@runuai/host 0.9.154 → 0.9.155

package/lib/agent-cli.ts

@@ -210,7 +210,14 @@ export function agentCliEnv(
   return {
     ...runtimeAuthority,
     UAI_TASK_TOKEN: signTaskToken(
-      { taskId, userId: ownerUserId, permissions, agentId: agent.id },
+      {
+        taskId,
+        userId: ownerUserId,
+        permissions,
+        agentId: agent.id,
+        // ADR-157 §3: binds the token to this agent, not merely its handle.
+        ...(agent.tokenGeneration ? { generation: agent.tokenGeneration } : {}),
+      },
       cliSecret,
     ),
     UAI_API_URL: apiUrl,
@@ -312,6 +319,58 @@ async function main() {
     }
     return;
   }
+  if (group === "crew") {
+    // ADR-157: the task's built-in Astronaut (the @astronaut Uai builds, never a
+    // persona) changes its own crew. One agent per call, always with a --why.
+    const handleOf = (v) => (typeof v === "string" && v.startsWith("@") ? v.slice(1) : v);
+    const launch = (a) => a.kind + (a.model ? "/" + a.model : "") + (a.effort ? "/" + a.effort : "");
+    if (action === "list") { out(await api("GET", "/api/agent/crew")); return; }
+    if (action === "add") {
+      const personaId = pos[0];
+      if (!personaId || !flags.why) {
+        console.error('uai: crew add needs a persona id (see crew list) and --why "<reason>"');
+        process.exit(1);
+      }
+      const body = { personaId, why: flags.why };
+      if (flags.as) body.handle = handleOf(flags.as);
+      if (flags.engine) body.kind = flags.engine;
+      if (flags.model) body.model = flags.model;
+      if (flags.effort) body.effort = flags.effort;
+      const r = await api("POST", "/api/agent/crew", body);
+      out("added @" + r.agent.id + " (" + r.agent.label + ") on " + launch(r.agent) + ". It stays idle until you dispatch work to it.");
+      return;
+    }
+    if (action === "model") {
+      const id = handleOf(pos[0] || "");
+      if (!id || !flags.why || !(flags.model || flags.engine || flags.effort)) {
+        console.error('uai: crew model needs @agent, at least one of --engine, --model and --effort, and --why "<reason>"');
+        process.exit(1);
+      }
+      // "default" clears the setting back to the engine's own default (null).
+      const cleared = (v) => (v === "default" ? null : v);
+      const body = { why: flags.why };
+      if (flags.engine) body.kind = flags.engine;
+      if (flags.model) body.model = cleared(flags.model);
+      if (flags.effort) body.effort = cleared(flags.effort);
+      const r = await api("PATCH", "/api/agent/crew/" + encodeURIComponent(id), body);
+      out(r.changed
+        ? "@" + id + " now runs on " + launch(r.agent) + "; its session restarts after its current turn"
+        : "@" + id + " already runs on " + launch(r.agent) + "; nothing changed");
+      return;
+    }
+    if (action === "remove") {
+      const id = handleOf(pos[0] || "");
+      if (!id || !flags.why) {
+        console.error('uai: crew remove needs @agent and --why "<reason>"');
+        process.exit(1);
+      }
+      await api("DELETE", "/api/agent/crew/" + encodeURIComponent(id), { why: flags.why });
+      out("removed @" + id);
+      return;
+    }
+    console.error("uai: crew commands are list, add, model and remove (Astronaut only)");
+    process.exit(1);
+  }
   const key = group + " " + (action || "");
   switch (key) {
     case "projects list": out((await api("GET", "/api/agent/projects")).projects); break;
@@ -497,6 +556,10 @@ async function main() {
         "  uai task history                   (list your past tasks)",
         "  uai task read <taskId>             (full chat of a past task you were on)",
         '  uai dispatch @agent [@agent…] "instruction"   (Secretary only)',
+        "  uai crew list                      (Astronaut only: personas, engines, models, limits, roster)",
+        '  uai crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why "<reason>"',
+        '  uai crew model @agent [--engine <kind>] [--model <m|default>] [--effort <e|default>] --why "<reason>"   (at least one of the three)',
+        '  uai crew remove @agent --why "<reason>"',
         "  uai react <heart|check|x> [--msg #id]   (no --msg = the message you were last handed)",
         "  uai whoami",
       ].join("\\n"));

package/lib/agents/claude.ts

@@ -390,6 +390,17 @@ const CLAUDE_FULL_ACCESS_ARGS = [
   "--strict-mcp-config",
 ];
 
+/**
+ * ADR-157 Astronaut profile: the normal tool set, minus Claude Code's native
+ * subagents. An Astronaut's helpers must be crew agents the task can see and
+ * bill; a built-in Agent/Task subagent would run (and spend) outside the crew.
+ */
+const CLAUDE_ASTRONAUT_ARGS = [
+  ...CLAUDE_FULL_ACCESS_ARGS,
+  "--disallowedTools",
+  "Agent,Task",
+];
+
 /**
  * ADR-083 communicator profile. This is deliberately an engine-level tool
  * boundary, not prompt advice: setting sources, hooks, skills, workflows and
@@ -440,7 +451,7 @@ export class ClaudeSession implements AgentSession {
     agent: RosterAgent;
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
-    executionProfile?: "communicator";
+    executionProfile?: "communicator" | "astronaut";
     attachCompatibilityKey?: string;
     agentEnv?: Record<string, string>;
   }) {
@@ -453,7 +464,9 @@ export class ClaudeSession implements AgentSession {
     const cliArgs = [
       ...(args.executionProfile === "communicator"
         ? CLAUDE_COMMUNICATOR_ARGS
-        : CLAUDE_FULL_ACCESS_ARGS),
+        : args.executionProfile === "astronaut"
+          ? CLAUDE_ASTRONAUT_ARGS
+          : CLAUDE_FULL_ACCESS_ARGS),
     ];
     if (process.env.UAI_CLAUDE_INCLUDE_PARTIAL_MESSAGES === "1") {
       cliArgs.push("--include-partial-messages");
@@ -704,6 +717,10 @@ register({
       defaultModel: CLAUDE_COMMUNICATOR_MODEL,
       defaultEffort: CLAUDE_COMMUNICATOR_EFFORT,
     },
+    {
+      id: "astronaut",
+      mechanism: "claude-disallowed-agent-task-v1",
+    },
   ],
   // Usable only when a Claude credential is in the env (injected into task
   // containers at task-up). Gates advertisement (ADR-044 P2).

package/lib/agents/codex.ts

@@ -391,6 +391,8 @@ export class CodexSession implements AgentSession {
     attachCompatibilityKey?: string;
     /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
     cliConfigOverrides?: string[];
+    /** ADR-157: the Astronaut runs without Codex's native multi-agent tools. */
+    executionProfile?: "communicator" | "astronaut";
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
@@ -425,8 +427,15 @@ export class CodexSession implements AgentSession {
       "shell_snapshot",
       "--disable",
       "shell_snapshot_v2",
-      "app-server",
     );
+    // ADR-157: an Astronaut's helpers must be crew agents the task can see and
+    // bill, so Codex's own subagents (spawn_agent; multi_agent is on by
+    // default in 0.157, multi_agent_v2 off) are disabled for it. Also after
+    // every override, so nothing can turn them back on.
+    if (args.executionProfile === "astronaut") {
+      codexArgs.push("--disable", "multi_agent", "--disable", "multi_agent_v2");
+    }
+    codexArgs.push("app-server");
     // ADR-061: the CLI is owned by an in-container runner (durable across
     // host restarts); legacy pipes behind UAI_DURABLE_SESSIONS=0. Codex
     // re-handshakes per host process (initialize + thread/start live in this
@@ -801,6 +810,9 @@ register({
   defaultModel: CODEX_DEFAULT_MODEL,
   supportedEfforts: () => [...CODEX_EFFORTS],
   defaultEffort: CODEX_DEFAULT_EFFORT,
+  // ADR-157: enforceable by construction (the --disable flags above). The
+  // communicator profile is Claude-only; Codex never declared it.
+  executionProfiles: [{ id: "astronaut", mechanism: "codex-disable-multi-agent-v1" }],
   // Usable only when the owner's ~/.codex login exists — task-up copies it into
   // each container from UAI_OWNER_HOME (default $HOME). Gates advertisement
   // (ADR-044 P2).
@@ -820,6 +832,7 @@ register({
     agentEnv,
     attachCompatibilityKey,
     cliConfigOverrides,
+    executionProfile,
   }) =>
     new CodexSession({
       taskId,
@@ -829,5 +842,6 @@ register({
       agentEnv,
       attachCompatibilityKey,
       cliConfigOverrides,
+      executionProfile,
     }),
 });

package/lib/agents/registry.ts

@@ -88,10 +88,11 @@ export function setAdvertisementFallback(
 }
 
 /**
- * ADR-154: on cloud credentials the runner holds no engine credential of its
- * own, so availability and the fallback above say nothing: the kinds the
- * cloud can lease an account for are advertised, and only those. Null while
- * the runner runs its tasks on its own credentials. Installed by main.ts.
+ * ADR-154 §10: on cloud credentials the runner holds no engine credential of
+ * its own, so availability and the fallback above say nothing: the kinds a
+ * leased task can run are advertised, and only those (`CLOUD_CREDENTIAL_KINDS`:
+ * the leased lanes and the Managed Engine). Null while the runner runs its
+ * tasks on its own credentials. Installed by main.ts.
  */
 let leasedKinds: () => ReadonlySet<string> | null = () => null;
 

package/lib/agents/types.ts

@@ -57,6 +57,9 @@ export const RosterAgent = z.object({
   // ADR-128: which upstream protocol a Uai-engine model speaks — resolved
   // cloud-side from the model catalog; selects the delegated adapter.
   uaiProvider: z.enum(["anthropic", "openai"]).optional(),
+  builtIn: z.literal("astronaut").optional(), // ADR-157: the cloud-built Astronaut only
+  // ADR-157 §3: signed into the agent's task token as `g` (see agentCliEnv).
+  tokenGeneration: z.string().min(1).max(64).optional(),
 });
 export type RosterAgent = z.infer<typeof RosterAgent>;
 
@@ -179,7 +182,7 @@ export interface AgentSessionFactory {
     systemPreamble: string;
     /** Host-derived restricted execution policy (ADR-083). Never supplied by
      *  the browser or stored on the roster entry. */
-    executionProfile?: "communicator";
+    executionProfile?: "communicator" | "astronaut";
     /** Durable runners are keyed by task+agent. Host-owned launch settings
      *  supply a compatibility key so restart recovery replaces, rather than
      *  attaches, a process launched with incompatible model/effort/policy. */

package/lib/agents/uai.ts

@@ -15,7 +15,7 @@
  * the request's `model`, and the gateway maps slug → upstream id.
  */
 
-import { factoryFor, register } from "./registry";
+import { factoryFor, register, supportsExecutionProfile } from "./registry";
 import type { AgentSession, AgentSessionFactory } from "./types";
 
 const DEFAULT_GATEWAY_URL = "https://inference.runuai.com";
@@ -80,6 +80,17 @@ const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession
   if (!delegate) {
     throw new Error(`uai engine: no ${delegateKind} adapter registered to delegate to`);
   }
+  // ADR-157 §7: the runner checked the profile against the `uai` kind, but the
+  // delegate is what enforces it. Refuse rather than run an Astronaut on a
+  // delegate that would ignore the profile.
+  if (
+    args.executionProfile &&
+    !supportsExecutionProfile(delegateKind, args.executionProfile)
+  ) {
+    throw new Error(
+      `uai engine: the ${delegateKind} adapter cannot enforce execution profile "${args.executionProfile}"`,
+    );
+  }
   const taskToken = args.agentEnv?.UAI_TASK_TOKEN;
   if (!taskToken) {
     // agentCliEnv mints no token for a permissionless non-secretary agent;
@@ -110,5 +121,8 @@ register({
   // Always available: the engine needs no host-side credential — auth is
   // the per-agent task token, billing is the org's credits.
   available: () => true,
+  // ADR-157: `create` forwards the profile to the Claude or Codex delegate,
+  // and both enforce it.
+  executionProfiles: [{ id: "astronaut", mechanism: "uai-delegated-astronaut-v1" }],
   create,
 });

package/lib/orchestrator.ts

@@ -202,7 +202,12 @@ import {
   rememberLeasedEngineRuntime,
 } from "./credential-cleanup-inventory";
 import { leasedMcpAclEntries } from "./credential-consumers/mcp";
-import { ENGINE_CREDENTIAL_FILES, ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
+import {
+  CREDENTIAL_FREE_KINDS,
+  ENGINE_ENV_CREDENTIAL_KEYS,
+  LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+} from "../src/cloud-credentials";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import {
   reactivateTaskGatewayTask,
@@ -232,6 +237,7 @@ import {
   MAX_AGENT_ID_CHARS,
   MAX_SECRETARY_DISPATCH_ID_CHARS,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
+  isBuiltInAstronaut,
 } from "../src/protocol";
 import {
   isEnvironmentTransportProvider,
@@ -249,6 +255,10 @@ export type HostEventSubscriber = (event: HostEvent) => void;
 const SECRETARY_SESSION_ATTACH_KEY = "secretary-normal-tools-v1";
 const RESTRICTED_SECRETARY_SESSION_ATTACH_KEY =
   "secretary-communicator-v1";
+// ADR-157: the built-in Astronaut's runner was launched without native
+// subagents. Its own generation keeps a normal-tools runner (or an Astronaut
+// launched before the block) from ever being attached in its place.
+const ASTRONAUT_SESSION_ATTACH_KEY = "astronaut-no-subagents-v1";
 
 // ---------------------------------------------------------------------------
 // Channel — one task's live conversation.
@@ -554,14 +564,6 @@ const LEASED_CREDENTIAL_BLANKS: Readonly<Record<string, string>> = Object.freeze
     [...new Set(Object.values(ENGINE_ENV_CREDENTIAL_KEYS).flat())].map((name) => [name, ""]),
   ),
 );
-/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
- *  gateway), but its agent's task token is its bearer: on a leased task its
- *  launches are admitted as that token (ADR-154 §6). */
-const MANAGED_ENGINE_KIND = "uai";
-/** ADR-154 §10: kinds whose agents carry no credential at all; every other
- *  kind outside the leased lanes (Kimi) stays down on a leased task until
- *  its lane exists. */
-const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
 /** ADR-154 §8: how soon a failed rewrite of a task's account homes is tried
  *  again. */
 const LEASED_SYNC_RETRY_MS = 30_000;
@@ -634,11 +636,6 @@ function sameLeasedIdentity(a: LeasedIdentity, b: LeasedIdentity): boolean {
   return a.subject === b.subject && a.runEpoch === b.runEpoch;
 }
 
-/** The engine kinds whose agents run on an AI account from the lease. */
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 /** A burned respawn budget resets after this quiet period (see reconcile). */
 const RESPAWN_COOLDOWN_MS = 10 * 60_000;
 /** ADR-053: gap between browser-install retries. Ensures fire every couple of
@@ -2591,11 +2588,22 @@ export class Orchestrator {
     }
   }
 
-  /** Reserved seam for a future explicit restricted-role control. */
+  /** The engine-enforced launch profile for one agent, if any. */
   private executionProfileFor(
-    _channel: Channel,
-    _agentId: string,
-  ): "communicator" | undefined {
+    channel: Channel,
+    agentId: string,
+  ): "communicator" | "astronaut" | undefined {
+    // ADR-157: the built-in Astronaut keeps normal tools but runs without
+    // native subagents, so every helper it uses is an accounted crew agent.
+    // The adapter factory refuses an engine that cannot enforce that.
+    if (
+      isBuiltInAstronaut(
+        channel,
+        channel.roster.find((agent) => agent.id === agentId),
+      )
+    ) {
+      return "astronaut";
+    }
     // Secretary is an organisational role, not a sandbox. The communicator
     // profile remains implemented by adapters for a future explicit opt-in,
     // but no task gets tool denial merely by selecting Secretary mode.
@@ -2611,18 +2619,22 @@ export class Orchestrator {
     // The restricted profile is dormant today, but giving it the normal-tools
     // generation would make a future opt-out able to attach a runner launched
     // under tool denial.
+    const profile = this.executionProfileFor(channel, agent.id);
     const policy = this.isSecretary(channel, agent.id)
-      ? this.executionProfileFor(channel, agent.id) === "communicator"
+      ? profile === "communicator"
         ? RESTRICTED_SECRETARY_SESSION_ATTACH_KEY
-        : SECRETARY_SESSION_ATTACH_KEY
+        : profile === "astronaut"
+          ? ASTRONAUT_SESSION_ATTACH_KEY
+          : SECRETARY_SESSION_ATTACH_KEY
       : undefined;
     const model = agent.model ?? "";
     const effort = agent.effort ?? "";
+    const generation = agent.tokenGeneration ?? "";
     // Preserve legacy null/policy-only attachment for agents that choose no
     // launch flags. Explicit model/effort gets a stable key so a host restart
     // cannot attach a runner created under different settings.
     const envMode = hostTaskEnvMode(task);
-    if (envMode === "baked" && !model && !effort) return policy;
+    if (envMode === "baked" && !model && !effort && !generation) return policy;
     return JSON.stringify([
       envMode === "baked" ? "roster-launch-v1" : "roster-launch-v2",
       ...(envMode === "loader" ? [envMode] : []),
@@ -2630,6 +2642,10 @@ export class Orchestrator {
       model,
       effort,
       policy ?? "",
+      // ADR-157 §3: a runner keeps the token it was launched with, so one
+      // launched for an earlier agent under this handle never attaches to a
+      // later one. Absent without a generation, so no existing key changes.
+      ...(generation ? [generation] : []),
     ]);
   }
 
@@ -2640,9 +2656,11 @@ export class Orchestrator {
   }
 
   private isPromptLevelSecretary(channel: Channel, agentId: string): boolean {
+    // The Astronaut profile only removes native subagents; the Astronaut is still
+    // a normal-tools, prompt-level Secretary (CLI dispatch, its own token).
     return (
       this.isSecretary(channel, agentId) &&
-      this.executionProfileFor(channel, agentId) === undefined
+      this.executionProfileFor(channel, agentId) !== "communicator"
     );
   }
 
@@ -6435,6 +6453,12 @@ function rosterLaunchChangeReason(
   if (previous.kind !== next.kind) changed.push("engine");
   if ((previous.model ?? "") !== (next.model ?? "")) changed.push("model");
   if ((previous.effort ?? "") !== (next.effort ?? "")) changed.push("effort");
+  // ADR-157 §3: the session holds a token minted for its generation, so a new
+  // one is a new agent under the handle (or one an older cloud release lost),
+  // and only a fresh launch carries a token the cloud accepts.
+  if ((previous.tokenGeneration ?? "") !== (next.tokenGeneration ?? "")) {
+    changed.push("token generation");
+  }
   return changed.length > 0 ? `${changed.join("/")} change` : null;
 }
 
@@ -6821,6 +6845,35 @@ export function buildSystemPreamble(
             'An epoch-ms `{"__uai":"input","ts":…}` line precedes each',
             "unchanged CLI frame, so the adjacent pair identifies a wake input.",
           ];
+  // ADR-157: the built-in Astronaut, holding tasks.agents.manage, runs its own
+  // crew. The cloud refuses the same commands from anyone else, including a
+  // Secretary persona that holds the grant. It always runs under the Astronaut
+  // profile (§7), so its tools are not an ordinary Secretary's.
+  const isAstronaut = isBuiltInAstronaut({ mode, secretaryAgentId }, agent);
+  const crewBrief =
+    isAstronaut && (agent.permissions ?? []).includes("tasks.agents.manage")
+      ? [
+          "## Your crew",
+          "",
+          "You choose this task's crew. `node " + CONTAINER_CLI_PATH + " crew list` shows the",
+          "personas you can hire, the engines and models this task can run (with the",
+          "managed engine's prices), the plan's room, and the current roster. Change it",
+          "one agent at a time, always with a reason the humans will read:",
+          "- `crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "- `crew model @agent [--engine <kind>] [--model <m>] [--effort <e>] --why \"…\"`",
+          "  (at least one of the three; `default` as the model or effort clears it to",
+          "  the engine's own default)",
+          "- `crew remove @agent --why \"…\"`",
+          "Use the smallest crew the job needs, often none: do small work yourself and",
+          "hire only when parallel work or a different skill or model pays for itself.",
+          "A new agent is idle until you `dispatch` to it, so brief it then. Remove an",
+          "agent when its part is done; its handle is not reused, so hiring that",
+          "persona again gives it a new one. A model change restarts that agent and drops",
+          "its prompt cache, so change models between steps, not mid-step. Your own",
+          "engine and model are the human's choice; you cannot change or remove yourself.",
+          "",
+        ]
+      : [];
   const secretaryRoleBrief = isSecretary
     ? [
         "## Secretary role",
@@ -6831,9 +6884,20 @@ export function buildSystemPreamble(
         "Synthesize the",
         "crew's replies for the human instead of forwarding a pile of raw updates.",
         "",
-        "Your Secretary role is prompt-guided, not tool-restricted. You have the",
-        "same normal tools, approved MCP connections, model choice, and persona",
-        "permissions as any other task agent. Your default job is to communicate,",
+        ...(isAstronaut
+          ? [
+              "Your role is prompt-guided. You have the normal tools, approved MCP",
+              "connections and persona permissions of any task agent, except native",
+              "subagents: helpers your engine starts on its own would work outside the",
+              "crew, unpriced and unseen by the humans, so they are switched off. Work",
+              "for another agent goes to a crew agent through `dispatch`. Your default",
+              "job is to communicate,",
+            ]
+          : [
+              "Your Secretary role is prompt-guided, not tool-restricted. You have the",
+              "same normal tools, approved MCP connections, model choice, and persona",
+              "permissions as any other task agent. Your default job is to communicate,",
+            ]),
         "coordinate, and dispatch implementation work rather than doing it yourself.",
         "If the human explicitly asks YOU to make a change, you may use those tools",
         "and do it directly; otherwise hand mutations to a crew agent.",
@@ -7072,6 +7136,7 @@ export function buildSystemPreamble(
     ...sessionInboxBrief,
     ...(sessionInboxBrief.length > 0 ? [""] : []),
     ...secretaryRoleBrief,
+    ...crewBrief,
     ...channelConventionsBrief,
     ...(replyCardBrief.length > 0 ? ["", ...replyCardBrief] : []),
     ...checkInTranscriptBrief,

package/lib/task-token.ts

@@ -11,6 +11,8 @@ export interface TaskTokenPayload {
   userId: string;
   permissions: string[];
   agentId?: string;
+  /** ADR-157 §3: the agent's roster generation; the cloud requires it to match. */
+  generation?: string;
 }
 
 const PREFIX = "uai_";
@@ -31,6 +33,7 @@ export function signTaskToken(payload: TaskTokenPayload, secret: string): string
         u: payload.userId,
         p: payload.permissions,
         ...(payload.agentId ? { a: payload.agentId } : {}),
+        ...(payload.generation ? { g: payload.generation } : {}),
         iat: Math.floor(Date.now() / 1000),
       }),
     ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.154",
+  "version": "0.9.155",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cloud-credentials.ts

@@ -286,6 +286,31 @@ export const ENGINE_CREDENTIAL_FILES: Readonly<Record<string, readonly string[]>
   opencode: ["auth.json"],
 };
 
+/** The engine kinds whose agents run on an AI account from the lease. */
+export const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
+  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
+  ...Object.keys(ENGINE_CREDENTIAL_FILES),
+]);
+
+/** ADR-128: the Managed Engine. It needs no AI account (it runs on Uai's
+ *  gateway), but its agent's task token is its bearer: on a leased task its
+ *  launches are admitted as that token (ADR-154 §6). */
+export const MANAGED_ENGINE_KIND = "uai";
+
+/** ADR-154 §10: kinds whose agents carry no credential at all; every other
+ *  kind outside the leased lanes (Kimi) stays down on a leased task until
+ *  its lane exists. */
+export const CREDENTIAL_FREE_KINDS: ReadonlySet<string> = new Set(["mock"]);
+
+/** ADR-154 §10: every kind a task on cloud credentials can run, and so every
+ *  kind a runner on them advertises. The Managed Engine is one, though it
+ *  leases nothing. Kimi, with no lane yet, is not. */
+export const CLOUD_CREDENTIAL_KINDS: ReadonlySet<string> = new Set([
+  ...LEASED_ENGINE_KINDS,
+  MANAGED_ENGINE_KIND,
+  ...CREDENTIAL_FREE_KINDS,
+]);
+
 interface LeasedValueBase {
   v: 1;
   part: "lease";

package/src/main.ts

@@ -92,8 +92,7 @@ import { cancelMcpCapture, completeMcpCapture, probeMcpCapture } from "../lib/mc
 import { captureGithub, mintSsh, readGithubRevision, revokeGithub } from "../lib/person-capture";
 import { handleMcpOp } from "../lib/mcp-connections";
 import {
-  ENGINE_CREDENTIAL_FILES,
-  ENGINE_ENV_CREDENTIAL_KEYS,
+  CLOUD_CREDENTIAL_KINDS,
   HOST_CLOUD_CREDENTIALS_FEATURE,
   parseCredentialsActivateResultFrame,
   runEpochFromWire,
@@ -301,6 +300,7 @@ import {
   HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+  AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
   isEngineAccountScope,
   HOST_LOGS_PROTOCOL_FEATURE,
   HOST_TASK_INVENTORY_PROTOCOL_FEATURE,
@@ -703,10 +703,6 @@ setCredentialsModeSource(() => credentialsActivation.mode());
  *  so the operator turning them on reaches it within minutes. */
 const CREDENTIALS_ACTIVATION_RETRY_MS = 5 * 60_000;
 const CREDENTIALS_ACTIVATION_ANSWER_MS = 60_000;
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 // Started here, first fired long after the bridge's state exists.
 const credentialsActivationTimer = setInterval(() => {
   if (stopping || !credentialFramesReady) return;
@@ -1398,6 +1394,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
       HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
       LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+      AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -1899,10 +1896,11 @@ function flushStoppedTaskStatuses(socket: WebSocket | null = ws): void {
 // ADR-131 D3: a stored account (any scope) makes a kind advertisable even
 // when the host's own credential is absent — see hasStoredEngineAccounts.
 setAdvertisementFallback((kind) => hasStoredEngineAccounts(kind));
-// ADR-154: on cloud credentials the runner holds none of its own, so a kind
-// is advertised when the cloud can lease an account for it (Kimi, with no
-// lane yet, is not), whatever this process's env says.
-setLeasedAdvertisement(() => (credentialsMode() === "active" ? LEASED_ENGINE_KINDS : null));
+// ADR-154 §10: on cloud credentials the runner holds none of its own, so it
+// advertises the kinds a leased task can run, whatever this process's env
+// says: the leased lanes and the Managed Engine, which leases nothing (Kimi,
+// with no lane yet, is left out).
+setLeasedAdvertisement(() => (credentialsMode() === "active" ? CLOUD_CREDENTIAL_KINDS : null));
 onRegistryChange(() => sendCapabilities());
 onContainerRuntimeChange((next, previous) => {
   if (stopping) return;
@@ -5418,6 +5416,12 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
       const perms = row.permissions.filter((p): p is string => typeof p === "string");
       if (perms.length > 0) out.permissions = perms;
     }
+    // ADR-157: the built-in Astronaut's marker, set only by the cloud.
+    if (row.builtIn === "astronaut") out.builtIn = "astronaut";
+    // ADR-157 §3: the generation its task token must carry.
+    if (typeof row.tokenGeneration === "string" && row.tokenGeneration.length > 0) {
+      out.tokenGeneration = row.tokenGeneration;
+    }
     return out;
   });
 }

package/src/protocol.ts

@@ -82,6 +82,14 @@ export type HostCommandResult<T> =
        * An unknown FIELD is ignored by old readers; an unknown CODE is not.
        */
       origin?: "cloud";
+      /**
+       * With `origin: "cloud"`: the protocol feature the command's payload
+       * needs and this runner does not advertise, so the bridge never sent it
+       * (ADR-157 §3: a roster with token generations needs
+       * `agent-token-generation-v1`). Additive for the same reason as
+       * `origin`; never set by a host.
+       */
+      requiresFeature?: string;
     };
 
 /** Capability ids shared by host advertisement and fail-closed cloud gates. */
@@ -156,6 +164,12 @@ export const HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE =
  * unrelated respawn and never stops a removed one, so the cloud refuses to
  * edit or remove a running task's agents on it. */
 export const LIVE_ROSTER_EDIT_PROTOCOL_FEATURE = "live-roster-edit-v1";
+/** ADR-157 §3: the host signs an agent's `tokenGeneration` into its task token
+ * (claim `g`). The cloud stamps a fresh generation on an agent that joins a
+ * running task only on a host advertising this, and refuses a token whose
+ * generation is not its roster entry's, so a token minted for an earlier agent
+ * under the same handle stays dead. */
+export const AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE = "agent-token-generation-v1";
 /** ADR-153 declarations + owner bindings. Advertising this means the host
  * understands every additive env frame field, persists bindings separately
  * from values, and reports immutable repository schema observations. Keep it
@@ -2956,6 +2970,29 @@ export const MAX_HOST_TASK_INVENTORY_TASK_ID_CHARS = 128;
 export const ENROLLMENT_REPLAY_PROTOCOL_HEADER = "x-uai-enrollment-replay";
 export const ENROLLMENT_REPLAY_PROTOCOL_VERSION = "same-host-v1";
 export const COMMUNICATOR_EXECUTION_PROFILE = "communicator";
+/**
+ * ADR-157: the built-in Astronaut. An Astronaut task has exactly one lead agent with
+ * this id, marked `builtIn: "astronaut"` by the cloud when it builds the entry;
+ * no client may send the marker. The lead runs under the `astronaut` execution
+ * profile: normal tools, but no native subagents (Claude's Agent/Task, Codex's
+ * multi-agent), so every helper it uses is an accounted crew agent.
+ */
+export const ASTRONAUT_AGENT_ID = "astronaut";
+export const ASTRONAUT_BUILT_IN = "astronaut";
+export const ASTRONAUT_EXECUTION_PROFILE = "astronaut";
+
+/** Whether `agent` is this task's built-in Astronaut (ADR-157 §1). */
+export function isBuiltInAstronaut(
+  task: { mode?: string | null; secretaryAgentId?: string | null },
+  agent: { id: string; builtIn?: string | null } | null | undefined,
+): boolean {
+  return (
+    task.mode === "secretary" &&
+    task.secretaryAgentId === ASTRONAUT_AGENT_ID &&
+    agent?.id === ASTRONAUT_AGENT_ID &&
+    agent.builtIn === ASTRONAUT_BUILT_IN
+  );
+}
 export const MAX_AGENT_ID_CHARS = 128;
 export const MAX_SECRETARY_DISPATCH_RECIPIENTS = 16;
 export const MAX_SECRETARY_DISPATCH_INSTRUCTION_CHARS = 8_000;
@@ -3023,6 +3060,11 @@ export interface TaskAgent {
   }>;
   /** ADR-048: the source persona's flat permission list for the `uai` CLI. */
   permissions?: string[];
+  /** ADR-157: set by the cloud on the built-in Astronaut only. */
+  builtIn?: "astronaut";
+  /** ADR-157 §3: this agent's token generation, stamped by the cloud when it
+   *  joined the running task; signed into its task token as `g`. */
+  tokenGeneration?: string;
 }
 
 export type ContainerRuntimePreference = "auto" | "docker" | "apple-container";