@sleep2agi/commhub-server 0.9.0-preview.106 → 0.9.0-preview.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.106",
+  "version": "0.9.0-preview.107",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/api-host-supervisors-runtime-readiness.test.ts

@@ -0,0 +1,182 @@
+// #622 —— daemon 逐 runtime 自检(runtime_readiness)从 report_status 一路走到
+// /api/host-supervisors。三件事:
+//   1. report_status 的 zod 形状收得宽:坏的 runtime_readiness 只丢它自己,
+//      绝不拒掉整份 report(否则一台 daemon 发了个奇怪的诊断字段就在 hub 上失联);
+//   2. 新字段会被**保留**(daemon_capabilities 不是 strict,schema 里没声明的键会被
+//      静默剥掉 —— 不加 schema 就永远到不了 REST);
+//   3. REST 只在 daemon 报了时输出,旧 daemon 的行里**没有**这个键;
+//      can_create_nodes 语义不变。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import "./require-explicit-test-db.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { register, login } from "./auth.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
+
+function captureToolSchemas(): Record<string, any> {
+  const mcp = new McpServer({ name: "schema-probe", version: "0" }) as any;
+  const schemas: Record<string, any> = {};
+  const origTool = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, desc: string, schema: any, handler: any) => {
+    schemas[name] = schema;
+    return origTool(name, desc, schema, handler);
+  };
+  registerTools(mcp, undefined, null, null, null, false, "tok_schema_probe");
+  return schemas;
+}
+const schemas = captureToolSchemas();
+const snapSchema = () => schemas.report_status.config_snapshot;
+const base = { flags: {}, config_update_capable: false, peer_reply_inbox_capable: true };
+
+const READY = {
+  ok: true, state: "ready", reason: "可以创建", version: "2.1.290",
+  checked_at: "2026-10-06T03:00:00.000Z", cli: "found", auth: "present", network: "reachable",
+};
+const MISSING = {
+  ok: false, state: "missing_cli", reason: "新节点的 PATH 上找不到可用的 grok 命令", checked_at: "2026-10-06T03:00:00.000Z",
+  cli: "missing", auth: "present", network: "skipped",
+};
+
+describe("#622 report_status schema —— runtime_readiness", () => {
+  test("合法值透传(没被 daemon_capabilities 的非 strict 剥掉)", () => {
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: {
+      can_create_nodes: true,
+      runtime_readiness: { "claude-code-cli": READY, "grok-build-acp": MISSING, "codex-sdk": { ...READY, shared_login_count: 27 } },
+    } });
+    expect(parsed.daemon_capabilities.runtime_readiness["claude-code-cli"].state).toBe("ready");
+    expect(parsed.daemon_capabilities.runtime_readiness["grok-build-acp"].state).toBe("missing_cli");
+    expect(parsed.daemon_capabilities.runtime_readiness["codex-sdk"].shared_login_count).toBe(27);
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+  });
+
+  test("🔴 坏形状绝不拒整份 report —— 只丢这一格", () => {
+    for (const bad of [
+      "string", 42, null, [], { x: "notobj" },
+      Object.fromEntries(Array.from({ length: 40 }, (_, i) => [`rt${i}`, READY])),
+    ]) {
+      const parsed = snapSchema().parse({ ...base, daemon_capabilities: { can_create_nodes: true, runtime_readiness: bad } });
+      expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+      expect(parsed.daemon_capabilities.runtime_readiness).toBeUndefined();
+    }
+  });
+
+  test("单个字段坏:schema 不拒整份;读取侧消毒把它兜成 unknown", () => {
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: {
+      can_create_nodes: true,
+      runtime_readiness: { a: { ok: "yes", state: 7, reason: "x".repeat(5000), shared_login_count: -3 } },
+    } });
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+    const a = sanitizeRuntimeReadiness(parsed.daemon_capabilities.runtime_readiness)!.a;
+    expect(a.ok).toBe(false);
+    expect(a.state).toBe("unknown");
+    expect(a.reason.length).toBe(600);
+    expect(a.shared_login_count).toBeUndefined();
+  });
+
+  test("总字节超 16 KB:整格丢掉(异常 daemon 不能往库里塞大对象)", () => {
+    const big = { a: { ...READY, reason: "x".repeat(20_000) } };
+    const parsed = snapSchema().parse({ ...base, daemon_capabilities: { can_create_nodes: true, runtime_readiness: big } });
+    expect(parsed.daemon_capabilities.runtime_readiness).toBeUndefined();
+    expect(parsed.daemon_capabilities.can_create_nodes).toBe(true);
+  });
+});
+
+describe("#622 sanitizeRuntimeReadiness(读取侧)", () => {
+  test("不认识的 state → unknown;ok 只有 ready 时才可能为真", () => {
+    const s = sanitizeRuntimeReadiness({
+      a: { ok: true, state: "something_new", reason: "r" },
+      b: { ok: true, state: "no_network", reason: "r" },
+    })!;
+    expect(s.a.state).toBe("unknown");
+    expect(s.a.ok).toBe(false);
+    expect(s.b.ok).toBe(false);
+  });
+  test("没报 / 空 → undefined(调用方据此不输出键)", () => {
+    expect(sanitizeRuntimeReadiness(undefined)).toBeUndefined();
+    expect(sanitizeRuntimeReadiness({})).toBeUndefined();
+    expect(sanitizeRuntimeReadiness([])).toBeUndefined();
+  });
+  test("未知枚举值的 cli/auth/network 被丢掉", () => {
+    const s = sanitizeRuntimeReadiness({ a: { ...READY, cli: "/home/x/bin/claude", network: "maybe" } })!;
+    expect(s.a.cli).toBeUndefined();
+    expect(s.a.network).toBeUndefined();
+    expect(s.a.auth).toBe("present");
+  });
+});
+
+let BASE = "";
+let server: any = null;
+let userToken = "";
+let userNetworkId = "";
+let userId = "";
+
+beforeAll(async () => {
+  process.env.HOST = "127.0.0.1";
+  const suffix = `${Date.now()}_${Math.floor(Math.random() * 1000)}`;
+  const password = "BootstrapPw123Aa!";
+  const seed = register(`rr_seed_${suffix}`, password, undefined, "seed");
+  if (!seed.ok) throw new Error("seed failed");
+  db.run("UPDATE users SET role = 'admin' WHERE username = ?1", [`rr_seed_${suffix}`]);
+  const u = register(`rr_u_${suffix}`, password, undefined, "seed");
+  if (!u.ok || !u.token) throw new Error("user register failed");
+  userToken = u.token;
+  userNetworkId = u.network_id ?? "";
+  userId = login(`rr_u_${suffix}`, password).user!.user_id;
+  const { bootServer } = await import("./server.js");
+  server = bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${server.port}`;
+  await new Promise((r) => setTimeout(r, 100));
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+});
+
+function seedDaemon(alias: string, snapshot: object): void {
+  db.run(
+    `INSERT OR REPLACE INTO nodes (
+       node_id, node_name, alias, runtime, model, config_path,
+       channels, server, hostname, network_id, config_revision, config_snapshot
+     ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
+    [`rr_n_${alias}`, alias, alias, "claude-agent-sdk", null, "/tmp/cfg.json", "[]", "test-host", "test-host",
+     userNetworkId, 0, JSON.stringify(snapshot)],
+  );
+  db.run(
+    `INSERT OR REPLACE INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6)`,
+    [`rr_t_${alias}`, `hash_rr_${alias}`, userId, userNetworkId, `node:${alias}`, "network"],
+  );
+}
+
+async function listDaemons(): Promise<any[]> {
+  const res = await fetch(`${BASE}/api/host-supervisors`, { headers: { Authorization: `Bearer ${userToken}` } });
+  const body = await res.json();
+  if (!body.ok) throw new Error("list failed: " + JSON.stringify(body));
+  return body.daemons;
+}
+
+describe("#622 /api/host-supervisors 输出 runtime_readiness", () => {
+  test("新 daemon:逐 runtime 透传;can_create_nodes 不受影响", async () => {
+    db.run("DELETE FROM nodes WHERE network_id = ?1", [userNetworkId]);
+    seedDaemon("rr-new", { role: "host_supervisor", daemon_capabilities: {
+      runtimes_supported: ["claude-code-cli", "grok-build-acp"],
+      can_create_nodes: true,
+      runtime_readiness: { "claude-code-cli": READY, "grok-build-acp": MISSING },
+    } });
+    const d = (await listDaemons()).find((x) => x.alias === "rr-new");
+    expect(d.can_create_nodes).toBe(true);
+    expect(d.runtime_readiness["claude-code-cli"]).toEqual(READY);
+    expect(d.runtime_readiness["grok-build-acp"].state).toBe("missing_cli");
+    expect(d.runtime_readiness["grok-build-acp"].ok).toBe(false);
+  });
+
+  test("🔴 旧 daemon(不报):响应里没有这个键 —— 不是 {}、不是 null", async () => {
+    db.run("DELETE FROM nodes WHERE network_id = ?1", [userNetworkId]);
+    seedDaemon("rr-old", { role: "host_supervisor", daemon_capabilities: { runtimes_supported: ["claude-agent-sdk"], can_create_nodes: true } });
+    const d = (await listDaemons()).find((x) => x.alias === "rr-old");
+    expect(d.can_create_nodes).toBe(true);
+    expect("runtime_readiness" in d).toBe(false);
+  });
+});

package/src/config-apply-validate.test.ts

@@ -249,6 +249,15 @@ describe("validatePatch — per-flag enum / range", () => {
     expect(validatePatch(undefined, { timeout: 3_600_001 })?.field).toBe("flags.timeout");
     expect(validatePatch(undefined, { timeout: 60.5 })?.field).toBe("flags.timeout");
   });
+  test("timeout: 0 = no limit; 1..999 is seconds-shaped and rejected (#605)", () => {
+    expect(validatePatch(undefined, { timeout: 0 })).toBeNull();
+    expect(validatePatch(undefined, { timeout: 1000 })).toBeNull();
+    for (const v of [1, 600, 999]) {
+      const r = validatePatch(undefined, { timeout: v });
+      expect(r?.field).toBe("flags.timeout");
+      expect(r?.reason).toContain("milliseconds");
+    }
+  });
 });
 
 describe("validatePatch — combinations", () => {

package/src/config-apply-validate.ts

@@ -5,6 +5,8 @@
 // tools.ts wrap these with auth checks (SEC-1 network scope, ntok_/utok_
 // caller identity, role gates).
 
+import { isValidTimeoutMs, TIMEOUT_MS_REASON } from "./create-node-validate.js";
+
 /**
  * Fields the dashboard may change. Anything not in this list is rejected
  * by hub-side validation regardless of role — the UI cannot smuggle
@@ -239,8 +241,10 @@ export function validatePatch(
         }
         break;
       case "timeout":
-        if (typeof val !== "number" || !Number.isInteger(val) || val < 0 || val > 3_600_000) {
-          return { field: "flags.timeout", reason: "must be an integer ms in [0, 3_600_000]" };
+        // #605 —— 与 create_node 同一把尺子(create-node-validate.ts isValidTimeoutMs):
+        // 毫秒,0 或 1000..3_600_000;1..999 是「按秒填了」的形状,拒绝而不是给一个亚秒超时。
+        if (!isValidTimeoutMs(val)) {
+          return { field: "flags.timeout", reason: TIMEOUT_MS_REASON };
         }
         break;
     }

package/src/create-node-validate.test.ts

@@ -69,6 +69,30 @@ describe("validateFlagValue (§4.2.2)", () => {
     expect(() => validateFlagValue("permissionMode", "plan")).not.toThrow();
     expect(() => validateFlagValue("permissionMode", "anything-else")).toThrow(ValidationError);
   });
+  // #605 —— agent-node 按毫秒读 flags.timeout(默认 300000)。这里曾收 1..86400(秒的形状):
+  // 600 原样到子节点 = 0.6 秒超时;600000(10 分钟)反被拒。现在与 update_node_config 同一把尺子。
+  test("timeout is milliseconds: 0 or 1000..3_600_000 (#605)", () => {
+    for (const v of [0, 1000, 300_000, 600_000, 3_600_000]) {
+      expect(() => validateFlagValue("timeout", v)).not.toThrow();
+    }
+    for (const v of [1, 600, 999, 86_400 * 1000 + 1, 3_600_001, -1, 1500.5, "600000", null]) {
+      expect(() => validateFlagValue("timeout", v)).toThrow(ValidationError);
+    }
+    try { validateFlagValue("timeout", 600); throw new Error("unreachable"); }
+    catch (e) {
+      expect(e).toBeInstanceOf(ValidationError);
+      expect((e as ValidationError).code).toBe("flag_value_invalid");
+      expect(String((e as ValidationError).detail?.reason)).toContain("milliseconds");
+    }
+  });
+  test("timeout range matches update_node_config's (#605)", async () => {
+    const { validatePatch } = await import("./config-apply-validate.js");
+    for (const v of [0, 1, 600, 999, 1000, 600_000, 3_600_000, 3_600_001, -1, 1.5]) {
+      let createOk = true;
+      try { validateFlagValue("timeout", v); } catch { createOk = false; }
+      expect({ v, ok: createOk }).toEqual({ v, ok: validatePatch(undefined, { timeout: v }) === null });
+    }
+  });
 });
 
 describe("validateEnvRefs (§4.4.7 + B1 G7/G8 sub-cases)", () => {

package/src/create-node-validate.ts

@@ -108,6 +108,23 @@ export function validateModel(s: unknown): asserts s is string | undefined | nul
   }
 }
 
+/**
+ * #605 —— `flags.timeout` 的单位是**毫秒**:agent-node 就是这么读的(cli.ts currentClaudeTimeoutMs /
+ * currentCodexTimeoutMs → util/timeout.ts resolveTimeoutMs、runtime/opencode-timeout.ts,默认 300000)。
+ * 这里曾按「秒」收 1..86400:填 600 想要 10 分钟的人拿到 0.6 秒、每个任务都超时;真正的毫秒值被拒。
+ *
+ * 范围与 update_node_config(config-apply-validate.ts)/ agent-node config-apply 同一把尺子:
+ * 0(不设上限)或 TIMEOUT_MS_MIN..TIMEOUT_MS_MAX。1..999 拒绝 —— 旧客户端按秒发的小值分辨不出意图,
+ * 不偷偷乘 1000,但也不再让任何人悄悄拿到一个亚秒超时。
+ */
+export const TIMEOUT_MS_MIN = 1000;
+export const TIMEOUT_MS_MAX = 3_600_000;
+export const TIMEOUT_MS_REASON =
+  `timeout is in milliseconds: 0 (no limit) or an integer ${TIMEOUT_MS_MIN}..${TIMEOUT_MS_MAX} (e.g. 600000 = 10 min)`;
+export function isValidTimeoutMs(v: unknown): v is number {
+  return typeof v === "number" && Number.isInteger(v) && (v === 0 || (v >= TIMEOUT_MS_MIN && v <= TIMEOUT_MS_MAX));
+}
+
 export function validateFlagValue(k: string, v: unknown): void {
   switch (k) {
     case "permissionMode":
@@ -129,8 +146,8 @@ export function validateFlagValue(k: string, v: unknown): void {
       }
       return;
     case "timeout":
-      if (!Number.isInteger(v) || (v as number) < 1 || (v as number) > 86400) {
-        throw new ValidationError("flag_value_invalid", { field: k, reason: "must be integer 1..86400" });
+      if (!isValidTimeoutMs(v)) {
+        throw new ValidationError("flag_value_invalid", { field: k, reason: TIMEOUT_MS_REASON });
       }
       return;
     case "copresence":

package/src/db.ts

@@ -2104,3 +2104,23 @@ export function logTaskEvent(taskId: string, fromStatus: string | null, toStatus
 if (db.dialect === "postgres") {
   for (const table of ["nodes", "user_inbox"]) db.exec(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS rowid BIGSERIAL`);
 }
+
+// Board #625: common SQLite/PostgreSQL DDL. Adoption records authority, not processes.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS node_daemon_bindings (
+    request_id TEXT PRIMARY KEY,
+    network_id TEXT NOT NULL,
+    node_id TEXT NOT NULL,
+    daemon_node_id TEXT NOT NULL,
+    workdir TEXT NOT NULL,
+    requested_by TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending','active','refused','revoked')),
+    error TEXT,
+    created_at BIGINT NOT NULL,
+    updated_at BIGINT NOT NULL
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_ndb_live_node
+    ON node_daemon_bindings(node_id) WHERE status IN ('pending','active');
+  CREATE INDEX IF NOT EXISTS idx_ndb_daemon_network
+    ON node_daemon_bindings(daemon_node_id,network_id,status);
+`);

package/src/mcp-context-cost-http.test.ts

@@ -25,7 +25,8 @@ if (!activeDbPath) throw new Error("mcp-context-cost requires COMMHUB_DB (or COM
  * 上限跟着收到用户这一档(~1.7 KB 余量);节点 / 全部工具的上限在 tool-audience-http.test.ts。
  * 加工具或加说明超过它,就在这里改数字并在 PR 里说为什么。
  */
-const TOOLS_LIST_MAX_BYTES = 56_500;
+// Board #625: two human adoption tools; measured 58 tools / 56,615 B.
+const TOOLS_LIST_MAX_BYTES = 57_500;
 /** 单个工具(名字 + 描述 + 输入 schema)的上限;最大的是 report_status(节点心跳,~8.4 KB 的遥测结构)。 */
 const TOOL_MAX_BYTES = 9_000;
 /** 单条工具描述的上限(说明写进参数的 describe,或者拆短)。 */

package/src/node-daemon-bindings.test.ts

@@ -0,0 +1,132 @@
+import { beforeEach, afterAll, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { buildControllableMap } from "./node-lifecycle-controllable.js";
+
+const NET = "net_adoption_test", USER = "u_adoption_test", CHILD = "n_adoption_child", DAEMON = "node_adoption_daemon";
+function cleanup() {
+  for (const table of ["node_daemon_bindings", "node_stop_requests", "node_start_requests", "node_create_requests", "audit_log", "sessions", "nodes", "api_tokens", "network_members", "networks"])
+    db.run(`DELETE FROM ${table} WHERE network_id=?1`, [NET]);
+  db.run("DELETE FROM users WHERE user_id=?1", [USER]);
+}
+beforeEach(() => {
+  cleanup();
+  db.run("INSERT INTO users(user_id,username,password_hash,role) VALUES(?1,?1,'x','user')", [USER]);
+  db.run("INSERT INTO networks(network_id,network_name,owner_id) VALUES(?1,?1,?2)", [NET, USER]);
+  db.run("INSERT INTO network_members(user_id,network_id,role) VALUES(?1,?2,'owner')", [USER, NET]);
+  for (const [id, alias, snap] of [[DAEMON, "adoption-daemon", { role: "host_supervisor", daemon_capabilities: { adopt_capable: true } }], [CHILD, "adoption-child", {}]] as const) {
+    db.run(`INSERT INTO nodes(node_id,node_name,alias,network_id,owner_user_id,hostname,config_snapshot,lifecycle_state) VALUES(?1,?2,?2,?3,?4,'test-host',?5,'active')`, [id, alias, NET, USER, JSON.stringify(snap)]);
+  }
+  db.run("INSERT INTO sessions(resume_id,session_id,alias,network_id,status,last_seen_at) VALUES('adoption-session','adoption-session','adoption-daemon',?1,'idle',datetime('now'))", [NET]);
+  db.run("INSERT INTO api_tokens(token_id,user_id,network_id,scope,name,token_hash) VALUES('adoption-token',?1,?2,'network','node:adoption-daemon','adoption-hash')", [USER, NET]);
+});
+afterAll(cleanup);
+function handlers(kind: "user" | "daemon" | "stranger" = "user") {
+  const server = new McpServer({ name: "adoption-test", version: "0" }) as any;
+  const out: any = {}, original = server.tool.bind(server);
+  server.tool = (name: string, desc: string, schema: any, handler: any) => { out[name] = handler; return original(name, desc, schema, handler); };
+  registerTools(server, undefined, kind === "daemon" ? NET : null, kind === "user" ? USER : null, null, kind === "daemon", kind === "daemon" ? "adoption-token" : null);
+  return out;
+}
+const call = async (handler: any, args: any = {}) => JSON.parse((await handler(args)).content[0].text);
+const request = () => call(handlers().request_adopt_node, { node_id: CHILD, daemon_node_id: DAEMON, workdir: "/workspace/project" });
+async function adopt() {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
+  return r.request_id;
+}
+
+test("unbound node_ cannot use an explicitly supplied daemon (witnessed red on main)", async () => {
+  db.run("UPDATE nodes SET node_id='node_unbound_child' WHERE node_id=?1", [CHILD]);
+  expect(await call(handlers().stop_node, { child_node_id: "node_unbound_child", daemon_node_id: DAEMON, network_id: NET })).toMatchObject({ ok: false, error: "daemon_not_resolvable" });
+  expect(db.all("SELECT * FROM node_stop_requests WHERE network_id=?1", NET)).toHaveLength(0);
+});
+test("two-phase binding, daemon-bound pull, controllable map, adopted delete refused", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect(await call(handlers().stop_node, { child_node_id: CHILD, daemon_node_id: DAEMON, network_id: NET })).toMatchObject({ ok: false });
+  expect(await call(handlers("daemon").get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: true, node_id: CHILD, alias: "adoption-child", workdir: "/workspace/project" });
+  expect(await call(handlers().get_adopt_request, { request_id: r.request_id })).toMatchObject({ ok: false });
+  expect(await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).toMatchObject({ ok: true });
+  expect((await call(handlers("daemon").list_my_children)).children).toContainEqual({ child_node_id: CHILD, alias: "adoption-child", lifecycle_state: "active", managed: "adopted" });
+  expect(buildControllableMap([], [{ node_id: CHILD, daemon_node_id: DAEMON }]).get(CHILD)).toBe(DAEMON);
+  expect(await call(handlers().delete_node, { child_node_id: CHILD, confirm_alias: "adoption-child", network_id: NET })).toMatchObject({ ok: false, error: "adopted_node_delete_unsupported" });
+  expect(db.get<any>("SELECT lifecycle_state FROM nodes WHERE node_id=?1", CHILD).lifecycle_state).toBe("active");
+});
+test("adopted stop/start complete through existing protocol; revocation removes authority", async () => {
+  await adopt(); const u = handlers(), d = handlers("daemon");
+  const stop = await call(u.stop_node, { child_node_id: CHILD, network_id: NET }); expect(stop.ok).toBe(true);
+  expect((await call(d.get_stop_request, { request_id: stop.request_id })).ok).toBe(true);
+  expect((await call(d.ack_stop_request, { request_id: stop.request_id, status: "stopped" })).ok).toBe(true);
+  expect((await call(d.list_my_children)).children[0].lifecycle_state).toBe("stopped");
+  const start = await call(u.start_node, { child_node_id: CHILD, network_id: NET }); expect(start.ok).toBe(true);
+  expect((await call(d.get_start_request, { request_id: start.request_id })).ok).toBe(true);
+  expect((await call(d.ack_start_request, { request_id: start.request_id, status: "started", child_pid: 4321 })).ok).toBe(true);
+  expect((await call(u.unadopt_node, { node_id: CHILD })).ok).toBe(true);
+  expect((await call(d.list_my_children)).children).toHaveLength(0);
+  expect((await call(u.stop_node, { child_node_id: CHILD, daemon_node_id: DAEMON, network_id: NET })).ok).toBe(false);
+});
+test("pending cancellation cannot be resurrected; duplicate pending refuses", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  expect((await request()).error).toBe("node_already_managed");
+  expect((await call(handlers().unadopt_node, { node_id: CHILD })).ok).toBe(true);
+  expect((await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_pending");
+});
+test("human-only and owner/admin fail closed; admin exception audited", async () => {
+  const args = { node_id: CHILD, daemon_node_id: DAEMON, workdir: "/workspace/project" };
+  expect((await call(handlers("daemon").request_adopt_node, args)).ok).toBe(false);
+  expect((await call(handlers("stranger").request_adopt_node, args)).ok).toBe(false);
+  db.run("UPDATE network_members SET role='member' WHERE network_id=?1", [NET]);
+  db.run("UPDATE nodes SET owner_user_id=NULL WHERE node_id=?1", [CHILD]);
+  expect((await request()).error).toBe("adopt_forbidden");
+  db.run("UPDATE network_members SET role='owner' WHERE network_id=?1", [NET]);
+  expect((await request()).ok).toBe(true);
+  expect(db.get("SELECT action FROM audit_log WHERE action='adopt_by_admin' AND network_id=?1", NET)).not.toBeNull();
+});
+test("viewer owner cannot request; membership loss before ack cannot activate", async () => {
+  db.run("UPDATE network_members SET role='viewer' WHERE network_id=?1", [NET]);
+  expect((await request()).error).toBe("adopt_forbidden");
+  db.run("UPDATE network_members SET role='owner' WHERE network_id=?1", [NET]);
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("DELETE FROM network_members WHERE network_id=?1", [NET]);
+  expect((await call(handlers("daemon").ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("adopt_forbidden");
+});
+test("wrong daemon cannot pull/ack; refusal releases reservation; in-flight unadopt is refused", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("UPDATE node_daemon_bindings SET daemon_node_id='other-daemon' WHERE request_id=?1", [r.request_id]);
+  const d = handlers("daemon");
+  expect((await call(d.get_adopt_request, { request_id: r.request_id })).error).toBe("request_not_found");
+  expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_found");
+  db.run("UPDATE node_daemon_bindings SET daemon_node_id=?1 WHERE request_id=?2", [DAEMON, r.request_id]);
+  expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "refused", error: "adopt_roots_not_configured" })).status).toBe("refused");
+  await adopt();
+  expect((await call(handlers().stop_node, { child_node_id: CHILD, network_id: NET })).ok).toBe(true);
+  expect((await call(handlers().unadopt_node, { node_id: CHILD })).error).toBe("node_lifecycle_in_flight");
+});
+test("old daemon, hostname mismatch, stale heartbeat and cross-network daemon rejected", async () => {
+  db.run("UPDATE nodes SET config_snapshot='null' WHERE node_id=?1", [DAEMON]);
+  expect((await request()).error).toBe("daemon_not_adopt_capable");
+  db.run("UPDATE nodes SET config_snapshot='{}' WHERE node_id=?1", [DAEMON]);
+  expect((await request()).error).toBe("daemon_not_adopt_capable");
+  db.run("UPDATE nodes SET config_snapshot=?1,hostname='different' WHERE node_id=?2", [JSON.stringify({ role: "host_supervisor", daemon_capabilities: { adopt_capable: true } }), DAEMON]);
+  expect((await request()).error).toBe("hostname_mismatch");
+  db.run("UPDATE nodes SET hostname='test-host' WHERE node_id=?1", [DAEMON]);
+  db.run("UPDATE sessions SET last_seen_at='2000-01-01 00:00:00' WHERE network_id=?1", [NET]);
+  expect((await request()).error).toBe("daemon_offline");
+  expect((await call(handlers().request_adopt_node, { node_id: CHILD, daemon_node_id: "other_network_daemon", workdir: "/workspace/project" })).error).toBe("daemon_not_found");
+});
+test("network boundaries apply to both human request and daemon pull/ack", async () => {
+  const r = await request(); expect(r.ok).toBe(true);
+  db.run("UPDATE node_daemon_bindings SET network_id='net_other_adoption_test' WHERE request_id=?1", [r.request_id]);
+  try {
+    const d = handlers("daemon");
+    expect((await call(d.get_adopt_request, { request_id: r.request_id })).error).toBe("request_not_found");
+    expect((await call(d.ack_adopt_request, { request_id: r.request_id, status: "adopted" })).error).toBe("request_not_found");
+  } finally { db.run("UPDATE node_daemon_bindings SET network_id=?1 WHERE request_id=?2", [NET, r.request_id]); }
+  db.run("UPDATE nodes SET network_id='net_other_adoption_test' WHERE node_id=?1", [DAEMON]);
+  try { expect((await request()).error).toBe("daemon_not_found"); }
+  finally { db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2", [NET, DAEMON]); }
+  db.run("UPDATE nodes SET network_id='net_other_adoption_test' WHERE node_id=?1", [CHILD]);
+  try { expect((await request()).error).toBe("adopt_forbidden"); }
+  finally { db.run("UPDATE nodes SET network_id=?1 WHERE node_id=?2", [NET, CHILD]); }
+});

package/src/node-daemon-bindings.ts

@@ -0,0 +1,130 @@
+import { db, uuidv4 } from "./db.js";
+import { getUserNetworkRole } from "./auth.js";
+import { pushEvent } from "./push.js";
+import { canRestWriteNetwork } from "./network-scope.js";
+import { parseDbTimestampMs } from "./db-timestamp.js";
+
+type Node = { node_id: string; alias: string; network_id: string; owner_user_id: string | null; hostname: string | null; config_snapshot: string | null };
+type Binding = { request_id: string; network_id: string; node_id: string; daemon_node_id: string; workdir: string; requested_by: string; status: string; error: string | null };
+type Human = { userId?: string | null; networkId?: string | null; isNode: boolean; canWrite: (networkId: string) => boolean };
+type Daemon = { ok: true; daemonNodeId: string; networkId: string } | { ok: false; error: string };
+const fail = (error: string) => ({ ok: false as const, error });
+const snapshot = (node: Node) => {
+  try { const value = JSON.parse(node.config_snapshot || "{}"); return value && typeof value === "object" && !Array.isArray(value) ? value : {}; }
+  catch { return {}; }
+};
+
+export function createdDaemon(nodeId: string): string | null {
+  if (!nodeId.startsWith("node_")) return null;
+  return db.get<{ daemon_node_id: string }>("SELECT daemon_node_id FROM node_create_requests WHERE request_id=?1", `cr_${nodeId.slice(5)}`)?.daemon_node_id ?? null;
+}
+export function activeBinding(nodeId: string): Binding | null {
+  return db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status='active'", nodeId);
+}
+export function resolveManagedDaemon(nodeId: string): string | null {
+  return createdDaemon(nodeId) ?? activeBinding(nodeId)?.daemon_node_id ?? null;
+}
+function humanNode(ctx: Human, nodeId: string): Node | null {
+  if (ctx.isNode || !ctx.userId) return null;
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", nodeId);
+  if (!node || (ctx.networkId && ctx.networkId !== node.network_id) || !ctx.canWrite(node.network_id)) return null;
+  const role = getUserNetworkRole(ctx.userId, node.network_id);
+  return node.owner_user_id === ctx.userId || role === "owner" || role === "admin" ? node : null;
+}
+function audit(binding: Binding, action: string, actor: string) {
+  db.run(`INSERT INTO audit_log(user_id,action,target_type,target_id,detail,network_id)
+    VALUES(?1,?2,'node_daemon_binding',?3,?4,?5)`,
+  [actor, action, binding.request_id, JSON.stringify({ node_id: binding.node_id, daemon_node_id: binding.daemon_node_id }), binding.network_id]);
+}
+function daemonReady(daemon: Node | null, node: Node): string | null {
+  if (!daemon || daemon.network_id !== node.network_id) return "daemon_not_found";
+  const snap = snapshot(daemon);
+  if (snap.role !== "host_supervisor" || snap.daemon_capabilities?.adopt_capable !== true) return "daemon_not_adopt_capable";
+  if (!node.hostname || daemon.hostname !== node.hostname) return "hostname_mismatch";
+  const session = db.get<{ last_seen_at: string }>(`SELECT last_seen_at FROM sessions WHERE alias=?1 AND network_id=?2`, daemon.alias, daemon.network_id);
+  const seen = parseDbTimestampMs(session?.last_seen_at ?? "");
+  if (!Number.isFinite(seen) || Date.now() - seen > 300_000) return "daemon_offline";
+  const token = db.get(`SELECT token_id FROM api_tokens WHERE name=?1 AND network_id=?2 AND revoked_at IS NULL`, `node:${daemon.alias}`, daemon.network_id);
+  return token ? null : "daemon_offline";
+}
+
+export function requestAdopt(ctx: Human, args: { node_id: string; daemon_node_id: string; workdir: string }) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, args.node_id);
+  if (!node) return fail("adopt_forbidden");
+  if (snapshot(node).role === "host_supervisor") return fail("cannot_adopt_daemon");
+  if (createdDaemon(node.node_id)) return fail("node_already_managed");
+  if (!args.workdir.trim() || /[\x00-\x1f]/.test(args.workdir)) return fail("invalid_workdir");
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", args.daemon_node_id);
+  const refused = daemonReady(daemon, node);
+  if (refused) return fail(refused);
+  const now = Date.now();
+  const binding: Binding = { ...args, request_id: `adopt_${uuidv4()}`, network_id: node.network_id, requested_by: ctx.userId, status: "pending", error: null };
+  const inserted = db.transaction(() => {
+    const result = db.run(`INSERT INTO node_daemon_bindings(request_id,network_id,node_id,daemon_node_id,workdir,requested_by,status,created_at,updated_at)
+      VALUES(?1,?2,?3,?4,?5,?6,'pending',?7,?7) ON CONFLICT DO NOTHING`,
+    [binding.request_id, binding.network_id, node.node_id, args.daemon_node_id, args.workdir, ctx.userId, now]);
+    if (!result.changes) return false;
+    audit(binding, node.owner_user_id === ctx.userId ? "adopt_requested" : "adopt_by_admin", ctx.userId!);
+    return true;
+  });
+  if (!inserted) return fail("node_already_managed");
+  pushEvent(daemon!.alias, { type: "adopt_node", request_id: binding.request_id }, node.network_id);
+  return { ok: true, request_id: binding.request_id, status: "pending" };
+}
+
+function daemonBinding(caller: Daemon, requestId: string): Binding | null {
+  if (!caller.ok) return null;
+  return db.get<Binding>(`SELECT * FROM node_daemon_bindings WHERE request_id=?1 AND daemon_node_id=?2 AND network_id=?3`, requestId, caller.daemonNodeId, caller.networkId);
+}
+export function getAdopt(caller: Daemon, requestId: string) {
+  if (!caller.ok) return fail(caller.error);
+  const binding = daemonBinding(caller, requestId);
+  if (!binding) return fail("request_not_found");
+  if (binding.status !== "pending") return fail("request_not_pending");
+  const node = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.node_id, binding.network_id);
+  if (!node) return fail("node_not_found");
+  return { ok: true, ...binding, alias: node.alias };
+}
+export function ackAdopt(caller: Daemon, args: { request_id: string; status: "adopted" | "refused"; error?: string }) {
+  if (!caller.ok) return fail(caller.error);
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const binding = daemonBinding(caller, args.request_id);
+  if (!binding) return fail("request_not_found");
+  return db.transaction(() => {
+    // Ownership/membership can change while local verification is in flight.
+    if (args.status === "adopted") {
+      const requester: Human = { userId: binding.requested_by, networkId: binding.network_id, isNode: false,
+        canWrite: networkId => canRestWriteNetwork({ userId: binding.requested_by, networkId: null }, networkId, false) };
+      const node = humanNode(requester, binding.node_id);
+      if (!node || createdDaemon(binding.node_id)) return fail("adopt_forbidden");
+      const refusal = daemonReady(db.get<Node>("SELECT * FROM nodes WHERE node_id=?1", binding.daemon_node_id), node);
+      if (refusal) return fail(refusal);
+    }
+    const changed = db.run(`UPDATE node_daemon_bindings SET status=?1,error=?2,updated_at=?3 WHERE request_id=?4 AND status='pending'`,
+      [args.status === "adopted" ? "active" : "refused", args.error ?? null, Date.now(), args.request_id]);
+    if (!changed.changes) return fail("request_not_pending");
+    audit(binding, `adopt_${args.status}`, caller.daemonNodeId);
+    return { ok: true, status: args.status === "adopted" ? "active" : "refused" };
+  });
+}
+export function unadopt(ctx: Human, nodeId: string) {
+  if (ctx.isNode || !ctx.userId) return fail("user_token_required");
+  if (db.transactionalFeaturesRefusal) return fail("atomic_transactions_required");
+  const node = humanNode(ctx, nodeId);
+  if (!node) return fail("adopt_forbidden");
+  const binding = db.get<Binding>("SELECT * FROM node_daemon_bindings WHERE node_id=?1 AND status IN ('pending','active')", nodeId);
+  if (!binding) return fail("binding_not_found");
+  // Do not reassign authority while a daemon may already be executing a lifecycle command.
+  for (const table of ["node_stop_requests", "node_start_requests"]) {
+    if (db.get(`SELECT request_id FROM ${table} WHERE child_node_id=?1 AND network_id=?2 AND status IN ('pending','delivered')`, nodeId, node.network_id)) return fail("node_lifecycle_in_flight");
+  }
+  db.transaction(() => {
+    db.run("UPDATE node_daemon_bindings SET status='revoked',updated_at=?1 WHERE request_id=?2", [Date.now(), binding.request_id]);
+    audit(binding, "unadopted", ctx.userId!);
+  });
+  const daemon = db.get<Node>("SELECT * FROM nodes WHERE node_id=?1 AND network_id=?2", binding.daemon_node_id, node.network_id);
+  if (daemon) pushEvent(daemon.alias, { type: "unadopt_node", node_id: nodeId, request_id: binding.request_id }, node.network_id);
+  return { ok: true, status: "revoked" };
+}

package/src/node-health-codex-login.test.ts

@@ -0,0 +1,120 @@
+// #594 step 1 — report_status.health.codex_login (non-secret codex login fingerprint +
+// "shared with N other nodes on this host"). Additive on the #448 health channel.
+//
+// 跑法：cd server && COMMHUB_DB=/tmp/node-health-codex-login.db bun test src/node-health-codex-login.test.ts
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { clearNodeHealthStore, readNodeHealth } from "./node-health-store.js";
+import { degradedLayers } from "./node-health-guard.js";
+
+const NET = "net_health_codex_login_t";
+const OWNER = "u_hcl_owner";
+const NODE_A = "hcl-node-a";
+const NODE_B = "hcl-node-b";
+const NODE_A_ID = "node_hcl_a";
+const NODE_B_ID = "node_hcl_b";
+const T_A = "tok_hcl_node_a";
+const T_B = "tok_hcl_node_b";
+
+function cleanup() {
+  for (const t of ["sessions", "nodes", "api_tokens", "network_members", "networks"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [OWNER]); } catch {}
+  clearNodeHealthStore();
+}
+function seed() {
+  db.run(`INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?2, 'x', 'user', datetime('now'))`, [OWNER, OWNER]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?2, ?3, datetime('now'))`, [NET, NET, OWNER]);
+  db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [OWNER, NET]);
+  for (const [id, alias, tok] of [[NODE_A_ID, NODE_A, T_A], [NODE_B_ID, NODE_B, T_B]]) {
+    db.run(`INSERT INTO nodes (node_id, node_name, alias, network_id, owner_user_id, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'), datetime('now'))`, [id, alias, alias, NET, OWNER]);
+    db.run(`INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at, bound_node_id) VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL, ?6)`, [tok, OWNER, NET, `node:${alias}`, `hash_${tok}`, id]);
+  }
+}
+
+async function connectAs(alias: string, tokenId: string) {
+  const server = new McpServer({ name: "health-test", version: "1" });
+  registerTools(server, undefined, NET, OWNER, alias, true, tokenId);
+  const client = new Client({ name: "health-client", version: "1" });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  await server.connect(st);
+  await client.connect(ct);
+  const call = async (args: Record<string, unknown>) => {
+    const r: any = await client.callTool({ name: "report_status", arguments: args });
+    return { isError: r.isError === true, body: JSON.parse(r.content?.[0]?.text ?? "null") };
+  };
+  return { call, close: async () => { await client.close(); await server.close(); } };
+}
+
+const LOGIN = { fingerprint: "1a2b3c4d", shared_with: 2, shared_home_with: 1, codex_home: "/srv/ws/.anet/nodes/a/codex-home" };
+
+beforeEach(() => { cleanup(); seed(); });
+afterAll(cleanup);
+
+describe("#594 report_status.health.codex_login passthrough", () => {
+  test("well-formed codex_login is kept next to the #448 layers and readable", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { bridge: "ok", model_auth: "ok", codex_login: LOGIN } });
+      expect(r.isError).toBe(false);
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual(LOGIN);
+  });
+
+  test("codex_login alone (codex-sdk runtime, no #448 monitor) is accepted", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: { fingerprint: "deadbeef", shared_with: 0 } } });
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual({ fingerprint: "deadbeef", shared_with: 0 });
+  });
+
+  test("🔴 a shared login is NOT a degraded layer — dispatch must not refuse because of it", () => {
+    expect(degradedLayers({ bridge: "ok", model_auth: "ok", codex_login: LOGIN } as any)).toEqual([]);
+  });
+
+  test("🔴 anything that is not an 8-hex fingerprint is dropped (a token pasted there never gets stored), report still accepted", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    const bads = [
+      { fingerprint: "FAKE-REFRESH-TOKEN-should-never-be-stored", shared_with: 1 },
+      { fingerprint: "a".repeat(64), shared_with: 1 },
+      { fingerprint: "1A2B3C4D", shared_with: 1 },
+      { fingerprint: "1a2b3c4d", shared_with: -1 },
+      { fingerprint: "1a2b3c4d", shared_with: 1.5 },
+      { fingerprint: "1a2b3c4d" },
+      "1a2b3c4d",
+    ];
+    try {
+      for (const bad of bads) {
+        const r = await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { bridge: "ok", model_auth: "ok", codex_login: bad } });
+        expect(r.isError).toBe(false);
+        const h = readNodeHealth(NET, NODE_A)?.health;
+        expect(h?.model_auth).toBe("ok");
+        expect(h?.codex_login).toBeUndefined();
+        expect(JSON.stringify(h)).not.toContain("FAKE-REFRESH-TOKEN");
+      }
+    } finally { await a.close(); }
+    expect(db.get<{ s: string }>("SELECT status AS s FROM sessions WHERE alias = ?1 AND network_id = ?2", NODE_A, NET)?.s).toBe("idle");
+  });
+
+  test("bad optional sub-fields degrade alone: control characters in codex_home are dropped, the rest kept", async () => {
+    const a = await connectAs(NODE_A, T_A);
+    try {
+      await a.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: { fingerprint: "1a2b3c4d", shared_with: 1, shared_home_with: "x", codex_home: "/x\n; rm -rf /" } } });
+    } finally { await a.close(); }
+    expect(readNodeHealth(NET, NODE_A)?.health.codex_login).toEqual({ fingerprint: "1a2b3c4d", shared_with: 1 });
+  });
+
+  test("another node's token cannot set this node's codex_login", async () => {
+    const b = await connectAs(NODE_B, T_B);
+    try {
+      await b.call({ resume_id: `sdk-${NODE_A_ID}`, alias: NODE_A, status: "idle", node_id: NODE_A_ID, health: { codex_login: LOGIN } });
+    } finally { await b.close(); }
+    expect(readNodeHealth(NET, NODE_A)).toBeNull();
+  });
+});

package/src/node-health-store.ts

@@ -27,9 +27,35 @@ export const nodeHealthSchema = z.object({
     reason: z.string().max(40),
   }).optional().catch(undefined),
   model_auth: z.enum(["ok", "revoked", "expired", "unknown"]).optional().catch(undefined),
+  // #594 —— codex 节点的登录指纹 + 本机另有几台节点持有同一份登录(见下方 codexLoginSchema)。
+  // 🔴 线上 schema 故意是 unknown:report_status 的 JSON schema 每个节点每次 tools/list 都要下发,
+  //    #476 给它定了字节上限(tool-audience-http.test.ts)。严格校验在 recordNodeHealth 里做,效果相同:
+  //    不合规 → 这一格当没报,整份 report 照收。
+  codex_login: z.unknown().optional(),
 }).optional().catch(undefined);
 
-export type NodeHealth = NonNullable<z.infer<typeof nodeHealthSchema>>;
+// #594 —— health.codex_login 的严格形状。纯展示/提示,**不是** degraded 层:共用登录今天还能跑,
+// 只是迟早互相顶掉(#1918);派发不因它拒绝。fingerprint 必须是 8 位小写 hex(sha256(refresh_token)
+// 截断,不是凭据)—— 节点误把 token 塞进来也存不下;计数是小的非负整数;codex_home 是节点自己的路径
+// (给客户端拼 `CODEX_HOME=<codex_home> codex login --device-auth`),拒控制字符。
+// 可选格各自降级;必需格(fingerprint / shared_with)不合规 → 整格丢弃。
+export const codexLoginSchema = z.object({
+  fingerprint: z.string().regex(/^[0-9a-f]{8}$/),
+  shared_with: z.number().int().min(0).max(100_000),
+  shared_home_with: z.number().int().min(0).max(100_000).optional().catch(undefined),
+  codex_home: z.string().max(1024).regex(/^[^\u0000-\u001f\u007f]*$/).optional().catch(undefined),
+});
+export type CodexLoginHealth = z.infer<typeof codexLoginSchema>;
+
+export type NodeHealth = Omit<NonNullable<z.infer<typeof nodeHealthSchema>>, "codex_login"> & { codex_login?: CodexLoginHealth };
+
+/** 线上收到的 health → 存的那份:codex_login 按严格形状过一遍,不合规就去掉这一格。 */
+export function normalizeNodeHealth(raw: NonNullable<z.infer<typeof nodeHealthSchema>>): NodeHealth {
+  const { codex_login: rawLogin, ...rest } = raw;
+  if (rawLogin === undefined) return rest;
+  const parsed = codexLoginSchema.safeParse(rawLogin);
+  return parsed.success ? { ...rest, codex_login: parsed.data } : rest;
+}
 
 const store = new Map<string, { health: NodeHealth; at: number }>();
 const keyOf = (networkId: string | null | undefined, alias: string) => `${networkId ?? "default"}\0${alias}`;
@@ -48,9 +74,12 @@ export function nodeHealthNextExpiryAt(now = Date.now()): number {
   return next;
 }
 
-export function recordNodeHealth(networkId: string | null | undefined, alias: string, health: NodeHealth, now = Date.now()): void {
+export function recordNodeHealth(
+  networkId: string | null | undefined, alias: string,
+  health: NodeHealth | NonNullable<z.infer<typeof nodeHealthSchema>>, now = Date.now(),
+): void {
   version++;
-  store.set(keyOf(networkId, alias), { health, at: now });
+  store.set(keyOf(networkId, alias), { health: normalizeNodeHealth(health), at: now });
   // 有界:按 TTL 顺手清掉过期的,别让改过名/删掉的节点在内存里攒着。
   if (store.size > 256) {
     for (const [k, v] of store) if (now - v.at > NODE_HEALTH_TTL_MS) store.delete(k);

package/src/node-id-alias.test.ts

@@ -168,7 +168,9 @@ describe("app#196 —— 「解析不到 daemon」的两种情况必须给不同
     const r = await call("stop_node", { node_id: DAEMON_CHILD });
     expect(r.ok).toBe(false);
     expect(r.error).toBe("daemon_not_resolvable");
-    expect(r.message).toContain("pass daemon_node_id explicitly");
+    // Board #625: an explicit daemon id no longer substitutes for authority.
+    expect(r.message).not.toContain("pass daemon_node_id explicitly");
+    expect(r.message).toContain("adopt this node");
   });
 
   test("delete_node 走同一条判别(两个调用点不能只改一个)", async () => {

package/src/node-lifecycle-controllable.ts

@@ -24,8 +24,10 @@ export function childNodeIdForCreateRequest(requestId: unknown): string | null {
 /** 由创建记录建出「child node_id → daemon node_id」的映射。 */
 export function buildControllableMap(
   createRequests: Array<{ request_id?: unknown; daemon_node_id?: unknown }>,
+  bindings: Array<{ node_id: string; daemon_node_id: string }> = [],
 ): Map<string, string> {
   const m = new Map<string, string>();
+  for (const binding of bindings) m.set(binding.node_id, binding.daemon_node_id);
   for (const cr of createRequests) {
     const child = childNodeIdForCreateRequest(cr?.request_id);
     if (!child) continue;

package/src/node-permissions.ts

@@ -220,6 +220,8 @@ export const NODE_TOOL_CLASS: Readonly<Record<string, ToolClass>> = {
   get_create_request: "always", ack_create_request: "always", get_stop_request: "always", ack_stop_request: "always",
   get_start_request: "always", ack_start_request: "always", get_probe_request: "always", ack_probe_request: "always",
   list_my_pending_create_requests: "always", list_my_pending_lifecycle_requests: "always", list_my_children: "always",
+  request_adopt_node: "human_only", unadopt_node: "human_only",
+  get_adopt_request: "always", ack_adopt_request: "always",
   send_desktop_message: "always", // 发给人的私信,不是派活
   // 读
   get_all_status: "read", get_session_status: "read", get_task: "read", list_tasks: "read", get_completions: "read",

package/src/runtime-readiness.ts

@@ -0,0 +1,83 @@
+// #622 —— daemon 逐 runtime 自检结果(`config_snapshot.daemon_capabilities.runtime_readiness`)。
+//
+// 上报侧:agent-node/src/runtime/runtime-readiness.ts。这里两件事:
+//   1. report_status 的 zod 形状 —— **收得宽**:任何一格坏都只丢这一格(或整个
+//      runtime_readiness),绝不拒掉整份 report(同 create_capability_observed_ms_ago
+//      的教训:zod 对象里一个已知字段验证失败 = 整份被拒 = 节点在 hub 上失联)。
+//   2. /api/host-supervisors 读取时再消毒一次(库里可能存着任何旧形状)。
+//
+// 向后兼容:旧 daemon 不报 ⇒ 响应里**没有**这个键(不是 {}、不是 null)。
+
+import { z } from "zod/v4";
+
+export const READINESS_STATES = ["ready", "missing_cli", "not_logged_in", "no_network", "unknown"] as const;
+export type ReadinessState = typeof READINESS_STATES[number];
+
+const MAX_RUNTIMES = 16;
+const MAX_REASON = 600;
+
+const MAX_JSON_BYTES = 16 * 1024;
+
+/** report_status 里 `daemon_capabilities.runtime_readiness` 的 schema。永不拒整份 report。
+ *
+ *  🔴 故意只验外形(对象、键数、总字节),逐格消毒放在读取侧 `sanitizeRuntimeReadiness`:
+ *     这份 schema 会进每个节点的 `tools/list`(#476 按角色的字节天花板),逐字段声明
+ *     一遍要多花 ~500 B;而读取侧本来就必须再消毒一次(库里可能存着任何旧形状)。
+ *     总字节上限挡住一个异常 daemon 往库里塞大对象。 */
+export const runtimeReadinessSchema = z
+  .record(z.string().max(64), z.record(z.string(), z.unknown()))
+  .refine((r) => Object.keys(r).length <= MAX_RUNTIMES && JSON.stringify(r).length <= MAX_JSON_BYTES)
+  .optional()
+  .catch(undefined);
+
+export interface RuntimeReadinessOut {
+  ok: boolean;
+  state: ReadinessState;
+  reason: string;
+  version?: string;
+  checked_at?: string;
+  cli?: string;
+  auth?: string;
+  network?: string;
+  shared_login_count?: number;
+}
+
+const ENUMS: Record<string, readonly string[]> = {
+  cli: ["found", "missing", "bundled", "unknown"],
+  auth: ["present", "absent", "not_required", "unknown"],
+  network: ["reachable", "unreachable", "skipped"],
+};
+
+/** 读取侧消毒。返回 undefined 表示「daemon 没报」—— 调用方据此**不输出**这个键。 */
+export function sanitizeRuntimeReadiness(raw: unknown): Record<string, RuntimeReadinessOut> | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const out: Record<string, RuntimeReadinessOut> = {};
+  let n = 0;
+  for (const [rt, v] of Object.entries(raw as Record<string, unknown>)) {
+    if (n >= MAX_RUNTIMES) break;
+    if (typeof rt !== "string" || rt.length === 0 || rt.length > 64) continue;
+    if (!v || typeof v !== "object" || Array.isArray(v)) continue;
+    const e = v as Record<string, unknown>;
+    const state: ReadinessState = (READINESS_STATES as readonly string[]).includes(e.state as string)
+      ? e.state as ReadinessState
+      : "unknown";
+    const entry: RuntimeReadinessOut = {
+      // ok 只在 state=ready 时可能为真:不让一个自相矛盾的上报朝「没问题」方向错。
+      ok: e.ok === true && state === "ready",
+      state,
+      reason: typeof e.reason === "string" ? e.reason.slice(0, MAX_REASON) : "",
+    };
+    if (typeof e.version === "string" && e.version.length > 0) entry.version = e.version.slice(0, 64);
+    if (typeof e.checked_at === "string" && e.checked_at.length > 0) entry.checked_at = e.checked_at.slice(0, 40);
+    for (const k of ["cli", "auth", "network"] as const) {
+      if (typeof e[k] === "string" && ENUMS[k].includes(e[k] as string)) entry[k] = e[k] as string;
+    }
+    if (typeof e.shared_login_count === "number" && Number.isInteger(e.shared_login_count)
+        && e.shared_login_count >= 0 && e.shared_login_count <= 100_000) {
+      entry.shared_login_count = e.shared_login_count;
+    }
+    out[rt] = entry;
+    n++;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}

package/src/server.ts

@@ -1,4 +1,5 @@
 import { buildServeErrorResponse } from "./serve-error.js";
+import { sanitizeRuntimeReadiness } from "./runtime-readiness.js";
 import { markGzipReusable, maybeGzipResponse, trimLightTask } from "./http-gzip";
 import { ifNoneMatchHits, memoStatusBody } from "./status-read-cache";
 import { dispatchQueueInfo, queueDepthByNode, queueDepthKey } from "./task-queue-ahead.js";
@@ -4474,6 +4475,7 @@ return Bun.serve({
           // 🔴 不是 clamp 成边界值:clamp 会把一个坏值变成一个**看起来正常的年龄**,
           //    而这一格存在的全部意义就是让人分辨新鲜和陈旧。
           let snapObservedMsAgo: number | undefined;
+          let snapReadiness: ReturnType<typeof sanitizeRuntimeReadiness>;
           if (r.config_snapshot) {
             try {
               const parsed = typeof r.config_snapshot === "string" ? JSON.parse(r.config_snapshot) : r.config_snapshot;
@@ -4491,13 +4493,15 @@ return Bun.serve({
                   && rawAge >= 0 && rawAge <= 365 * 24 * 60 * 60 * 1000) {
                 snapObservedMsAgo = rawAge;
               }
+              // #622 —— 逐 runtime 就绪度;旧 daemon 不报 ⇒ undefined ⇒ 响应里没有这个键。
+              snapReadiness = sanitizeRuntimeReadiness(caps?.runtime_readiness);
             } catch { /* malformed */ }
           }
           return { row: r, role: snapRole, canCreate: snapCanCreate, blockedReason: snapBlockedReason,
-            observedMsAgo: snapObservedMsAgo };
+            observedMsAgo: snapObservedMsAgo, readiness: snapReadiness };
         })
         .filter(({ role }) => role === "host_supervisor")
-        .map(({ row: r, canCreate, blockedReason, observedMsAgo }) => {
+        .map(({ row: r, canCreate, blockedReason, observedMsAgo, readiness }) => {
           let online = false;
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
@@ -4562,6 +4566,10 @@ return Bun.serve({
               out.create_capability_observed_ms_ago = observedMsAgo;
             }
           }
+          // #622 —— 逐 runtime 实测就绪度(CLI / 登录存在性 / 网络 / codex 共享登录数)。
+          // 只在 daemon 真的报了时出现;**不影响** can_create_nodes(旧 app 依赖它的语义)。
+          // 内容不含路径与凭据(上报侧只发存在性 + 版本号 + 通用修法),所以不按角色脱敏。
+          if (readiness) out.runtime_readiness = readiness;
           // app「新建节点」确认页的默认工作目录根。出现即表示该 daemon 认 node_spec.workdir;
           // 缺席(老 daemon / 老 hub 的 zod 剥掉了它)时 app 藏起那一行、不发 workdir。
           // 🔴 它是那台机器的家目录路径 —— 与 ip_internal 同级,只给 admin/owner。
@@ -4628,7 +4636,10 @@ return Bun.serve({
           const crParams: any[] = [];
           let crSql = "SELECT request_id, daemon_node_id FROM node_create_requests WHERE 1=1";
           crSql = addNetworkScope(crSql, crParams, restScope);
-          return buildControllableMap(db.all<Record<string, any>>(crSql, ...crParams));
+          const bindingParams: any[] = [];
+          const bindingSql = addNetworkScope("SELECT node_id,daemon_node_id FROM node_daemon_bindings WHERE status='active'", bindingParams, restScope);
+          return buildControllableMap(db.all<Record<string, any>>(crSql, ...crParams),
+            db.all<{ node_id: string; daemon_node_id: string }>(bindingSql, ...bindingParams));
         } catch {
           // 表不存在/查询失败 ⇒ 全部按不可控处理,不让这一格拖垮整个列表
           return new Map<string, string>();

package/src/stop-delete-node.test.ts

@@ -184,6 +184,12 @@ function setupAlphaNetwork() {
   seedMembership(USER_A_ID, NET_A, "admin");
   seedDaemon(NET_A, DAEMON_A_ID, DAEMON_A_ALIAS, USER_A_ID, DAEMON_A_TOK);
   seedChild(NET_A, CHILD_A_ID, CHILD_A_ALIAS, USER_A_ID, CHILD_TOK_A_ID);
+  // Board #625: happy paths must carry actual creation authority, not merely a node_ id.
+  db.run(
+    `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
+     VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
+    [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
+  );
 }
 
 // ── stop_node ──────────────────────────────────────────────────────
@@ -418,12 +424,7 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
   // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。
   test("#1448 finding-4: stop/delete reject a wrong same-network daemon_node_id (daemon_child_mismatch)", async () => {
     setupAlphaNetwork();
-    // authority: CHILD_A 由 DAEMON_A 创建(resolveDaemonForChild 读 node_create_requests)
-    db.run(
-      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
-       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
-      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
-    );
+    // setupAlphaNetwork carries the creation authority.
     // 一个同网、存在、但没创建 CHILD_A 的 daemon
     const DAEMON_B = "node_sd_daemon_b";
     seedDaemon(NET_A, DAEMON_B, "sd-daemon-b", USER_A_ID, "tok_sd_daemon_b");
@@ -454,12 +455,7 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(readNode(HAND_ID)?.lifecycle_state).toBe("active");
     const rows = db.get<{ n: number }>(`SELECT COUNT(*) AS n FROM node_stop_requests WHERE child_node_id = ?1`, HAND_ID);
     expect(Number(rows?.n ?? 0)).toBe(0);
-    // 回归钉:daemon 建的 child(有 create 记录)照常可停
-    db.run(
-      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
-       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
-      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
-    );
+    // 回归钉:setupAlphaNetwork 中有 create 记录的 child 照常可停。
     expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, network_id: NET_A })).ok).toBe(true);
   });
 

package/src/tool-audience-http.test.ts

@@ -182,7 +182,9 @@ describe("what each caller sees", () => {
 describe("bytes per role (#476 ceilings stay meaningful per role)", () => {
   // 全部工具(= 改动前每个调用者拿到的)71–72 KB;改动后按角色。改数字时在 PR 里写为什么。
   // 量出来(#478 合入时):全部 74 个工具 71,559 B;节点 52 个 57,632 B(−19%);人 56 个 54,780 B(−23%)。留 ~1.5 KB 余量。
-  const CEILINGS = { node: 59_000, user: 56_500, all: 72_500 } as const;
+  // Board #625 adds 2 human tools + 2 hidden daemon protocol tools. Measured:
+  // all 78 / 73,969 B; user 58 / 56,615 B; node remains 52 / 58,320 B.
+  const CEILINGS = { node: 59_000, user: 57_500, all: 75_000 } as const;
   test("node / user / all", async () => {
     const node = await listTools(T.node_normal);
     const user = await listTools(T.owner);

package/src/tool-audience.ts

@@ -23,6 +23,8 @@ import { NODE_TOOL_CLASS, nodeIdentity, nodePermissionsFlag, broadcastVerdict, h
 export type ToolAudience = "both" | "node" | "protocol" | "user";
 
 export const TOOL_AUDIENCE: Readonly<Record<string, ToolAudience>> = {
+  request_adopt_node: "user", unadopt_node: "user",
+  get_adopt_request: "protocol", ack_adopt_request: "protocol",
   // ── 节点:用户令牌一律 network_token_required ──
   report_status: "node",
   // ── 协议:用户令牌一律 network_token_required / node_token_required / caller_not_a_daemon ──

package/src/tools.ts

@@ -1,7 +1,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { requestAdopt, getAdopt, ackAdopt, unadopt, resolveManagedDaemon, activeBinding, createdDaemon } from "./node-daemon-bindings.js";
+import { runtimeReadinessSchema } from "./runtime-readiness.js";
 import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
-import { nodeHealthSchema, recordNodeHealth } from "./node-health-store.js";
+import { nodeHealthSchema, normalizeNodeHealth, recordNodeHealth } from "./node-health-store.js";
 import { assertNodeHealthy } from "./node-health-guard.js";
 import { noteModelAuthHealth } from "./model-auth-notify.js";
 import { numberedAliasInClause, parseAliasFilter } from "./alias-filter.js";
@@ -806,6 +808,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         //    应当 hub 先合)。同一份 schema 里 side_thread_capability / external_schedules
         //    是 `.strict()` 的,后果不同 —— 见 `host:` 上方那段方框注释。
         daemon_capabilities: z.object({
+          adopt_capable: z.boolean().optional(),
           runtimes_supported: z.array(z.string().max(64)).max(16).optional(),
           allowed_secret_keys: z.array(z.string().max(64)).max(64).optional(),
           max_concurrent_children: z.number().int().min(1).max(1000).optional(),
@@ -880,6 +883,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           // `.catch(undefined)`:同上一格的立场 —— 一个诊断/展示字段不许拒掉整份 report。
           // 读取侧再按形状消毒(create-node-validate.ts daemonDefaultWorkdirRoot)。
           default_workdir_root: z.string().max(1024).optional().catch(undefined),
+          // #622 —— 逐 runtime 实测就绪度。收得宽、坏了只丢这一格(见 runtime-readiness.ts)。
+          runtime_readiness: runtimeReadinessSchema,
         }).optional(),
       }).optional().describe("RFC-024 — masked node config snapshot"),
       // app#225 follow-up — the reporting process answers the `rules_file`
@@ -1153,7 +1158,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // #448 — only the node token bound to this alias may speak for its health
       // (same rule as the *_capable flags above).
       const acceptedHealth = nodeHealth && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias
-        ? nodeHealth
+        ? normalizeNodeHealth(nodeHealth) // #594 — strict codex_login shape (the wire schema is loose on purpose)
         : undefined;
       if (acceptedHealth) {
         recordNodeHealth(sessionNetId, effectiveAlias, acceptedHealth);
@@ -4655,55 +4660,22 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     delete_config: boolean;
     confirm_alias?: string;
   };
-  // RFC-027 PR2 prereq — auto-resolve daemon_node_id from child_node_id.
-  // The dashboard (and most callers of stop_node / delete_node) shouldn't
-  // need to track the daemon→child mapping themselves; the hub has it on
-  // node_create_requests at child creation time. Returns null when no
-  // creation record exists (orphan node row OR pre-RFC-026 node) — caller
-  // must then pass daemon_node_id explicitly. node_id derivation:
-  // `node_${request_id.replace(/^cr_/,"")}` (see create-node-daemon.ts
-  // and PR1 BLOCKER-1 fix), so we reverse it: `cr_${node_id.slice(5)}`.
+  // Board #625: creation authority first, then an acknowledged adoption binding.
+  // Supplying a daemon id explicitly is routing, never proof of authority.
   const resolveDaemonForChild = (child_node_id: string): string | null => {
-    if (!child_node_id.startsWith("node_")) return null;
-    const requestId = `cr_${child_node_id.slice(5)}`;
-    const row = db.get<{ daemon_node_id: string }>(
-      `SELECT daemon_node_id FROM node_create_requests WHERE request_id = ?1`,
-      requestId,
-    );
-    return row?.daemon_node_id ?? null;
+    return resolveManagedDaemon(child_node_id);
   };
 
-  /**
-   * 为什么这里要分两种「解析不到 daemon」(#196 / app 仓)。
-   *
-   * `resolveDaemonForChild` 对两件完全不同的事都返回 `null`:
-   *   ① id 不以 `node_` 开头 —— 这个节点**根本不是 daemon 创建的**,
-   *      是有人在某台机器上直接 `anet node start` 起来的。hub 上没有任何
-   *      daemon 可以代它执行停止,**这条路径对它在概念上就不成立**。
-   *   ② id 以 `node_` 开头,但 `node_create_requests` 里查不到那一行 ——
-   *      它可能确实是 daemon 建的,只是记录缺失,这时「显式传 daemon_node_id」
-   *      是一条真的走得通的路。
-   *
-   * 🔴 原先两种情况打印同一句 `pass daemon_node_id explicitly`。对 ① 来说
-   *    **这句建议的前提是假的** —— 没有 daemon 可传,用户按它做只会走进死路。
-   *    2026-08-28 对生产 hub 实测:218 个节点里 **207 个**是 ① 这种。
-   *
-   * 信息在源头就存在(那个 `startsWith("node_")` 判断),只是被丢在了返回值里。
-   */
+  // Preserve old error codes for clients; both now require real managed authority.
   const explainUnresolvableDaemon = (child_node_id: string) =>
     child_node_id.startsWith("node_")
       ? {
           ok: false, error: "daemon_not_resolvable",
-          message: "no node_create_requests row found for this child_node_id; pass daemon_node_id explicitly",
+          message: "no creation authority or active adoption binding; adopt this node before remote stop/start",
         }
       : {
           ok: false, error: "not_daemon_managed",
-          message:
-            `node ${child_node_id} was not created by a daemon (it was started by hand with ` +
-            `\`anet node start\` on some machine), so no daemon on the Hub can stop it ` +
-            `(naming a daemon_node_id does not change that). ` +
-            `Run \`anet node stop <alias>\` on that machine instead. ` +
-            `Daemon-created children have ids beginning with \`node_\`; this one does not.`,
+          message: "node has no creation authority or active adoption binding; adopt it or run `anet node stop <alias>` on its host",
         };
 
   const dispatchStopOrDelete = (args: DispatchArgs, clientNetId?: string | null) => {
@@ -4818,27 +4790,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       return { ok: false, error: "daemon_cross_tenant", message: "daemon and child are in different networks" };
     }
 
-    // #1448 finding-4 — daemon 必须是该 child 的**权威创建者**,镜像 start_node 的
-    // daemon_child_mismatch。此前 stop/delete 接受调用方传入的 daemon_node_id,只校验
-    // 它存在 + 同网,不验它真的创建了这个 child。同网调用方传错 daemon_node_id → 门铃
-    // 路由到错 daemon。🔴 f3(#1453) 合入后更糟:错 daemon 无该 child 的 map entry → 走
-    // 收敛分支 sweep(错机器 pgrep 空) + ack stopped → hub 假收敛 stopped、child 仍在
-    // 正确机器上跑(旧 noop 至少留下可见的卡死态)。网络 scope 只挡跨租户,网内是 footgun。
-    //
-    // 用「确定性不匹配」判据:authority 已知(child 有 create 记录)且不等 → 拒。不对
-    // authority==null(create 记录被裁剪的旧 child)加拒,避免给它们的 stop/delete 引入
-    // 新失败面——handler 的 daemon_node_id??resolveDaemonForChild 已兜住无法解析的情形。
+    // Board #625 closes the missing-create-record exception, regardless of id prefix.
     const authoritativeDaemonId = resolveDaemonForChild(args.child_node_id);
-    // #571 — 手工起的节点(id 不以 `node_` 开头)**没有**任何 daemon 链接。此前
-    // authority==null 时放行调用方点名的任意同网 daemon → 门铃发给那台 daemon,
-    // 它本地没这个 child 的记录,会走「按 alias 全机 pgrep + SIGTERM」的收敛分支,
-    // 杀掉那台机器上所有同 alias 的 agent-node(不分工作目录/HOME/网络)。
-    // 对 hand-started 节点这条路在概念上就不成立(见 explainUnresolvableDaemon ①),
-    // 所以不管调用方传没传 daemon_node_id 一律拒。`node_` 开头但缺 create 记录的
-    // (②,显式传 daemon 是文档化的出路)保持原行为。
-    if (!authoritativeDaemonId && !args.child_node_id.startsWith("node_")) {
+    if (!authoritativeDaemonId) {
       return explainUnresolvableDaemon(args.child_node_id);
     }
+    if (args.action === "delete" && !createdDaemon(args.child_node_id) && activeBinding(args.child_node_id)) {
+      return { ok: false, error: "adopted_node_delete_unsupported" };
+    }
     if (authoritativeDaemonId && authoritativeDaemonId !== args.daemon_node_id) {
       return { ok: false, error: "daemon_child_mismatch", message: "daemon_node_id is not this child's authoritative creator daemon" };
     }
@@ -5462,15 +5421,49 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             AND COALESCE(n.lifecycle_state, 'active') NOT IN ('stopped', 'stop_failed')`,
         callerDaemon.daemonNodeId, callerDaemon.networkId,
       );
-      const children = rows.map(r => ({
+      const children: Array<{ child_node_id: string; alias: string; lifecycle_state: string; managed?: "adopted" }> = rows.map(r => ({
         child_node_id: r.child_node_id,
         alias: r.child_name,
         lifecycle_state: r.lifecycle_state ?? "active",
       }));
+      const adopted = db.all<{ node_id: string; alias: string; lifecycle_state: string | null }>(
+        `SELECT n.node_id,n.alias,n.lifecycle_state FROM node_daemon_bindings b
+         JOIN nodes n ON n.node_id=b.node_id AND n.network_id=b.network_id
+         WHERE b.daemon_node_id=?1 AND b.network_id=?2 AND b.status='active'`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      for (const n of adopted) children.push({ child_node_id: n.node_id, alias: n.alias, lifecycle_state: n.lifecycle_state ?? "active", managed: "adopted" });
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: children.length, children }) }] };
     },
   );
 
+  const adoptionHuman = () => ({ userId: enforceUserId, networkId: enforceNetworkId, isNode: callerTokenIsNetwork, canWrite });
+  const adoptionReply = (result: unknown) => ({ content: [{ type: "text" as const, text: JSON.stringify(result) }] });
+  server.tool(
+    "request_adopt_node",
+    "Human owner/admin requests adoption. Only the target capable daemon may activate the binding after local verification; no process is signalled.",
+    { node_id: z.string().min(1).max(200), daemon_node_id: z.string().min(1).max(200), workdir: z.string().min(1).max(4096) },
+    async args => adoptionReply(requestAdopt(adoptionHuman(), args)),
+  );
+  server.tool(
+    "get_adopt_request",
+    "Target daemon pulls a pending adoption request for local verification.",
+    { request_id: z.string().min(1).max(200) },
+    async ({ request_id }) => adoptionReply(getAdopt(resolveCallerDaemonTokenBound(), request_id)),
+  );
+  server.tool(
+    "ack_adopt_request",
+    "Target daemon confirms local registration or refuses adoption. Revoked requests cannot reactivate.",
+    { request_id: z.string().min(1).max(200), status: z.enum(["adopted", "refused"]), error: z.string().max(1000).optional() },
+    async args => adoptionReply(ackAdopt(resolveCallerDaemonTokenBound(), args)),
+  );
+  server.tool(
+    "unadopt_node",
+    "Human owner/admin revokes a pending or active binding without stopping the node.",
+    { node_id: z.string().min(1).max(200) },
+    async ({ node_id }) => adoptionReply(unadopt(adoptionHuman(), node_id)),
+  );
+
   // ── RFC-028 P1 — Provider & Model Registry + connectivity probe ──
   // Background timers (probe GC + sweeper) idempotent; safe to call
   // per registerTools.