@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/src/store.ts

@@ -3,6 +3,7 @@ import { chmodSync } from 'node:fs';
 import { randomUUID, randomBytes } from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import { UsageLedger } from './usage.js';
+import { WorkerBoundary } from './worker-boundary.js';
 import { OFFLINE_ROUTE, type ProviderRoute } from './provider-config.js';
 import { canonical } from './protocol.js';
 import {
@@ -26,9 +27,11 @@ export class Store {
   readonly db: DatabaseSync;
   readonly changes = new EventEmitter();
   readonly usage = new UsageLedger(this);
+  readonly workerBoundary = new WorkerBoundary(this);
   reconcileCompactions?: (id: string) => void;
   finishChild?: (attempt: Attempt) => void;
   projectTaskAttempt?: (attempt: Attempt) => void;
+  teamSnapshot?: (session: string) => unknown;
   guardTaskSubmission?: (session: string, step?: string) => void;
   cancelChildren?: (attempt: string) => void;
   recordTaskMutation?: (
@@ -59,7 +62,7 @@ export class Store {
     );
     const version = (this.db.prepare('PRAGMA user_version').get() as { user_version: number })
       .user_version;
-    if (version > 11) {
+    if (version > 17) {
       this.db.close();
       throw new ServiceError('schema_too_new', 'Database schema is newer than this service');
     }
@@ -202,6 +205,50 @@ export class Store {
           CREATE TABLE recurring_occurrences(id TEXT PRIMARY KEY,job_id TEXT NOT NULL REFERENCES recurring_jobs(id),occurrence_key TEXT NOT NULL,session_id TEXT NOT NULL UNIQUE REFERENCES sessions(id),job_run_id TEXT UNIQUE REFERENCES jobs(id),schedule_revision INTEGER NOT NULL,due_at INTEGER,state TEXT NOT NULL,error TEXT,created_at INTEGER NOT NULL,UNIQUE(job_id,occurrence_key));
           CREATE TABLE operator_inbox(id TEXT PRIMARY KEY,session_id TEXT NOT NULL REFERENCES sessions(id),source_key TEXT NOT NULL UNIQUE,kind TEXT NOT NULL,detail TEXT NOT NULL,revision INTEGER NOT NULL,state TEXT NOT NULL,ack_revision INTEGER NOT NULL DEFAULT 0,updated_at INTEGER NOT NULL);
           PRAGMA user_version=11; COMMIT;`);
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 12
+      ) {
+        this.db.exec('BEGIN IMMEDIATE');
+        this.workerBoundary.migrate();
+        this.db.exec('PRAGMA user_version=12; COMMIT;');
+      }
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 13
+      )
+        this.db.exec(`BEGIN IMMEDIATE;
+          CREATE TABLE agent_grants(id TEXT PRIMARY KEY,owner_session TEXT NOT NULL REFERENCES sessions(id),profile_id TEXT NOT NULL,document TEXT NOT NULL,digest TEXT NOT NULL,state TEXT NOT NULL);
+          CREATE TABLE specialist_reports(worker_id TEXT PRIMARY KEY,input_digest TEXT NOT NULL,artifact_id TEXT NOT NULL REFERENCES artifacts(id));
+          PRAGMA user_version=13; COMMIT;`);
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 14
+      )
+        this.db.exec(`BEGIN IMMEDIATE;
+          CREATE TABLE team_assignments(id TEXT PRIMARY KEY,task_id TEXT NOT NULL REFERENCES durable_tasks(id),step_id TEXT NOT NULL REFERENCES task_steps(id),plan_revision INTEGER NOT NULL,profile_id TEXT NOT NULL,grant_id TEXT NOT NULL REFERENCES agent_grants(id),budget INTEGER NOT NULL,generation INTEGER NOT NULL DEFAULT 0,child_id TEXT REFERENCES child_tasks(id),superseded INTEGER NOT NULL DEFAULT 0);
+          CREATE UNIQUE INDEX team_active_step ON team_assignments(step_id) WHERE superseded=0;
+          CREATE TABLE team_messages(id TEXT PRIMARY KEY,task_id TEXT NOT NULL REFERENCES durable_tasks(id),sender TEXT NOT NULL,recipient TEXT NOT NULL REFERENCES team_assignments(id),text TEXT NOT NULL,input_digest TEXT NOT NULL,created_at INTEGER NOT NULL,delivered_at INTEGER,acknowledged_at INTEGER);
+          PRAGMA user_version=14; COMMIT;`);
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 15
+      )
+        this.db.exec(`BEGIN IMMEDIATE;
+          CREATE TABLE worker_integrations(id TEXT PRIMARY KEY,parent_session TEXT NOT NULL REFERENCES sessions(id),child_id TEXT NOT NULL UNIQUE REFERENCES child_tasks(id),worker_id TEXT NOT NULL,patch_digest TEXT NOT NULL,before_revision INTEGER NOT NULL,before_digest TEXT NOT NULL,after_artifact TEXT NOT NULL REFERENCES artifacts(id),state TEXT NOT NULL,mutation_id TEXT REFERENCES workspace_mutations(id),mutation_key TEXT NOT NULL UNIQUE,generation INTEGER NOT NULL DEFAULT 1);
+          CREATE TABLE team_rejections(step_id TEXT NOT NULL REFERENCES task_steps(id),attempt_id TEXT NOT NULL REFERENCES attempts(id),request_id TEXT NOT NULL,reason TEXT NOT NULL,PRIMARY KEY(step_id,attempt_id));
+          PRAGMA user_version=15; COMMIT;`);
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 16
+      )
+        this.db.exec(`BEGIN IMMEDIATE;
+          CREATE TABLE external_assignments(assignment_id TEXT PRIMARY KEY REFERENCES team_assignments(id),runtime TEXT NOT NULL,digest TEXT NOT NULL);
+          CREATE TABLE external_runs(child_id TEXT PRIMARY KEY REFERENCES child_tasks(id),run_id TEXT NOT NULL UNIQUE,state TEXT NOT NULL,epoch INTEGER NOT NULL,checkpoint TEXT,receipt TEXT,stopped INTEGER NOT NULL DEFAULT 0,error TEXT,result TEXT,import_artifact TEXT REFERENCES artifacts(id));
+          CREATE TABLE task_invocations(attempt_id TEXT PRIMARY KEY REFERENCES attempts(id),task_id TEXT NOT NULL REFERENCES durable_tasks(id),runtime_id TEXT NOT NULL,input_digest TEXT NOT NULL,created_at INTEGER NOT NULL);
+          CREATE TABLE external_model_requests(id TEXT PRIMARY KEY,child_id TEXT NOT NULL REFERENCES external_runs(child_id),input_bytes INTEGER NOT NULL,output_bound INTEGER NOT NULL);
+          PRAGMA user_version=16; COMMIT;`);
+      if (
+        (this.db.prepare('PRAGMA user_version').get() as { user_version: number }).user_version < 17
+      )
+        this.db.exec(`BEGIN IMMEDIATE;
+          CREATE TABLE a2a_inbound(id TEXT PRIMARY KEY,peer TEXT NOT NULL,tenant TEXT NOT NULL,message_id TEXT NOT NULL,input_digest TEXT NOT NULL,assignment_id TEXT NOT NULL UNIQUE REFERENCES team_assignments(id),grant_digest TEXT NOT NULL,context_id TEXT NOT NULL UNIQUE,child_id TEXT NOT NULL UNIQUE REFERENCES child_tasks(id),created_at INTEGER NOT NULL,skill TEXT NOT NULL,cancel_requested INTEGER NOT NULL DEFAULT 0,UNIQUE(peer,tenant,message_id));
+          PRAGMA user_version=17; COMMIT;`);
     } catch (error) {
       if (this.db.isTransaction) this.db.exec('ROLLBACK');
       this.db.close();
@@ -785,9 +832,18 @@ export class Store {
       history_truncated: cursor !== null,
       approvals: this.approvals(id),
       operations: this.operations(id),
-      children: this.db
-        .prepare('SELECT * FROM child_tasks WHERE parent_session=? ORDER BY rowid DESC LIMIT 100')
-        .all(id) as unknown as SessionSnapshot['children'],
+      children: (
+        this.db
+          .prepare('SELECT * FROM child_tasks WHERE parent_session=? ORDER BY rowid DESC LIMIT 100')
+          .all(id) as unknown as SessionSnapshot['children']
+      ).map((child) => ({
+        ...child,
+        worker: this.workerBoundary.view(child.id),
+      })),
+      ...(this.workerBoundary.profiles
+        ? { agents: this.workerBoundary.profiles.snapshot(id) }
+        : {}),
+      ...(this.teamSnapshot ? { team: this.teamSnapshot(id) } : {}),
     };
   }
   cancelled(id: string): boolean {

package/src/supervisor.ts

@@ -25,13 +25,19 @@ import type { ChildWork } from './children.js';
 import {
   OFFLINE_ROUTE,
   providerRoute,
-  validateClaudePayload,
+  providerHasOutputCap,
   type ProviderRoute,
 } from './provider-config.js';
 import type { TaskContext, Compaction } from './task-context.js';
-import { loadApiKey, validateApiKey } from './credentials.js';
+import { validateApiKey } from './credentials.js';
+import { resolveProviderAuth } from './provider-auth.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { validateProviderPayload } from './provider-payload.js';
 import { digest } from './protocol.js';
 import type { CodingWork } from './coding.js';
+import type { TaskLimits } from './task-policy.js';
+import { repositoryPath, type RepositorySnapshots } from './repository-snapshots.js';
+import type { TeamWork } from './team-work.js';
 
 export interface Launch {
   command: string;
@@ -49,8 +55,12 @@ export interface SupervisorOptions {
   effectsEnabled?: boolean;
   providerRoute?: ProviderRoute;
   anthropicApiKey?: string;
+  providerCredentials?: import('@earendil-works/pi-ai').CredentialStore;
+  providerEnvironment?: NodeJS.ProcessEnv;
 }
 interface Worker {
+  route: ProviderRoute;
+  providerOutputCap?: boolean;
   id: string;
   epoch: number;
   token: string;
@@ -100,18 +110,79 @@ export class Supervisor extends EventEmitter {
   managed?: ManagedWork;
   children?: ChildWork;
   coding?: CodingWork;
+  repositories?: RepositorySnapshots;
+  team?: TeamWork;
+  routeFor(id: string): ProviderRoute {
+    const child = this.children?.owned(id);
+    return child
+      ? (this.store.workerBoundary.view(child.id).binding.agent?.route ?? this.route)
+      : this.route;
+  }
+  async prepareProviderRoute(input: ProviderRoute) {
+    const route = structuredClone(input);
+    if (route.provider === 'salaam-proof') return { route, output_cap: true, auth: undefined };
+    const auth =
+      route.provider === 'anthropic' && this.apiKey
+        ? { auth: { apiKey: this.apiKey }, env: {} }
+        : await resolveProviderAuth(
+            route,
+            this.options.providerCredentials,
+            this.options.providerEnvironment,
+          );
+    const bound = bindProviderConfiguration(route, auth);
+    return { route: bound, output_cap: providerHasOutputCap(bound, auth), auth };
+  }
   private codingBinding(id: string): CodingBinding | undefined {
-    return this.children?.owned(id) ? undefined : this.coding?.binding(id);
+    const child = this.children?.owned(id),
+      coding = this.coding?.binding(id);
+    if (!child) return coding;
+    const binding = this.store.workerBoundary.view(child.id).binding;
+    return binding.isolation && coding
+      ? {
+          ...coding,
+          files: binding.tools.includes('salaam_files'),
+          commands: coding.commands && binding.tools.includes('salaam_command'),
+        }
+      : undefined;
   }
   private tools(id: string): string[] {
+    const child = this.children?.owned(id);
+    if (child) return JSON.parse(child.authority) as string[];
     return workerTools(
       !!this.options.effectsEnabled,
       !!this.children?.owned(id),
       this.codingBinding(id),
     );
   }
+  private childBoundary(id: string, epoch: number) {
+    const child = this.children?.owned(id);
+    return child ? this.store.workerBoundary.assert(child, epoch, this.routeFor(id)) : undefined;
+  }
   readonly route: ProviderRoute;
   private apiKey?: string;
+  private outputCap = true;
+  private authInitialized = false;
+  providerCapabilities() {
+    return {
+      output_token_cap: this.outputCap,
+      durable_tasks: true,
+      warning: this.outputCap
+        ? null
+        : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+    };
+  }
+  assertTaskProviderSupported(limits: TaskLimits, outputCap = this.outputCap) {
+    if (!outputCap && (limits.token_units !== null || limits.output_token_bound !== null))
+      throw new ServiceError(
+        'provider_capability',
+        'This provider authentication has no output cap; set limits.token_units to null and omit output_token_bound',
+      );
+  }
+  assertSessionProviderSupported(id: string, outputCap = this.outputCap) {
+    const parent = this.children?.owned(id)?.parent_session ?? id;
+    const task = this.tasks.work?.forSession(parent);
+    if (task) this.assertTaskProviderSupported(task.limits, outputCap);
+  }
   readonly bootId = randomUUID();
   private workers = new Map<string, Worker>();
   private monitor: NodeJS.Timeout;
@@ -121,27 +192,54 @@ export class Supervisor extends EventEmitter {
     readonly options: SupervisorOptions,
   ) {
     super();
-    this.route = options.providerRoute ?? { ...OFFLINE_ROUTE };
+    this.route = structuredClone(options.providerRoute ?? OFFLINE_ROUTE);
     // Validate public configuration without trusting programmatic callers.
     const checked = providerRoute(
       this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider,
-      this.route.provider === 'anthropic' ? this.route.model : undefined,
-      this.route.provider === 'anthropic' ? this.route.max_tokens : undefined,
+      this.route.provider !== 'salaam-proof' ? this.route.model : undefined,
+      this.route.provider !== 'salaam-proof' ? this.route.max_tokens : undefined,
       this.route.workspace_id,
+      this.route.connection,
     );
     if (canonical(checked) !== canonical(this.route)) throw new Error('Invalid provider route');
-    if (this.route.provider === 'anthropic')
-      this.apiKey = options.anthropicApiKey
-        ? validateApiKey(options.anthropicApiKey)
-        : loadApiKey();
+    if (options.anthropicApiKey) this.apiKey = validateApiKey(options.anthropicApiKey);
     this.bundle = bundleDigest();
     this.monitor = setInterval(() => {
       for (const worker of this.workers.values())
-        if (worker.ready && Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
-          this.invalidate(worker, 'Worker heartbeat expired');
+        if (worker.ready) {
+          if (Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
+            this.invalidate(worker, 'Worker heartbeat expired');
+          const child = this.children?.owned(worker.id);
+          if (child?.state === 'accepted') {
+            try {
+              this.childBoundary(worker.id, worker.epoch);
+            } catch (error) {
+              this.invalidate(worker, 'Worker boundary revoked: ' + (error as Error).message);
+            }
+          }
+        }
     }, 250);
     this.monitor.unref();
   }
+  async providerAuth() {
+    if (this.route.provider === 'salaam-proof') return undefined;
+    if (this.route.provider === 'anthropic' && this.apiKey)
+      return { auth: { apiKey: this.apiKey }, env: {} };
+    const auth = await resolveProviderAuth(
+      this.route,
+      this.options.providerCredentials,
+      this.options.providerEnvironment,
+    );
+    Object.assign(this.route, bindProviderConfiguration(this.route, auth));
+    const outputCap = providerHasOutputCap(this.route, auth);
+    if (this.authInitialized && this.outputCap !== outputCap)
+      throw new Error(
+        'Provider output-cap capability changed; restart the service before using the new authentication',
+      );
+    this.outputCap = outputCap;
+    this.authInitialized = true;
+    return auth;
+  }
   async recover(): Promise<void> {
     const rows = this.store.db.prepare("SELECT * FROM workers WHERE state!='exited'").all() as {
       session_id: string;
@@ -177,6 +275,13 @@ export class Supervisor extends EventEmitter {
     }
   }
   async start(id: string): Promise<void> {
+    const child = this.children?.owned(id);
+    if (child && this.store.workerBoundary.view(child.id).binding.runtime !== 'native-pi')
+      throw new ServiceError(
+        'external_worker_owned',
+        'Use the external worker lifecycle; Pi cannot claim this session',
+      );
+    const route = this.routeFor(id);
     const prior = this.workers.get(id);
     if (prior && !prior.stopping)
       throw new ServiceError('worker_exists', 'Worker already supervised');
@@ -193,7 +298,7 @@ export class Supervisor extends EventEmitter {
         'reconciliation_required',
         previous.error ?? 'Session requires reconciliation',
       );
-    this.store.bindRoute(id, this.route);
+    this.store.bindRoute(id, route);
     const epoch = this.store.allocate(id, this.bootId);
     let accept!: () => void;
     let reject!: (e: Error) => void;
@@ -204,6 +309,7 @@ export class Supervisor extends EventEmitter {
     const binding = randomBytes(16).toString('hex');
     const frame = this.tasks.frame(id, binding);
     const worker: Worker = {
+      route: structuredClone(route),
       id,
       epoch,
       token: randomBytes(32).toString('hex'),
@@ -224,6 +330,8 @@ export class Supervisor extends EventEmitter {
     void handshake.catch(() => {});
     let timer: NodeJS.Timeout | undefined;
     try {
+      const child = this.children?.owned(id);
+      if (child) this.store.workerBoundary.claim(child, epoch, route);
       const workerDir = join(this.options.stateDir, 'workers', id);
       mkdirSync(join(workerDir, 'agent'), { recursive: true, mode: 0o700 });
       writeFileSync(
@@ -245,7 +353,8 @@ export class Supervisor extends EventEmitter {
         frame,
         effects: !!this.options.effectsEnabled && !this.children?.owned(id),
         child: !!this.children?.owned(id),
-        route: this.route,
+        worker_binding: this.childBoundary(id, epoch),
+        route: route,
         coding: this.codingBinding(id),
       };
       const args = [
@@ -271,9 +380,9 @@ export class Supervisor extends EventEmitter {
         '--tools',
         this.tools(id).join(','),
         '--provider',
-        this.route.provider,
+        route.provider,
         '--model',
-        this.route.model,
+        route.model,
       ];
       if (previous.pi_session_file && existsSync(previous.pi_session_file)) {
         const index = args.indexOf('--session-id');
@@ -293,7 +402,7 @@ export class Supervisor extends EventEmitter {
         LANG: process.env.LANG ?? 'en_US.UTF-8',
         PI_CODING_AGENT_DIR: join(workerDir, 'agent'),
         SALAAM_WORKER_CONFIG: JSON.stringify(config),
-        ...(this.apiKey ? { ANTHROPIC_API_KEY: this.apiKey } : {}),
+        ...(route.connection?.configuration ?? {}),
       };
       worker.pi = (this.options.launch ?? ((x) => new PiProcess(x.command, x.args, x.cwd, x.env)))({
         command: process.execPath,
@@ -387,16 +496,21 @@ export class Supervisor extends EventEmitter {
       const file = typeof state.sessionFile === 'string' ? resolve(state.sessionFile) : null;
       if (!file || !file.startsWith(resolve(sessionDir) + '/'))
         throw new Error('Pi session is outside its managed directory');
-      if (
-        object(state.model).provider !== this.route.provider ||
-        object(state.model).id !== this.route.model
-      )
+      if (object(state.model).provider !== route.provider || object(state.model).id !== route.model)
         throw new Error('Pi selected an unapproved provider route');
       if (worker.invalid) throw new Error(worker.invalid);
       // Pi buffers setup-only entries until there is a conversation. Do not
       // persist a cursor into that ephemeral tree before its file exists.
       if (existsSync(file)) await this.syncEntries(worker);
-      this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id)), file);
+      if (child) this.store.workerBoundary.accepted(child, epoch, route);
+      this.store.state(
+        id,
+        epoch,
+        'ready',
+        null,
+        workerCapabilities(this.codingBinding(id), this.tools(id)),
+        file,
+      );
       worker.ready = true;
       worker.lastBeat = Date.now();
     } catch (error) {
@@ -455,6 +569,7 @@ export class Supervisor extends EventEmitter {
     body: Record<string, unknown>,
   ): Promise<unknown> {
     const w = this.authenticate(id, token, body);
+    const route = w.route;
     if (method === 'failure') {
       if (!w.stopping) this.invalidate(w, 'Required extension failed');
       return { ok: true };
@@ -464,6 +579,7 @@ export class Supervisor extends EventEmitter {
     if (method === 'handshake') {
       try {
         if (w.manifest) throw new Error('Duplicate handshake');
+        const boundary = this.childBoundary(id, w.epoch);
         const expected = {
           protocol_version: PROTOCOL_VERSION,
           bundle_digest: w.bundle,
@@ -471,13 +587,14 @@ export class Supervisor extends EventEmitter {
           session_id: id,
           pi_session_id: id,
           epoch: w.epoch,
-          capabilities: workerCapabilities(this.codingBinding(id)),
+          capabilities: workerCapabilities(this.codingBinding(id), this.tools(id)),
           tools: this.tools(id),
           active_tools: this.tools(id),
           ...(this.codingBinding(id) ? { coding: this.codingBinding(id) } : {}),
-          provider: this.route.provider,
-          route: this.route,
+          provider: route.provider,
+          route: route,
           context_digest: textDigest(w.frame),
+          ...(boundary ? { worker_binding: boundary } : {}),
         };
         for (const [key, value] of Object.entries(expected))
           if (canonical(body[key]) !== canonical(value))
@@ -499,12 +616,98 @@ export class Supervisor extends EventEmitter {
     if (w.attempt && this.store.cancelled(w.attempt))
       throw new ServiceError('attempt_cancelled', 'Attempt cancellation revoked further grants');
     try {
+      this.childBoundary(id, w.epoch);
+      if (method.startsWith('team.')) {
+        const child = this.children?.owned(id);
+        if (!child || !this.team || !w.attempt) throw new Error('No owned team assignment');
+        const binding = this.store.workerBoundary.view(child.id).binding;
+        if (!binding.assignment || !binding.tools.includes('salaam_team'))
+          throw new Error('No team message authority');
+        const authorize = () => {
+          this.assertActive(id, w.epoch, w.attempt!);
+          this.team!.assert(binding);
+          this.store.taskGrantCheck?.(id);
+        };
+        authorize();
+        const request = string(body.request_id, 'request_id', 128),
+          assignment = binding.assignment.id;
+        if (method === 'team.send')
+          return this.team.send(
+            binding.owner_task!,
+            assignment,
+            string(body.recipient, 'recipient', 128),
+            string(body.text, 'text', 4096),
+            request,
+            authorize,
+          );
+        if (method === 'team.receive') return this.team.receive(assignment, request, authorize);
+        if (method === 'team.ack')
+          return this.team.acknowledge(
+            assignment,
+            string(body.message_id, 'message_id', 128),
+            request,
+            authorize,
+          );
+        throw new ServiceError('invalid_field', 'Unknown team method', 400);
+      }
+      if (method === 'specialist.read' || method === 'specialist.report') {
+        const child = this.children?.owned(id);
+        if (!child || !this.repositories || !w.attempt)
+          throw new Error('No active specialist assignment');
+        this.assertActive(id, w.epoch, w.attempt);
+        const binding = this.store.workerBoundary.view(child.id).binding;
+        const tool = method === 'specialist.read' ? 'salaam_repository' : 'salaam_findings';
+        if (!binding.tools.includes(tool)) throw new Error('Specialist authority is unavailable');
+        this.store.taskGrantCheck?.(id);
+        if (method === 'specialist.report') return this.repositories.report(binding, body.findings);
+        const args = object(body.args);
+        return this.store.request(
+          `specialist-read:${id}:${w.epoch}`,
+          string(body.tool_call_id, 'tool_call_id', 512),
+          args,
+          () => {
+            const result = this.repositories!.read(binding, args);
+            this.store.event(id, 'specialist.read', {
+              attempt_id: w.attempt,
+              snapshot_digest: binding.repository?.digest,
+              argument_digest: digest(args),
+              result_digest: digest(result),
+            });
+            return result;
+          },
+        );
+      }
+      if (method === 'provider.auth') {
+        if (!this.children?.owned(id)) {
+          const auth = await this.providerAuth();
+          if (canonical(this.route) !== canonical(route)) throw new Error('Provider route changed');
+          w.providerOutputCap = this.outputCap;
+          this.assertSessionProviderSupported(id, this.outputCap);
+          return auth;
+        }
+        const prepared = await this.prepareProviderRoute(route);
+        const expectedCap = this.children?.owned(id)
+          ? this.store.workerBoundary.view(this.children.owned(id)!.id).binding.agent?.output_cap
+          : this.outputCap;
+        if (
+          canonical(prepared.route) !== canonical(route) ||
+          (expectedCap ?? this.outputCap) !== prepared.output_cap
+        )
+          throw new Error('Provider capability or route changed; restart or renew admission');
+        w.providerOutputCap = prepared.output_cap;
+        this.assertSessionProviderSupported(id, prepared.output_cap);
+        const auth = prepared.auth;
+        return auth;
+      }
       if (method === 'coding.files' || method === 'coding.command') {
-        if (this.children?.owned(id) || !this.coding || !this.codingBinding(id) || !w.attempt)
+        if (!this.coding || !this.codingBinding(id) || !w.attempt)
           throw new Error('Coding authority is unavailable');
         this.assertActive(id, w.epoch, w.attempt);
+        this.store.taskGrantCheck?.(id);
         const args = object(body.args);
-        if (method === 'coding.files')
+        if (method === 'coding.files') {
+          if (!this.codingBinding(id)?.files) throw new Error('File authority is unavailable');
+          if (this.children?.owned(id) && args.path !== undefined) repositoryPath(args.path);
           return this.coding.file(
             id,
             w.epoch,
@@ -512,6 +715,7 @@ export class Supervisor extends EventEmitter {
             string(body.tool_call_id, 'tool_call_id', 512),
             args,
           );
+        }
         if (!this.codingBinding(id)?.commands) throw new Error('Command execution is unavailable');
         if (args.action === 'start')
           return this.coding.start(id, w.attempt, args, () =>
@@ -557,8 +761,16 @@ export class Supervisor extends EventEmitter {
       }
       if (method.startsWith('child.')) {
         if (!this.children || !w.attempt) throw new Error('No active parent attempt');
-        this.assertActive(id, w.epoch, w.attempt);
-        if (method === 'child.spawn')
+        // spawn() resolves a saved step before testing a fresh invocation/grant.
+        if (method !== 'child.spawn') this.assertActive(id, w.epoch, w.attempt);
+        if (method === 'child.spawn') {
+          if (
+            Object.keys(body).some(
+              (key) =>
+                !['epoch', 'step_key', 'prompt', 'budget', 'authority', 'profile'].includes(key),
+            )
+          )
+            throw new ServiceError('invalid_child', 'Unsupported child admission field');
           return this.children.spawn(
             id,
             w.epoch,
@@ -568,8 +780,12 @@ export class Supervisor extends EventEmitter {
             Number(body.budget),
             Array.isArray(body.authority)
               ? body.authority.map((x) => string(x, 'authority', 128))
-              : ['salaam_probe'],
+              : body.profile
+                ? []
+                : ['salaam_probe'],
+            body.profile === undefined ? undefined : string(body.profile, 'profile', 128),
           );
+        }
         if (method === 'child.list') return this.children.list(id);
         const child = string(body.child_id, 'child_id', 128);
         if (method === 'child.inspect') return this.children.inspect(id, child);
@@ -614,10 +830,10 @@ export class Supervisor extends EventEmitter {
           this.store.usage.observe(
             id,
             string(body.source_key, 'source_key', 256),
-            this.route.provider,
-            this.route.model,
+            route.provider,
+            route.model,
             body.usage,
-            this.route.provider === 'anthropic' ? 'estimated' : 'known',
+            route.provider !== 'salaam-proof' ? 'estimated' : 'known',
           ),
         );
         return { ok: true };
@@ -626,22 +842,26 @@ export class Supervisor extends EventEmitter {
         this.coding?.assertSafe(id);
         this.store.taskGrantCheck?.(id);
         if (
-          body.provider !== this.route.provider ||
-          body.model !== this.route.model ||
+          body.provider !== route.provider ||
+          body.model !== route.model ||
           body.context_digest !== textDigest(this.tasks.frame(id, w.binding))
         )
           throw new Error('Provider or task context is invalid');
-        if (this.route.provider === 'anthropic') {
-          validateClaudePayload(
+        if (route.provider !== 'salaam-proof') {
+          if (w.providerOutputCap === undefined)
+            throw new Error('Provider authentication was not admitted');
+          this.assertSessionProviderSupported(id, w.providerOutputCap);
+          validateProviderPayload(
             body.payload,
-            this.route,
+            route,
             this.tasks.frame(id, w.binding),
             this.tools(id),
+            !w.providerOutputCap,
           );
           if (body.payload_digest !== digest(body.payload))
-            throw new Error('Claude payload digest changed');
+            throw new Error('Provider payload digest changed');
         }
-        if (this.route.provider === 'salaam-proof') {
+        if (route.provider === 'salaam-proof') {
           const payload = object(body.payload);
           if (!Array.isArray(payload.messages)) throw new Error('Proof payload missing');
           const last = object(payload.messages.at(-1));
@@ -666,7 +886,7 @@ export class Supervisor extends EventEmitter {
           string(body.source_key, 'source_key', 256),
           String(body.provider),
           String(body.model),
-          { input: Buffer.byteLength(JSON.stringify(body.payload)), output: this.route.max_tokens },
+          { input: Buffer.byteLength(JSON.stringify(body.payload)), output: route.max_tokens },
         );
         this.store.transaction(() => {
           this.store.event(id, 'model.admitted', {
@@ -692,6 +912,19 @@ export class Supervisor extends EventEmitter {
       return { ok: true };
     } catch (error) {
       this.store.taskBudgetDenied?.(id, error);
+      if (
+        method.startsWith('specialist.') &&
+        error instanceof ServiceError &&
+        [
+          'not_found',
+          'binary_file',
+          'line_limit',
+          'invalid_field',
+          'unsafe_path',
+          'request_conflict',
+        ].includes(error.code)
+      )
+        throw error;
       if (
         method.startsWith('coding.') &&
         error instanceof ServiceError &&
@@ -740,9 +973,26 @@ export class Supervisor extends EventEmitter {
     }
   }
   inspect(id: string): Session {
+    const externalChild = this.children?.owned(id);
+    if (externalChild && this.store.workerBoundary.view(externalChild.id).binding.external)
+      return this.store.session(id);
+    const child = this.children?.owned(id);
+    const cap = child
+      ? this.store.workerBoundary.view(child.id).binding.agent?.output_cap
+      : undefined;
     const state = {
       ...this.store.session(id),
       provider_route: this.store.providerRoute(id) ?? undefined,
+      provider_capabilities:
+        cap === undefined
+          ? this.providerCapabilities()
+          : {
+              output_token_cap: cap,
+              durable_tasks: true,
+              warning: cap
+                ? null
+                : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+            },
     };
     const w = this.workers.get(id);
     if (w?.invalid) return { ...state, state: 'unhealthy', capabilities: [], error: w.invalid };
@@ -942,6 +1192,7 @@ export class Supervisor extends EventEmitter {
       if (w.invalid || end.aborted) throw new Error(w.invalid ?? 'Attempt aborted');
       const entries = await this.readEntries(w);
       const result = object((await w.pi.command('get_last_assistant_text')).data);
+      this.childBoundary(id, w.epoch);
       this.store.finish(
         work.attempt.id,
         outcomeError ? 'failed' : 'completed',
@@ -957,6 +1208,8 @@ export class Supervisor extends EventEmitter {
       w.pi.off('record', record);
       w.busy = false;
       delete w.attempt;
+      const child = this.children?.owned(id);
+      if (child && child.state !== 'accepted') await this.stopWorker(w);
       this.emit('idle', id);
     }
     return true;