuntimeActivationError(error: unknown): void {
+  console.warn(
+    `[host-agent] container runtime activation failed: ${error instanceof Error ? error.message : String(error)}`,
+  );
+}
+
+/** The activation pass itself, under `isCurrent` through publication. */
+function activateRuntimePass(
+  epoch: number,
+  isCurrent: () => boolean,
+  recoverOnCredentials: RuntimeRecoveryRequest,
+): Promise<RuntimeActivationAttemptResult> {
   return runMaintainedRuntimeActivation({
-    isCurrent: () => runtimeActivationIsCurrent(epoch),
+    isCurrent,
     beforeMaintenance: async () => {
       // This is the first selected-daemon operation in activation. Durable
       // TaskEnvironment locators must match the exact process pin before
@@ -1351,8 +1957,8 @@ async function activateContainerRuntime(
         lifecycle: getOrchestrator(),
         isCurrent: () => runtimeActivationIsCurrent(epoch),
       });
-      for (const taskId of isolated.stoppedTaskIds) {
-        queueStoppedTaskStatus(taskId);
+      for (const stoppedTask of isolated.stoppedTasks) {
+        queueStoppedTaskStatus(stoppedTask);
       }
       publishActivationPhase(
         `writable-container quarantine: ${isolated.verdict}`,
@@ -1365,7 +1971,7 @@ async function activateContainerRuntime(
       );
       return reconcileStableStandardImage(epoch);
     },
-    recover,
+    recover: recoverOnCredentials,
     // A bounded recovery pass can finish with active tasks still unknowable.
     // Keep the public runtime in `checking`. A real outage becomes
     // `no-runtime`; a still-ready daemon requests a bounded follow-up only
@@ -1386,13 +1992,15 @@ async function activateContainerRuntime(
     // image before the ready frame reattaches persisted agent sessions.
     publishOperational: async () => {
       if (
-        runtimeActivationIsCurrent(epoch) &&
+        isCurrent() &&
         markContainerRuntimeOperational(epoch)
       ) {
         watchCodexAuth(() => containerRuntimeProblem() === null);
         resumeRuntimeDeferredAgentWork();
         startSecretsProxyUpkeep();
         sendCapabilities();
+        // ADR-154 §13: a switch waiting for the runtime goes on now.
+        if (!stopping) void credentialsActivation.advance();
       }
     },
   });
@@ -1407,7 +2015,11 @@ async function reconcileStableStandardImage(
 ): Promise<"ready" | "retry" | "stale"> {
   while (runtimeActivationIsCurrent(epoch)) {
     const before = JSON.stringify(configuredOptionalEngines());
-    const result = await ensureStandardImage();
+    // The one pass that may restart a wedged Apple runtime's services, and
+    // only while this activation is current: its recovery follows (#p2jdax).
+    const result = await ensureStandardImage({
+      withinActivation: () => runtimeActivationIsCurrent(epoch),
+    });
     if (!runtimeActivationIsCurrent(epoch)) return "stale";
     if (!result.ok && result.remedy === "stop-volume-holders") {
       // The shared volume needs a repair the running holder tasks block and
@@ -1422,8 +2034,8 @@ async function reconcileStableStandardImage(
         isCurrent: () => runtimeActivationIsCurrent(epoch),
         scope: "volume-holders",
       });
-      for (const taskId of swept.stoppedTaskIds) {
-        queueStoppedTaskStatus(taskId);
+      for (const stoppedTask of swept.stoppedTasks) {
+        queueStoppedTaskStatus(stoppedTask);
       }
       if (!runtimeActivationIsCurrent(epoch)) return "stale";
       return "retry";
@@ -1452,68 +2064,43 @@ async function reconcileStableStandardImage(
  * ready-to-ready proof restores operation without a full recovery sweep;
  * actual loss/restoration creates a readiness edge and takes the full path. */
 function revalidateContainerRuntimeOnConnect(): void {
-  const runtime = containerRuntimeState();
-  const suspendedEpoch =
-    runtime.status === "ready" ? suspendContainerRuntime() : null;
-  void (async () => {
-    const next = await initializeContainerRuntime();
-    if (
-      suspendedEpoch === null ||
-      next.status !== "ready" ||
-      !containerRuntimeEpochIsCurrent(suspendedEpoch)
-    ) {
-      return;
-    }
-    if (!(await selectedRuntimeMatchesPersistedTaskEnvironments())) return;
-    if (!runtimeActivationIsCurrent(suspendedEpoch)) return;
-    // A healthy daemon can still have restarted while the bridge was offline.
-    // One label scan keeps ordinary cloud/network flaps cheap; only a missing,
-    // exited, or unknowable active app takes the full per-task recovery path.
-    const recovery = await runtimeRecoveryVerdict();
-    let recovered = recovery === "clean";
-    if (!recovered) {
-      recovered = await requestRuntimeRecovery(() =>
-        runtimeActivationIsCurrent(suspendedEpoch),
-      );
-    }
-    if (!runtimeActivationIsCurrent(suspendedEpoch)) return;
-    // Prove the daemon once more after recovery so a mid-sweep loss cannot
-    // reopen commands and tunnels on an unresolved backend.
-    const final = await initializeContainerRuntime();
-    if (
-      final.status !== "ready" ||
-      !containerRuntimeEpochIsCurrent(suspendedEpoch)
-    ) {
-      return;
-    }
-    if (!recovered) {
-      scheduleContainerRuntimeActivationRetry(
-        requestRuntimeRecovery,
-        suspendedEpoch,
-      );
-      return;
-    }
-    if (markContainerRuntimeOperational(suspendedEpoch)) {
-      runtimeActivationTail.resolve(suspendedEpoch);
+  // Suspended synchronously, before auth (lib/runtime-reconnect.ts).
+  void revalidateRuntimeOnConnect({
+    suspend: () => (containerRuntimeState().status === "ready" ? suspendContainerRuntime() : null),
+    probe: async () => (await initializeContainerRuntime()).status === "ready",
+    epochIsCurrent: (epoch) => containerRuntimeEpochIsCurrent(epoch),
+    activationIsCurrent: (epoch) => runtimeActivationIsCurrent(epoch),
+    persistedEnvironmentsMatch: () => selectedRuntimeMatchesPersistedTaskEnvironments(),
+    recoveryVerdict: () => runtimeRecoveryVerdict(),
+    recover: (isCurrent) => requestRuntimeRecovery(isCurrent),
+    scheduleRetry: (epoch) => scheduleContainerRuntimeActivationRetry(requestRuntimeRecovery, epoch),
+    requestActivation: (epoch) => void requestContainerRuntimeActivation(requestRuntimeRecovery, epoch),
+    publish: (epoch) => {
+      if (!markContainerRuntimeOperational(epoch)) return false;
+      runtimeActivationTail.resolve(epoch);
       resumeRuntimeDeferredAgentWork();
       sendCapabilities();
-    }
-  })().catch((error) => {
-    console.warn(
-      `[host-agent] container runtime reconnect validation failed: ${error instanceof Error ? error.message : String(error)}`,
-    );
-    if (
-      suspendedEpoch !== null &&
-      runtimeActivationIsCurrent(suspendedEpoch)
-    ) {
-      scheduleContainerRuntimeActivationRetry(
-        requestRuntimeRecovery,
-        suspendedEpoch,
-      );
-    }
+      return true;
+    },
   });
 }
 
+/** Work outside activation that needs the runtime's remedy (a wedged Apple
+ * runtime, or a one-off container that will not go, #p2jdax) asks for the
+ * operator's recheck: its activation alone restarts the runtime's services,
+ * and recovers every task after. An ask while an activation (with its
+ * retries) is under way is asked again once it is done; one while only a
+ * recheck is under way joins it (containerRuntimeRecheckRequester). */
+function installContainerRuntimeRecheckRequester(): void {
+  setContainerRuntimeRecheckRequester(
+    containerRuntimeRecheckRequester({
+      activationUnderWay: () => runtimeActivationTail.underWay(),
+      activationSettled: () => runtimeActivationTail.whenSettled(),
+      recheck: requestForcedContainerRuntimeRecheck,
+    }),
+  );
+}
+
 /** An operator recheck is an explicit recovery request. Invalidate even a
  * stale ready verdict so an unseen daemon restart gets image maintenance,
  * persisted-task recovery, credential reinjection, and channel reattach. */
@@ -2161,6 +2748,7 @@ async function connect(): Promise<void> {
     if (pingTimer) clearInterval(pingTimer);
     if (deadTimer) clearInterval(deadTimer);
     eventFlushEnabled = false;
+    credentialFramesReady = false;
     cancelEventFlushBackpressureTimer();
     if (resumeFallbackTimer) {
       clearTimeout(resumeFallbackTimer);
@@ -2177,7 +2765,7 @@ async function connect(): Promise<void> {
     // task reconciliation, which must observe `checking` until this proof
     // finishes instead of treating a dead daemon as an empty one.
     revalidateContainerRuntimeOnConnect();
-    send(socket, { kind: "auth", token, hostId, bootId: BOOT_ID });
+    send(socket, { kind: "auth", token, hostId, bootId: RUNNER_BOOT_ID });
     // Advertise capabilities immediately after auth (ADR-021). The bridge
     // rejects with close-code 4001 if auth fails, so sending here is harmless
     // on a bad token and saves a round-trip on a good one. Re-sent on every
@@ -2236,17 +2824,13 @@ async function connect(): Promise<void> {
     if (!frame) return;
     if (stopping && rejectFrameDuringShutdown(socket, frame)) return;
     if (signInBoxMode() && rejectFrameOnSignInBox(socket, frame)) return;
+    if (!onOwnCredentials() && rejectCredentialFrameOffOwnCredentials(socket, frame)) return;
 
     switch (frame.kind) {
       case "pong":
         break;
       case "event.resume":
-        // ADR-133: the cloud's first frame after a verified auth. A lease
-        // request sent any earlier lands in the bridge's pre-verdict window,
-        // where only auth/ping/result frames survive (live 2026-09-10,
-        // hostless smoke 5: the first request vanished, the machine sat
-        // three minutes without credentials).
-        leaseManager?.reconnected();
+        bridgeResumed();
         // ADR-103: the cloud named its watermark — rewind the transmit
         // cursor to it (null = no state, replay nothing) and start draining.
         if (resumeFallbackTimer) {
@@ -2317,6 +2901,7 @@ async function connect(): Promise<void> {
           emitEngineLoginEvent,
           frame.label,
           frame.scope,
+          frame.flow,
         );
         break;
       case "engine.login.input":
@@ -2338,6 +2923,7 @@ async function connect(): Promise<void> {
           frame.label,
           (event) => sendRemoteOperationFrame(event),
           frame.scope,
+          frame.flow,
         );
         break;
       case "engine.connect.stop":
@@ -2399,7 +2985,21 @@ async function connect(): Promise<void> {
         break;
       case "lease.grant":
       case "lease.deny":
-        leaseManager?.handle(frame);
+        routeV0LeaseFrame(frame);
+        break;
+      case "lease.grant.v1":
+      case "lease.unavailable":
+      case "lease.stale":
+      case "credential.changed":
+      case "credential.refresh.result":
+      case "env.replica.v1.begin":
+      case "env.replica.v1.page":
+      case "env.replica.v1.apply":
+      case "env.replica.v1.commit":
+        if (credentialsMode() === "active") void cloudCredentials.handleFrame(frame);
+        break;
+      case "credentials.activate.result":
+        settleCredentialsActivation(frame);
         break;
       case "gh.connect.set": {
         const runtimeProblem = containerRuntimeProblem();
@@ -2515,7 +3115,7 @@ async function connect(): Promise<void> {
         // nowhere".
         void listUserInstallationIds(
           frame.userId,
-          {},
+          revisionListDeps(frame.userId, frame.parameter),
           frame.generation ?? 0,
         ).then(
           (installationIds) =>
@@ -2526,13 +3126,19 @@ async function connect(): Promise<void> {
               installationIds,
             }),
           (err) => {
-            const error = err instanceof Error ? err.message : String(err);
             const code =
               err instanceof GitHubRepositoryAccessError
                 ? err.code
                 : "github_unavailable";
+            // From a revision on the box: a fixed message by code.
+            const error =
+              frame.parameter !== undefined
+                ? PICKER_FAILURE_TEXT[code]
+                : err instanceof Error
+                  ? err.message
+                  : String(err);
             console.warn(
-              `[github] installation list failed for ${frame.userId}: ${error}`,
+              `[github] installation list failed for ${frame.userId}: ${frame.parameter !== undefined ? code : error}`,
             );
             send(socket, {
               kind: "gh.installations.ack",
@@ -2549,7 +3155,7 @@ async function connect(): Promise<void> {
         void listUserInstallationRepositoryIds(
           frame.userId,
           frame.installationId,
-          {},
+          revisionListDeps(frame.userId, frame.parameter),
           frame.generation ?? 0,
         ).then(
           ({ repositoryIds, truncated }) =>
@@ -2561,13 +3167,18 @@ async function connect(): Promise<void> {
               truncated,
             }),
           (err) => {
-            const error = err instanceof Error ? err.message : String(err);
             const code =
               err instanceof GitHubRepositoryAccessError
                 ? err.code
                 : "github_unavailable";
+            const error =
+              frame.parameter !== undefined
+                ? PICKER_FAILURE_TEXT[code]
+                : err instanceof Error
+                  ? err.message
+                  : String(err);
             console.warn(
-              `[github] repository list failed for ${frame.userId}/${frame.installationId}: ${error}`,
+              `[github] repository list failed for ${frame.userId}/${frame.installationId}: ${frame.parameter !== undefined ? code : error}`,
             );
             send(socket, {
               kind: "gh.repositories.ack",
@@ -2758,6 +3369,69 @@ async function connect(): Promise<void> {
         );
         break;
       }
+      case "mcp.capture.probe":
+      case "mcp.capture.complete": {
+        // ADR-154 §11: only the sign-in box runs an MCP handshake as a
+        // capture flow; anything else leaves it unanswered.
+        if (!signInBoxMode()) break;
+        const store = configuredCredentialStore();
+        const opId = frame.opId;
+        const running = !store
+          ? Promise.resolve({
+              outcome: "error" as const,
+              capture: null,
+              authorizeUrl: null,
+              scopes: null,
+              error: "the sign-in box has no credential store",
+            })
+          : frame.kind === "mcp.capture.probe"
+            ? probeMcpCapture(frame, { store })
+            : completeMcpCapture(frame, { store });
+        void managedMutationDrain.track(() =>
+          running
+            // Every step answers: an unexpected failure is a fixed refusal,
+            // never a silence the cloud waits out, nor an unhandled rejection.
+            .catch(() => ({
+              outcome: "error" as const,
+              capture: null,
+              authorizeUrl: null,
+              scopes: null,
+              error: "the sign-in box could not complete this step",
+            }))
+            .then((body) => send(socket, { kind: "mcp.capture.ack", opId, ...body })),
+        );
+        break;
+      }
+      case "mcp.capture.cancel":
+        // The cloud ended the sign-in: forget its verifier and secret now.
+        if (signInBoxMode()) cancelMcpCapture(frame);
+        break;
+      case "github.capture":
+      case "ssh.mint": {
+        // ADR-154 §12: only the sign-in box writes a person's GitHub sign-in
+        // or SSH key as a revision; anything else leaves it unanswered.
+        if (!signInBoxMode()) break;
+        const store = configuredCredentialStore();
+        const opId = frame.opId;
+        const running =
+          frame.kind === "github.capture" ? captureGithub(frame, { store }) : mintSsh(frame, { store });
+        void managedMutationDrain.track(() =>
+          running
+            .catch(() => ({ capture: null, publicKey: null, error: "The sign-in box could not complete this; nothing was kept." }))
+            .then((body) => send(socket, { kind: "person.capture.ack", opId, ...body })),
+        );
+        break;
+      }
+      case "github.revoke": {
+        if (!signInBoxMode()) break;
+        const opId = frame.opId;
+        void managedMutationDrain.track(() =>
+          revokeGithub(frame, { store: configuredCredentialStore() })
+            .catch(() => ({ outcome: "retry" as const, error: "the sign-in box could not complete the revocation" }))
+            .then((body) => send(socket, { kind: "github.revoke.ack", opId, ...body })),
+        );
+        break;
+      }
       case "env.staging.put": {
         // Only the write-only sign-in box owns immutable staging paths. An
         // owned runner or task sidecar must never accept plaintext here.
@@ -2767,6 +3441,17 @@ async function connect(): Promise<void> {
         );
         break;
       }
+      case "env.legacy.tag": {
+        // ADR-154 §9: only the sign-in box tags legacy parameters.
+        if (!signInBoxMode()) break;
+        const { opId, keys } = frame;
+        void managedMutationDrain.track(() =>
+          queueProjectEnvLegacyTag(frame, { stopping: () => shutdownRequested })
+            .catch(() => keys.map((key) => ({ key, outcome: "retry" as const })))
+            .then((results) => send(socket, { kind: "env.legacy.tag.ack", opId, results })),
+        );
+        break;
+      }
       case "env.replica.begin": {
         // Replica authority exists only on a task sidecar. Pool machines,
         // owned runners and the sign-in box deliberately leave these frames
@@ -3605,15 +4290,12 @@ async function dispatchCommand(
         .finally(() => invalidateMachineTunnelRoute(downInput.taskId));
     }
     case "taskStop": {
-      const stopTaskId = typeof args[0] === "string" ? args[0] : "";
+      const stopTaskId = expectString(args, 0);
+      const stopInput = expectTaskStopInput(args, 1);
       // A stopped machine loses its address; same before-and-after discipline.
       invalidateMachineTunnelRoute(stopTaskId);
       return hostCommands
-        .taskStop(
-          ctx,
-          stopTaskId,
-          (args[1] ?? { reason: "manual" }) as { reason: "idle" | "manual" },
-        )
+        .taskStop(ctx, stopTaskId, stopInput)
         .finally(() => invalidateMachineTunnelRoute(stopTaskId));
     }
     case "taskStatus":
@@ -3836,6 +4518,53 @@ function isTaskLease(value: unknown): value is TaskLease {
   );
 }
 
+/**
+ * ADR-154 §12: on the sign-in box the repository picker lists with the exact
+ * GitHub revision the cloud names, read from the store; the cloud's flow
+ * epoch fences it, so the runner-side generation check does not apply. A
+ * store that cannot answer reads as unavailable, never as signed out.
+ * Without a revision, the held token, as before.
+ */
+/** One picker request on the sign-in box, the revision's read and GitHub's
+ *  listing together: inside the cloud's 30-second answer deadline. */
+const PICKER_DEADLINE_MS = 25_000;
+
+function revisionListDeps(
+  userId: string,
+  parameter: string | undefined,
+): Parameters<typeof listUserInstallationIds>[1] {
+  if (parameter === undefined) return {};
+  const deadlineAt = Date.now() + PICKER_DEADLINE_MS;
+  return {
+    deadlineAt,
+    credentialGenerationMatches: () => true,
+    requestAccessToken: async () => {
+      if (!signInBoxMode()) throw new GitHubTokenUnreadableError();
+      const store = configuredCredentialStore();
+      if (!store) throw new GitHubTokenUnreadableError();
+      let token: string | null;
+      try {
+        token = await readGithubRevision(store, parameter, userId, AbortSignal.timeout(Math.max(1, deadlineAt - Date.now())));
+      } catch (err) {
+        // The kind of failure in the box's log; neither carries its words.
+        console.warn(`[github] the picker could not read ${parameter} (${storeFailureKind(err)})`);
+        throw new GitHubTokenUnreadableError();
+      }
+      return token === null ? null : { accessToken: token, expiresAt: null };
+    },
+  };
+}
+
+/** What the cloud hears when the box's picker fails: by its code, never
+ *  a dependency's words. */
+const PICKER_FAILURE_TEXT: Record<GitHubRepositoryAccessErrorCode, string> = {
+  token_missing: "no GitHub sign-in to list with",
+  reauth_required: "the GitHub sign-in needs signing in again",
+  installation_inaccessible: "GitHub no longer shows that installation to this person",
+  github_unavailable: "GitHub could not be asked just now",
+  invalid_response: "GitHub answered with something unexpected",
+};
+
 function parseCloudFrame(data: RawData): CloudToHost | null {
   let parsed: unknown;
   try {
@@ -3987,12 +4716,18 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
     typeof frame.userId === "string" &&
     parseGitHubCredentialGeneration(frame.generation) !== null
   ) {
+    // ADR-154 §12: a revision named is this person's GitHub sign-in, or the
+    // frame is dropped rather than listed with another token.
+    if (frame.parameter !== undefined && !isPersonGithubParameter(frame.parameter, frame.userId)) {
+      return null;
+    }
     return {
       kind: "gh.installations.list",
       opId: frame.opId,
       generation:
         parseGitHubCredentialGeneration(frame.generation) ?? undefined,
       userId: frame.userId,
+      ...(frame.parameter !== undefined ? { parameter: frame.parameter } : {}),
     };
   }
   if (
@@ -4004,6 +4739,9 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
     frame.installationId > 0 &&
     parseGitHubCredentialGeneration(frame.generation) !== null
   ) {
+    if (frame.parameter !== undefined && !isPersonGithubParameter(frame.parameter, frame.userId)) {
+      return null;
+    }
     return {
       kind: "gh.repositories.list",
       opId: frame.opId,
@@ -4011,6 +4749,7 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
         parseGitHubCredentialGeneration(frame.generation) ?? undefined,
       userId: frame.userId,
       installationId: frame.installationId,
+      ...(frame.parameter !== undefined ? { parameter: frame.parameter } : {}),
     };
   }
   if (
@@ -4045,7 +4784,8 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
     isProjectEnvReplicaBeginFrame(frame) ||
     isProjectEnvReplicaPageFrame(frame) ||
     isProjectEnvReplicaApplyFrame(frame) ||
-    isProjectEnvReplicaCommitFrame(frame)
+    isProjectEnvReplicaCommitFrame(frame) ||
+    isProjectEnvLegacyTagFrame(frame)
   ) {
     return frame;
   }
@@ -4056,6 +4796,14 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "mcp.op", opId: frame.opId, op: frame.op };
   }
+  // ADR-154 §11: an MCP handshake as a capture flow, exact or dropped.
+  if (frame.kind === "mcp.capture.probe") return parseMcpCaptureProbeFrame(frame);
+  // ADR-154 §12: a person's GitHub sign-in and SSH key, exact or dropped.
+  if (frame.kind === "github.capture") return parseGithubCaptureFrame(frame);
+  if (frame.kind === "ssh.mint") return parseSshMintFrame(frame);
+  if (frame.kind === "github.revoke") return parseGithubRevokeFrame(frame);
+  if (frame.kind === "mcp.capture.complete") return parseMcpCaptureCompleteFrame(frame);
+  if (frame.kind === "mcp.capture.cancel") return parseMcpCaptureCancelFrame(frame);
   // ADR-133: the cloud's answers to a sidecar's lease request. Without these
   // two clauses the sidecar logs "dropping unknown frame kind=lease.grant"
   // and the task dies after the 3-minute credentials gate.
@@ -4073,6 +4821,23 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "lease.deny", opId: frame.opId, error: frame.error };
   }
+  // ADR-154: the v1 lease, credential and task env replica frames, parsed
+  // to their exact shapes here; only a runner on cloud credentials acts on
+  // them.
+  if (frame.kind === "lease.grant.v1") return parseLeaseGrantV1Frame(frame);
+  if (frame.kind === "lease.unavailable") return parseLeaseUnavailableFrame(frame);
+  if (frame.kind === "lease.stale") return parseLeaseStaleFrame(frame);
+  if (frame.kind === "credential.changed") return parseCredentialChangedFrame(frame);
+  if (frame.kind === "credential.refresh.result") return parseCredentialRefreshResultFrame(frame);
+  if (frame.kind === "credentials.activate.result") return parseCredentialsActivateResultFrame(frame);
+  if (
+    isProjectEnvReplicaV1BeginFrame(frame) ||
+    isProjectEnvReplicaV1PageFrame(frame) ||
+    isProjectEnvReplicaV1ApplyFrame(frame) ||
+    isProjectEnvReplicaV1CommitFrame(frame)
+  ) {
+    return frame;
+  }
   // Names only — never payloads (frames can carry tokens).
   console.warn(
     `[host-agent] dropping unknown frame kind=${String(frame.kind)}` +
@@ -4162,7 +4927,9 @@ function sendHostConfigAck(
 }
 
 function send(socket: WebSocket, frame: HostToCloud): void {
-  socket.send(JSON.stringify(frame));
+  // Never past the bridge's ceiling: the cloud would close the connection.
+  const json = outboundFrameJson(frame);
+  if (json !== null) socket.send(json);
 }
 
 /**
@@ -4313,6 +5080,10 @@ function rejectFrameDuringShutdown(
     case "env.replica.page":
     case "env.replica.apply":
     case "env.replica.commit":
+    case "env.replica.v1.begin":
+    case "env.replica.v1.page":
+    case "env.replica.v1.apply":
+    case "env.replica.v1.commit":
       // These ordered operations need the durable current cursor in an error
       // ack. Shutdown has already closed the store admission gate, so leave
       // them unanswered for the cloud to retry on the replacement socket.
@@ -4325,6 +5096,37 @@ function rejectFrameDuringShutdown(
         error,
       });
       return true;
+    case "mcp.capture.probe":
+    case "mcp.capture.complete":
+      send(socket, {
+        kind: "mcp.capture.ack",
+        opId: frame.opId,
+        outcome: "error",
+        capture: null,
+        authorizeUrl: null,
+        scopes: null,
+        error,
+      });
+      return true;
+    case "mcp.capture.cancel":
+      // Not new work: it ends work already admitted, which drains on. Handled
+      // as ever (synchronous and idempotent), so a flow the cloud ended while
+      // this process drains stops its HTTP and its writes now.
+      return false;
+    case "github.capture":
+    case "ssh.mint":
+      send(socket, { kind: "person.capture.ack", opId: frame.opId, capture: null, publicKey: null, error });
+      return true;
+    case "github.revoke":
+      send(socket, { kind: "github.revoke.ack", opId: frame.opId, outcome: "retry", error });
+      return true;
+    case "env.legacy.tag":
+      send(socket, {
+        kind: "env.legacy.tag.ack",
+        opId: frame.opId,
+        results: frame.keys.map((key) => ({ key, outcome: "retry" })),
+      });
+      return true;
     case "host.inventory.request":
       // Read-only and retryable after the replacement process reconnects. A
       // partial page during shutdown would be tied to a dying generation.
@@ -4349,6 +5151,13 @@ function rejectFrameDuringShutdown(
     // A lease answer is housekeeping the sidecar still wants during a drain.
     case "lease.grant":
     case "lease.deny":
+    // ADR-154's lease, credential and activation frames, likewise.
+    case "lease.grant.v1":
+    case "lease.unavailable":
+    case "lease.stale":
+    case "credential.changed":
+    case "credential.refresh.result":
+    case "credentials.activate.result":
       return false;
   }
 }
@@ -4359,6 +5168,88 @@ function rejectFrameDuringShutdown(
  * nothing here will ever accept them — while the managed lifecycle, engine
  * sign-ins and account management pass through untouched.
  */
+/**
+ * ADR-154 §13: once the runner is leaving its own credentials (or has left
+ * them), no frame that would write or read one of its local credential
+ * stores is admitted: an engine sign-in, a GitHub token, an SSH key, an MCP
+ * connection, a project env value, or a GitHub listing on its token. Each is
+ * answered as shutdown answers it, saying why; ordered env operations, whose
+ * error needs a cursor the closed store cannot give, are left unanswered for
+ * the cloud, which stops sending them at the runner's floor. A GitHub clear
+ * or an SSH key's deletion is refused as well (the purge removes every one,
+ * and none writes its fence after it), and a sign-in's late code or callback
+ * is dropped. Stops go on.
+ */
+function rejectCredentialFrameOffOwnCredentials(socket: WebSocket, frame: CloudToHost): boolean {
+  const error = CREDENTIALS_IN_CLOUD;
+  switch (frame.kind) {
+    case "engine.login.start":
+      send(socket, {
+        kind: "engine.login.event",
+        opId: frame.opId,
+        engine: frame.engine,
+        phase: "failed",
+        errorCode: "unavailable",
+        message: error,
+      });
+      return true;
+    case "engine.connect.start":
+      send(socket, {
+        kind: "engine.connect.event",
+        opId: frame.opId,
+        engine: frame.engine,
+        phase: "done",
+        ok: false,
+        message: error,
+      });
+      return true;
+    case "engine.login.input":
+    case "engine.login.callback":
+      // Every sign-in flow stopped when leaving began: a late code or
+      // callback has nothing to finish, and is dropped unread.
+      return true;
+    case "gh.connect.set":
+    case "gh.connect.clear":
+      send(socket, { kind: "gh.connect.ack", opId: frame.opId, userId: frame.userId, ok: false, error });
+      return true;
+    case "gh.installations.list":
+      send(socket, { kind: "gh.installations.ack", opId: frame.opId, ok: false, code: "github_unavailable", error });
+      return true;
+    case "gh.repositories.list":
+      send(socket, { kind: "gh.repositories.ack", opId: frame.opId, ok: false, code: "github_unavailable", error });
+      return true;
+    case "ssh.key.get":
+    case "ssh.key.ensure":
+    case "ssh.key.delete":
+      send(socket, { kind: "ssh.key.ack", userId: frame.userId, ok: false, error });
+      return true;
+    case "mcp.op":
+      send(socket, { kind: "mcp.ack", opId: frame.opId, ok: false, error });
+      return true;
+    case "env.var.list":
+      if ("after" in frame || "reconciliationAttemptId" in frame) return true;
+      send(socket, { kind: "env.var.ack", opId: frame.opId, ok: false, error });
+      return true;
+    case "env.var.set":
+    case "env.var.delete":
+      if ("delivery" in frame) return true;
+      send(socket, { kind: "env.var.ack", opId: frame.opId, ok: false, error });
+      return true;
+    case "env.var.remove":
+    case "env.binding.set":
+    case "env.staging.put":
+    case "env.reconcile.begin":
+    case "env.reconciled":
+    case "env.delivery.skip":
+      return true;
+    default:
+      return false;
+  }
+}
+
+/** The cloud's own words for a runner past its floor (lib/credentials-activation.ts). */
+const CREDENTIALS_IN_CLOUD = "this runner reads its credentials from Uai Cloud; manage them in Connections";
+
 function rejectFrameOnSignInBox(socket: WebSocket, frame: CloudToHost): boolean {
   switch (frame.kind) {
     case "command":
@@ -4553,6 +5444,21 @@ function expectTaskDownInput(args: unknown[], index: number): TaskDownInput {
   return out;
 }
 
+function expectTaskStopInput(args: unknown[], index: number): TaskStopInput {
+  const input = expectRecord(args[index], "task stop input");
+  if (input.reason !== "idle" && input.reason !== "manual") {
+    throw new Error("invalid task stop reason");
+  }
+  const out: TaskStopInput = { reason: input.reason };
+  if (Object.prototype.hasOwnProperty.call(input, "runEpoch")) {
+    if (!Number.isSafeInteger(input.runEpoch) || (input.runEpoch as number) < 1) {
+      throw new Error("invalid task stop run epoch");
+    }
+    out.runEpoch = input.runEpoch as number;
+  }
+  return out;
+}
+
 function expectTaskDiffInput(args: unknown[], index: number): TaskDiffInput {
   const input = expectRecord(args[index], "task diff input");
   const projectsValue = input.projects;
@@ -4760,6 +5666,9 @@ function expectTaskCommandTask(value: unknown): TaskCommandTask {
     "task.engineAccountScope",
   );
   if (taskScope !== undefined) out.engineAccountScope = taskScope;
+  // ADR-154: the run epoch every v1 grant and replica frame is fenced to.
+  const runEpoch = runEpochFromWire(row.runEpoch, "task.runEpoch");
+  if (runEpoch !== undefined) out.runEpoch = runEpoch;
   return out;
 }
 
@@ -4842,6 +5751,18 @@ function requestShutdown(signal: NodeJS.Signals): void {
   void stopRemoteOperationManagers();
   stopMcpGatewaySubscription();
   stopAgentClisReadySubscription();
+  // ADR-154: no credential is served or taken after this; what was accepted
+  // drains, bounded, and no cleanup starts (the next process's recovery runs
+  // it). Exit waits for it.
+  void cloudCredentials
+    .shutdown()
+    .catch((error: unknown) =>
+      console.warn(`[credentials] shutdown failed: ${error instanceof Error ? error.message : String(error)}`),
+    )
+    .finally(() => {
+      cloudCredentialsStopped = true;
+      maybeExit();
+    });
   // Before the gateway: unregister its TLS consumer, end proxy connections,
   // refuse new root mutations of tasks and wait for those under way. Exit
   // waits for all of it (see secretsProxyStopped).
@@ -4877,7 +5798,8 @@ function maybeExit(): void {
     inFlight > 0 ||
     managedMutationDrain.activeCount > 0 ||
     pendingRemoteOperationCleanups.size > 0 ||
-    !secretsProxyStopped
+    !secretsProxyStopped ||
+    !cloudCredentialsStopped
   ) return;
   if (ws) {
     if (ws.readyState === WebSocket.OPEN) {