@skrr-ai/cli 0.1.127 → 0.1.129

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/executorStopReceipt.js

@@ -0,0 +1,160 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var executorStopReceipt_exports = {};
+__export(executorStopReceipt_exports, {
+  EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS: () => EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+  EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES: () => EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES,
+  EXECUTOR_STOP_RECEIPT_TYP: () => EXECUTOR_STOP_RECEIPT_TYP,
+  canonicalReceiptJson: () => canonicalReceiptJson,
+  executorStopReceiptHtu: () => executorStopReceiptHtu,
+  parseExecutorStopReceiptBody: () => parseExecutorStopReceiptBody,
+  signExecutorStopReceipt: () => signExecutorStopReceipt,
+  verifyExecutorStopReceipt: () => verifyExecutorStopReceipt
+});
+module.exports = __toCommonJS(executorStopReceipt_exports);
+var import_deviceKey = require("./deviceKey.js");
+const EXECUTOR_STOP_RECEIPT_TYP = "skrr-executor-stop-receipt+jwt";
+const EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES = ["session_temp"];
+const EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS = 24 * 60 * 60;
+const MAX_ID_LENGTH = 160;
+const BODY_KEYS = [
+  "version",
+  "daemonId",
+  "sourceId",
+  "sessionId",
+  "requestId",
+  "dispatchId",
+  "status",
+  "stoppedAt",
+  "descendants",
+  "erasure"
+];
+const BINDING_KEYS = ["daemonId", "sourceId", "sessionId", "requestId", "dispatchId"];
+const isPlainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const hasExactKeys = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const isId = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_ID_LENGTH;
+const isCount = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+function canonicalReceiptJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalReceiptJson).join(",")}]`;
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalReceiptJson(record[key])}`).join(",")}}`;
+}
+function executorStopReceiptHtu(dispatchId) {
+  return `https://executor-stop-receipt.skrr.invalid/v1/${encodeURIComponent(dispatchId)}`;
+}
+function parseExecutorStopReceiptBody(value) {
+  if (!isPlainObject(value) || !hasExactKeys(value, BODY_KEYS) || value.version !== 1)
+    return null;
+  if (!BINDING_KEYS.every((key) => isId(value[key])))
+    return null;
+  if (value.status !== "completed" && value.status !== "failed" && value.status !== "cancelled")
+    return null;
+  if (typeof value.stoppedAt !== "string" || Number.isNaN(Date.parse(value.stoppedAt)))
+    return null;
+  const d = value.descendants;
+  if (!isPlainObject(d) || !hasExactKeys(d, ["observed", "stopped", "survivors"]))
+    return null;
+  if (!isCount(d.observed) || !isCount(d.stopped) || !isCount(d.survivors))
+    return null;
+  if (d.observed !== d.stopped + d.survivors)
+    return null;
+  const e = value.erasure;
+  if (!isPlainObject(e))
+    return null;
+  if (e.performed === false) {
+    if (!hasExactKeys(e, ["performed"]))
+      return null;
+  } else if (e.performed === true) {
+    if (!hasExactKeys(e, ["performed", "scope", "artifacts", "bytes"]))
+      return null;
+    if (!EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES.includes(e.scope))
+      return null;
+    if (!isCount(e.artifacts) || !isCount(e.bytes))
+      return null;
+  } else {
+    return null;
+  }
+  return value;
+}
+async function signExecutorStopReceipt(signer, body, options = {}) {
+  const parsed = parseExecutorStopReceiptBody(body);
+  if (!parsed)
+    throw new Error("signExecutorStopReceipt: body is not a v1 executor stop receipt body");
+  const proof = await (0, import_deviceKey.signProofWith)(signer, {
+    method: "POST",
+    url: executorStopReceiptHtu(parsed.dispatchId),
+    // `accessToken` is hashed inline into the `ath` claim: the commitment to the body.
+    accessToken: canonicalReceiptJson(parsed),
+    ...options.iat !== void 0 ? { iat: options.iat } : {},
+    ...options.jti !== void 0 ? { jti: options.jti } : {}
+  }, EXECUTOR_STOP_RECEIPT_TYP);
+  return { body: parsed, proof };
+}
+function verifyExecutorStopReceipt(receipt, options) {
+  if (!isPlainObject(receipt) || !hasExactKeys(receipt, ["body", "proof"])) {
+    return { valid: false, reason: "bad_receipt" };
+  }
+  const body = parseExecutorStopReceiptBody(receipt.body);
+  if (!body || typeof receipt.proof !== "string")
+    return { valid: false, reason: "bad_receipt" };
+  const pin = options.pinnedPublicJwk;
+  if (!pin || !(0, import_deviceKey.isDevicePublicJwk)(pin))
+    return { valid: false, reason: "no_pin" };
+  const result = (0, import_deviceKey.verifyDevicePublicKeyProof)(receipt.proof, {
+    expectedHtm: "POST",
+    expectedHtu: executorStopReceiptHtu(body.dispatchId),
+    expectedAth: (0, import_deviceKey.tokenHash)(canonicalReceiptJson(body)),
+    pinnedPublicJwk: pin,
+    // The algorithm of the PIN, never a list: a receipt cannot pick a weaker one.
+    allowedAlgs: [(0, import_deviceKey.algForJwk)(pin)],
+    maxAgeSeconds: options.maxAgeSeconds ?? EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+    ...options.clockSkewSeconds !== void 0 ? { clockSkewSeconds: options.clockSkewSeconds } : {},
+    ...options.now !== void 0 ? { now: options.now } : {}
+  }, EXECUTOR_STOP_RECEIPT_TYP);
+  if (!result.valid)
+    return { valid: false, reason: result.reason };
+  for (const key of BINDING_KEYS) {
+    const want = options.expected?.[key];
+    if (want !== void 0 && body[key] !== want)
+      return { valid: false, reason: "binding_mismatch" };
+  }
+  if (body.descendants.survivors > 0)
+    return { valid: false, reason: "not_quiescent" };
+  return {
+    valid: true,
+    body,
+    alg: result.alg,
+    thumbprint: (0, import_deviceKey.jwkThumbprint)(result.publicJwk),
+    signedAtSeconds: result.claims.iat
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+  EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES,
+  EXECUTOR_STOP_RECEIPT_TYP,
+  canonicalReceiptJson,
+  executorStopReceiptHtu,
+  parseExecutorStopReceiptBody,
+  signExecutorStopReceipt,
+  verifyExecutorStopReceipt
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -28,6 +28,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type DaemonKeychainServiceClass, type KekStrategy, } from './kek/index.js';
 export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, type LiveKeychainProbe, type LiveStateProbe, } from './liveState.js';
 export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyAlg, type DeviceKeyPair, type DeviceKeySigner, type DevicePublicJwk, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type P256PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { canonicalReceiptJson, EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS, EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES, EXECUTOR_STOP_RECEIPT_TYP, executorStopReceiptHtu, parseExecutorStopReceiptBody, signExecutorStopReceipt, verifyExecutorStopReceipt, type ExecutorStopReceipt, type ExecutorStopReceiptBody, type ExecutorStopReceiptErasureScope, type ExecutorStopReceiptFailureReason, type ExecutorStopReceiptStatus, type SignExecutorStopReceiptOptions, type VerifyExecutorStopReceiptOptions, type VerifyExecutorStopReceiptResult, } from './executorStopReceipt.js';
 export { softwareEd25519Handle, type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
 export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -46,6 +46,9 @@ __export(index_exports, {
   DPOP_PROOF_REQUIRED: () => import_dpop.DPOP_PROOF_REQUIRED,
   DPOP_PROOF_TYP: () => import_dpop.DPOP_PROOF_TYP,
   DPOP_PROOF_VERIFY_UNAVAILABLE: () => import_dpop.DPOP_PROOF_VERIFY_UNAVAILABLE,
+  EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS: () => import_executorStopReceipt.EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+  EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES: () => import_executorStopReceipt.EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES,
+  EXECUTOR_STOP_RECEIPT_TYP: () => import_executorStopReceipt.EXECUTOR_STOP_RECEIPT_TYP,
   EXIT_NEEDS_REAUTH: () => import_messages.EXIT_NEEDS_REAUTH,
   FIRST_PARTY_HARNESS_CHANNELS: () => import_firstPartyHarnessChannels.FIRST_PARTY_HARNESS_CHANNELS,
   FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX: () => import_firstPartyHarnessHome.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX,
@@ -148,6 +151,7 @@ __export(index_exports, {
   buildManifestMessage: () => import_releaseManifest.buildManifestMessage,
   buildPairAad: () => import_daemonPair.buildPairAad,
   buildPairUrl: () => import_daemonPair.buildPairUrl,
+  canonicalReceiptJson: () => import_executorStopReceipt.canonicalReceiptJson,
   challenge: () => import_pkce.challenge,
   classifyDaemonKeychainService: () => import_kek.classifyDaemonKeychainService,
   classifyRefreshResponse: () => import_refreshClassification.classifyRefreshResponse,
@@ -186,6 +190,7 @@ __export(index_exports, {
   enrollWithServer: () => import_deviceIdentityBridge.enrollWithServer,
   ensureMachineDaemonId: () => import_machineId.ensureMachineDaemonId,
   envHasProxy: () => import_spawnEnv.envHasProxy,
+  executorStopReceiptHtu: () => import_executorStopReceipt.executorStopReceiptHtu,
   findLegacyLocalState: () => import_legacyStatePreflight.findLegacyLocalState,
   firstPartyHarnessBinDir: () => import_firstPartyHarnessHome.firstPartyHarnessBinDir,
   firstPartyHarnessChannelPrefix: () => import_firstPartyHarnessChannels.firstPartyHarnessChannelPrefix,
@@ -270,6 +275,7 @@ __export(index_exports, {
   pairBase64UrlToUint8Array: () => import_daemonPair.base64UrlToUint8Array,
   pairUint8ArrayToBase64: () => import_daemonPair.uint8ArrayToBase64,
   pairUint8ArrayToBase64Url: () => import_daemonPair.uint8ArrayToBase64Url,
+  parseExecutorStopReceiptBody: () => import_executorStopReceipt.parseExecutorStopReceiptBody,
   parsePairBundle: () => import_daemonPair.parsePairBundle,
   parsePairPlaintext: () => import_daemonPair.parsePairPlaintext,
   parsePairUrl: () => import_daemonPair.parsePairUrl,
@@ -309,6 +315,7 @@ __export(index_exports, {
   sanitizeSpawnEnv: () => import_spawnEnv.sanitizeSpawnEnv,
   setMachineUuidProfile: () => import_machineUuid.setMachineUuidProfile,
   shutdownCredEnvelope: () => import_credentialEnvelopeBridge.shutdownCredEnvelope,
+  signExecutorStopReceipt: () => import_executorStopReceipt.signExecutorStopReceipt,
   signProofWith: () => import_deviceKey.signProofWith,
   signServerRequest: () => import_deviceIdentityBridge.signServerRequest,
   signWithCandidate: () => import_deviceIdentityBridge.signWithCandidate,
@@ -322,6 +329,7 @@ __export(index_exports, {
   verifyChallenge: () => import_pkce.verifyChallenge,
   verifyDeviceProof: () => import_deviceKey.verifyProof,
   verifyDpopProof: () => import_dpop.verifyDpopProof,
+  verifyExecutorStopReceipt: () => import_executorStopReceipt.verifyExecutorStopReceipt,
   verifyIndependentMachineReservation: () => import_independentMachineReservation.verifyIndependentMachineReservation,
   verifyManifest: () => import_releaseManifest.verifyManifest,
   withAuthLock: () => import_refresh.withAuthLock,
@@ -351,6 +359,7 @@ var import_credentialEnvelope = require("./credentialEnvelope.js");
 var import_kek = require("./kek/index.js");
 var import_liveState = require("./liveState.js");
 var import_deviceKey = require("./deviceKey.js");
+var import_executorStopReceipt = require("./executorStopReceipt.js");
 var import_deviceKeyHandle = require("./deviceKeyHandle.js");
 var import_deviceKeyServerSupport = require("./deviceKeyServerSupport.js");
 var import_deviceKeyHardware = require("./deviceKeyHardware.js");
@@ -407,6 +416,9 @@ var import_independentMachineReservation = require("./independentMachineReservat
   DPOP_PROOF_REQUIRED,
   DPOP_PROOF_TYP,
   DPOP_PROOF_VERIFY_UNAVAILABLE,
+  EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+  EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES,
+  EXECUTOR_STOP_RECEIPT_TYP,
   EXIT_NEEDS_REAUTH,
   FIRST_PARTY_HARNESS_CHANNELS,
   FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX,
@@ -509,6 +521,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   buildManifestMessage,
   buildPairAad,
   buildPairUrl,
+  canonicalReceiptJson,
   challenge,
   classifyDaemonKeychainService,
   classifyRefreshResponse,
@@ -547,6 +560,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   enrollWithServer,
   ensureMachineDaemonId,
   envHasProxy,
+  executorStopReceiptHtu,
   findLegacyLocalState,
   firstPartyHarnessBinDir,
   firstPartyHarnessChannelPrefix,
@@ -631,6 +645,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   pairBase64UrlToUint8Array,
   pairUint8ArrayToBase64,
   pairUint8ArrayToBase64Url,
+  parseExecutorStopReceiptBody,
   parsePairBundle,
   parsePairPlaintext,
   parsePairUrl,
@@ -670,6 +685,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   sanitizeSpawnEnv,
   setMachineUuidProfile,
   shutdownCredEnvelope,
+  signExecutorStopReceipt,
   signProofWith,
   signServerRequest,
   signWithCandidate,
@@ -683,6 +699,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   verifyChallenge,
   verifyDeviceProof,
   verifyDpopProof,
+  verifyExecutorStopReceipt,
   verifyIndependentMachineReservation,
   verifyManifest,
   withAuthLock,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonWire.js

@@ -101,6 +101,7 @@ const SESSION_TURN_DIFF_LIVE = 'session_turn_diff_live_v1';
 const WORKSPACE_ISOLATION_PROBE = 'workspace_isolation_probe_v1';
 const TOOL_RESPONSE_OUTBOX = 'tool_response_outbox_v1';
 const SESSION_STEER = 'session_steer_v1';
+const QUESTION_ACK = 'question_ack_v1';
 // ---------------------------------------------------------------------------
 // Connection, identity, liveness
 // ---------------------------------------------------------------------------
@@ -267,7 +268,16 @@ const SESSIONS = [
         delivery: 'acked',
         answeredBy: 'daemon:claude:question:response',
     }),
-    toDaemon('daemon:claude:question:response', "A person's answer to a question."),
+    // A daemon that announces `question_ack_v1` says whether it TOOK the answer: the
+    // question was still pending and the harness has it ('delivered'), or the daemon had
+    // already timed out or been cancelled ('not_pending'). Without the capability the
+    // worker settles an answer at the relay handoff, as it always did.
+    toDaemon('daemon:claude:question:response', "A person's answer to a question.", {
+        delivery: 'acked',
+        answeredBy: 'daemon:claude:question:ack',
+        capability: QUESTION_ACK,
+    }),
+    toServer('daemon:claude:question:ack', "Whether this daemon took a person's answer to a question, or had already stopped waiting.", { capability: QUESTION_ACK, payload: { kind: 'zod', schema: 'daemonQuestionAckSchema' } }),
 ];
 // ---------------------------------------------------------------------------
 // Tools (the cloud agent's tool calls, proxied to the machine)

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/executorStopReceipt.d.ts

@@ -0,0 +1,123 @@
+/**
+ * executorStopReceipt.ts — a daemon-signed proof that a scheduled session stopped.
+ *
+ * OSK-20777, Gate 1 (docs/architecture/scheduled-publication-custody-enrollment-2026-11-01.md).
+ * Today the executor's terminal proof is the daemon reporting about itself over its own socket: the
+ * dispatch tuple is checked for consistency but nothing is signed, nothing covers descendant
+ * processes, and nothing says what was erased. A receipt is that report, signed with the device key
+ * the server already pins on the daemon's row, so a settlement that depends on it depends on the
+ * machine and not on whoever reached the socket.
+ *
+ * No new cryptography. A receipt is a DPoP-shaped device proof (`deviceKey.ts`) under its OWN header
+ * `typ`, so the two can never stand in for each other: a request proof fails here with `bad_typ`, and a
+ * receipt fails the request verifier the same way. The proof's `ath` commits to the SHA-256 of the
+ * canonical receipt body, its `htu` names the dispatch, and the pin decides which key may sign it.
+ *
+ * Verification is deliberately strict and returns a reason, never a boolean:
+ *   - a pin is REQUIRED (a receipt with no key to compare against has no authority);
+ *   - the algorithm admitted is the algorithm of the pin, never a list, so a receipt cannot choose a
+ *     weaker algorithm than the device enrolled with;
+ *   - the body is a closed shape with bounded fields;
+ *   - every field the caller expects (the dispatch the server issued) must match exactly;
+ *   - a descendant that survived is `not_quiescent`, not a valid receipt with a footnote;
+ *   - erasure is claimed only for the one scope the owner allowed, `session_temp`.
+ *
+ * Freshness is the caller's decision (`maxAgeSeconds`). A receipt can legitimately arrive hours after it
+ * was signed, replayed from the daemon's response WAL after a reconnect, so it has no short window of its
+ * own. Replay protection is the dispatch binding: the server accepts one receipt per `dispatchId`.
+ */
+import { type DeviceKeyAlg, type DeviceKeySigner, type DevicePublicJwk, type VerifyFailureReason } from './deviceKey.js';
+/** Header `typ` of an executor stop receipt. Distinct from `DEVICE_PROOF_TYP` on purpose. */
+export declare const EXECUTOR_STOP_RECEIPT_TYP = "skrr-executor-stop-receipt+jwt";
+/** What the daemon may claim to have erased. One scope, decided by the owner (2026-11-01). */
+export declare const EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES: readonly ["session_temp"];
+export type ExecutorStopReceiptErasureScope = (typeof EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES)[number];
+/** Default ceiling on a receipt's age, for a caller that does not decide: one day. */
+export declare const EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS: number;
+export type ExecutorStopReceiptStatus = 'completed' | 'failed' | 'cancelled';
+export interface ExecutorStopReceiptBody {
+    version: 1;
+    daemonId: string;
+    /** The scheduled Run (or Source) the dispatch belongs to. */
+    sourceId: string;
+    sessionId: string;
+    requestId: string;
+    dispatchId: string;
+    status: ExecutorStopReceiptStatus;
+    /** ISO-8601, when the session's process tree was last observed stopped. */
+    stoppedAt: string;
+    /** Counted after the stop, not assumed. `observed === stopped + survivors`. */
+    descendants: {
+        observed: number;
+        stopped: number;
+        survivors: number;
+    };
+    /** `performed: false` carries no scope: nothing was erased and nothing is claimed. */
+    erasure: {
+        performed: false;
+    } | {
+        performed: true;
+        scope: ExecutorStopReceiptErasureScope;
+        artifacts: number;
+        bytes: number;
+    };
+}
+export interface ExecutorStopReceipt {
+    body: ExecutorStopReceiptBody;
+    /** The device-key proof (JWS compact) that commits to `body`. */
+    proof: string;
+}
+export type ExecutorStopReceiptFailureReason = VerifyFailureReason | 'bad_receipt' | 'no_pin' | 'binding_mismatch' | 'not_quiescent';
+export type VerifyExecutorStopReceiptResult = {
+    valid: true;
+    body: ExecutorStopReceiptBody;
+    alg: DeviceKeyAlg;
+    thumbprint: string;
+    signedAtSeconds: number;
+} | {
+    valid: false;
+    reason: ExecutorStopReceiptFailureReason;
+};
+declare const BINDING_KEYS: readonly ["daemonId", "sourceId", "sessionId", "requestId", "dispatchId"];
+/**
+ * Stable JSON: object keys sorted at every level, no whitespace. The signer and the verifier must
+ * produce the same bytes from the same body, whatever order a transport reordered its keys into.
+ */
+export declare function canonicalReceiptJson(value: unknown): string;
+/** The URI a receipt's proof names. Reserved `.invalid` host: it can never be a real request target. */
+export declare function executorStopReceiptHtu(dispatchId: string): string;
+/** Shape check only. Returns the body as typed, or null when it is not exactly a v1 receipt body. */
+export declare function parseExecutorStopReceiptBody(value: unknown): ExecutorStopReceiptBody | null;
+export interface SignExecutorStopReceiptOptions {
+    /** Test hooks; production leaves both unset. */
+    iat?: number;
+    jti?: string;
+}
+/**
+ * Sign a receipt with any `DeviceKeySigner` (a software key, or a hardware handle). Throws on a body
+ * that is not exactly a v1 receipt body, so a daemon bug cannot produce a signed receipt the server
+ * would only reject later.
+ */
+export declare function signExecutorStopReceipt(signer: DeviceKeySigner, body: ExecutorStopReceiptBody, options?: SignExecutorStopReceiptOptions): Promise<ExecutorStopReceipt>;
+export interface VerifyExecutorStopReceiptOptions {
+    /** The key pinned on the daemon's row. REQUIRED: without it nothing authorizes the signature. */
+    pinnedPublicJwk: DevicePublicJwk | undefined;
+    /**
+     * What the server issued for this dispatch. Every key given must equal the receipt's, so a receipt for
+     * another daemon, Run, session, request or dispatch is `binding_mismatch`.
+     */
+    expected?: Partial<Pick<ExecutorStopReceiptBody, (typeof BINDING_KEYS)[number]>>;
+    /** Ceiling on the receipt's age in seconds. Defaults to one day. */
+    maxAgeSeconds?: number;
+    /** Tolerated clock skew in seconds. Defaults to the proof verifier's. */
+    clockSkewSeconds?: number;
+    /** Testing hook. */
+    now?: number;
+}
+/**
+ * Verify a receipt against the pinned key. Order matters: shape, then signature and pin, then the
+ * binding to the dispatch, then what the body claims. A forged receipt is reported as the forgery it
+ * is (`sig_invalid`, `pin_mismatch`, `ath_mismatch`), not as a quiescence failure.
+ */
+export declare function verifyExecutorStopReceipt(receipt: unknown, options: VerifyExecutorStopReceiptOptions): VerifyExecutorStopReceiptResult;
+export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/executorStopReceipt.js

@@ -0,0 +1,173 @@
+/**
+ * executorStopReceipt.ts — a daemon-signed proof that a scheduled session stopped.
+ *
+ * OSK-20777, Gate 1 (docs/architecture/scheduled-publication-custody-enrollment-2026-11-01.md).
+ * Today the executor's terminal proof is the daemon reporting about itself over its own socket: the
+ * dispatch tuple is checked for consistency but nothing is signed, nothing covers descendant
+ * processes, and nothing says what was erased. A receipt is that report, signed with the device key
+ * the server already pins on the daemon's row, so a settlement that depends on it depends on the
+ * machine and not on whoever reached the socket.
+ *
+ * No new cryptography. A receipt is a DPoP-shaped device proof (`deviceKey.ts`) under its OWN header
+ * `typ`, so the two can never stand in for each other: a request proof fails here with `bad_typ`, and a
+ * receipt fails the request verifier the same way. The proof's `ath` commits to the SHA-256 of the
+ * canonical receipt body, its `htu` names the dispatch, and the pin decides which key may sign it.
+ *
+ * Verification is deliberately strict and returns a reason, never a boolean:
+ *   - a pin is REQUIRED (a receipt with no key to compare against has no authority);
+ *   - the algorithm admitted is the algorithm of the pin, never a list, so a receipt cannot choose a
+ *     weaker algorithm than the device enrolled with;
+ *   - the body is a closed shape with bounded fields;
+ *   - every field the caller expects (the dispatch the server issued) must match exactly;
+ *   - a descendant that survived is `not_quiescent`, not a valid receipt with a footnote;
+ *   - erasure is claimed only for the one scope the owner allowed, `session_temp`.
+ *
+ * Freshness is the caller's decision (`maxAgeSeconds`). A receipt can legitimately arrive hours after it
+ * was signed, replayed from the daemon's response WAL after a reconnect, so it has no short window of its
+ * own. Replay protection is the dispatch binding: the server accepts one receipt per `dispatchId`.
+ */
+import { algForJwk, isDevicePublicJwk, jwkThumbprint, signProofWith, tokenHash, verifyDevicePublicKeyProof, } from './deviceKey.js';
+/** Header `typ` of an executor stop receipt. Distinct from `DEVICE_PROOF_TYP` on purpose. */
+export const EXECUTOR_STOP_RECEIPT_TYP = 'skrr-executor-stop-receipt+jwt';
+/** What the daemon may claim to have erased. One scope, decided by the owner (2026-11-01). */
+export const EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES = ['session_temp'];
+/** Default ceiling on a receipt's age, for a caller that does not decide: one day. */
+export const EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS = 24 * 60 * 60;
+const MAX_ID_LENGTH = 160;
+const BODY_KEYS = [
+    'version',
+    'daemonId',
+    'sourceId',
+    'sessionId',
+    'requestId',
+    'dispatchId',
+    'status',
+    'stoppedAt',
+    'descendants',
+    'erasure',
+];
+const BINDING_KEYS = ['daemonId', 'sourceId', 'sessionId', 'requestId', 'dispatchId'];
+const isPlainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const hasExactKeys = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const isId = (value) => typeof value === 'string' && value.length > 0 && value.length <= MAX_ID_LENGTH;
+const isCount = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+/**
+ * Stable JSON: object keys sorted at every level, no whitespace. The signer and the verifier must
+ * produce the same bytes from the same body, whatever order a transport reordered its keys into.
+ */
+export function canonicalReceiptJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalReceiptJson).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalReceiptJson(record[key])}`)
+        .join(',')}}`;
+}
+/** The URI a receipt's proof names. Reserved `.invalid` host: it can never be a real request target. */
+export function executorStopReceiptHtu(dispatchId) {
+    return `https://executor-stop-receipt.skrr.invalid/v1/${encodeURIComponent(dispatchId)}`;
+}
+/** Shape check only. Returns the body as typed, or null when it is not exactly a v1 receipt body. */
+export function parseExecutorStopReceiptBody(value) {
+    if (!isPlainObject(value) || !hasExactKeys(value, BODY_KEYS) || value.version !== 1)
+        return null;
+    if (!BINDING_KEYS.every((key) => isId(value[key])))
+        return null;
+    if (value.status !== 'completed' && value.status !== 'failed' && value.status !== 'cancelled')
+        return null;
+    if (typeof value.stoppedAt !== 'string' || Number.isNaN(Date.parse(value.stoppedAt)))
+        return null;
+    const d = value.descendants;
+    if (!isPlainObject(d) || !hasExactKeys(d, ['observed', 'stopped', 'survivors']))
+        return null;
+    if (!isCount(d.observed) || !isCount(d.stopped) || !isCount(d.survivors))
+        return null;
+    if (d.observed !== d.stopped + d.survivors)
+        return null;
+    const e = value.erasure;
+    if (!isPlainObject(e))
+        return null;
+    if (e.performed === false) {
+        if (!hasExactKeys(e, ['performed']))
+            return null;
+    }
+    else if (e.performed === true) {
+        if (!hasExactKeys(e, ['performed', 'scope', 'artifacts', 'bytes']))
+            return null;
+        if (!EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES.includes(e.scope))
+            return null;
+        if (!isCount(e.artifacts) || !isCount(e.bytes))
+            return null;
+    }
+    else {
+        return null;
+    }
+    return value;
+}
+/**
+ * Sign a receipt with any `DeviceKeySigner` (a software key, or a hardware handle). Throws on a body
+ * that is not exactly a v1 receipt body, so a daemon bug cannot produce a signed receipt the server
+ * would only reject later.
+ */
+export async function signExecutorStopReceipt(signer, body, options = {}) {
+    const parsed = parseExecutorStopReceiptBody(body);
+    if (!parsed)
+        throw new Error('signExecutorStopReceipt: body is not a v1 executor stop receipt body');
+    const proof = await signProofWith(signer, {
+        method: 'POST',
+        url: executorStopReceiptHtu(parsed.dispatchId),
+        // `accessToken` is hashed inline into the `ath` claim: the commitment to the body.
+        accessToken: canonicalReceiptJson(parsed),
+        ...(options.iat !== undefined ? { iat: options.iat } : {}),
+        ...(options.jti !== undefined ? { jti: options.jti } : {}),
+    }, EXECUTOR_STOP_RECEIPT_TYP);
+    return { body: parsed, proof };
+}
+/**
+ * Verify a receipt against the pinned key. Order matters: shape, then signature and pin, then the
+ * binding to the dispatch, then what the body claims. A forged receipt is reported as the forgery it
+ * is (`sig_invalid`, `pin_mismatch`, `ath_mismatch`), not as a quiescence failure.
+ */
+export function verifyExecutorStopReceipt(receipt, options) {
+    if (!isPlainObject(receipt) || !hasExactKeys(receipt, ['body', 'proof'])) {
+        return { valid: false, reason: 'bad_receipt' };
+    }
+    const body = parseExecutorStopReceiptBody(receipt.body);
+    if (!body || typeof receipt.proof !== 'string')
+        return { valid: false, reason: 'bad_receipt' };
+    const pin = options.pinnedPublicJwk;
+    if (!pin || !isDevicePublicJwk(pin))
+        return { valid: false, reason: 'no_pin' };
+    const result = verifyDevicePublicKeyProof(receipt.proof, {
+        expectedHtm: 'POST',
+        expectedHtu: executorStopReceiptHtu(body.dispatchId),
+        expectedAth: tokenHash(canonicalReceiptJson(body)),
+        pinnedPublicJwk: pin,
+        // The algorithm of the PIN, never a list: a receipt cannot pick a weaker one.
+        allowedAlgs: [algForJwk(pin)],
+        maxAgeSeconds: options.maxAgeSeconds ?? EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS,
+        ...(options.clockSkewSeconds !== undefined
+            ? { clockSkewSeconds: options.clockSkewSeconds }
+            : {}),
+        ...(options.now !== undefined ? { now: options.now } : {}),
+    }, EXECUTOR_STOP_RECEIPT_TYP);
+    if (!result.valid)
+        return { valid: false, reason: result.reason };
+    for (const key of BINDING_KEYS) {
+        const want = options.expected?.[key];
+        if (want !== undefined && body[key] !== want)
+            return { valid: false, reason: 'binding_mismatch' };
+    }
+    if (body.descendants.survivors > 0)
+        return { valid: false, reason: 'not_quiescent' };
+    return {
+        valid: true,
+        body,
+        alg: result.alg,
+        thumbprint: jwkThumbprint(result.publicJwk),
+        signedAtSeconds: result.claims.iat,
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -28,6 +28,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, classifyDaemonKeychainService, isMasterKekKeychainService, isSessionKeychainService, isUserOwnedSecretKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type DaemonKeychainServiceClass, type KekStrategy, } from './kek/index.js';
 export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SERVICE_BASE, DAEMON_KEYCHAIN_SERVICE_BASE, HERMETIC_HOME_ENV, LEGACY_DAEMON_KEYCHAIN_SERVICE, LIVE_DEFAULT_PROFILE, LIVE_STATE_REFUSED_CODE, LiveStateRefusedError, accountHomeDir, assertMayMutateLiveKeychain, assertMayMutateLiveState, isLiveKeychainService, isLiveStateRefusal, isTestProcess, keychainSuffixForDir, liveKeychainServices, liveStateRoot, refusesLiveKeychainMutation, refusesLiveStateInTest, rethrowIfLiveStateRefusal, testProcessSignal, type LiveKeychainProbe, type LiveStateProbe, } from './liveState.js';
 export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyAlg, type DeviceKeyPair, type DeviceKeySigner, type DevicePublicJwk, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type P256PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
+export { canonicalReceiptJson, EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS, EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES, EXECUTOR_STOP_RECEIPT_TYP, executorStopReceiptHtu, parseExecutorStopReceiptBody, signExecutorStopReceipt, verifyExecutorStopReceipt, type ExecutorStopReceipt, type ExecutorStopReceiptBody, type ExecutorStopReceiptErasureScope, type ExecutorStopReceiptFailureReason, type ExecutorStopReceiptStatus, type SignExecutorStopReceiptOptions, type VerifyExecutorStopReceiptOptions, type VerifyExecutorStopReceiptResult, } from './executorStopReceipt.js';
 export { softwareEd25519Handle, type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
 export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_ALGS_FIELD, } from './deviceKeyServerSupport.js';
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -109,6 +109,8 @@ export { ALLOW_LIVE_STATE_ENV, __setAccountHomeForTest, DAEMON_BYOK_KEYCHAIN_SER
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
 // Server-side verification middleware is a later PR.
 export { algForJwk, buildProof as buildDeviceProof, DEVICE_KEY_ALGS, generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, normalizeHtu, p256PublicJwkFromRaw, proofSigningInput, publicJwkFromX, signProofWith, tokenHash, verifyProof as verifyDeviceProof, } from './deviceKey.js';
+// OSK-20777 Gate 1 — a daemon-signed proof that a scheduled session stopped, under its own proof `typ`.
+export { canonicalReceiptJson, EXECUTOR_STOP_RECEIPT_DEFAULT_MAX_AGE_SECONDS, EXECUTOR_STOP_RECEIPT_ERASURE_SCOPES, EXECUTOR_STOP_RECEIPT_TYP, executorStopReceiptHtu, parseExecutorStopReceiptBody, signExecutorStopReceipt, verifyExecutorStopReceipt, } from './executorStopReceipt.js';
 // The handle every signing site holds instead of a private key, and the
 // hardware-bound backend behind it (docs/architecture/device-key-custody-2026-10-29.md).
 export { softwareEd25519Handle } from './deviceKeyHandle.js';

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.33",
+  "version": "0.4.34",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {