@superjackfruitlabs/salaam 0.0.1 → 0.0.3

package/src/supervisor.ts

@@ -1,7 +1,7 @@
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { EventEmitter } from 'node:events';
-import { mkdirSync, existsSync, writeFileSync } from 'node:fs';
+import { mkdirSync, existsSync, writeFileSync, readFileSync, readlinkSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import {
   CAPABILITIES,
@@ -17,21 +17,48 @@ import {
   type Manifest,
   type Session,
 } from './protocol.js';
-import { PI_CLI, HOUSE_EXTENSION, POLICY_DIGEST, bundleDigest } from './config.js';
+import {
+  PI_CLI,
+  HOUSE_EXTENSION,
+  POLICY_DIGEST,
+  bundleDigest,
+  VERSION,
+  PI_VERSION,
+} from './config.js';
+import { readinessFingerprint } from './readiness-fingerprint.js';
 import { PiProcess, PiCommandError } from './pi.js';
 import type { Store } from './store.js';
 import type { ManagedWork } from './managed.js';
+import type { McpWork, McpWorkerBinding } from './mcp-work.js';
+import type { StationWork, StationBinding } from './station-work.js';
+import type { ToolkitWork, ToolkitWorkerBinding } from './toolkit-work.js';
 import type { ChildWork } from './children.js';
 import {
   OFFLINE_ROUTE,
   providerRoute,
-  validateClaudePayload,
+  providerHasOutputCap,
   type ProviderRoute,
 } from './provider-config.js';
 import type { TaskContext, Compaction } from './task-context.js';
-import { loadApiKey, validateApiKey } from './credentials.js';
+import { validateApiKey } from './credentials.js';
+import { resolveProviderAuth } from './provider-auth.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { validateProviderPayload } from './provider-payload.js';
 import { digest } from './protocol.js';
+import { readLocalWorkspace } from './local-workspace.js';
 import type { CodingWork } from './coding.js';
+import type { TaskLimits } from './task-policy.js';
+import { repositoryPath, type RepositorySnapshots } from './repository-snapshots.js';
+import type { TeamWork } from './team-work.js';
+import {
+  acpFailure,
+  credentialStrings,
+  parseAcpFailure,
+  providerOutcome,
+  redactFailureText,
+  toolMetadata,
+  type AttemptOutcome,
+} from './acp-outcome.js';
 
 export interface Launch {
   command: string;
@@ -49,8 +76,16 @@ export interface SupervisorOptions {
   effectsEnabled?: boolean;
   providerRoute?: ProviderRoute;
   anthropicApiKey?: string;
+  providerCredentials?: import('@earendil-works/pi-ai').CredentialStore;
+  providerEnvironment?: NodeJS.ProcessEnv;
 }
 interface Worker {
+  mcp?: McpWorkerBinding;
+  toolkit?: ToolkitWorkerBinding;
+  station?: StationBinding;
+  secrets?: string[];
+  route: ProviderRoute;
+  providerOutputCap?: boolean;
   id: string;
   epoch: number;
   token: string;
@@ -71,7 +106,40 @@ interface Worker {
   reject: (error: Error) => void;
 }
 export function processIdentity(pid: number): string | null {
+  if (!Number.isSafeInteger(pid) || pid < 1) return null;
   try {
+    if (process.platform === 'linux') {
+      // /proc stat field 22 is the boot-relative start tick. Pair it with boot,
+      // process group, executable and argv, and re-read to reject PID reuse mid-snapshot.
+      const path = `/proc/${pid}`;
+      const stat = () => {
+        const value = readFileSync(path + '/stat', 'utf8');
+        const end = value.lastIndexOf(') ');
+        if (end < 0 || !value.startsWith(pid + ' (')) throw Error('Invalid process stat');
+        const fields = value
+          .slice(end + 2)
+          .trim()
+          .split(/\s+/);
+        if (!/^\d+$/.test(fields[19] ?? '') || !/^\d+$/.test(fields[2] ?? ''))
+          throw Error('Invalid process start identity');
+        return { start: fields[19], group: fields[2], session: fields[3] };
+      };
+      const before = stat(),
+        boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim(),
+        executable = readlinkSync(path + '/exe'),
+        argv = readFileSync(path + '/cmdline');
+      if (
+        !/^[a-f0-9-]{36}$/.test(boot) ||
+        !argv.length ||
+        argv.length > 16384 ||
+        canonical(before) !== canonical(stat())
+      )
+        return null;
+      return (
+        'linux-proc-v1:' +
+        textDigest(canonical({ pid, boot, ...before, executable, argv: argv.toString('base64') }))
+      );
+    }
     return (
       execFileSync('/bin/ps', ['-ww', '-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
         encoding: 'utf8',
@@ -95,23 +163,96 @@ function groupExists(pid: number): boolean {
   }
 }
 export class Supervisor extends EventEmitter {
+  localCoding?: import('./local-coding.js').LocalCoding;
   tasks!: TaskContext;
   private compactionJobs = new Set<Promise<void>>();
   managed?: ManagedWork;
+  mcp?: McpWork;
+  toolkit?: ToolkitWork;
+  station?: StationWork;
   children?: ChildWork;
   coding?: CodingWork;
+  repositories?: RepositorySnapshots;
+  team?: TeamWork;
+  routeFor(id: string): ProviderRoute {
+    const child = this.children?.owned(id);
+    return child
+      ? (this.store.workerBoundary.view(child.id).binding.agent?.route ?? this.route)
+      : this.store.localWorkspace(id)
+        ? (this.store.providerRoute(id) ?? this.route)
+        : this.route;
+  }
+  async prepareProviderRoute(input: ProviderRoute) {
+    const route = structuredClone(input);
+    if (route.provider === 'salaam-proof') return { route, output_cap: true, auth: undefined };
+    const auth =
+      route.provider === 'anthropic' && this.apiKey
+        ? { auth: { apiKey: this.apiKey }, env: {} }
+        : await resolveProviderAuth(
+            route,
+            this.options.providerCredentials,
+            this.options.providerEnvironment,
+          );
+    const bound = bindProviderConfiguration(route, auth);
+    return { route: bound, output_cap: providerHasOutputCap(bound, auth), auth };
+  }
   private codingBinding(id: string): CodingBinding | undefined {
-    return this.children?.owned(id) ? undefined : this.coding?.binding(id);
+    const child = this.children?.owned(id),
+      coding = this.coding?.binding(id);
+    if (!child) return coding;
+    const binding = this.store.workerBoundary.view(child.id).binding;
+    return binding.isolation && coding
+      ? {
+          ...coding,
+          files: binding.tools.includes('salaam_files'),
+          commands: coding.commands && binding.tools.includes('salaam_command'),
+        }
+      : undefined;
   }
   private tools(id: string): string[] {
+    const child = this.children?.owned(id);
+    if (child) return JSON.parse(child.authority) as string[];
     return workerTools(
       !!this.options.effectsEnabled,
       !!this.children?.owned(id),
       this.codingBinding(id),
+      undefined,
+      !!this.mcp,
+      !!this.toolkit,
+      !!this.station,
+      this.store.localWorkspace(id),
+      this.store.localCoding(id),
     );
   }
+  private childBoundary(id: string, epoch: number) {
+    const child = this.children?.owned(id);
+    return child ? this.store.workerBoundary.assert(child, epoch, this.routeFor(id)) : undefined;
+  }
   readonly route: ProviderRoute;
   private apiKey?: string;
+  private outputCap = true;
+  private authInitialized = false;
+  providerCapabilities() {
+    return {
+      output_token_cap: this.outputCap,
+      durable_tasks: true,
+      warning: this.outputCap
+        ? null
+        : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+    };
+  }
+  assertTaskProviderSupported(limits: TaskLimits, outputCap = this.outputCap) {
+    if (!outputCap && (limits.token_units !== null || limits.output_token_bound !== null))
+      throw new ServiceError(
+        'provider_capability',
+        'This provider authentication has no output cap; set limits.token_units to null and omit output_token_bound',
+      );
+  }
+  assertSessionProviderSupported(id: string, outputCap = this.outputCap) {
+    const parent = this.children?.owned(id)?.parent_session ?? id;
+    const task = this.tasks.work?.forSession(parent);
+    if (task) this.assertTaskProviderSupported(task.limits, outputCap);
+  }
   readonly bootId = randomUUID();
   private workers = new Map<string, Worker>();
   private monitor: NodeJS.Timeout;
@@ -121,27 +262,55 @@ export class Supervisor extends EventEmitter {
     readonly options: SupervisorOptions,
   ) {
     super();
-    this.route = options.providerRoute ?? { ...OFFLINE_ROUTE };
+    this.route = structuredClone(options.providerRoute ?? OFFLINE_ROUTE);
     // Validate public configuration without trusting programmatic callers.
     const checked = providerRoute(
       this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider,
-      this.route.provider === 'anthropic' ? this.route.model : undefined,
-      this.route.provider === 'anthropic' ? this.route.max_tokens : undefined,
+      this.route.provider !== 'salaam-proof' ? this.route.model : undefined,
+      this.route.provider !== 'salaam-proof' ? this.route.max_tokens : undefined,
       this.route.workspace_id,
+      this.route.connection,
+      this.route.reasoning,
     );
     if (canonical(checked) !== canonical(this.route)) throw new Error('Invalid provider route');
-    if (this.route.provider === 'anthropic')
-      this.apiKey = options.anthropicApiKey
-        ? validateApiKey(options.anthropicApiKey)
-        : loadApiKey();
+    if (options.anthropicApiKey) this.apiKey = validateApiKey(options.anthropicApiKey);
     this.bundle = bundleDigest();
     this.monitor = setInterval(() => {
       for (const worker of this.workers.values())
-        if (worker.ready && Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
-          this.invalidate(worker, 'Worker heartbeat expired');
+        if (worker.ready) {
+          if (Date.now() - worker.lastBeat > (options.heartbeatTimeout ?? 2500))
+            this.invalidate(worker, 'Worker heartbeat expired');
+          const child = this.children?.owned(worker.id);
+          if (child?.state === 'accepted') {
+            try {
+              this.childBoundary(worker.id, worker.epoch);
+            } catch (error) {
+              this.invalidate(worker, 'Worker boundary revoked: ' + (error as Error).message);
+            }
+          }
+        }
     }, 250);
     this.monitor.unref();
   }
+  async providerAuth() {
+    if (this.route.provider === 'salaam-proof') return undefined;
+    if (this.route.provider === 'anthropic' && this.apiKey)
+      return { auth: { apiKey: this.apiKey }, env: {} };
+    const auth = await resolveProviderAuth(
+      this.route,
+      this.options.providerCredentials,
+      this.options.providerEnvironment,
+    );
+    Object.assign(this.route, bindProviderConfiguration(this.route, auth));
+    const outputCap = providerHasOutputCap(this.route, auth);
+    if (this.authInitialized && this.outputCap !== outputCap)
+      throw new Error(
+        'Provider output-cap capability changed; restart the service before using the new authentication',
+      );
+    this.outputCap = outputCap;
+    this.authInitialized = true;
+    return auth;
+  }
   async recover(): Promise<void> {
     const rows = this.store.db.prepare("SELECT * FROM workers WHERE state!='exited'").all() as {
       session_id: string;
@@ -177,6 +346,14 @@ export class Supervisor extends EventEmitter {
     }
   }
   async start(id: string): Promise<void> {
+    this.store.execution.assert(id);
+    const child = this.children?.owned(id);
+    if (child && this.store.workerBoundary.view(child.id).binding.runtime !== 'native-pi')
+      throw new ServiceError(
+        'external_worker_owned',
+        'Use the external worker lifecycle; Pi cannot claim this session',
+      );
+    const route = this.routeFor(id);
     const prior = this.workers.get(id);
     if (prior && !prior.stopping)
       throw new ServiceError('worker_exists', 'Worker already supervised');
@@ -193,7 +370,7 @@ export class Supervisor extends EventEmitter {
         'reconciliation_required',
         previous.error ?? 'Session requires reconciliation',
       );
-    this.store.bindRoute(id, this.route);
+    this.store.bindRoute(id, route);
     const epoch = this.store.allocate(id, this.bootId);
     let accept!: () => void;
     let reject!: (e: Error) => void;
@@ -204,6 +381,7 @@ export class Supervisor extends EventEmitter {
     const binding = randomBytes(16).toString('hex');
     const frame = this.tasks.frame(id, binding);
     const worker: Worker = {
+      route: structuredClone(route),
       id,
       epoch,
       token: randomBytes(32).toString('hex'),
@@ -220,10 +398,18 @@ export class Supervisor extends EventEmitter {
       reject,
     };
     this.workers.set(id, worker);
+    worker.secrets = [worker.token, ...(this.apiKey ? [this.apiKey] : [])];
     // Attach a rejection handler before spawn/identity checks can fail.
     void handshake.catch(() => {});
     let timer: NodeJS.Timeout | undefined;
     try {
+      const child = this.children?.owned(id);
+      if (this.mcp && !child) worker.mcp = await this.mcp.ready(id);
+      if (this.toolkit && !child) worker.toolkit = await this.toolkit.ready(id);
+      if (this.station && !child) worker.station = this.station.ready(id);
+      this.store.execution.assert(id);
+      if (worker.stopping || worker.invalid) throw new Error('Worker startup cancelled');
+      if (child) this.store.workerBoundary.claim(child, epoch, route);
       const workerDir = join(this.options.stateDir, 'workers', id);
       mkdirSync(join(workerDir, 'agent'), { recursive: true, mode: 0o700 });
       writeFileSync(
@@ -245,8 +431,14 @@ export class Supervisor extends EventEmitter {
         frame,
         effects: !!this.options.effectsEnabled && !this.children?.owned(id),
         child: !!this.children?.owned(id),
-        route: this.route,
+        worker_binding: this.childBoundary(id, epoch),
+        route: route,
         coding: this.codingBinding(id),
+        local: this.store.localWorkspace(id),
+        localCoding: this.store.localCoding(id),
+        ...(worker.mcp ? { mcp: worker.mcp } : {}),
+        ...(worker.toolkit ? { toolkit: worker.toolkit } : {}),
+        ...(worker.station ? { station: worker.station } : {}),
       };
       const args = [
         PI_CLI,
@@ -271,9 +463,9 @@ export class Supervisor extends EventEmitter {
         '--tools',
         this.tools(id).join(','),
         '--provider',
-        this.route.provider,
+        route.provider,
         '--model',
-        this.route.model,
+        route.model,
       ];
       if (previous.pi_session_file && existsSync(previous.pi_session_file)) {
         const index = args.indexOf('--session-id');
@@ -293,7 +485,7 @@ export class Supervisor extends EventEmitter {
         LANG: process.env.LANG ?? 'en_US.UTF-8',
         PI_CODING_AGENT_DIR: join(workerDir, 'agent'),
         SALAAM_WORKER_CONFIG: JSON.stringify(config),
-        ...(this.apiKey ? { ANTHROPIC_API_KEY: this.apiKey } : {}),
+        ...(route.connection?.configuration ?? {}),
       };
       worker.pi = (this.options.launch ?? ((x) => new PiProcess(x.command, x.args, x.cwd, x.env)))({
         command: process.execPath,
@@ -316,6 +508,15 @@ export class Supervisor extends EventEmitter {
                 attempt_id: worker.attempt,
                 worker_epoch: epoch,
                 ...observation,
+                ...(observation.phase === 'started'
+                  ? toolMetadata(
+                      observation.tool,
+                      observation.input,
+                      observation.tool === 'salaam_station'
+                        ? this.station?.config.workspace
+                        : this.coding?.workspaces.find(id)?.root,
+                    )
+                  : {}),
               });
               return { recorded: true };
             },
@@ -387,16 +588,37 @@ export class Supervisor extends EventEmitter {
       const file = typeof state.sessionFile === 'string' ? resolve(state.sessionFile) : null;
       if (!file || !file.startsWith(resolve(sessionDir) + '/'))
         throw new Error('Pi session is outside its managed directory');
-      if (
-        object(state.model).provider !== this.route.provider ||
-        object(state.model).id !== this.route.model
-      )
+      if (object(state.model).provider !== route.provider || object(state.model).id !== route.model)
         throw new Error('Pi selected an unapproved provider route');
       if (worker.invalid) throw new Error(worker.invalid);
       // Pi buffers setup-only entries until there is a conversation. Do not
       // persist a cursor into that ephemeral tree before its file exists.
       if (existsSync(file)) await this.syncEntries(worker);
-      this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id)), file);
+      this.store.execution.assert(id);
+      if (child) this.store.workerBoundary.accepted(child, epoch, route);
+      this.store.state(
+        id,
+        epoch,
+        'ready',
+        null,
+        workerCapabilities(this.codingBinding(id), this.tools(id)),
+        file,
+        readinessFingerprint({
+          session_id: id,
+          worker_epoch: epoch,
+          version: 1,
+          harness: 'salaam',
+          harness_version: VERSION,
+          pi_version: PI_VERSION,
+          bundle_digest: worker.bundle,
+          policy_digest: POLICY_DIGEST,
+          provider: route.provider,
+          model: route.model,
+          context_digest: textDigest(worker.frame),
+          context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
+          verification: 'pinned-readiness-handshake',
+        }),
+      );
       worker.ready = true;
       worker.lastBeat = Date.now();
     } catch (error) {
@@ -414,6 +636,7 @@ export class Supervisor extends EventEmitter {
     worker.reject(new Error(reason));
     try {
       this.managed?.invalidateWorker(worker.id, worker.epoch);
+      this.cancelMcpWorker(worker);
       this.children?.workerLost(worker.id, reason);
     } catch {
       /* in-memory readiness denial fences new dispatch */
@@ -425,6 +648,24 @@ export class Supervisor extends EventEmitter {
     }
     if (worker.pi) void this.stopWorker(worker).catch(() => {});
   }
+  private cancelMcpWorker(worker: Worker): void {
+    if (this.station && worker.attempt) {
+      this.store.transaction(() => this.station!.cancelInTransaction(worker.attempt!));
+      void this.station.abortAttempt(worker.attempt).catch(() => {
+        worker.invalid = 'Station stop is unconfirmed';
+      });
+    }
+    if (this.toolkit && worker.attempt) {
+      this.store.transaction(() => this.toolkit!.cancelInTransaction(worker.attempt!));
+      this.toolkit.abortAttempt(worker.attempt);
+    }
+    if (this.mcp && worker.attempt) {
+      this.store.transaction(() =>
+        this.mcp!.cancelInTransaction(worker.attempt!, 'worker_unavailable'),
+      );
+      this.mcp.abortAttempt(worker.attempt);
+    }
+  }
   private authenticate(
     id: string,
     token: string | undefined,
@@ -455,15 +696,26 @@ export class Supervisor extends EventEmitter {
     body: Record<string, unknown>,
   ): Promise<unknown> {
     const w = this.authenticate(id, token, body);
+    const route = w.route;
     if (method === 'failure') {
       if (!w.stopping) this.invalidate(w, 'Required extension failed');
       return { ok: true };
     }
     if (w.invalid || w.stopping)
       throw new ServiceError('worker_unavailable', 'Worker is not available', 403);
+    try {
+      this.store.execution.assert(id);
+      if (w.mcp) this.mcp!.assertBinding(id, w.mcp);
+      if (w.toolkit) this.toolkit!.assertBinding(id, w.toolkit);
+      if (w.station) this.station!.assertBinding(id, w.station);
+    } catch (error) {
+      this.invalidate(w, 'Session execution authority revoked');
+      throw error;
+    }
     if (method === 'handshake') {
       try {
         if (w.manifest) throw new Error('Duplicate handshake');
+        const boundary = this.childBoundary(id, w.epoch);
         const expected = {
           protocol_version: PROTOCOL_VERSION,
           bundle_digest: w.bundle,
@@ -471,13 +723,17 @@ export class Supervisor extends EventEmitter {
           session_id: id,
           pi_session_id: id,
           epoch: w.epoch,
-          capabilities: workerCapabilities(this.codingBinding(id)),
+          capabilities: workerCapabilities(this.codingBinding(id), this.tools(id)),
           tools: this.tools(id),
           active_tools: this.tools(id),
           ...(this.codingBinding(id) ? { coding: this.codingBinding(id) } : {}),
-          provider: this.route.provider,
-          route: this.route,
+          provider: route.provider,
+          route: route,
           context_digest: textDigest(w.frame),
+          ...(boundary ? { worker_binding: boundary } : {}),
+          ...(w.mcp ? { mcp: w.mcp } : {}),
+          ...(w.toolkit ? { toolkit: w.toolkit } : {}),
+          ...(w.station ? { station: w.station } : {}),
         };
         for (const [key, value] of Object.entries(expected))
           if (canonical(body[key]) !== canonical(value))
@@ -499,12 +755,256 @@ export class Supervisor extends EventEmitter {
     if (w.attempt && this.store.cancelled(w.attempt))
       throw new ServiceError('attempt_cancelled', 'Attempt cancellation revoked further grants');
     try {
+      this.childBoundary(id, w.epoch);
+      if (method.startsWith('team.')) {
+        const child = this.children?.owned(id);
+        if (!child || !this.team || !w.attempt) throw new Error('No owned team assignment');
+        const binding = this.store.workerBoundary.view(child.id).binding;
+        if (!binding.assignment || !binding.tools.includes('salaam_team'))
+          throw new Error('No team message authority');
+        const authorize = () => {
+          this.assertActive(id, w.epoch, w.attempt!);
+          this.team!.assert(binding);
+          this.store.taskGrantCheck?.(id);
+        };
+        authorize();
+        const request = string(body.request_id, 'request_id', 128),
+          assignment = binding.assignment.id;
+        if (method === 'team.send')
+          return this.team.send(
+            binding.owner_task!,
+            assignment,
+            string(body.recipient, 'recipient', 128),
+            string(body.text, 'text', 4096),
+            request,
+            authorize,
+          );
+        if (method === 'team.receive') return this.team.receive(assignment, request, authorize);
+        if (method === 'team.ack')
+          return this.team.acknowledge(
+            assignment,
+            string(body.message_id, 'message_id', 128),
+            request,
+            authorize,
+          );
+        throw new ServiceError('invalid_field', 'Unknown team method', 400);
+      }
+      if (method === 'specialist.read' || method === 'specialist.report') {
+        const child = this.children?.owned(id);
+        if (!child || !this.repositories || !w.attempt)
+          throw new Error('No active specialist assignment');
+        this.assertActive(id, w.epoch, w.attempt);
+        const binding = this.store.workerBoundary.view(child.id).binding;
+        const tool = method === 'specialist.read' ? 'salaam_repository' : 'salaam_findings';
+        if (!binding.tools.includes(tool)) throw new Error('Specialist authority is unavailable');
+        this.store.taskGrantCheck?.(id);
+        if (method === 'specialist.report') return this.repositories.report(binding, body.findings);
+        const args = object(body.args);
+        return this.store.request(
+          `specialist-read:${id}:${w.epoch}`,
+          string(body.tool_call_id, 'tool_call_id', 512),
+          args,
+          () => {
+            const result = this.repositories!.read(binding, args);
+            this.store.event(id, 'specialist.read', {
+              attempt_id: w.attempt,
+              snapshot_digest: binding.repository?.digest,
+              argument_digest: digest(args),
+              result_digest: digest(result),
+            });
+            return result;
+          },
+        );
+      }
+      if (method === 'provider.auth') {
+        if (!this.children?.owned(id) && !this.store.localWorkspace(id)) {
+          const auth = await this.providerAuth();
+          if (canonical(this.route) !== canonical(route)) throw new Error('Provider route changed');
+          w.providerOutputCap = this.outputCap;
+          this.assertSessionProviderSupported(id, this.outputCap);
+          return auth;
+        }
+        const prepared = await this.prepareProviderRoute(route);
+        const expectedCap = this.children?.owned(id)
+          ? this.store.workerBoundary.view(this.children.owned(id)!.id).binding.agent?.output_cap
+          : (this.store.localOutputCap(id) ?? this.outputCap);
+        if (
+          canonical(prepared.route) !== canonical(route) ||
+          (expectedCap ?? this.outputCap) !== prepared.output_cap
+        )
+          throw new Error('Provider capability or route changed; restart or renew admission');
+        w.providerOutputCap = prepared.output_cap;
+        this.assertSessionProviderSupported(id, prepared.output_cap);
+        const auth = prepared.auth;
+        w.secrets = [...new Set([...(w.secrets ?? []), ...credentialStrings(auth)])];
+        return auth;
+      }
+      if (method.startsWith('toolkit.')) {
+        if (!this.toolkit || !w.toolkit || !w.attempt || this.children?.owned(id))
+          throw new ServiceError('toolkit_disabled', 'Worker has no native Toolkit authority', 403);
+        this.assertActive(id, w.epoch, w.attempt);
+        this.toolkit.assertBinding(id, w.toolkit);
+        this.store.taskGrantCheck?.(id);
+        if (method === 'toolkit.catalog')
+          return this.toolkit.catalog(
+            id,
+            w.toolkit,
+            body.category === undefined ? undefined : string(body.category, 'category', 128),
+            body.action === undefined ? undefined : string(body.action, 'action', 128),
+          );
+        if (!['toolkit.prepare', 'toolkit.run', 'toolkit.status'].includes(method))
+          throw new ServiceError('invalid_field', 'Unsupported native Toolkit action', 400);
+        const call =
+          method === 'toolkit.prepare'
+            ? this.toolkit.prepare(
+                id,
+                w.epoch,
+                w.attempt,
+                string(body.tool_call_id, 'tool_call_id', 512),
+                body.args,
+              )
+            : this.toolkit.calls.get(string(body.call_id, 'call_id', 128));
+        if (
+          call.session_id !== id ||
+          call.worker_epoch !== w.epoch ||
+          call.attempt_id !== w.attempt
+        )
+          throw new ServiceError(
+            'mcp_call_scope',
+            'Native Toolkit call belongs to another invocation',
+            403,
+          );
+        if (method === 'toolkit.run') this.toolkit.start(call.id, id, w.epoch, w.attempt);
+        return this.toolkit.view(call.id);
+      }
+      if (method.startsWith('mcp.')) {
+        if (!this.mcp || !w.mcp || !w.attempt || this.children?.owned(id))
+          throw new ServiceError('mcp_disabled', 'Worker has no managed MCP authority', 403);
+        this.assertActive(id, w.epoch, w.attempt);
+        this.mcp.assertBinding(id, w.mcp);
+        this.store.taskGrantCheck?.(id);
+        if (method === 'mcp.catalog')
+          return this.mcp.describe(
+            id,
+            w.mcp,
+            body.server === undefined ? undefined : string(body.server, 'server', 128),
+            body.tool === undefined ? undefined : string(body.tool, 'tool', 128),
+          );
+        const call =
+          method === 'mcp.prepare'
+            ? this.mcp.prepare(
+                id,
+                w.epoch,
+                w.attempt,
+                string(body.tool_call_id, 'tool_call_id', 512),
+                body.args,
+              )
+            : this.mcp.get(string(body.call_id, 'call_id', 128));
+        if (
+          call.session_id !== id ||
+          call.worker_epoch !== w.epoch ||
+          call.attempt_id !== w.attempt
+        )
+          throw new ServiceError('mcp_call_scope', 'MCP call belongs to another invocation', 403);
+        if (!['mcp.prepare', 'mcp.run', 'mcp.status'].includes(method))
+          throw new ServiceError('invalid_field', 'Unsupported MCP action', 400);
+        const current =
+          method === 'mcp.run' ? this.mcp.start(call.id, id, w.epoch, w.attempt) : call;
+        return {
+          call: current,
+          result: current.result_artifact
+            ? JSON.parse(this.mcp.artifacts.read(current.result_artifact))
+            : null,
+          ...(current.operation_id && this.managed
+            ? {
+                operation: this.managed.operation(current.operation_id),
+                approval: this.managed.forOperation(current.operation_id),
+              }
+            : {}),
+        };
+      }
+      if (method.startsWith('station.')) {
+        if (!this.station || !w.station || !w.attempt || this.children?.owned(id))
+          throw new ServiceError('station_disabled', 'Station execution is unavailable');
+        this.assertActive(id, w.epoch, w.attempt);
+        this.store.taskGrantCheck?.(id);
+        if (method === 'station.read')
+          return this.station.read(
+            id,
+            w.epoch,
+            w.attempt,
+            string(body.tool_call_id, 'tool_call_id', 512),
+            object(body.args),
+          );
+        if (method === 'station.prepare')
+          return this.station.prepare(
+            id,
+            w.epoch,
+            w.attempt,
+            string(body.tool_call_id, 'tool_call_id', 512),
+            object(body.args),
+          );
+        const c = this.station.get(string(body.call_id, 'call_id', 128));
+        if (c.session_id !== id || c.worker_epoch !== w.epoch || c.attempt_id !== w.attempt)
+          throw new ServiceError(
+            'station_scope',
+            'Station call belongs to another invocation',
+            403,
+          );
+        if (method === 'station.run') return this.station.run(c.id);
+        if (method === 'station.status') return this.station.view(c.id);
+        throw new ServiceError('invalid_field', 'Unsupported station method');
+      }
+      if (method.startsWith('local.') && method !== 'local.read') {
+        if (
+          !this.localCoding ||
+          !this.store.localCoding(id) ||
+          this.children?.owned(id) ||
+          !w.attempt
+        )
+          throw new ServiceError('local_denied', 'Local coding is not admitted', 403);
+        this.assertActive(id, w.epoch, w.attempt);
+        if (method === 'local.prepare')
+          return this.localCoding.prepare(
+            id,
+            w.epoch,
+            w.attempt,
+            string(body.tool_call_id, 'tool_call_id', 512),
+            object(body.args),
+          );
+        const c = this.localCoding.get(string(body.call_id, 'call_id'));
+        if (c.session_id !== id || c.epoch !== w.epoch || c.attempt_id !== w.attempt)
+          throw new ServiceError('local_scope', 'Operation belongs to another invocation', 403);
+        if (method === 'local.run') return this.localCoding.run(c.id);
+        if (method === 'local.status') return this.localCoding.view(c.id);
+        throw new ServiceError('invalid_field', 'Unsupported local method');
+      }
+      if (method === 'local.read') {
+        if (!this.store.localWorkspace(id) || this.children?.owned(id) || !w.attempt)
+          throw new ServiceError('workspace_denied', 'Local workspace is not admitted', 403);
+        this.assertActive(id, w.epoch, w.attempt);
+        this.store.taskGrantCheck?.(id);
+        const args = object(body.args);
+        const result = readLocalWorkspace(this.store.session(id).cwd, args);
+        this.store.transaction(() =>
+          this.store.event(id, 'workspace.read', {
+            attempt_id: w.attempt,
+            tool_call_id: string(body.tool_call_id, 'tool_call_id', 512),
+            argument_digest: digest(args),
+            result_digest: digest(result),
+          }),
+        );
+        return result;
+      }
       if (method === 'coding.files' || method === 'coding.command') {
-        if (this.children?.owned(id) || !this.coding || !this.codingBinding(id) || !w.attempt)
+        if (!this.coding || !this.codingBinding(id) || !w.attempt)
           throw new Error('Coding authority is unavailable');
         this.assertActive(id, w.epoch, w.attempt);
+        this.store.taskGrantCheck?.(id);
         const args = object(body.args);
-        if (method === 'coding.files')
+        if (method === 'coding.files') {
+          if (!this.codingBinding(id)?.files) throw new Error('File authority is unavailable');
+          if (this.children?.owned(id) && args.path !== undefined) repositoryPath(args.path);
           return this.coding.file(
             id,
             w.epoch,
@@ -512,6 +1012,7 @@ export class Supervisor extends EventEmitter {
             string(body.tool_call_id, 'tool_call_id', 512),
             args,
           );
+        }
         if (!this.codingBinding(id)?.commands) throw new Error('Command execution is unavailable');
         if (args.action === 'start')
           return this.coding.start(id, w.attempt, args, () =>
@@ -557,8 +1058,16 @@ export class Supervisor extends EventEmitter {
       }
       if (method.startsWith('child.')) {
         if (!this.children || !w.attempt) throw new Error('No active parent attempt');
-        this.assertActive(id, w.epoch, w.attempt);
-        if (method === 'child.spawn')
+        // spawn() resolves a saved step before testing a fresh invocation/grant.
+        if (method !== 'child.spawn') this.assertActive(id, w.epoch, w.attempt);
+        if (method === 'child.spawn') {
+          if (
+            Object.keys(body).some(
+              (key) =>
+                !['epoch', 'step_key', 'prompt', 'budget', 'authority', 'profile'].includes(key),
+            )
+          )
+            throw new ServiceError('invalid_child', 'Unsupported child admission field');
           return this.children.spawn(
             id,
             w.epoch,
@@ -568,8 +1077,12 @@ export class Supervisor extends EventEmitter {
             Number(body.budget),
             Array.isArray(body.authority)
               ? body.authority.map((x) => string(x, 'authority', 128))
-              : ['salaam_probe'],
+              : body.profile
+                ? []
+                : ['salaam_probe'],
+            body.profile === undefined ? undefined : string(body.profile, 'profile', 128),
           );
+        }
         if (method === 'child.list') return this.children.list(id);
         const child = string(body.child_id, 'child_id', 128);
         if (method === 'child.inspect') return this.children.inspect(id, child);
@@ -614,10 +1127,10 @@ export class Supervisor extends EventEmitter {
           this.store.usage.observe(
             id,
             string(body.source_key, 'source_key', 256),
-            this.route.provider,
-            this.route.model,
+            route.provider,
+            route.model,
             body.usage,
-            this.route.provider === 'anthropic' ? 'estimated' : 'known',
+            route.provider !== 'salaam-proof' ? 'estimated' : 'known',
           ),
         );
         return { ok: true };
@@ -626,22 +1139,26 @@ export class Supervisor extends EventEmitter {
         this.coding?.assertSafe(id);
         this.store.taskGrantCheck?.(id);
         if (
-          body.provider !== this.route.provider ||
-          body.model !== this.route.model ||
+          body.provider !== route.provider ||
+          body.model !== route.model ||
           body.context_digest !== textDigest(this.tasks.frame(id, w.binding))
         )
           throw new Error('Provider or task context is invalid');
-        if (this.route.provider === 'anthropic') {
-          validateClaudePayload(
+        if (route.provider !== 'salaam-proof') {
+          if (w.providerOutputCap === undefined)
+            throw new Error('Provider authentication was not admitted');
+          this.assertSessionProviderSupported(id, w.providerOutputCap);
+          validateProviderPayload(
             body.payload,
-            this.route,
+            route,
             this.tasks.frame(id, w.binding),
             this.tools(id),
+            !w.providerOutputCap,
           );
           if (body.payload_digest !== digest(body.payload))
-            throw new Error('Claude payload digest changed');
+            throw new Error('Provider payload digest changed');
         }
-        if (this.route.provider === 'salaam-proof') {
+        if (route.provider === 'salaam-proof') {
           const payload = object(body.payload);
           if (!Array.isArray(payload.messages)) throw new Error('Proof payload missing');
           const last = object(payload.messages.at(-1));
@@ -666,7 +1183,7 @@ export class Supervisor extends EventEmitter {
           string(body.source_key, 'source_key', 256),
           String(body.provider),
           String(body.model),
-          { input: Buffer.byteLength(JSON.stringify(body.payload)), output: this.route.max_tokens },
+          { input: Buffer.byteLength(JSON.stringify(body.payload)), output: route.max_tokens },
         );
         this.store.transaction(() => {
           this.store.event(id, 'model.admitted', {
@@ -674,11 +1191,13 @@ export class Supervisor extends EventEmitter {
             epoch: w.epoch,
             provider: body.provider,
             context_digest: body.context_digest,
+            context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
             payload_digest: body.payload_digest,
             task_version: this.tasks.state(id).version,
           });
         });
       } else if (method === 'policy' || method === 'tool') {
+        this.tasks.admitted?.assertFresh(id);
         this.store.taskGrantCheck?.(id);
         if (!this.tools(id).includes(String(body.tool))) throw new Error('Tool is outside policy');
         this.store.transaction(() => {
@@ -693,9 +1212,58 @@ export class Supervisor extends EventEmitter {
     } catch (error) {
       this.store.taskBudgetDenied?.(id, error);
       if (
-        method.startsWith('coding.') &&
+        method.startsWith('station.') &&
         error instanceof ServiceError &&
         [
+          'invalid_field',
+          'request_conflict',
+          'station_files_changed',
+          'station_scope',
+          'station_call_limit',
+          'station_busy',
+          'not_found',
+        ].includes(error.code)
+      )
+        throw error;
+      if (
+        (method.startsWith('mcp.') || method.startsWith('toolkit.')) &&
+        error instanceof ServiceError &&
+        [
+          'invalid_field',
+          'invalid_mcp_call',
+          'invalid_mcp_arguments',
+          'invalid_mcp_server',
+          'invalid_mcp_tool',
+          'mcp_tool_unadmitted',
+          'mcp_input_limit',
+          'mcp_call_limit',
+          'invalid_toolkit_request',
+          'toolkit_busy',
+          'request_conflict',
+        ].includes(error.code)
+      )
+        throw error;
+      if (
+        method.startsWith('specialist.') &&
+        error instanceof ServiceError &&
+        [
+          'not_found',
+          'binary_file',
+          'line_limit',
+          'invalid_field',
+          'local_busy',
+          'workspace_read_failed',
+          'unsafe_path',
+          'request_conflict',
+        ].includes(error.code)
+      )
+        throw error;
+      if (
+        (method.startsWith('coding.') || method.startsWith('local.')) &&
+        error instanceof ServiceError &&
+        [
+          'local_busy',
+          'workspace_read_failed',
           'unsafe_path',
           'workspace_changed',
           'workspace_busy',
@@ -740,9 +1308,37 @@ export class Supervisor extends EventEmitter {
     }
   }
   inspect(id: string): Session {
+    if (this.store.execution.revocation(id)) {
+      const session = this.store.session(id);
+      return {
+        ...session,
+        state: ['starting', 'ready'].includes(session.state) ? 'unhealthy' : session.state,
+        capabilities: [],
+        error: 'Session execution authority revoked',
+      };
+    }
+    const externalChild = this.children?.owned(id);
+    if (externalChild && this.store.workerBoundary.view(externalChild.id).binding.external)
+      return this.store.session(id);
+    const child = this.children?.owned(id);
+    const cap = child
+      ? this.store.workerBoundary.view(child.id).binding.agent?.output_cap
+      : this.store.localWorkspace(id)
+        ? this.store.localOutputCap(id)
+        : undefined;
     const state = {
       ...this.store.session(id),
       provider_route: this.store.providerRoute(id) ?? undefined,
+      provider_capabilities:
+        cap === undefined
+          ? this.providerCapabilities()
+          : {
+              output_token_cap: cap,
+              durable_tasks: true,
+              warning: cap
+                ? null
+                : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
+            },
     };
     const w = this.workers.get(id);
     if (w?.invalid) return { ...state, state: 'unhealthy', capabilities: [], error: w.invalid };
@@ -763,6 +1359,8 @@ export class Supervisor extends EventEmitter {
     return state;
   }
   assertActive(id: string, epoch: number, attempt: string): void {
+    this.tasks.admitted?.assertFresh(id);
+    this.store.execution.assert(id);
     const w = this.workers.get(id);
     if (
       !w ||
@@ -785,17 +1383,81 @@ export class Supervisor extends EventEmitter {
     const w = this.workers.get(id);
     if (w) this.invalidate(w, 'Managed control failed: ' + error.message);
   }
+  async steer(
+    id: string,
+    request: string,
+    text: string,
+    controller: import('./protocol.js').Controller,
+  ) {
+    const input = { kind: 'steer', id, text };
+    const saved = this.store.cachedRequest<{ state: string }>('local-operator', request, input);
+    if (saved) return saved;
+    const worker = this.workers.get(id);
+    const intent = this.store.request('local-operator', request, input, () => {
+      this.store.authorizeControl(id, controller);
+      this.store.execution.assert(id);
+      if (
+        !this.store.localWorkspace(id) ||
+        !worker?.ready ||
+        worker.invalid ||
+        worker.stopping ||
+        !worker.pi ||
+        !worker.busy ||
+        !worker.attempt
+      )
+        throw new ServiceError(
+          'steer_unavailable',
+          'Steering requires an active local model turn; use /queue for the next turn',
+        );
+      if (this.store.hasUnknown(id))
+        throw new ServiceError('outcome_unknown', 'Resolve uncertain work before steering');
+      if (this.store.attempt(worker.attempt).state !== 'running')
+        throw new ServiceError('steer_unavailable', 'The active attempt is no longer running');
+      const receipt = { state: 'delivery_unknown', attempt: worker.attempt, epoch: worker.epoch };
+      this.store.event(id, 'steering.saved', { ...receipt, text }, request);
+      return receipt;
+    });
+    try {
+      await worker!.pi!.command('steer', { message: text });
+      return this.store.transaction(() => {
+        const receipt = { ...intent, state: 'received' };
+        this.store.event(id, 'steering.received', receipt, request);
+        this.store.db
+          .prepare('UPDATE requests SET response=? WHERE actor=? AND id=?')
+          .run(JSON.stringify(receipt), 'local-operator', request);
+        return receipt;
+      });
+    } catch (error) {
+      // The worker may have received it. Never retry this message across reconnect/restart.
+      this.store.transaction(() =>
+        this.store.event(id, 'steering.delivery_unknown', intent, request),
+      );
+      throw new ServiceError(
+        'steer_delivery_unknown',
+        'Steering receipt was lost. Inspect history; this steering request will not be replayed.',
+      );
+    }
+  }
   async cancelAttempt(attempt: string): Promise<void> {
     const work = this.store.attempt(attempt);
     const w = this.workers.get(work.session_id);
     if (!w?.pi || w.attempt !== attempt) return;
+    const settled = w.pi.waitFor('agent_settled', 5000);
+    void settled.catch(() => {});
     try {
       await w.pi.command('abort', {}, 5000);
+      await settled;
     } catch {
       await this.stopWorker(w);
     }
   }
+  attemptActive(attempt: string): boolean {
+    const work = this.store.attempt(attempt),
+      worker = this.workers.get(work.session_id);
+    return worker?.attempt === attempt && worker.busy;
+  }
   assertIdle(id: string): Worker {
+    this.store.execution.assert(id);
     const w = this.workers.get(id);
     if (!w?.ready || w.invalid || w.stopping || !w.pi || this.store.session(id).state !== 'ready')
       throw new ServiceError('not_ready', 'A ready worker is required');
@@ -919,18 +1581,39 @@ export class Supervisor extends EventEmitter {
     // Approval deadlines belong to the journal, not an adapter-side timer.
     const settled = w.pi.waitFor('agent_settled', 0);
     void settled.catch(() => {});
-    let outcomeError: string | null = null;
+    let outcome: AttemptOutcome | undefined;
     const record = (value: Record<string, unknown>) => {
       if (value.type === 'message_end') {
         const message = object(value.message);
-        if (
-          message.role === 'assistant' &&
-          ['error', 'aborted'].includes(String(message.stopReason))
-        )
-          outcomeError = String(message.errorMessage ?? message.stopReason);
+        if (message.role === 'assistant') {
+          const explicit = parseAcpFailure(message.salaamFailure);
+          const candidate: AttemptOutcome = explicit
+            ? {
+                version: 1,
+                stopReason:
+                  explicit.kind === 'refusal'
+                    ? 'refusal'
+                    : explicit.kind === 'max_tokens'
+                      ? 'max_tokens'
+                      : 'error',
+                failure: { ...explicit, message: redactFailureText(explicit.message, w.secrets) },
+              }
+            : providerOutcome(
+                String(message.stopReason),
+                String(message.errorMessage ?? ''),
+                w.route,
+                undefined,
+                w.secrets,
+              );
+          if (candidate.stopReason !== 'end_turn') outcome = candidate;
+        }
       }
       if (value.type === 'tool_execution_end' && value.isError === true)
-        outcomeError = 'Tool execution failed';
+        outcome ??= {
+          version: 1,
+          stopReason: 'error',
+          failure: acpFailure(new ServiceError('tool_failed', 'Tool execution failed')),
+        };
     };
     w.pi.on('record', record);
     try {
@@ -942,21 +1625,26 @@ export class Supervisor extends EventEmitter {
       if (w.invalid || end.aborted) throw new Error(w.invalid ?? 'Attempt aborted');
       const entries = await this.readEntries(w);
       const result = object((await w.pi.command('get_last_assistant_text')).data);
+      this.childBoundary(id, w.epoch);
       this.store.finish(
         work.attempt.id,
-        outcomeError ? 'failed' : 'completed',
+        outcome ? 'failed' : 'completed',
         String(result.text ?? ''),
-        outcomeError,
+        outcome?.failure?.message ?? null,
         { epoch: w.epoch, ...entries },
+        outcome,
       );
     } catch (error) {
+      const message = redactFailureText((error as Error).message, w.secrets);
       if (!w.stopping && !this.store.cancelled(work.attempt.id))
-        this.invalidate(w, 'Attempt interrupted: ' + (error as Error).message);
-      this.store.finish(work.attempt.id, 'interrupted', null, (error as Error).message);
+        this.invalidate(w, 'Attempt interrupted: ' + message);
+      this.store.finish(work.attempt.id, 'interrupted', null, message);
     } finally {
       w.pi.off('record', record);
       w.busy = false;
       delete w.attempt;
+      const child = this.children?.owned(id);
+      if (child && child.state !== 'accepted') await this.stopWorker(w);
       this.emit('idle', id);
     }
     return true;
@@ -982,6 +1670,10 @@ export class Supervisor extends EventEmitter {
       leaf: typeof entries.leafId === 'string' ? entries.leafId : null,
     };
   }
+  async stopSession(id: string): Promise<void> {
+    const w = this.workers.get(id);
+    if (w) await this.stopWorker(w);
+  }
   private async stopWorker(w: Worker): Promise<void> {
     if (w.stopping) {
       await w.pi?.closed;
@@ -991,6 +1683,7 @@ export class Supervisor extends EventEmitter {
     w.ready = false;
     try {
       this.managed?.invalidateWorker(w.id, w.epoch);
+      this.cancelMcpWorker(w);
       this.children?.workerLost(w.id, 'Worker stopped before child dispatch');
     } catch {
       /* shutdown still owns and stops the worker */