@superjackfruitlabs/salaam 0.0.1 → 0.0.3

package/dist/src/supervisor.js

@@ -1,16 +1,51 @@
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { EventEmitter } from 'node:events';
-import { mkdirSync, existsSync, writeFileSync } from 'node:fs';
+import { mkdirSync, existsSync, writeFileSync, readFileSync, readlinkSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { PROTOCOL_VERSION, canonical, object, ServiceError, textDigest, workerTools, workerCapabilities, string, } from './protocol.js';
-import { PI_CLI, HOUSE_EXTENSION, POLICY_DIGEST, bundleDigest } from './config.js';
+import { PI_CLI, HOUSE_EXTENSION, POLICY_DIGEST, bundleDigest, VERSION, PI_VERSION, } from './config.js';
+import { readinessFingerprint } from './readiness-fingerprint.js';
 import { PiProcess, PiCommandError } from './pi.js';
-import { OFFLINE_ROUTE, providerRoute, validateClaudePayload, } from './provider-config.js';
-import { loadApiKey, validateApiKey } from './credentials.js';
+import { OFFLINE_ROUTE, providerRoute, providerHasOutputCap, } from './provider-config.js';
+import { validateApiKey } from './credentials.js';
+import { resolveProviderAuth } from './provider-auth.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { validateProviderPayload } from './provider-payload.js';
 import { digest } from './protocol.js';
+import { readLocalWorkspace } from './local-workspace.js';
+import { repositoryPath } from './repository-snapshots.js';
+import { acpFailure, credentialStrings, parseAcpFailure, providerOutcome, redactFailureText, toolMetadata, } from './acp-outcome.js';
 export function processIdentity(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return null;
     try {
+        if (process.platform === 'linux') {
+            // /proc stat field 22 is the boot-relative start tick. Pair it with boot,
+            // process group, executable and argv, and re-read to reject PID reuse mid-snapshot.
+            const path = `/proc/${pid}`;
+            const stat = () => {
+                const value = readFileSync(path + '/stat', 'utf8');
+                const end = value.lastIndexOf(') ');
+                if (end < 0 || !value.startsWith(pid + ' ('))
+                    throw Error('Invalid process stat');
+                const fields = value
+                    .slice(end + 2)
+                    .trim()
+                    .split(/\s+/);
+                if (!/^\d+$/.test(fields[19] ?? '') || !/^\d+$/.test(fields[2] ?? ''))
+                    throw Error('Invalid process start identity');
+                return { start: fields[19], group: fields[2], session: fields[3] };
+            };
+            const before = stat(), boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim(), executable = readlinkSync(path + '/exe'), argv = readFileSync(path + '/cmdline');
+            if (!/^[a-f0-9-]{36}$/.test(boot) ||
+                !argv.length ||
+                argv.length > 16384 ||
+                canonical(before) !== canonical(stat()))
+                return null;
+            return ('linux-proc-v1:' +
+                textDigest(canonical({ pid, boot, ...before, executable, argv: argv.toString('base64') })));
+        }
         return (execFileSync('/bin/ps', ['-ww', '-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
@@ -37,19 +72,81 @@ function groupExists(pid) {
 export class Supervisor extends EventEmitter {
     store;
     options;
+    localCoding;
     tasks;
     compactionJobs = new Set();
     managed;
+    mcp;
+    toolkit;
+    station;
     children;
     coding;
+    repositories;
+    team;
+    routeFor(id) {
+        const child = this.children?.owned(id);
+        return child
+            ? (this.store.workerBoundary.view(child.id).binding.agent?.route ?? this.route)
+            : this.store.localWorkspace(id)
+                ? (this.store.providerRoute(id) ?? this.route)
+                : this.route;
+    }
+    async prepareProviderRoute(input) {
+        const route = structuredClone(input);
+        if (route.provider === 'salaam-proof')
+            return { route, output_cap: true, auth: undefined };
+        const auth = route.provider === 'anthropic' && this.apiKey
+            ? { auth: { apiKey: this.apiKey }, env: {} }
+            : await resolveProviderAuth(route, this.options.providerCredentials, this.options.providerEnvironment);
+        const bound = bindProviderConfiguration(route, auth);
+        return { route: bound, output_cap: providerHasOutputCap(bound, auth), auth };
+    }
     codingBinding(id) {
-        return this.children?.owned(id) ? undefined : this.coding?.binding(id);
+        const child = this.children?.owned(id), coding = this.coding?.binding(id);
+        if (!child)
+            return coding;
+        const binding = this.store.workerBoundary.view(child.id).binding;
+        return binding.isolation && coding
+            ? {
+                ...coding,
+                files: binding.tools.includes('salaam_files'),
+                commands: coding.commands && binding.tools.includes('salaam_command'),
+            }
+            : undefined;
     }
     tools(id) {
-        return workerTools(!!this.options.effectsEnabled, !!this.children?.owned(id), this.codingBinding(id));
+        const child = this.children?.owned(id);
+        if (child)
+            return JSON.parse(child.authority);
+        return workerTools(!!this.options.effectsEnabled, !!this.children?.owned(id), this.codingBinding(id), undefined, !!this.mcp, !!this.toolkit, !!this.station, this.store.localWorkspace(id), this.store.localCoding(id));
+    }
+    childBoundary(id, epoch) {
+        const child = this.children?.owned(id);
+        return child ? this.store.workerBoundary.assert(child, epoch, this.routeFor(id)) : undefined;
     }
     route;
     apiKey;
+    outputCap = true;
+    authInitialized = false;
+    providerCapabilities() {
+        return {
+            output_token_cap: this.outputCap,
+            durable_tasks: true,
+            warning: this.outputCap
+                ? null
+                : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+        };
+    }
+    assertTaskProviderSupported(limits, outputCap = this.outputCap) {
+        if (!outputCap && (limits.token_units !== null || limits.output_token_bound !== null))
+            throw new ServiceError('provider_capability', 'This provider authentication has no output cap; set limits.token_units to null and omit output_token_bound');
+    }
+    assertSessionProviderSupported(id, outputCap = this.outputCap) {
+        const parent = this.children?.owned(id)?.parent_session ?? id;
+        const task = this.tasks.work?.forSession(parent);
+        if (task)
+            this.assertTaskProviderSupported(task.limits, outputCap);
+    }
     bootId = randomUUID();
     workers = new Map();
     monitor;
@@ -58,23 +155,46 @@ export class Supervisor extends EventEmitter {
         super();
         this.store = store;
         this.options = options;
-        this.route = options.providerRoute ?? { ...OFFLINE_ROUTE };
+        this.route = structuredClone(options.providerRoute ?? OFFLINE_ROUTE);
         // Validate public configuration without trusting programmatic callers.
-        const checked = providerRoute(this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider, this.route.provider === 'anthropic' ? this.route.model : undefined, this.route.provider === 'anthropic' ? this.route.max_tokens : undefined, this.route.workspace_id);
+        const checked = providerRoute(this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider, this.route.provider !== 'salaam-proof' ? this.route.model : undefined, this.route.provider !== 'salaam-proof' ? this.route.max_tokens : undefined, this.route.workspace_id, this.route.connection, this.route.reasoning);
         if (canonical(checked) !== canonical(this.route))
             throw new Error('Invalid provider route');
-        if (this.route.provider === 'anthropic')
-            this.apiKey = options.anthropicApiKey
-                ? validateApiKey(options.anthropicApiKey)
-                : loadApiKey();
+        if (options.anthropicApiKey)
+            this.apiKey = validateApiKey(options.anthropicApiKey);
         this.bundle = bundleDigest();
         this.monitor = setInterval(() => {
             for (const worker of this.workers.values())
-                if (worker.ready && Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
-                    this.invalidate(worker, 'Worker heartbeat expired');
+                if (worker.ready) {
+                    if (Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
+                        this.invalidate(worker, 'Worker heartbeat expired');
+                    const child = this.children?.owned(worker.id);
+                    if (child?.state === 'accepted') {
+                        try {
+                            this.childBoundary(worker.id, worker.epoch);
+                        }
+                        catch (error) {
+                            this.invalidate(worker, 'Worker boundary revoked: ' + error.message);
+                        }
+                    }
+                }
         }, 250);
         this.monitor.unref();
     }
+    async providerAuth() {
+        if (this.route.provider === 'salaam-proof')
+            return undefined;
+        if (this.route.provider === 'anthropic' && this.apiKey)
+            return { auth: { apiKey: this.apiKey }, env: {} };
+        const auth = await resolveProviderAuth(this.route, this.options.providerCredentials, this.options.providerEnvironment);
+        Object.assign(this.route, bindProviderConfiguration(this.route, auth));
+        const outputCap = providerHasOutputCap(this.route, auth);
+        if (this.authInitialized && this.outputCap !== outputCap)
+            throw new Error('Provider output-cap capability changed; restart the service before using the new authentication');
+        this.outputCap = outputCap;
+        this.authInitialized = true;
+        return auth;
+    }
     async recover() {
         const rows = this.store.db.prepare("SELECT * FROM workers WHERE state!='exited'").all();
         for (const row of rows) {
@@ -102,6 +222,11 @@ export class Supervisor extends EventEmitter {
         }
     }
     async start(id) {
+        this.store.execution.assert(id);
+        const child = this.children?.owned(id);
+        if (child && this.store.workerBoundary.view(child.id).binding.runtime !== 'native-pi')
+            throw new ServiceError('external_worker_owned', 'Use the external worker lifecycle; Pi cannot claim this session');
+        const route = this.routeFor(id);
         const prior = this.workers.get(id);
         if (prior && !prior.stopping)
             throw new ServiceError('worker_exists', 'Worker already supervised');
@@ -113,7 +238,7 @@ export class Supervisor extends EventEmitter {
                 .prepare("SELECT 1 FROM workers WHERE session_id=? AND state!='exited' LIMIT 1")
                 .get(id))
             throw new ServiceError('reconciliation_required', previous.error ?? 'Session requires reconciliation');
-        this.store.bindRoute(id, this.route);
+        this.store.bindRoute(id, route);
         const epoch = this.store.allocate(id, this.bootId);
         let accept;
         let reject;
@@ -124,6 +249,7 @@ export class Supervisor extends EventEmitter {
         const binding = randomBytes(16).toString('hex');
         const frame = this.tasks.frame(id, binding);
         const worker = {
+            route: structuredClone(route),
             id,
             epoch,
             token: randomBytes(32).toString('hex'),
@@ -140,10 +266,23 @@ export class Supervisor extends EventEmitter {
             reject,
         };
         this.workers.set(id, worker);
+        worker.secrets = [worker.token, ...(this.apiKey ? [this.apiKey] : [])];
         // Attach a rejection handler before spawn/identity checks can fail.
         void handshake.catch(() => { });
         let timer;
         try {
+            const child = this.children?.owned(id);
+            if (this.mcp && !child)
+                worker.mcp = await this.mcp.ready(id);
+            if (this.toolkit && !child)
+                worker.toolkit = await this.toolkit.ready(id);
+            if (this.station && !child)
+                worker.station = this.station.ready(id);
+            this.store.execution.assert(id);
+            if (worker.stopping || worker.invalid)
+                throw new Error('Worker startup cancelled');
+            if (child)
+                this.store.workerBoundary.claim(child, epoch, route);
             const workerDir = join(this.options.stateDir, 'workers', id);
             mkdirSync(join(workerDir, 'agent'), { recursive: true, mode: 0o700 });
             writeFileSync(join(workerDir, 'agent', 'settings.json'), JSON.stringify({
@@ -161,8 +300,14 @@ export class Supervisor extends EventEmitter {
                 frame,
                 effects: !!this.options.effectsEnabled && !this.children?.owned(id),
                 child: !!this.children?.owned(id),
-                route: this.route,
+                worker_binding: this.childBoundary(id, epoch),
+                route: route,
                 coding: this.codingBinding(id),
+                local: this.store.localWorkspace(id),
+                localCoding: this.store.localCoding(id),
+                ...(worker.mcp ? { mcp: worker.mcp } : {}),
+                ...(worker.toolkit ? { toolkit: worker.toolkit } : {}),
+                ...(worker.station ? { station: worker.station } : {}),
             };
             const args = [
                 PI_CLI,
@@ -187,9 +332,9 @@ export class Supervisor extends EventEmitter {
                 '--tools',
                 this.tools(id).join(','),
                 '--provider',
-                this.route.provider,
+                route.provider,
                 '--model',
-                this.route.model,
+                route.model,
             ];
             if (previous.pi_session_file && existsSync(previous.pi_session_file)) {
                 const index = args.indexOf('--session-id');
@@ -208,7 +353,7 @@ export class Supervisor extends EventEmitter {
                 LANG: process.env.LANG ?? 'en_US.UTF-8',
                 PI_CODING_AGENT_DIR: join(workerDir, 'agent'),
                 SALAAM_WORKER_CONFIG: JSON.stringify(config),
-                ...(this.apiKey ? { ANTHROPIC_API_KEY: this.apiKey } : {}),
+                ...(route.connection?.configuration ?? {}),
             };
             worker.pi = (this.options.launch ?? ((x) => new PiProcess(x.command, x.args, x.cwd, x.env)))({
                 command: process.execPath,
@@ -229,6 +374,11 @@ export class Supervisor extends EventEmitter {
                             attempt_id: worker.attempt,
                             worker_epoch: epoch,
                             ...observation,
+                            ...(observation.phase === 'started'
+                                ? toolMetadata(observation.tool, observation.input, observation.tool === 'salaam_station'
+                                    ? this.station?.config.workspace
+                                    : this.coding?.workspaces.find(id)?.root)
+                                : {}),
                         });
                         return { recorded: true };
                     });
@@ -298,8 +448,7 @@ export class Supervisor extends EventEmitter {
             const file = typeof state.sessionFile === 'string' ? resolve(state.sessionFile) : null;
             if (!file || !file.startsWith(resolve(sessionDir) + '/'))
                 throw new Error('Pi session is outside its managed directory');
-            if (object(state.model).provider !== this.route.provider ||
-                object(state.model).id !== this.route.model)
+            if (object(state.model).provider !== route.provider || object(state.model).id !== route.model)
                 throw new Error('Pi selected an unapproved provider route');
             if (worker.invalid)
                 throw new Error(worker.invalid);
@@ -307,7 +456,24 @@ export class Supervisor extends EventEmitter {
             // persist a cursor into that ephemeral tree before its file exists.
             if (existsSync(file))
                 await this.syncEntries(worker);
-            this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id)), file);
+            this.store.execution.assert(id);
+            if (child)
+                this.store.workerBoundary.accepted(child, epoch, route);
+            this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id), this.tools(id)), file, readinessFingerprint({
+                session_id: id,
+                worker_epoch: epoch,
+                version: 1,
+                harness: 'salaam',
+                harness_version: VERSION,
+                pi_version: PI_VERSION,
+                bundle_digest: worker.bundle,
+                policy_digest: POLICY_DIGEST,
+                provider: route.provider,
+                model: route.model,
+                context_digest: textDigest(worker.frame),
+                context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
+                verification: 'pinned-readiness-handshake',
+            }));
             worker.ready = true;
             worker.lastBeat = Date.now();
         }
@@ -328,6 +494,7 @@ export class Supervisor extends EventEmitter {
         worker.reject(new Error(reason));
         try {
             this.managed?.invalidateWorker(worker.id, worker.epoch);
+            this.cancelMcpWorker(worker);
             this.children?.workerLost(worker.id, reason);
         }
         catch {
@@ -342,6 +509,22 @@ export class Supervisor extends EventEmitter {
         if (worker.pi)
             void this.stopWorker(worker).catch(() => { });
     }
+    cancelMcpWorker(worker) {
+        if (this.station && worker.attempt) {
+            this.store.transaction(() => this.station.cancelInTransaction(worker.attempt));
+            void this.station.abortAttempt(worker.attempt).catch(() => {
+                worker.invalid = 'Station stop is unconfirmed';
+            });
+        }
+        if (this.toolkit && worker.attempt) {
+            this.store.transaction(() => this.toolkit.cancelInTransaction(worker.attempt));
+            this.toolkit.abortAttempt(worker.attempt);
+        }
+        if (this.mcp && worker.attempt) {
+            this.store.transaction(() => this.mcp.cancelInTransaction(worker.attempt, 'worker_unavailable'));
+            this.mcp.abortAttempt(worker.attempt);
+        }
+    }
     authenticate(id, token, body) {
         const w = this.workers.get(id);
         if (!w ||
@@ -362,6 +545,7 @@ export class Supervisor extends EventEmitter {
     }
     async bridge(id, method, token, body) {
         const w = this.authenticate(id, token, body);
+        const route = w.route;
         if (method === 'failure') {
             if (!w.stopping)
                 this.invalidate(w, 'Required extension failed');
@@ -369,10 +553,24 @@ export class Supervisor extends EventEmitter {
         }
         if (w.invalid || w.stopping)
             throw new ServiceError('worker_unavailable', 'Worker is not available', 403);
+        try {
+            this.store.execution.assert(id);
+            if (w.mcp)
+                this.mcp.assertBinding(id, w.mcp);
+            if (w.toolkit)
+                this.toolkit.assertBinding(id, w.toolkit);
+            if (w.station)
+                this.station.assertBinding(id, w.station);
+        }
+        catch (error) {
+            this.invalidate(w, 'Session execution authority revoked');
+            throw error;
+        }
         if (method === 'handshake') {
             try {
                 if (w.manifest)
                     throw new Error('Duplicate handshake');
+                const boundary = this.childBoundary(id, w.epoch);
                 const expected = {
                     protocol_version: PROTOCOL_VERSION,
                     bundle_digest: w.bundle,
@@ -380,13 +578,17 @@ export class Supervisor extends EventEmitter {
                     session_id: id,
                     pi_session_id: id,
                     epoch: w.epoch,
-                    capabilities: workerCapabilities(this.codingBinding(id)),
+                    capabilities: workerCapabilities(this.codingBinding(id), this.tools(id)),
                     tools: this.tools(id),
                     active_tools: this.tools(id),
                     ...(this.codingBinding(id) ? { coding: this.codingBinding(id) } : {}),
-                    provider: this.route.provider,
-                    route: this.route,
+                    provider: route.provider,
+                    route: route,
                     context_digest: textDigest(w.frame),
+                    ...(boundary ? { worker_binding: boundary } : {}),
+                    ...(w.mcp ? { mcp: w.mcp } : {}),
+                    ...(w.toolkit ? { toolkit: w.toolkit } : {}),
+                    ...(w.station ? { station: w.station } : {}),
                 };
                 for (const [key, value] of Object.entries(expected))
                     if (canonical(body[key]) !== canonical(value))
@@ -409,13 +611,191 @@ export class Supervisor extends EventEmitter {
         if (w.attempt && this.store.cancelled(w.attempt))
             throw new ServiceError('attempt_cancelled', 'Attempt cancellation revoked further grants');
         try {
+            this.childBoundary(id, w.epoch);
+            if (method.startsWith('team.')) {
+                const child = this.children?.owned(id);
+                if (!child || !this.team || !w.attempt)
+                    throw new Error('No owned team assignment');
+                const binding = this.store.workerBoundary.view(child.id).binding;
+                if (!binding.assignment || !binding.tools.includes('salaam_team'))
+                    throw new Error('No team message authority');
+                const authorize = () => {
+                    this.assertActive(id, w.epoch, w.attempt);
+                    this.team.assert(binding);
+                    this.store.taskGrantCheck?.(id);
+                };
+                authorize();
+                const request = string(body.request_id, 'request_id', 128), assignment = binding.assignment.id;
+                if (method === 'team.send')
+                    return this.team.send(binding.owner_task, assignment, string(body.recipient, 'recipient', 128), string(body.text, 'text', 4096), request, authorize);
+                if (method === 'team.receive')
+                    return this.team.receive(assignment, request, authorize);
+                if (method === 'team.ack')
+                    return this.team.acknowledge(assignment, string(body.message_id, 'message_id', 128), request, authorize);
+                throw new ServiceError('invalid_field', 'Unknown team method', 400);
+            }
+            if (method === 'specialist.read' || method === 'specialist.report') {
+                const child = this.children?.owned(id);
+                if (!child || !this.repositories || !w.attempt)
+                    throw new Error('No active specialist assignment');
+                this.assertActive(id, w.epoch, w.attempt);
+                const binding = this.store.workerBoundary.view(child.id).binding;
+                const tool = method === 'specialist.read' ? 'salaam_repository' : 'salaam_findings';
+                if (!binding.tools.includes(tool))
+                    throw new Error('Specialist authority is unavailable');
+                this.store.taskGrantCheck?.(id);
+                if (method === 'specialist.report')
+                    return this.repositories.report(binding, body.findings);
+                const args = object(body.args);
+                return this.store.request(`specialist-read:${id}:${w.epoch}`, string(body.tool_call_id, 'tool_call_id', 512), args, () => {
+                    const result = this.repositories.read(binding, args);
+                    this.store.event(id, 'specialist.read', {
+                        attempt_id: w.attempt,
+                        snapshot_digest: binding.repository?.digest,
+                        argument_digest: digest(args),
+                        result_digest: digest(result),
+                    });
+                    return result;
+                });
+            }
+            if (method === 'provider.auth') {
+                if (!this.children?.owned(id) && !this.store.localWorkspace(id)) {
+                    const auth = await this.providerAuth();
+                    if (canonical(this.route) !== canonical(route))
+                        throw new Error('Provider route changed');
+                    w.providerOutputCap = this.outputCap;
+                    this.assertSessionProviderSupported(id, this.outputCap);
+                    return auth;
+                }
+                const prepared = await this.prepareProviderRoute(route);
+                const expectedCap = this.children?.owned(id)
+                    ? this.store.workerBoundary.view(this.children.owned(id).id).binding.agent?.output_cap
+                    : (this.store.localOutputCap(id) ?? this.outputCap);
+                if (canonical(prepared.route) !== canonical(route) ||
+                    (expectedCap ?? this.outputCap) !== prepared.output_cap)
+                    throw new Error('Provider capability or route changed; restart or renew admission');
+                w.providerOutputCap = prepared.output_cap;
+                this.assertSessionProviderSupported(id, prepared.output_cap);
+                const auth = prepared.auth;
+                w.secrets = [...new Set([...(w.secrets ?? []), ...credentialStrings(auth)])];
+                return auth;
+            }
+            if (method.startsWith('toolkit.')) {
+                if (!this.toolkit || !w.toolkit || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('toolkit_disabled', 'Worker has no native Toolkit authority', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.toolkit.assertBinding(id, w.toolkit);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'toolkit.catalog')
+                    return this.toolkit.catalog(id, w.toolkit, body.category === undefined ? undefined : string(body.category, 'category', 128), body.action === undefined ? undefined : string(body.action, 'action', 128));
+                if (!['toolkit.prepare', 'toolkit.run', 'toolkit.status'].includes(method))
+                    throw new ServiceError('invalid_field', 'Unsupported native Toolkit action', 400);
+                const call = method === 'toolkit.prepare'
+                    ? this.toolkit.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), body.args)
+                    : this.toolkit.calls.get(string(body.call_id, 'call_id', 128));
+                if (call.session_id !== id ||
+                    call.worker_epoch !== w.epoch ||
+                    call.attempt_id !== w.attempt)
+                    throw new ServiceError('mcp_call_scope', 'Native Toolkit call belongs to another invocation', 403);
+                if (method === 'toolkit.run')
+                    this.toolkit.start(call.id, id, w.epoch, w.attempt);
+                return this.toolkit.view(call.id);
+            }
+            if (method.startsWith('mcp.')) {
+                if (!this.mcp || !w.mcp || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('mcp_disabled', 'Worker has no managed MCP authority', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.mcp.assertBinding(id, w.mcp);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'mcp.catalog')
+                    return this.mcp.describe(id, w.mcp, body.server === undefined ? undefined : string(body.server, 'server', 128), body.tool === undefined ? undefined : string(body.tool, 'tool', 128));
+                const call = method === 'mcp.prepare'
+                    ? this.mcp.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), body.args)
+                    : this.mcp.get(string(body.call_id, 'call_id', 128));
+                if (call.session_id !== id ||
+                    call.worker_epoch !== w.epoch ||
+                    call.attempt_id !== w.attempt)
+                    throw new ServiceError('mcp_call_scope', 'MCP call belongs to another invocation', 403);
+                if (!['mcp.prepare', 'mcp.run', 'mcp.status'].includes(method))
+                    throw new ServiceError('invalid_field', 'Unsupported MCP action', 400);
+                const current = method === 'mcp.run' ? this.mcp.start(call.id, id, w.epoch, w.attempt) : call;
+                return {
+                    call: current,
+                    result: current.result_artifact
+                        ? JSON.parse(this.mcp.artifacts.read(current.result_artifact))
+                        : null,
+                    ...(current.operation_id && this.managed
+                        ? {
+                            operation: this.managed.operation(current.operation_id),
+                            approval: this.managed.forOperation(current.operation_id),
+                        }
+                        : {}),
+                };
+            }
+            if (method.startsWith('station.')) {
+                if (!this.station || !w.station || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('station_disabled', 'Station execution is unavailable');
+                this.assertActive(id, w.epoch, w.attempt);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'station.read')
+                    return this.station.read(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                if (method === 'station.prepare')
+                    return this.station.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                const c = this.station.get(string(body.call_id, 'call_id', 128));
+                if (c.session_id !== id || c.worker_epoch !== w.epoch || c.attempt_id !== w.attempt)
+                    throw new ServiceError('station_scope', 'Station call belongs to another invocation', 403);
+                if (method === 'station.run')
+                    return this.station.run(c.id);
+                if (method === 'station.status')
+                    return this.station.view(c.id);
+                throw new ServiceError('invalid_field', 'Unsupported station method');
+            }
+            if (method.startsWith('local.') && method !== 'local.read') {
+                if (!this.localCoding ||
+                    !this.store.localCoding(id) ||
+                    this.children?.owned(id) ||
+                    !w.attempt)
+                    throw new ServiceError('local_denied', 'Local coding is not admitted', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                if (method === 'local.prepare')
+                    return this.localCoding.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                const c = this.localCoding.get(string(body.call_id, 'call_id'));
+                if (c.session_id !== id || c.epoch !== w.epoch || c.attempt_id !== w.attempt)
+                    throw new ServiceError('local_scope', 'Operation belongs to another invocation', 403);
+                if (method === 'local.run')
+                    return this.localCoding.run(c.id);
+                if (method === 'local.status')
+                    return this.localCoding.view(c.id);
+                throw new ServiceError('invalid_field', 'Unsupported local method');
+            }
+            if (method === 'local.read') {
+                if (!this.store.localWorkspace(id) || this.children?.owned(id) || !w.attempt)
+                    throw new ServiceError('workspace_denied', 'Local workspace is not admitted', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.store.taskGrantCheck?.(id);
+                const args = object(body.args);
+                const result = readLocalWorkspace(this.store.session(id).cwd, args);
+                this.store.transaction(() => this.store.event(id, 'workspace.read', {
+                    attempt_id: w.attempt,
+                    tool_call_id: string(body.tool_call_id, 'tool_call_id', 512),
+                    argument_digest: digest(args),
+                    result_digest: digest(result),
+                }));
+                return result;
+            }
             if (method === 'coding.files' || method === 'coding.command') {
-                if (this.children?.owned(id) || !this.coding || !this.codingBinding(id) || !w.attempt)
+                if (!this.coding || !this.codingBinding(id) || !w.attempt)
                     throw new Error('Coding authority is unavailable');
                 this.assertActive(id, w.epoch, w.attempt);
+                this.store.taskGrantCheck?.(id);
                 const args = object(body.args);
-                if (method === 'coding.files')
+                if (method === 'coding.files') {
+                    if (!this.codingBinding(id)?.files)
+                        throw new Error('File authority is unavailable');
+                    if (this.children?.owned(id) && args.path !== undefined)
+                        repositoryPath(args.path);
                     return this.coding.file(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), args);
+                }
                 if (!this.codingBinding(id)?.commands)
                     throw new Error('Command execution is unavailable');
                 if (args.action === 'start')
@@ -452,11 +832,18 @@ export class Supervisor extends EventEmitter {
             if (method.startsWith('child.')) {
                 if (!this.children || !w.attempt)
                     throw new Error('No active parent attempt');
-                this.assertActive(id, w.epoch, w.attempt);
-                if (method === 'child.spawn')
+                // spawn() resolves a saved step before testing a fresh invocation/grant.
+                if (method !== 'child.spawn')
+                    this.assertActive(id, w.epoch, w.attempt);
+                if (method === 'child.spawn') {
+                    if (Object.keys(body).some((key) => !['epoch', 'step_key', 'prompt', 'budget', 'authority', 'profile'].includes(key)))
+                        throw new ServiceError('invalid_child', 'Unsupported child admission field');
                     return this.children.spawn(id, w.epoch, w.attempt, string(body.step_key, 'step_key', 128), string(body.prompt, 'prompt', 32768), Number(body.budget), Array.isArray(body.authority)
                         ? body.authority.map((x) => string(x, 'authority', 128))
-                        : ['salaam_probe']);
+                        : body.profile
+                            ? []
+                            : ['salaam_probe'], body.profile === undefined ? undefined : string(body.profile, 'profile', 128));
+                }
                 if (method === 'child.list')
                     return this.children.list(id);
                 const child = string(body.child_id, 'child_id', 128);
@@ -494,22 +881,25 @@ export class Supervisor extends EventEmitter {
                     .get(String(body.source_key));
                 if (!source || source.session_id !== id || source.attempt_id !== (w.attempt ?? null))
                     throw new Error('Usage does not belong to this request');
-                this.store.transaction(() => this.store.usage.observe(id, string(body.source_key, 'source_key', 256), this.route.provider, this.route.model, body.usage, this.route.provider === 'anthropic' ? 'estimated' : 'known'));
+                this.store.transaction(() => this.store.usage.observe(id, string(body.source_key, 'source_key', 256), route.provider, route.model, body.usage, route.provider !== 'salaam-proof' ? 'estimated' : 'known'));
                 return { ok: true };
             }
             if (method === 'model') {
                 this.coding?.assertSafe(id);
                 this.store.taskGrantCheck?.(id);
-                if (body.provider !== this.route.provider ||
-                    body.model !== this.route.model ||
+                if (body.provider !== route.provider ||
+                    body.model !== route.model ||
                     body.context_digest !== textDigest(this.tasks.frame(id, w.binding)))
                     throw new Error('Provider or task context is invalid');
-                if (this.route.provider === 'anthropic') {
-                    validateClaudePayload(body.payload, this.route, this.tasks.frame(id, w.binding), this.tools(id));
+                if (route.provider !== 'salaam-proof') {
+                    if (w.providerOutputCap === undefined)
+                        throw new Error('Provider authentication was not admitted');
+                    this.assertSessionProviderSupported(id, w.providerOutputCap);
+                    validateProviderPayload(body.payload, route, this.tasks.frame(id, w.binding), this.tools(id), !w.providerOutputCap);
                     if (body.payload_digest !== digest(body.payload))
-                        throw new Error('Claude payload digest changed');
+                        throw new Error('Provider payload digest changed');
                 }
-                if (this.route.provider === 'salaam-proof') {
+                if (route.provider === 'salaam-proof') {
                     const payload = object(body.payload);
                     if (!Array.isArray(payload.messages))
                         throw new Error('Proof payload missing');
@@ -526,19 +916,21 @@ export class Supervisor extends EventEmitter {
                         body.payload_digest !== digest(payload))
                         throw new Error('Proof task payload is stale or invalid');
                 }
-                this.store.usage.admit(id, w.attempt, string(body.source_key, 'source_key', 256), String(body.provider), String(body.model), { input: Buffer.byteLength(JSON.stringify(body.payload)), output: this.route.max_tokens });
+                this.store.usage.admit(id, w.attempt, string(body.source_key, 'source_key', 256), String(body.provider), String(body.model), { input: Buffer.byteLength(JSON.stringify(body.payload)), output: route.max_tokens });
                 this.store.transaction(() => {
                     this.store.event(id, 'model.admitted', {
                         attempt_id: w.attempt ?? null,
                         epoch: w.epoch,
                         provider: body.provider,
                         context_digest: body.context_digest,
+                        context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
                         payload_digest: body.payload_digest,
                         task_version: this.tasks.state(id).version,
                     });
                 });
             }
             else if (method === 'policy' || method === 'tool') {
+                this.tasks.admitted?.assertFresh(id);
                 this.store.taskGrantCheck?.(id);
                 if (!this.tools(id).includes(String(body.tool)))
                     throw new Error('Tool is outside policy');
@@ -556,9 +948,52 @@ export class Supervisor extends EventEmitter {
         }
         catch (error) {
             this.store.taskBudgetDenied?.(id, error);
-            if (method.startsWith('coding.') &&
+            if (method.startsWith('station.') &&
+                error instanceof ServiceError &&
+                [
+                    'invalid_field',
+                    'request_conflict',
+                    'station_files_changed',
+                    'station_scope',
+                    'station_call_limit',
+                    'station_busy',
+                    'not_found',
+                ].includes(error.code))
+                throw error;
+            if ((method.startsWith('mcp.') || method.startsWith('toolkit.')) &&
+                error instanceof ServiceError &&
+                [
+                    'invalid_field',
+                    'invalid_mcp_call',
+                    'invalid_mcp_arguments',
+                    'invalid_mcp_server',
+                    'invalid_mcp_tool',
+                    'mcp_tool_unadmitted',
+                    'mcp_input_limit',
+                    'mcp_call_limit',
+                    'invalid_toolkit_request',
+                    'toolkit_busy',
+                    'request_conflict',
+                ].includes(error.code))
+                throw error;
+            if (method.startsWith('specialist.') &&
+                error instanceof ServiceError &&
+                [
+                    'not_found',
+                    'binary_file',
+                    'line_limit',
+                    'invalid_field',
+                    'local_busy',
+                    'workspace_read_failed',
+                    'unsafe_path',
+                    'request_conflict',
+                ].includes(error.code))
+                throw error;
+            if ((method.startsWith('coding.') || method.startsWith('local.')) &&
                 error instanceof ServiceError &&
                 [
+                    'local_busy',
+                    'workspace_read_failed',
                     'unsafe_path',
                     'workspace_changed',
                     'workspace_busy',
@@ -599,9 +1034,36 @@ export class Supervisor extends EventEmitter {
         }
     }
     inspect(id) {
+        if (this.store.execution.revocation(id)) {
+            const session = this.store.session(id);
+            return {
+                ...session,
+                state: ['starting', 'ready'].includes(session.state) ? 'unhealthy' : session.state,
+                capabilities: [],
+                error: 'Session execution authority revoked',
+            };
+        }
+        const externalChild = this.children?.owned(id);
+        if (externalChild && this.store.workerBoundary.view(externalChild.id).binding.external)
+            return this.store.session(id);
+        const child = this.children?.owned(id);
+        const cap = child
+            ? this.store.workerBoundary.view(child.id).binding.agent?.output_cap
+            : this.store.localWorkspace(id)
+                ? this.store.localOutputCap(id)
+                : undefined;
         const state = {
             ...this.store.session(id),
             provider_route: this.store.providerRoute(id) ?? undefined,
+            provider_capabilities: cap === undefined
+                ? this.providerCapabilities()
+                : {
+                    output_token_cap: cap,
+                    durable_tasks: true,
+                    warning: cap
+                        ? null
+                        : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+                },
         };
         const w = this.workers.get(id);
         if (w?.invalid)
@@ -623,6 +1085,8 @@ export class Supervisor extends EventEmitter {
         return state;
     }
     assertActive(id, epoch, attempt) {
+        this.tasks.admitted?.assertFresh(id);
+        this.store.execution.assert(id);
         const w = this.workers.get(id);
         if (!w ||
             !w.ready ||
@@ -645,19 +1109,69 @@ export class Supervisor extends EventEmitter {
         if (w)
             this.invalidate(w, 'Managed control failed: ' + error.message);
     }
+    async steer(id, request, text, controller) {
+        const input = { kind: 'steer', id, text };
+        const saved = this.store.cachedRequest('local-operator', request, input);
+        if (saved)
+            return saved;
+        const worker = this.workers.get(id);
+        const intent = this.store.request('local-operator', request, input, () => {
+            this.store.authorizeControl(id, controller);
+            this.store.execution.assert(id);
+            if (!this.store.localWorkspace(id) ||
+                !worker?.ready ||
+                worker.invalid ||
+                worker.stopping ||
+                !worker.pi ||
+                !worker.busy ||
+                !worker.attempt)
+                throw new ServiceError('steer_unavailable', 'Steering requires an active local model turn; use /queue for the next turn');
+            if (this.store.hasUnknown(id))
+                throw new ServiceError('outcome_unknown', 'Resolve uncertain work before steering');
+            if (this.store.attempt(worker.attempt).state !== 'running')
+                throw new ServiceError('steer_unavailable', 'The active attempt is no longer running');
+            const receipt = { state: 'delivery_unknown', attempt: worker.attempt, epoch: worker.epoch };
+            this.store.event(id, 'steering.saved', { ...receipt, text }, request);
+            return receipt;
+        });
+        try {
+            await worker.pi.command('steer', { message: text });
+            return this.store.transaction(() => {
+                const receipt = { ...intent, state: 'received' };
+                this.store.event(id, 'steering.received', receipt, request);
+                this.store.db
+                    .prepare('UPDATE requests SET response=? WHERE actor=? AND id=?')
+                    .run(JSON.stringify(receipt), 'local-operator', request);
+                return receipt;
+            });
+        }
+        catch (error) {
+            // The worker may have received it. Never retry this message across reconnect/restart.
+            this.store.transaction(() => this.store.event(id, 'steering.delivery_unknown', intent, request));
+            throw new ServiceError('steer_delivery_unknown', 'Steering receipt was lost. Inspect history; this steering request will not be replayed.');
+        }
+    }
     async cancelAttempt(attempt) {
         const work = this.store.attempt(attempt);
         const w = this.workers.get(work.session_id);
         if (!w?.pi || w.attempt !== attempt)
             return;
+        const settled = w.pi.waitFor('agent_settled', 5000);
+        void settled.catch(() => { });
         try {
             await w.pi.command('abort', {}, 5000);
+            await settled;
         }
         catch {
             await this.stopWorker(w);
         }
     }
+    attemptActive(attempt) {
+        const work = this.store.attempt(attempt), worker = this.workers.get(work.session_id);
+        return worker?.attempt === attempt && worker.busy;
+    }
     assertIdle(id) {
+        this.store.execution.assert(id);
         const w = this.workers.get(id);
         if (!w?.ready || w.invalid || w.stopping || !w.pi || this.store.session(id).state !== 'ready')
             throw new ServiceError('not_ready', 'A ready worker is required');
@@ -782,16 +1296,33 @@ export class Supervisor extends EventEmitter {
         // Approval deadlines belong to the journal, not an adapter-side timer.
         const settled = w.pi.waitFor('agent_settled', 0);
         void settled.catch(() => { });
-        let outcomeError = null;
+        let outcome;
         const record = (value) => {
             if (value.type === 'message_end') {
                 const message = object(value.message);
-                if (message.role === 'assistant' &&
-                    ['error', 'aborted'].includes(String(message.stopReason)))
-                    outcomeError = String(message.errorMessage ?? message.stopReason);
+                if (message.role === 'assistant') {
+                    const explicit = parseAcpFailure(message.salaamFailure);
+                    const candidate = explicit
+                        ? {
+                            version: 1,
+                            stopReason: explicit.kind === 'refusal'
+                                ? 'refusal'
+                                : explicit.kind === 'max_tokens'
+                                    ? 'max_tokens'
+                                    : 'error',
+                            failure: { ...explicit, message: redactFailureText(explicit.message, w.secrets) },
+                        }
+                        : providerOutcome(String(message.stopReason), String(message.errorMessage ?? ''), w.route, undefined, w.secrets);
+                    if (candidate.stopReason !== 'end_turn')
+                        outcome = candidate;
+                }
             }
             if (value.type === 'tool_execution_end' && value.isError === true)
-                outcomeError = 'Tool execution failed';
+                outcome ??= {
+                    version: 1,
+                    stopReason: 'error',
+                    failure: acpFailure(new ServiceError('tool_failed', 'Tool execution failed')),
+                };
         };
         w.pi.on('record', record);
         try {
@@ -805,17 +1336,22 @@ export class Supervisor extends EventEmitter {
                 throw new Error(w.invalid ?? 'Attempt aborted');
             const entries = await this.readEntries(w);
             const result = object((await w.pi.command('get_last_assistant_text')).data);
-            this.store.finish(work.attempt.id, outcomeError ? 'failed' : 'completed', String(result.text ?? ''), outcomeError, { epoch: w.epoch, ...entries });
+            this.childBoundary(id, w.epoch);
+            this.store.finish(work.attempt.id, outcome ? 'failed' : 'completed', String(result.text ?? ''), outcome?.failure?.message ?? null, { epoch: w.epoch, ...entries }, outcome);
         }
         catch (error) {
+            const message = redactFailureText(error.message, w.secrets);
             if (!w.stopping && !this.store.cancelled(work.attempt.id))
-                this.invalidate(w, 'Attempt interrupted: ' + error.message);
-            this.store.finish(work.attempt.id, 'interrupted', null, error.message);
+                this.invalidate(w, 'Attempt interrupted: ' + message);
+            this.store.finish(work.attempt.id, 'interrupted', null, message);
         }
         finally {
             w.pi.off('record', record);
             w.busy = false;
             delete w.attempt;
+            const child = this.children?.owned(id);
+            if (child && child.state !== 'accepted')
+                await this.stopWorker(w);
             this.emit('idle', id);
         }
         return true;
@@ -835,6 +1371,11 @@ export class Supervisor extends EventEmitter {
             leaf: typeof entries.leafId === 'string' ? entries.leafId : null,
         };
     }
+    async stopSession(id) {
+        const w = this.workers.get(id);
+        if (w)
+            await this.stopWorker(w);
+    }
     async stopWorker(w) {
         if (w.stopping) {
             await w.pi?.closed;
@@ -844,6 +1385,7 @@ export class Supervisor extends EventEmitter {
         w.ready = false;
         try {
             this.managed?.invalidateWorker(w.id, w.epoch);
+            this.cancelMcpWorker(w);
             this.children?.workerLost(w.id, 'Worker stopped before child dispatch');
         }
         catch {