@runuai/host 0.9.153 → 0.9.155

package/lib/credential-consumers/github.ts

@@ -23,7 +23,8 @@
  *   is recorded in the cleanup inventory before anything is written to it.
  * - Writes for one task run one at a time, and each exec is admitted at the
  *   provider's last moment against the task's live state: the same
- *   assignment, the same credential revision, not sealed. A cleanup seals
+ *   assignment, credential identity, revision and material version, not
+ *   sealed. A cleanup seals
  *   (or drops the credentials it names), then waits for every write under
  *   way to end, so nothing it is about to delete can be written again after.
  */
@@ -64,6 +65,16 @@ export interface LeasedSshKey {
   publicKey: string;
 }
 
+export type PersonCredentialLane = "github" | "ssh";
+
+/** Writer-only authority: clone callers do not need to know the version. */
+type VersionedCredential<T> = T & { version: number };
+
+interface PersonCredentialSlots {
+  github: Slot<VersionedCredential<LeasedGithub>>;
+  ssh: Slot<VersionedCredential<LeasedSshKey>>;
+}
+
 /** A manifest lane: not named, named but unreadable, or in hand. */
 type Slot<T extends { credentialId: string; revision: string }> =
   | { kind: "absent" }
@@ -85,14 +96,12 @@ interface GitHold {
   release(): void;
 }
 
-interface TaskPersonCredentials {
+/** The inherited slots are what the registry's gate opened on: the exact
+ * committed view, absent while closed. Only these serve holds and writers. */
+interface TaskPersonCredentials extends PersonCredentialSlots {
   assignment: TaskAssignment;
-  /** What the registry's gate opened on (the exact committed view): the
-   *  only thing holds and writers read. Absent while closed. */
-  github: Slot<LeasedGithub>;
-  ssh: Slot<LeasedSshKey>;
   /** What the last install proposed: never served until a gate opens on it. */
-  candidate: { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> };
+  candidate: PersonCredentialSlots;
   /** The registry's gate for this run: nothing is held or written while
    *  closed. */
   open: boolean;
@@ -109,33 +118,59 @@ interface TaskPersonCredentials {
 
 const byTask = new Map<string, TaskPersonCredentials>();
 
-function slotOf<T extends GithubLeasedValue | SshLeasedValue, V extends { credentialId: string; revision: string }>(
+function slotOf<
+  T extends GithubLeasedValue | SshLeasedValue,
+  V extends { credentialId: string; revision: string; version: number },
+>(
   credential: TaskStaticCredential<T> | null,
-  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision">,
+  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision" | "version">,
 ): Slot<V> {
   if (!credential) return { kind: "absent" };
   const identity = { credentialId: credential.manifest.credentialId, revision: credential.manifest.revision };
-  if (credential.availability !== "available" || !credential.material) return { kind: "unavailable", ...identity };
-  return { kind: "present", value: { ...identity, ...value(credential.material) } as V };
+  if (
+    credential.availability !== "available" ||
+    !credential.material ||
+    credential.observedVersion === null
+  ) {
+    return { kind: "unavailable", ...identity };
+  }
+  return {
+    kind: "present",
+    value: {
+      ...identity,
+      version: credential.observedVersion,
+      ...value(credential.material),
+    } as V,
+  };
 }
 
-function slotsOf(view: TaskCredentialView): { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> } {
+function slotsOf(view: TaskCredentialView): PersonCredentialSlots {
   return {
-    github: slotOf<GithubLeasedValue, LeasedGithub>(view.github, (material) => ({ token: material.token })),
-    ssh: slotOf<SshLeasedValue, LeasedSshKey>(view.ssh, (material) => ({
+    github: slotOf<GithubLeasedValue, VersionedCredential<LeasedGithub>>(view.github, (material) => ({ token: material.token })),
+    ssh: slotOf<SshLeasedValue, VersionedCredential<LeasedSshKey>>(view.ssh, (material) => ({
       privateKey: material.privateKey,
       publicKey: material.publicKey,
     })),
   };
 }
 
-/** The same credential at the same revision, both readable. */
+function identityOf(slot: Slot<CredentialIdentity>): CredentialIdentity | null {
+  return slot.kind === "present"
+    ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
+    : slot.kind === "unavailable"
+      ? { credentialId: slot.credentialId, revision: slot.revision }
+      : null;
+}
+
+/** The same named credential at the same revision, readable or not. */
 function sameIdentity<T extends CredentialIdentity>(a: Slot<T>, b: Slot<T>): boolean {
-  return (
-    a.kind === "present" &&
-    b.kind === "present" &&
-    a.value.credentialId === b.value.credentialId &&
-    a.value.revision === b.value.revision
+  const left = identityOf(a);
+  const right = identityOf(b);
+  return Boolean(
+    left &&
+      right &&
+      left.credentialId === right.credentialId &&
+      left.revision === right.revision,
   );
 }
 
@@ -194,12 +229,6 @@ export async function cleanupPersonCredentials(request: CredentialCleanupRequest
           removed.credentialId === identity.credentialId &&
           (removed.revision === null || removed.revision === identity.revision),
       ));
-  const identityOf = (slot: Slot<CredentialIdentity>): CredentialIdentity | null =>
-    slot.kind === "present"
-      ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
-      : slot.kind === "unavailable"
-        ? { credentialId: slot.credentialId, revision: slot.revision }
-        : null;
   if (request.mode === "full") {
     current.sealed = true;
     current.open = false;
@@ -286,6 +315,44 @@ export interface TaskGitCredentialHold {
   release(): void;
 }
 
+/**
+ * A task-runtime reconciliation's hold on the exact open person-credential
+ * gate. Unlike a clone's hold, it does not require either credential to be
+ * readable and exposes no material. Cleanup aborts it and waits for release,
+ * so a retry delay or runtime reconstruction cannot outlive the run whose
+ * files it is about to write.
+ */
+export interface TaskPersonCredentialGateHold {
+  signal: AbortSignal;
+  release(): void;
+}
+
+export function holdPersonCredentialGate(
+  assignment: TaskAssignment,
+): TaskPersonCredentialGateHold {
+  const state = liveState(assignment);
+  const controller = new AbortController();
+  let settle!: () => void;
+  const released = new Promise<void>((resolve) => {
+    settle = resolve;
+  });
+  let releasedOnce = false;
+  const hold: GitHold = {
+    controller,
+    github: identityOf(state.github),
+    ssh: identityOf(state.ssh),
+    released,
+    release: () => {
+      if (releasedOnce) return;
+      releasedOnce = true;
+      state.holds.delete(hold);
+      settle();
+    },
+  };
+  state.holds.add(hold);
+  return { signal: controller.signal, release: hold.release };
+}
+
 /**
  * Hold the owner's GitHub sign-in and SSH key for one host-side git
  * operation of the exact assignment, while the registry's gate is open on
@@ -361,7 +428,7 @@ export const TASK_SSH_ALLOWED_SIGNERS_PATH = "/home/node/.ssh/allowed_signers";
 export const TASK_SSH_SIGNING_GITCONFIG_PATH = "/home/node/.ssh/uai-signing.gitconfig";
 /** SSH as git's transport to GitHub, while the task has no GitHub sign-in. */
 export const TASK_SSH_TRANSPORT_GITCONFIG_PATH = "/home/node/.ssh/uai-transport.gitconfig";
-/** The writer's step was refused: the run, the revision or the gate moved. */
+/** The writer's step was refused: the run, material or gate moved. */
 export class PersonCredentialWriteRefused extends Error {
   constructor() {
     super("the task's credentials changed or were cleaned up; the write was not made");
@@ -505,11 +572,18 @@ export function writeTaskGithub(environment: Environment, assignment: TaskAssign
     const slot = current().github;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the GitHub sign-in could not be read");
-    const { credentialId, revision, token } = slot.value;
-    // Admitted only while this exact revision is still the task's.
+    const { credentialId, revision, version, token } = slot.value;
+    // Admitted only while this exact material version is still the task's.
     const admit = (): void => {
       const live = current().github;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(environment, assignment, "github", credentialId, withStaged(TASK_GH_HOSTS_PATH, TASK_GH_GITCONFIG_PATH));
     const hosts = await run(environment, ["/bin/sh", "-c", GH_LOGIN_SCRIPT], `${token}\n`, "gh auth login", admit, "root");
@@ -548,10 +622,17 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
     const slot = current().ssh;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the SSH key could not be read");
-    const { credentialId, revision, privateKey, publicKey } = slot.value;
+    const { credentialId, revision, version, privateKey, publicKey } = slot.value;
     const admit = (): void => {
       const live = current().ssh;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(
       environment,
@@ -589,6 +670,33 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
   });
 }
 
+/**
+ * Reconcile the task-visible person credentials in their coupled order.
+ * GitHub chooses HTTPS and removes SSH transport; SSH then observes whether
+ * GitHub is present and either keeps HTTPS or restores SSH transport. Every
+ * individual exec remains fenced by the exact run and material version.
+ * Absent lanes rely on the coordinator having removed their inventoried
+ * files. When GitHub is removed, callers must select the surviving SSH lane
+ * even if its credential has not changed, so transport is restored too.
+ */
+export async function writeTaskPersonCredentials(
+  environment: Environment,
+  assignment: TaskAssignment,
+  lanes: readonly PersonCredentialLane[] = ["github", "ssh"],
+  signal?: AbortSignal,
+): Promise<void> {
+  const selected = new Set(lanes);
+  for (const [lane, write] of [
+    ["github", writeTaskGithub],
+    ["ssh", writeTaskSshKey],
+  ] as const) {
+    if (!selected.has(lane)) continue;
+    signal?.throwIfAborted();
+    await write(environment, assignment);
+  }
+  signal?.throwIfAborted();
+}
+
 function sameAssignment(a: TaskAssignment, b: TaskAssignment): boolean {
   return a.taskId === b.taskId && a.runEpoch === b.runEpoch;
 }

package/lib/orchestrator.ts

@@ -202,7 +202,12 @@ import {
   rememberLeasedEngineRuntime,
 } from "./credential-cleanup-inventory";
 import { leasedMcpAclEntries } from "./credential-consumers/mcp";
-import { ENGINE_CREDENTIAL_FILES, ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+import {
+  CREDENTIAL_FREE_KINDS,
+  ENGINE_ENV_CREDENTIAL_KEYS,
+  LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+} from "../src/cloud-credentials";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import {
   reactivateTaskGatewayTask,
@@ -232,6 +237,7 @@ import {
   MAX_AGENT_ID_CHARS,
   MAX_SECRETARY_DISPATCH_ID_CHARS,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
+  isBuiltInAstronaut,
 } from "../src/protocol";
 import {
   isEnvironmentTransportProvider,
@@ -249,6 +255,10 @@ export type HostEventSubscriber = (event: HostEvent) => void;
 const SECRETARY_SESSION_ATTACH_KEY = "secretary-normal-tools-v1";
 const RESTRICTED_SECRETARY_SESSION_ATTACH_KEY =
   "secretary-communicator-v1";
+// ADR-157: the built-in Astronaut's runner was launched without native
+// subagents. Its own generation keeps a normal-tools runner (or an Astronaut
+// launched before the block) from ever being attached in its place.
+const ASTRONAUT_SESSION_ATTACH_KEY = "astronaut-no-subagents-v1";
 
 // ---------------------------------------------------------------------------
 // Channel — one task's live conversation.
@@ -554,14 +564,6 @@ const LEASED_CREDENTIAL_BLANKS: Readonly<Record<string, string>> = Object.freeze
     [...new Set(Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat())].map((name) => [name, ""]),
   ),
 );
-/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
- *  gateway), but its agent's task token is its bearer: on a leased task its
- *  launches are admitted as that token (ADR-154 §6). */
-const MANAGED_ENGINE_KIND = "uai";
-/** ADR-154 §10: kinds whose agents carry no credential at all; every other
- *  kind outside the leased lanes (Kimi) stays down on a leased task until
- *  its lane exists. */
-const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
 /** ADR-154 §8: how soon a failed rewrite of a task's account homes is tried
  *  again. */
 const LEASED_SYNC_RETRY_MS = 30_000;
@@ -634,11 +636,6 @@ function sameLeasedIdentity(a: LeasedIdentity, b: LeasedIdentity): boolean {
   return a.subject === b.subject && a.runEpoch === b.runEpoch;
 }
 
-/** The engine kinds whose agents run on an AI account from the lease. */
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 /** A burned respawn budget resets after this quiet period (see reconcile). */
 const RESPAWN_COOLDOWN_MS = 10 * 60_000;
 /** ADR-053: gap between browser-install retries. Ensures fire every couple of
@@ -2591,11 +2588,22 @@ export class Orchestrator {
     }
   }
 
-  /** Reserved seam for a future explicit restricted-role control. */
+  /** The engine-enforced launch profile for one agent, if any. */
   private executionProfileFor(
-    _channel: Channel,
-    _agentId: string,
-  ): "communicator" | undefined {
+    channel: Channel,
+    agentId: string,
+  ): "communicator" | "astronaut" | undefined {
+    // ADR-157: the built-in Astronaut keeps normal tools but runs without
+    // native subagents, so every helper it uses is an accounted crew agent.
+    // The adapter factory refuses an engine that cannot enforce that.
+    if (
+      isBuiltInAstronaut(
+        channel,
+        channel.roster.find((agent) => agent.id === agentId),
+      )
+    ) {
+      return "astronaut";
+    }
     // Secretary is an organisational role, not a sandbox. The communicator
     // profile remains implemented by adapters for a future explicit opt-in,
     // but no task gets tool denial merely by selecting Secretary mode.
@@ -2611,18 +2619,22 @@ export class Orchestrator {
     // The restricted profile is dormant today, but giving it the normal-tools
     // generation would make a future opt-out able to attach a runner launched
     // under tool denial.
+    const profile = this.executionProfileFor(channel, agent.id);
     const policy = this.isSecretary(channel, agent.id)
-      ? this.executionProfileFor(channel, agent.id) === "communicator"
+      ? profile === "communicator"
         ? RESTRICTED_SECRETARY_SESSION_ATTACH_KEY
-        : SECRETARY_SESSION_ATTACH_KEY
+        : profile === "astronaut"
+          ? ASTRONAUT_SESSION_ATTACH_KEY
+          : SECRETARY_SESSION_ATTACH_KEY
       : undefined;
     const model = agent.model ?? "";
     const effort = agent.effort ?? "";
+    const generation = agent.tokenGeneration ?? "";
     // Preserve legacy null/policy-only attachment for agents that choose no
     // launch flags. Explicit model/effort gets a stable key so a host restart
     // cannot attach a runner created under different settings.
     const envMode = hostTaskEnvMode(task);
-    if (envMode === "baked" && !model && !effort) return policy;
+    if (envMode === "baked" && !model && !effort && !generation) return policy;
     return JSON.stringify([
       envMode === "baked" ? "roster-launch-v1" : "roster-launch-v2",
       ...(envMode === "loader" ? [envMode] : []),
@@ -2630,6 +2642,10 @@ export class Orchestrator {
       model,
       effort,
       policy ?? "",
+      // ADR-157 §3: a runner keeps the token it was launched with, so one
+      // launched for an earlier agent under this handle never attaches to a
+      // later one. Absent without a generation, so no existing key changes.
+      ...(generation ? [generation] : []),
     ]);
   }
 
@@ -2640,9 +2656,11 @@ export class Orchestrator {
   }
 
   private isPromptLevelSecretary(channel: Channel, agentId: string): boolean {
+    // The Astronaut profile only removes native subagents; the Astronaut is still
+    // a normal-tools, prompt-level Secretary (CLI dispatch, its own token).
     return (
       this.isSecretary(channel, agentId) &&
-      this.executionProfileFor(channel, agentId) === undefined
+      this.executionProfileFor(channel, agentId) !== "communicator"
     );
   }
 
@@ -6435,6 +6453,12 @@ function rosterLaunchChangeReason(
   if (previous.kind !== next.kind) changed.push("engine");
   if ((previous.model ?? "") !== (next.model ?? "")) changed.push("model");
   if ((previous.effort ?? "") !== (next.effort ?? "")) changed.push("effort");
+  // ADR-157 §3: the session holds a token minted for its generation, so a new
+  // one is a new agent under the handle (or one an older cloud release lost),
+  // and only a fresh launch carries a token the cloud accepts.
+  if ((previous.tokenGeneration ?? "") !== (next.tokenGeneration ?? "")) {
+    changed.push("token generation");
+  }
   return changed.length > 0 ? `${changed.join("/")} change` : null;
 }
 
@@ -6821,6 +6845,35 @@ export function buildSystemPreamble(
             'An epoch-ms `{"__uai":"input","ts":…}` line precedes each',
             "unchanged CLI frame, so the adjacent pair identifies a wake input.",
           ];
+  // ADR-157: the built-in Astronaut, holding tasks.agents.manage, runs its own
+  // crew. The cloud refuses the same commands from anyone else, including a
+  // Secretary persona that holds the grant. It always runs under the Astronaut
+  // profile (§7), so its tools are not an ordinary Secretary's.
+  const isAstronaut = isBuiltInAstronaut({ mode, secretaryAgentId }, agent);
+  const crewBrief =
+    isAstronaut && (agent.permissions ?? []).includes("tasks.agents.manage")
+      ? [
+          "## Your crew",
+          "",
+          "You choose this task's crew. `node " + CONTAINER_CLI_PATH + " crew list` shows the",
+          "personas you can hire, the engines and models this task can run (with the",
+          "managed engine's prices), the plan's room, and the current roster. Change it",
+          "one agent at a time, always with a reason the humans will read:",
+          "- `crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "- `crew model @agent [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "  (at least one of the three; `default` as the model or effort clears it to",
+          "  the engine's own default)",
+          "- `crew remove @agent --why \"…\"`",
+          "Use the smallest crew the job needs, often none: do small work yourself and",
+          "hire only when parallel work or a different skill or model pays for itself.",
+          "A new agent is idle until you `dispatch` to it, so brief it then. Remove an",
+          "agent when its part is done; its handle is not reused, so hiring that",
+          "persona again gives it a new one. A model change restarts that agent and drops",
+          "its prompt cache, so change models between steps, not mid-step. Your own",
+          "engine and model are the human's choice; you cannot change or remove yourself.",
+          "",
+        ]
+      : [];
   const secretaryRoleBrief = isSecretary
     ? [
         "## Secretary role",
@@ -6831,9 +6884,20 @@ export function buildSystemPreamble(
         "Synthesize the",
         "crew's replies for the human instead of forwarding a pile of raw updates.",
         "",
-        "Your Secretary role is prompt-guided, not tool-restricted. You have the",
-        "same normal tools, approved MCP connections, model choice, and persona",
-        "permissions as any other task agent. Your default job is to communicate,",
+        ...(isAstronaut
+          ? [
+              "Your role is prompt-guided. You have the normal tools, approved MCP",
+              "connections and persona permissions of any task agent, except native",
+              "subagents: helpers your engine starts on its own would work outside the",
+              "crew, unpriced and unseen by the humans, so they are switched off. Work",
+              "for another agent goes to a crew agent through `dispatch`. Your default",
+              "job is to communicate,",
+            ]
+          : [
+              "Your Secretary role is prompt-guided, not tool-restricted. You have the",
+              "same normal tools, approved MCP connections, model choice, and persona",
+              "permissions as any other task agent. Your default job is to communicate,",
+            ]),
         "coordinate, and dispatch implementation work rather than doing it yourself.",
         "If the human explicitly asks YOU to make a change, you may use those tools",
         "and do it directly; otherwise hand mutations to a crew agent.",
@@ -7072,6 +7136,7 @@ export function buildSystemPreamble(
     ...sessionInboxBrief,
     ...(sessionInboxBrief.length > 0 ? [""] : []),
     ...secretaryRoleBrief,
+    ...crewBrief,
     ...channelConventionsBrief,
     ...(replyCardBrief.length > 0 ? ["", ...replyCardBrief] : []),
     ...checkInTranscriptBrief,

package/lib/task-person-credentials.ts

@@ -0,0 +1,76 @@
+/**
+ * Restore GitHub/SSH files when a running task's cloud credentials become
+ * usable, after recovery or a live change. The persisted provider locator
+ * is the only runtime authority; a missing runtime is a retryable failure.
+ * Fresh task-up uses the same writer on its newly provisioned handle.
+ */
+import type { HostTask } from "../db/schema";
+import { CredentialLeaseUnavailableError, type TaskAssignment } from "./cloud-credential-leases";
+import { writeTaskPersonCredentials, type PersonCredentialLane } from "./credential-consumers/github";
+import type { TaskWriteEnvironment } from "./credential-consumers/task-files";
+import { getHostTask, readTaskRunEpochState } from "./runtime-state";
+import { reconstructPersistedTaskEnvironment } from "./task-environment";
+
+/**
+ * The composer retries a rejection while the same material is current and
+ * aborts this signal before cleanup or takeover. In particular, a fresh
+ * task that is still starting must retry: a rotation after its runtime-ready
+ * writes but before it is marked running must not be silently missed.
+ */
+export async function reconcileRunningTaskPersonCredentials(
+  assignment: Readonly<TaskAssignment>,
+  lanes: readonly PersonCredentialLane[],
+  signal: AbortSignal,
+): Promise<void> {
+  const current = (): HostTask => {
+    signal.throwIfAborted();
+    const task = getHostTask(assignment.taskId);
+    const run = readTaskRunEpochState(assignment.taskId);
+    if (
+      task === null ||
+      task.statusMirror !== "running" ||
+      task.runEpoch !== assignment.runEpoch ||
+      run === null ||
+      !run.assignmentOpen ||
+      run.highestRunEpoch !== assignment.runEpoch ||
+      run.runtimeEstablishedEpoch !== assignment.runEpoch
+    ) {
+      throw new CredentialLeaseUnavailableError("the task's running credential assignment is not current");
+    }
+    return task;
+  };
+  const task = current();
+  const assertCurrent = (): void => {
+    const live = current();
+    if (
+      live.environmentProvider !== task.environmentProvider ||
+      live.environmentLocator !== task.environmentLocator ||
+      live.envMode !== task.envMode
+    ) {
+      throw new CredentialLeaseUnavailableError("the task's credential runtime has changed");
+    }
+  };
+  const environment = await reconstructPersistedTaskEnvironment(task);
+  assertCurrent();
+  if (environment === null) {
+    throw new CredentialLeaseUnavailableError("the task's credential runtime is unavailable");
+  }
+  // Keep the exact running assignment and cancellation at each provider's
+  // last exec boundary too: reconstruction or address lookup can suspend
+  // while Stop or a new run replaces the runtime.
+  const writable: TaskWriteEnvironment = {
+    descriptor: environment.descriptor,
+    exec: (request) => {
+      assertCurrent();
+      return environment.exec({
+        ...request,
+        admit: () => {
+          assertCurrent();
+          request.admit?.();
+        },
+      });
+    },
+  };
+  await writeTaskPersonCredentials(writable, assignment, lanes, signal);
+  assertCurrent();
+}

package/lib/task-token.ts

@@ -11,6 +11,8 @@ export interface TaskTokenPayload {
   userId: string;
   permissions: string[];
   agentId?: string;
+  /** ADR-157 §3: the agent's roster generation; the cloud requires it to match. */
+  generation?: string;
 }
 
 const PREFIX = "uai_";
@@ -31,6 +33,7 @@ export function signTaskToken(payload: TaskTokenPayload, secret: string): string
         u: payload.userId,
         p: payload.permissions,
         ...(payload.agentId ? { a: payload.agentId } : {}),
+        ...(payload.generation ? { g: payload.generation } : {}),
         iat: Math.floor(Date.now() / 1000),
       }),
     ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.153",
+  "version": "0.9.155",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cloud-credentials.ts

@@ -286,6 +286,31 @@ export const ENGINE_CREDENTIAL_FILES: Readonly<Record<string, readonly string[]>
   opencode: ["auth.json"],
 };
 
+/** The engine kinds whose agents run on an AI account from the lease. */
+export const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
+  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
+  ...Object.keys(ENGINE_CREDENTIAL_FILES),
+]);
+
+/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
+ *  gateway), but its agent's task token is its bearer: on a leased task its
+ *  launches are admitted as that token (ADR-154 §6). */
+export const MANAGED_ENGINE_KIND = "uai";
+
+/** ADR-154 §10: kinds whose agents carry no credential at all; every other
+ *  kind outside the leased lanes (Kimi) stays down on a leased task until
+ *  its lane exists. */
+export const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
+
+/** ADR-154 §10: every kind a task on cloud credentials can run, and so every
+ *  kind a runner on them advertises. The Managed Engine is one, though it
+ *  leases nothing. Kimi, with no lane yet, is not. */
+export const CLOUD_CREDENTIAL_KINDS: ReadonlySet<string> = new Set([
+  ...LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+  ...CREDENTIAL_FREE_KINDS,
+]);
+
 interface LeasedValueBase {
   v: 1;
   part: "lease";

package/src/index.ts

@@ -15,14 +15,14 @@ import {
   whileOnOwnCredentials,
   type LegacyStartPermit,
 } from "../lib/cloud-credential-host";
-import { CredentialLeaseUnavailableError, type TaskAssignment } from "../lib/cloud-credential-leases";
+import type { TaskAssignment } from "../lib/cloud-credential-leases";
 import {
   StartInterruptedError,
   type CloudCredentialRuntime,
   type TaskCredentialStart,
   type TaskUpHold,
 } from "../lib/cloud-credential-runtime";
-import { writeTaskGithub, writeTaskSshKey } from "../lib/credential-consumers/github";
+import { writeTaskPersonCredentials } from "../lib/credential-consumers/github";
 import { agentClisReady, ensureStandardImage } from "../lib/standard-image";
 import { cloneRepo } from "../lib/repo-clone";
 import { handleFilesOp } from "../lib/shared-files";
@@ -315,10 +315,7 @@ function leasedTaskUp(
           signal,
         );
       }
-      for (const write of [writeTaskGithub, writeTaskSshKey]) {
-        if (signal.aborted) throw new CredentialLeaseUnavailableError("the task's credentials were withdrawn");
-        await write(environment, start.assignment);
-      }
+      await writeTaskPersonCredentials(environment, start.assignment, undefined, signal);
     },
     ...(filesV1 ? { filesV1: true as const } : {}),
   };