@stigmer/server 3.15.3-dev.20260916211208 → 3.16.1-dev.20260917224426

package/dist/runnerauth/built-in-runner-credential-provider.js

@@ -0,0 +1,217 @@
+/**
+ * The built-in RunnerCredentialProvider — the open-source execution-scoped
+ * default (runner-credential-provider.ts) plus the three capabilities an
+ * ENFORCING self-host needs, composed under the built-in authorization
+ * posture beside the runner-subject verifier (boot/compose.ts). The
+ * cloud's shape, kept on purpose: one provider object carries the
+ * edition's whole credential story, so the composition root binds one
+ * thing and every OSS touchpoint that consults the seam sees the same
+ * policy. Mint, verify, isEnabled and the dispatch's `mintRunCredential`
+ * are the default provider's, byte for byte; under trusted-local the
+ * default alone is composed and none of what follows exists.
+ *
+ * ONE reading of "what is this runner bound to" — `runnerBindingOf` —
+ * feeds everything here and the Authorizer's lane admission
+ * (authorization/lane-admission.ts). It re-verifies the caller's own
+ * `rawToken` (the cloud's `verifiedClaims(caller.rawToken)` pattern: one
+ * HMAC, no store read) and reads the kind off the bound id's prefix
+ * through the contract's table (bound-execution.ts). It checks the
+ * caller CLASS first: the lane admission runs on every run-gate check
+ * for every caller, and only the runner-subject verifier mints `runner`,
+ * so a person costs nothing here. It never throws: a person, a runner
+ * holding no token, a token this server did not sign, or a binding that
+ * names no kind is simply "not a runner binding", and each caller
+ * answers its own default for that. A CONNECT binding (`mcp-connect`, a
+ * runner reading one discovery's secrets as the person who asked) IS a
+ * runner binding, and every capability below answers it by name: it is
+ * admitted on no run gate, vouches no lineage, captures no memory, and
+ * the exchange mints nothing for it.
+ *
+ * The capabilities, and where they follow or narrow the cloud:
+ *
+ *   - `vouchRunnerLineageLabels`: a WORKFLOW-bound runner vouches the two
+ *     lineage keys for its own workflow execution and REFUSES a stamp
+ *     naming another (the cloud's byte-pinned copy, constants.ts). Without
+ *     this, a self-host with sign-in on cannot run any workflow that
+ *     calls an agent: the child create's GuardReservedLabels asks the
+ *     Authorizer for `can_write_reserved_labels` on the platform object,
+ *     which the built-in Authorizer denies for everyone. NARROWER than the
+ *     cloud on purpose: the cloud vouches for every runner-class
+ *     credential and binds only its workflow lane; here an agent-bound
+ *     runner vouches nothing, because the workflow's `agent_call` activity
+ *     is the only producer of the lineage labels and it runs under the
+ *     workflow's credential (runner: activities/call-agent.ts). Nothing
+ *     observable diverges; do not widen this toward the cloud without a
+ *     producer that needs it.
+ *   - `authorizeMemoryCapture`: an AGENT-bound runner is ADMITTED with the
+ *     human the verifier resolved as the memory's subject — the row's one
+ *     principal under the model; without it every memory an enforcing
+ *     self-host writes belongs to nobody — and the run's session as the
+ *     proved provenance. The cloud reads both off its session-scoped
+ *     token; our token names only the execution, so this reads the row
+ *     (one primary-key read per `remember` call) and the seam allows the
+ *     promise. The cloud's org arm is kept: a capture addressed to an org
+ *     that is not the run's is "a forged address, not a routing choice"
+ *     (its byte-pinned copy). A workflow-bound runner is refused (the
+ *     cloud refuses every non-session lane); a person, or a runner whose
+ *     token does not verify, is no-opinion and the gate's own logic
+ *     applies. A run that has vanished between the verifier's read and
+ *     this one is refused: a memory the server cannot attribute to a run
+ *     must not be written as nobody's (fail closed).
+ *   - `exchangeScopedToken`: the platform exchange (getRunnerScopedToken)
+ *     becomes a MINT GATE. Under trusted-local the controller's own arms
+ *     mint a clocked decrypt-lane token for any caller naming an
+ *     execution, and that is harmless — the token unlocks a decrypt lane
+ *     and nothing more. Under this posture the same token IS an identity
+ *     (the verifier admits its bearer as the run's human), so minting
+ *     one for another person's run would be impersonation. The execution
+ *     arms therefore mint only for the run's own person — the account
+ *     the row's creator stamp resolves to, the same reading the verifier
+ *     makes — and mint the RUN credential (no `exp`; `expires_in_seconds`
+ *     0, the proto default), so under the posture there is one credential
+ *     shape and the exchange is the runner's true fallback for a dispatch
+ *     that carried none. The ladder is the platform's own: a row that
+ *     does not exist → NOT_FOUND with the load-first copy (what a `get`
+ *     on that id answers), a caller who is not the run's person, or a run
+ *     whose stamp names nobody → PERMISSION_DENIED with one sentence
+ *     (constants.ts). The id decides which execution kind is read (the
+ *     lane's rule everywhere); the request's arm only chooses the
+ *     not-found copy; an id that resolves to a CONNECT binding is
+ *     NOT_FOUND too, because the exchange mints run credentials and a
+ *     connect is not a run. Liveness is NOT judged at mint — both lanes that
+ *     accept the token judge it, by one rule (bound-execution.ts), and a
+ *     third judge here would be a divergence waiting to happen. The
+ *     pool-claim, renewal and unset arms answer not-minted, the
+ *     controller's arms verbatim; keyless answers not-minted too.
+ *
+ * Deliberately UNDEFINED here: `bootstrapCredentials`,
+ * `mintSandboxCredential`, `authorizeExecutionContextRead`,
+ * `resolvePayloadKey`. Their open-source arms stay where they are (the
+ * sandbox lane's mint, the decrypt lane's binding-equality decision);
+ * this provider adds policy an enforcing server lacks and takes over
+ * nothing that already works.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { accountForStamp } from "../domain/identityaccount/resolve.js";
+import { getKindName } from "../pipeline/apiresource-meta.js";
+import { notFoundError } from "../pipeline/errors.js";
+import { bindsARun, boundExecutionKindOf, loadBoundExecution, } from "./bound-execution.js";
+import { MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE, RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE, WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE, } from "./constants.js";
+import { newExecutionScopedRunnerCredentialProvider } from "./runner-credential-provider.js";
+/**
+ * The one reading of a runner's binding. `undefined` for anything that
+ * is not a runner-class caller holding a token this service signed whose
+ * binding names an execution kind; never a throw.
+ */
+export function runnerBindingOf(service, caller) {
+    if (caller.callerClass !== "runner" || caller.rawToken === "") {
+        return undefined;
+    }
+    let executionId;
+    try {
+        executionId = service.verify(caller.rawToken);
+    }
+    catch {
+        return undefined;
+    }
+    const kind = boundExecutionKindOf(executionId);
+    return kind === undefined ? undefined : { kind, executionId };
+}
+/** The lane-admission predicate: a runner acting for a WORKFLOW execution (the cloud's `workflow_sandbox`). */
+export function isWorkflowBoundRunner(service, caller) {
+    return runnerBindingOf(service, caller)?.kind === "workflow-execution";
+}
+/** The kind name the not-found copy carries, by the request's arm (what a `get` on that kind would say). */
+function requestedKindName(arm) {
+    switch (arm) {
+        case "agent-execution":
+            return getKindName(ApiResourceKind.agent_execution);
+        case "workflow-execution":
+            return getKindName(ApiResourceKind.workflow_execution);
+        default: {
+            const exhaustive = arm;
+            throw new Error(`unhandled exchange arm: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+export function newBuiltInRunnerCredentialProvider(deps) {
+    const { service, store, accounts } = deps;
+    const lane = newExecutionScopedRunnerCredentialProvider(service);
+    const mintRunCredential = lane.mintRunCredential.bind(lane);
+    return {
+        isEnabled: lane.isEnabled,
+        mint: lane.mint,
+        verify: lane.verify,
+        mintRunCredential,
+        async exchangeScopedToken(request, caller) {
+            switch (request.arm) {
+                case "agent-execution":
+                case "workflow-execution": {
+                    if (request.executionId === "" || !service.isEnabled()) {
+                        return { minted: false };
+                    }
+                    const execution = await loadBoundExecution(store, request.executionId);
+                    // A connect binding is not a run: the exchange mints RUN
+                    // credentials, and the requested kind's row does not exist.
+                    if (execution === undefined || !bindsARun(execution.kind)) {
+                        throw notFoundError(requestedKindName(request.arm), request.executionId);
+                    }
+                    const person = await accountForStamp(accounts, execution.createdBy);
+                    if (person === undefined ||
+                        person.metadata?.id !== caller.identityId) {
+                        throw new ConnectError(RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE, Code.PermissionDenied);
+                    }
+                    return {
+                        minted: true,
+                        token: mintRunCredential(execution.executionId),
+                        // No `exp` on a run credential; 0 is the proto default and
+                        // the runner's acquire sites read no expiry from it.
+                        expiresInSeconds: 0,
+                    };
+                }
+                case "pool-claim":
+                case "renewal":
+                case "unset":
+                    return { minted: false };
+                default: {
+                    const exhaustive = request;
+                    throw new Error(`unhandled exchange arm: ${JSON.stringify(exhaustive)}`);
+                }
+            }
+        },
+        vouchRunnerLineageLabels(caller, stampedWorkflowExecutionId) {
+            const binding = runnerBindingOf(service, caller);
+            if (binding?.kind !== "workflow-execution") {
+                return false;
+            }
+            if (stampedWorkflowExecutionId !== "" &&
+                stampedWorkflowExecutionId !== binding.executionId) {
+                throw new ConnectError(WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE, Code.InvalidArgument);
+            }
+            return true;
+        },
+        async authorizeMemoryCapture(caller, captureOrg) {
+            const binding = runnerBindingOf(service, caller);
+            if (binding === undefined) {
+                return { verdict: "no-opinion" };
+            }
+            if (binding.kind !== "agent-execution") {
+                return { verdict: "refuse" };
+            }
+            const execution = await loadBoundExecution(store, binding.executionId);
+            if (execution === undefined) {
+                return { verdict: "refuse" };
+            }
+            if (captureOrg !== "" && captureOrg !== execution.org) {
+                throw new ConnectError(MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE, Code.PermissionDenied);
+            }
+            return {
+                verdict: "admit",
+                subjectIdentityAccountId: caller.identityId,
+                provedSessionId: execution.sessionId,
+            };
+        },
+    };
+}
+//# sourceMappingURL=built-in-runner-credential-provider.js.map

package/dist/runnerauth/built-in-runner-credential-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/built-in-runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAGvE,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,yCAAyC,GAC1C,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,0CAA0C,EAAE,MAAM,iCAAiC,CAAC;AAkB7F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA0B,EAC1B,MAAsB;IAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,MAAsB;IAEtB,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,KAAK,oBAAoB,CAAC;AACzE,CAAC;AAED,4GAA4G;AAC5G,SAAS,iBAAiB,CACxB,GAA6C;IAE7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,iBAAiB;YACpB,OAAO,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACtD,KAAK,oBAAoB;YACvB,OAAO,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,GAAG,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAyC;IAEzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,0CAA0C,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB;QAEjB,KAAK,CAAC,mBAAmB,CACvB,OAAiC,EACjC,MAAsB;YAEtB,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;gBACpB,KAAK,iBAAiB,CAAC;gBACvB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;wBACvD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;oBAC3B,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,KAAK,EACL,OAAO,CAAC,WAAW,CACpB,CAAC;oBACF,yDAAyD;oBACzD,4DAA4D;oBAC5D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1D,MAAM,aAAa,CACjB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAC9B,OAAO,CAAC,WAAW,CACpB,CAAC;oBACJ,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;oBACpE,IACE,MAAM,KAAK,SAAS;wBACpB,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,MAAM,CAAC,UAAU,EACzC,CAAC;wBACD,MAAM,IAAI,YAAY,CACpB,sCAAsC,EACtC,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,MAAM,EAAE,IAAI;wBACZ,KAAK,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC;wBAC/C,2DAA2D;wBAC3D,qDAAqD;wBACrD,gBAAgB,EAAE,CAAC;qBACpB,CAAC;gBACJ,CAAC;gBACD,KAAK,YAAY,CAAC;gBAClB,KAAK,SAAS,CAAC;gBACf,KAAK,OAAO;oBACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC3B,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,OAAO,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB,CACtB,MAAsB,EACtB,0BAAkC;YAElC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,0BAA0B,KAAK,EAAE;gBACjC,0BAA0B,KAAK,OAAO,CAAC,WAAW,EAClD,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,sBAAsB,CAC1B,MAAsB,EACtB,UAAkB;YAElB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACnC,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CACpB,mCAAmC,EACnC,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,wBAAwB,EAAE,MAAM,CAAC,UAAU;gBAC3C,eAAe,EAAE,SAAS,CAAC,SAAS;aACrC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runnerauth/constants.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The runner-subject lane's pinned names and copy — the one constants
+ * module for the runner-credential domain (the ts-server guideline:
+ * byte-pinned copy lives in one constants module per domain, never
+ * inline at the refusal site).
+ *
+ * Two refusal sentences for a PRESENTED credential, deliberately not
+ * more (the InvalidTokenError doctrine of runnerauth.ts: a finer reason
+ * invites branching on it). The runner is the only caller that ever
+ * presents a run credential, and the person reading these is its
+ * operator, in the runner's log:
+ *
+ *   - the TOKEN sentence: the credential itself is not one this server
+ *     will honor — forged, the wrong shape, bound to an execution or a
+ *     connect this server does not have (a connect's row is gone once
+ *     the connect settles), a clockless token bound to a connect (a shape
+ *     no mint produces), a present `exp` in the past, or minted by a key
+ *     this server does not hold. A missing row is this sentence and not
+ *     NOT_FOUND on purpose: the credential is invalid, and the run is
+ *     not the caller's to learn about.
+ *   - the LIVENESS sentence: the credential is genuine but its run is
+ *     over, or its run or connect was created by nobody this server
+ *     recognizes as a person (the schedule fire caller's
+ *     deterministic-refusal shape: no retry will make that run anyone's).
+ *
+ * And one for a REQUESTED credential — the platform exchange under the
+ * built-in posture (built-in-runner-credential-provider.ts), where the
+ * caller is a signed-in person asking for a run's credential and the
+ * answer is a permission, not a token verdict: only the person whose run
+ * it is may hold its credential. A run whose creator stamp names nobody
+ * gets the same sentence — no one is its person.
+ *
+ * The lineage mismatch copy is the cloud edition's, transcribed byte for
+ * byte (credentials/provider.ts in the composition; the Java
+ * RecordRunnerLineageLabelsStep before it) so the two editions refuse a
+ * mis-stamped lineage label with one sentence.
+ */
+/** The verifier's name in the boot log and in auth failures (the `oidc` / `apikey` precedent). */
+export declare const RUNNER_VERIFIER_NAME = "runner";
+/** The token arms: forged, wrong shape, unknown execution, past `exp`, keyless. */
+export declare const RUNNER_CREDENTIAL_INVALID_MESSAGE = "runner credential is not valid on this server";
+/** The resolution arms: a terminal execution; a run stamped by nobody the server recognizes. */
+export declare const RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE = "runner credential names a run that is over or belongs to nobody this server recognizes";
+/** The exchange's refusal under the built-in posture: the caller is not the run's person (PERMISSION_DENIED). */
+export declare const RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE = "a run credential is minted only for the person whose run it is";
+/** The cloud's byte-pinned lineage refusal (the Java step's copy). */
+export declare const WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE = "workflow lineage label names a workflow execution this runner credential is not bound to";
+/** The cloud's byte-pinned org-mismatch refusal (MemoryPolicy.MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE). */
+export declare const MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE = "memory capture is scoped to the session's organization";
+/**
+ * How long a run credential outlives its run, measured from the row's
+ * `status.completed_at`. A run's credential is valid while the run is
+ * not terminal — runs wait on humans with no timeout, so no clock can
+ * bound them — and for this long after, because two legitimate runner
+ * writes land after the terminal stamp: the session-subject generation
+ * the workflow fires and does not await (issue #665), and a Temporal
+ * activity retried after its completion failed to reach the engine.
+ * Ten minutes covers one model call and one retry backoff; today's
+ * exchange-lane token outlives a run by up to an hour. A terminal row
+ * with no `completed_at` gets no grace: fail closed.
+ */
+export declare const RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS: number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/runnerauth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/runnerauth/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,mFAAmF;AACnF,eAAO,MAAM,iCAAiC,kDACG,CAAC;AAElD,gGAAgG;AAChG,eAAO,MAAM,kCAAkC,2FAC2C,CAAC;AAE3F,iHAAiH;AACjH,eAAO,MAAM,sCAAsC,mEACe,CAAC;AAEnE,sEAAsE;AACtE,eAAO,MAAM,yCAAyC,6FACsC,CAAC;AAE7F,uGAAuG;AACvG,eAAO,MAAM,mCAAmC,2DACU,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sCAAsC,QAAiB,CAAC"}

package/dist/runnerauth/constants.js

@@ -0,0 +1,63 @@
+/**
+ * The runner-subject lane's pinned names and copy — the one constants
+ * module for the runner-credential domain (the ts-server guideline:
+ * byte-pinned copy lives in one constants module per domain, never
+ * inline at the refusal site).
+ *
+ * Two refusal sentences for a PRESENTED credential, deliberately not
+ * more (the InvalidTokenError doctrine of runnerauth.ts: a finer reason
+ * invites branching on it). The runner is the only caller that ever
+ * presents a run credential, and the person reading these is its
+ * operator, in the runner's log:
+ *
+ *   - the TOKEN sentence: the credential itself is not one this server
+ *     will honor — forged, the wrong shape, bound to an execution or a
+ *     connect this server does not have (a connect's row is gone once
+ *     the connect settles), a clockless token bound to a connect (a shape
+ *     no mint produces), a present `exp` in the past, or minted by a key
+ *     this server does not hold. A missing row is this sentence and not
+ *     NOT_FOUND on purpose: the credential is invalid, and the run is
+ *     not the caller's to learn about.
+ *   - the LIVENESS sentence: the credential is genuine but its run is
+ *     over, or its run or connect was created by nobody this server
+ *     recognizes as a person (the schedule fire caller's
+ *     deterministic-refusal shape: no retry will make that run anyone's).
+ *
+ * And one for a REQUESTED credential — the platform exchange under the
+ * built-in posture (built-in-runner-credential-provider.ts), where the
+ * caller is a signed-in person asking for a run's credential and the
+ * answer is a permission, not a token verdict: only the person whose run
+ * it is may hold its credential. A run whose creator stamp names nobody
+ * gets the same sentence — no one is its person.
+ *
+ * The lineage mismatch copy is the cloud edition's, transcribed byte for
+ * byte (credentials/provider.ts in the composition; the Java
+ * RecordRunnerLineageLabelsStep before it) so the two editions refuse a
+ * mis-stamped lineage label with one sentence.
+ */
+/** The verifier's name in the boot log and in auth failures (the `oidc` / `apikey` precedent). */
+export const RUNNER_VERIFIER_NAME = "runner";
+/** The token arms: forged, wrong shape, unknown execution, past `exp`, keyless. */
+export const RUNNER_CREDENTIAL_INVALID_MESSAGE = "runner credential is not valid on this server";
+/** The resolution arms: a terminal execution; a run stamped by nobody the server recognizes. */
+export const RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE = "runner credential names a run that is over or belongs to nobody this server recognizes";
+/** The exchange's refusal under the built-in posture: the caller is not the run's person (PERMISSION_DENIED). */
+export const RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE = "a run credential is minted only for the person whose run it is";
+/** The cloud's byte-pinned lineage refusal (the Java step's copy). */
+export const WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE = "workflow lineage label names a workflow execution this runner credential is not bound to";
+/** The cloud's byte-pinned org-mismatch refusal (MemoryPolicy.MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE). */
+export const MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE = "memory capture is scoped to the session's organization";
+/**
+ * How long a run credential outlives its run, measured from the row's
+ * `status.completed_at`. A run's credential is valid while the run is
+ * not terminal — runs wait on humans with no timeout, so no clock can
+ * bound them — and for this long after, because two legitimate runner
+ * writes land after the terminal stamp: the session-subject generation
+ * the workflow fires and does not await (issue #665), and a Temporal
+ * activity retried after its completion failed to reach the engine.
+ * Ten minutes covers one model call and one retry backoff; today's
+ * exchange-lane token outlives a run by up to an hour. A terminal row
+ * with no `completed_at` gets no grace: fail closed.
+ */
+export const RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS = 10 * 60 * 1000;
+//# sourceMappingURL=constants.js.map

package/dist/runnerauth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/runnerauth/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,+CAA+C,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,MAAM,kCAAkC,GAC7C,wFAAwF,CAAC;AAE3F,iHAAiH;AACjH,MAAM,CAAC,MAAM,sCAAsC,GACjD,gEAAgE,CAAC;AAEnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yCAAyC,GACpD,0FAA0F,CAAC;AAE7F,uGAAuG;AACvG,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wDAAwD,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/runnerauth/dispatch-credential.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one reader of the provider's `mintRunCredential` capability for the
+ * two dispatch paths (temporal/agentexecution/engine-client.ts and
+ * temporal/workflowexecution/engine-client.ts). Both engines put the
+ * answer on the invoke workflow input as `execution_context_token` — the
+ * connect lane's key for the same token type (domain/mcpserver/engine.ts)
+ * — and omit the key when the answer is "".
+ *
+ * Three answers, one rule each:
+ *
+ *   - the capability is absent: "" — this edition's runner is
+ *     credentialed another way (the cloud bakes a sandbox credential at
+ *     provision; runner-credential-provider.ts). Nothing to log: it is
+ *     the composition's shape, not a condition.
+ *   - the capability answers "": "" — the lane cannot mint (keyless, the
+ *     modeled disabled state). The composition root makes a keyless
+ *     server boot-fatal, so this is a test-only arm in practice.
+ *   - the capability THROWS: one warning naming the execution, then "" —
+ *     a dispatch never fails because a credential could not be minted
+ *     (the connect lane's precedent, ruled 2026-09-16). The runner then
+ *     falls back to the platform exchange and, refused there for a run
+ *     that is not the key-holder's, reads redacted and fails the run
+ *     loudly at its first read — attributable, never silent. The default
+ *     provider throws only for an empty execution id (a programming
+ *     error), so this arm exists to be pinned, not expected.
+ *
+ * The credential is never logged: the warning carries the execution id
+ * and the error's message, and the engines' own "Started …" lines carry
+ * ids and queues (a test pins the field names). A run credential in a log
+ * line would let anyone who reads the log act as the run's human for as
+ * long as the run lives.
+ */
+import type { Logger } from "../boot/logger.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+/** The dispatch's view of the seam: the one capability it reads. */
+export type RunCredentialMint = Pick<RunnerCredentialProvider, "mintRunCredential">;
+export declare function runCredentialForDispatch(credentials: RunCredentialMint, executionId: string, logger: Logger): string;
+//# sourceMappingURL=dispatch-credential.d.ts.map

package/dist/runnerauth/dispatch-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.d.ts","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,wBAAwB,EACxB,mBAAmB,CACpB,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAiBR"}

package/dist/runnerauth/dispatch-credential.js

@@ -0,0 +1,17 @@
+export function runCredentialForDispatch(credentials, executionId, logger) {
+    const mintRunCredential = credentials.mintRunCredential?.bind(credentials);
+    if (mintRunCredential === undefined) {
+        return "";
+    }
+    try {
+        return mintRunCredential(executionId);
+    }
+    catch (error) {
+        logger.warn("Failed to mint the run credential — dispatching without it; the runner will fall back to the platform exchange", {
+            execution_id: executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return "";
+    }
+}
+//# sourceMappingURL=dispatch-credential.js.map

package/dist/runnerauth/dispatch-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.js","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAyCA,MAAM,UAAU,wBAAwB,CACtC,WAA8B,EAC9B,WAAmB,EACnB,MAAc;IAEd,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,gHAAgH,EAChH;YACE,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/runnerauth/runner-credential-provider.d.ts

@@ -41,12 +41,26 @@
  * the token baked into a provisioned sandbox, and the ExecutionContext
  * decrypt trust decision. Each is an OPTIONAL method here; each OSS call
  * site falls back to today's exact behavior when the method is absent,
- * and the OSS default provider defines none — empty-composition behavior
- * is byte-identical by construction (the local conformance rosters pin
- * it). One provider object carries the edition's whole credential story;
- * the rejected alternative (a second single-instance driver for the
- * exchange) split that story across two objects whose only consumer is
- * the same composition.
+ * and the OSS default provider defines none of these POLICY capabilities
+ * — empty-composition behavior is byte-identical by construction (the
+ * local conformance rosters pin it). One provider object carries the
+ * edition's whole credential story; the rejected alternative (a second
+ * single-instance driver for the exchange) split that story across two
+ * objects whose only consumer is the same composition.
+ *
+ * One capability is open source's OWN and the default provider does
+ * define it: `mintRunCredential`, the run credential the dispatch path
+ * puts on every invoke workflow input (2026-09-16). It is optional on the
+ * seam for the same reason the others are — an edition whose runner
+ * credential rides another channel (the cloud's, minted at sandbox
+ * provision) leaves it undefined and its payloads carry nothing — but
+ * here the OSS default is the one that defines it, because the run
+ * credential is how an open-source runner acts for each run under the
+ * built-in authorization posture (runner-subject-verifier.ts). A unit
+ * that registers its own Authorizer but no provider of its own inherits
+ * this mint and composes no verifier for it; such a unit owns its
+ * credential story and must bring a provider, the rule the composition
+ * root already states for the verifier.
  *
  * Capability implementations REFUSE by throwing (a ConnectError with the
  * implementation's own byte-pinned copy — the gate-step refusal shape)
@@ -201,6 +215,22 @@ export interface RunnerCredentialProvider {
      * propagates to the invoking step's own failure posture.
      */
     mintSandboxCredential?(request: SandboxCredentialRequest): string;
+    /**
+     * The RUN credential the dispatch path hands the runner in the invoke
+     * workflow input (`execution_context_token` on both invoke inputs —
+     * the connect lane's key for the same token type). Bound to one
+     * execution and carrying NO `exp`: its validity is the bound row's
+     * liveness (runnerauth.ts `mintRunCredential`; bound-execution.ts),
+     * read by both lanes that accept it. When present, both engine clients
+     * call it for every dispatch (start, recover, signalWithStart); absent,
+     * the payload carries no credential — the edition's runner is
+     * credentialed another way (the cloud bakes a sandbox credential at
+     * provision). Returns "" to dispatch without a credential (the lane
+     * cannot mint — keyless); a thrown error is a real fault, which the
+     * dispatch reader (dispatch-credential.ts) logs and degrades to the
+     * same "" rather than failing the run's start.
+     */
+    mintRunCredential?(executionId: string): string;
     /**
      * The ExecutionContext decrypt trust decision for getByExecutionId
      * (`executionId` is the EC's spec.execution_id). When present, it IS
@@ -263,17 +293,25 @@ export interface RunnerCredentialProvider {
      * `captureOrg` is the request's metadata.org, checked against the
      * token's own org claim).
      *
+     * May answer synchronously or with a promise: the cloud's credential
+     * carries the subject and the session in its own claims, so its answer
+     * is a decode; open source's run credential names only the execution,
+     * so the built-in provider reads the execution row for its session and
+     * org (built-in-runner-credential-provider.ts). The gate awaits either.
+     *
      * Absent method → the gate's existing logic exactly (today's OSS
      * behavior: the trusted-local single-user posture admits, honestly).
      */
-    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision;
+    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision | Promise<MemoryCaptureDecision>;
 }
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export declare function newExecutionScopedRunnerCredentialProvider(service: RunnerAuthService): RunnerCredentialProvider;
 //# sourceMappingURL=runner-credential-provider.d.ts.map

package/dist/runnerauth/runner-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CAoB1B"}
+{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhD;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CA8B1B"}

package/dist/runnerauth/runner-credential-provider.js

@@ -1,10 +1,12 @@
 import { InvalidTokenError, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth.js";
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export function newExecutionScopedRunnerCredentialProvider(service) {
     return {
@@ -23,6 +25,16 @@ export function newExecutionScopedRunnerCredentialProvider(service) {
             }
             return service.verify(token);
         },
+        mintRunCredential(executionId) {
+            // Keyless is the modeled disabled state (the exchange's fail-soft
+            // arm, the sandbox lane's tokenless launch): answer "" and let the
+            // dispatch go without. Anything else the service refuses is a
+            // programming error and propagates as itself.
+            if (!service.isEnabled()) {
+                return "";
+            }
+            return service.mintRunCredential(executionId);
+        },
     };
 }
 //# sourceMappingURL=runner-credential-provider.js.map

package/dist/runnerauth/runner-credential-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AA0DA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AA4OzB;;;;;;GAMG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAwEA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAmQzB;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,iBAAiB,CAAC,WAAmB;YACnC,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,8CAA8C;YAC9C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runnerauth/runner-subject-verifier.d.ts

@@ -0,0 +1,14 @@
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { IdentityVerifier } from "../extensions/identity.js";
+import type { BoundExecutionStore } from "./bound-execution.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+export interface RunnerSubjectVerifierDeps {
+    /** Where the executions live — one primary-key read per claimed token. */
+    readonly store: BoundExecutionStore;
+    /** The account port the creator stamp resolves through (by id, then by subject). */
+    readonly accounts: AccountsByCaller;
+    /** The provider whose execution_scoped lane signed the token — verification goes through the seam. */
+    readonly credentials: Pick<RunnerCredentialProvider, "verify">;
+}
+export declare function newRunnerSubjectIdentityVerifier(deps: RunnerSubjectVerifierDeps): IdentityVerifier;
+//# sourceMappingURL=runner-subject-verifier.d.ts.map

package/dist/runnerauth/runner-subject-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-subject-verifier.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-subject-verifier.ts"],"names":[],"mappings":"AAwEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAOhF,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;CAChE;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,gBAAgB,CAmClB"}