@superjackfruitlabs/salaam 0.0.2 → 0.0.4

package/dist/src/supervisor.js

@@ -1,20 +1,65 @@
+import { BoardReads } from './board-reads.js';
+import { HostBreaker, callThroughBreaker } from './host-breaker.js';
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { EventEmitter } from 'node:events';
-import { mkdirSync, existsSync, writeFileSync } from 'node:fs';
+import { mkdirSync, existsSync, writeFileSync, readFileSync, readlinkSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { PROTOCOL_VERSION, canonical, object, ServiceError, textDigest, workerTools, workerCapabilities, string, } from './protocol.js';
-import { PI_CLI, HOUSE_EXTENSION, POLICY_DIGEST, bundleDigest } from './config.js';
+import { PI_CLI, HOUSE_EXTENSION, POLICY_DIGEST, bundleDigest, VERSION, PI_VERSION, } from './config.js';
+import { readinessFingerprint } from './readiness-fingerprint.js';
 import { PiProcess, PiCommandError } from './pi.js';
+import { mergeMcpProvenance } from './operator-mcp.js';
 import { OFFLINE_ROUTE, providerRoute, providerHasOutputCap, } from './provider-config.js';
 import { validateApiKey } from './credentials.js';
 import { resolveProviderAuth } from './provider-auth.js';
 import { bindProviderConfiguration } from './provider-model.js';
 import { validateProviderPayload } from './provider-payload.js';
 import { digest } from './protocol.js';
+import { readLocalWorkspace } from './local-workspace.js';
 import { repositoryPath } from './repository-snapshots.js';
+import { acpFailure, credentialStrings, parseAcpFailure, providerOutcome, redactFailureText, toolMetadata, } from './acp-outcome.js';
 export function processIdentity(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return null;
     try {
+        if (process.platform === 'linux') {
+            // /proc stat field 22 is the boot-relative start tick. Pair it with boot,
+            // process group, executable and argv, and re-read to reject PID reuse mid-snapshot.
+            const path = `/proc/${pid}`;
+            const stat = () => {
+                const value = readFileSync(path + '/stat', 'utf8');
+                const end = value.lastIndexOf(') ');
+                if (end < 0 || !value.startsWith(pid + ' ('))
+                    throw Error('Invalid process stat');
+                const fields = value
+                    .slice(end + 2)
+                    .trim()
+                    .split(/\s+/);
+                if (!/^\d+$/.test(fields[19] ?? '') || !/^\d+$/.test(fields[2] ?? ''))
+                    throw Error('Invalid process start identity');
+                return { start: fields[19], group: fields[2], session: fields[3] };
+            };
+            const before = stat(), boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim(), 
+            // A tools-user launcher (sudo) is root-owned; its exe link is unreadable to the service.
+            executable = (() => {
+                try {
+                    return readlinkSync(path + '/exe');
+                }
+                catch (error) {
+                    if (error.code === 'EACCES')
+                        return 'unreadable';
+                    throw error;
+                }
+            })(), argv = readFileSync(path + '/cmdline');
+            if (!/^[a-f0-9-]{36}$/.test(boot) ||
+                !argv.length ||
+                argv.length > 16384 ||
+                canonical(before) !== canonical(stat()))
+                return null;
+            return ('linux-proc-v1:' +
+                textDigest(canonical({ pid, boot, ...before, executable, argv: argv.toString('base64') })));
+        }
         return (execFileSync('/bin/ps', ['-ww', '-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
@@ -41,9 +86,17 @@ function groupExists(pid) {
 export class Supervisor extends EventEmitter {
     store;
     options;
+    localCoding;
     tasks;
     compactionJobs = new Set();
+    fetchBreaker = new HostBreaker();
     managed;
+    mcp;
+    operatorMcp;
+    /** Item 9: the host's pinned persona, given to every worker on this host. */
+    persona;
+    toolkit;
+    station;
     children;
     coding;
     repositories;
@@ -52,7 +105,9 @@ export class Supervisor extends EventEmitter {
         const child = this.children?.owned(id);
         return child
             ? (this.store.workerBoundary.view(child.id).binding.agent?.route ?? this.route)
-            : this.route;
+            : this.store.localWorkspace(id)
+                ? (this.store.providerRoute(id) ?? this.route)
+                : this.route;
     }
     async prepareProviderRoute(input) {
         const route = structuredClone(input);
@@ -81,7 +136,26 @@ export class Supervisor extends EventEmitter {
         const child = this.children?.owned(id);
         if (child)
             return JSON.parse(child.authority);
-        return workerTools(!!this.options.effectsEnabled, !!this.children?.owned(id), this.codingBinding(id));
+        return workerTools(!!this.options.effectsEnabled, !!this.children?.owned(id), this.codingBinding(id), undefined, !!this.mcp, !!this.toolkit, !!this.station, this.store.localWorkspace(id), this.store.localCoding(id), this.declaredMcp(id));
+    }
+    /** Operator-declared MCP reaches root sessions only; children get no MCP authority. */
+    declaredMcp(id) {
+        return !!this.operatorMcp && !this.operatorMcp.empty && !this.children?.owned(id);
+    }
+    /** Every MCP server the session got, from both sources; persisted beside the worker. */
+    mcpServers(id) {
+        const live = this.workers.get(id)?.mcpServers;
+        if (live)
+            return structuredClone(live);
+        try {
+            const path = join(this.options.stateDir, 'workers', id, 'mcp-servers.json');
+            return existsSync(path)
+                ? JSON.parse(readFileSync(path, 'utf8'))
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
     }
     childBoundary(id, epoch) {
         const child = this.children?.owned(id);
@@ -112,6 +186,10 @@ export class Supervisor extends EventEmitter {
     }
     bootId = randomUUID();
     workers = new Map();
+    boardReadsStore;
+    get boardReads() {
+        return (this.boardReadsStore ??= new BoardReads(this.store));
+    }
     monitor;
     bundle;
     constructor(store, options) {
@@ -120,7 +198,7 @@ export class Supervisor extends EventEmitter {
         this.options = options;
         this.route = structuredClone(options.providerRoute ?? OFFLINE_ROUTE);
         // Validate public configuration without trusting programmatic callers.
-        const checked = providerRoute(this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider, this.route.provider !== 'salaam-proof' ? this.route.model : undefined, this.route.provider !== 'salaam-proof' ? this.route.max_tokens : undefined, this.route.workspace_id, this.route.connection);
+        const checked = providerRoute(this.route.provider === 'salaam-proof' ? 'offline' : this.route.provider, this.route.provider !== 'salaam-proof' ? this.route.model : undefined, this.route.provider !== 'salaam-proof' ? this.route.max_tokens : undefined, this.route.workspace_id, this.route.connection, this.route.reasoning);
         if (canonical(checked) !== canonical(this.route))
             throw new Error('Invalid provider route');
         if (options.anthropicApiKey)
@@ -185,6 +263,7 @@ export class Supervisor extends EventEmitter {
         }
     }
     async start(id) {
+        this.store.execution.assert(id);
         const child = this.children?.owned(id);
         if (child && this.store.workerBoundary.view(child.id).binding.runtime !== 'native-pi')
             throw new ServiceError('external_worker_owned', 'Use the external worker lifecycle; Pi cannot claim this session');
@@ -228,11 +307,33 @@ export class Supervisor extends EventEmitter {
             reject,
         };
         this.workers.set(id, worker);
+        worker.secrets = [worker.token, ...(this.apiKey ? [this.apiKey] : [])];
         // Attach a rejection handler before spawn/identity checks can fail.
         void handshake.catch(() => { });
         let timer;
         try {
             const child = this.children?.owned(id);
+            if (this.mcp && !child)
+                worker.mcp = await this.mcp.ready(id);
+            if (this.toolkit && !child)
+                worker.toolkit = await this.toolkit.ready(id);
+            if (this.declaredMcp(id))
+                worker.operatorMcp = this.operatorMcp.provenance();
+            if (worker.operatorMcp || worker.mcp) {
+                // Collisions are refused at admission; nothing is silently shadowed.
+                worker.mcpServers = mergeMcpProvenance(worker.operatorMcp ?? [], (worker.mcp?.servers ?? []).map((server) => ({
+                    name: server.name,
+                    source: 'agentpod',
+                    transport: 'http',
+                    endpoint_digest: server.endpoint_digest,
+                    declaration_digest: digest(server),
+                })));
+            }
+            if (this.station && !child)
+                worker.station = this.station.ready(id);
+            this.store.execution.assert(id);
+            if (worker.stopping || worker.invalid)
+                throw new Error('Worker startup cancelled');
             if (child)
                 this.store.workerBoundary.claim(child, epoch, route);
             const workerDir = join(this.options.stateDir, 'workers', id);
@@ -242,6 +343,11 @@ export class Supervisor extends EventEmitter {
             }), { mode: 0o600 });
             const sessionDir = join(workerDir, 'sessions');
             mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
+            const provenancePath = join(workerDir, 'mcp-servers.json');
+            if (worker.mcpServers)
+                writeFileSync(provenancePath, JSON.stringify(worker.mcpServers, null, 2), { mode: 0o600 });
+            else
+                rmSync(provenancePath, { force: true });
             const config = {
                 socket: this.options.bridgeSocket,
                 token: worker.token,
@@ -255,6 +361,14 @@ export class Supervisor extends EventEmitter {
                 worker_binding: this.childBoundary(id, epoch),
                 route: route,
                 coding: this.codingBinding(id),
+                local: this.store.localWorkspace(id),
+                localCoding: this.store.localCoding(id),
+                ...(worker.mcp ? { mcp: worker.mcp } : {}),
+                ...(worker.operatorMcp ? { operator_mcp: worker.operatorMcp } : {}),
+                ...(worker.mcpServers ? { mcp_servers: worker.mcpServers } : {}),
+                ...(worker.toolkit ? { toolkit: worker.toolkit } : {}),
+                ...(worker.station ? { station: worker.station } : {}),
+                ...(this.persona ? { persona: this.persona } : {}),
             };
             const args = [
                 PI_CLI,
@@ -321,6 +435,11 @@ export class Supervisor extends EventEmitter {
                             attempt_id: worker.attempt,
                             worker_epoch: epoch,
                             ...observation,
+                            ...(observation.phase === 'started'
+                                ? toolMetadata(observation.tool, observation.input, observation.tool === 'salaam_station'
+                                    ? this.station?.config.workspace
+                                    : this.coding?.workspaces.find(id)?.root)
+                                : {}),
                         });
                         return { recorded: true };
                     });
@@ -398,9 +517,24 @@ export class Supervisor extends EventEmitter {
             // persist a cursor into that ephemeral tree before its file exists.
             if (existsSync(file))
                 await this.syncEntries(worker);
+            this.store.execution.assert(id);
             if (child)
                 this.store.workerBoundary.accepted(child, epoch, route);
-            this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id), this.tools(id)), file);
+            this.store.state(id, epoch, 'ready', null, workerCapabilities(this.codingBinding(id), this.tools(id)), file, readinessFingerprint({
+                session_id: id,
+                worker_epoch: epoch,
+                version: 1,
+                harness: 'salaam',
+                harness_version: VERSION,
+                pi_version: PI_VERSION,
+                bundle_digest: worker.bundle,
+                policy_digest: POLICY_DIGEST,
+                provider: route.provider,
+                model: route.model,
+                context_digest: textDigest(worker.frame),
+                context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
+                verification: 'pinned-readiness-handshake',
+            }));
             worker.ready = true;
             worker.lastBeat = Date.now();
         }
@@ -421,6 +555,7 @@ export class Supervisor extends EventEmitter {
         worker.reject(new Error(reason));
         try {
             this.managed?.invalidateWorker(worker.id, worker.epoch);
+            this.cancelMcpWorker(worker);
             this.children?.workerLost(worker.id, reason);
         }
         catch {
@@ -435,6 +570,22 @@ export class Supervisor extends EventEmitter {
         if (worker.pi)
             void this.stopWorker(worker).catch(() => { });
     }
+    cancelMcpWorker(worker) {
+        if (this.station && worker.attempt) {
+            this.store.transaction(() => this.station.cancelInTransaction(worker.attempt));
+            void this.station.abortAttempt(worker.attempt).catch(() => {
+                worker.invalid = 'Station stop is unconfirmed';
+            });
+        }
+        if (this.toolkit && worker.attempt) {
+            this.store.transaction(() => this.toolkit.cancelInTransaction(worker.attempt));
+            this.toolkit.abortAttempt(worker.attempt);
+        }
+        if (this.mcp && worker.attempt) {
+            this.store.transaction(() => this.mcp.cancelInTransaction(worker.attempt, 'worker_unavailable'));
+            this.mcp.abortAttempt(worker.attempt);
+        }
+    }
     authenticate(id, token, body) {
         const w = this.workers.get(id);
         if (!w ||
@@ -453,6 +604,36 @@ export class Supervisor extends EventEmitter {
         }
         return w;
     }
+    /** Is this attempt a task step that has acceptance checks to decide it? */
+    checkedStepAttempt(attempt) {
+        const row = this.store.db
+            .prepare('SELECT checks FROM task_steps WHERE attempt_id=?')
+            .get(attempt);
+        try {
+            const checks = row?.checks ? JSON.parse(String(row.checks)) : [];
+            return Array.isArray(checks) && checks.length > 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** A station call refused before it runs leaves no station_calls row, so record its
+     * method, requested action and refusal code: never its path, arguments or content. */
+    recordStationRefusal(id, method, body, error) {
+        const args = body.args && typeof body.args === 'object' ? body.args : {};
+        const ident = (v) => typeof v === 'string' && /^[A-Za-z0-9_.:-]{1,64}$/.test(v) ? v : null;
+        try {
+            this.store.transaction(() => this.store.event(id, 'station.call_refused', {
+                attempt_id: this.workers.get(id)?.attempt ?? null,
+                method: ident(method),
+                action: ident(args.action),
+                code: error instanceof ServiceError ? ident(error.code) : 'error',
+            }));
+        }
+        catch {
+            // Recording a refusal never changes the refusal itself.
+        }
+    }
     async bridge(id, method, token, body) {
         const w = this.authenticate(id, token, body);
         const route = w.route;
@@ -463,6 +644,19 @@ export class Supervisor extends EventEmitter {
         }
         if (w.invalid || w.stopping)
             throw new ServiceError('worker_unavailable', 'Worker is not available', 403);
+        try {
+            this.store.execution.assert(id);
+            if (w.mcp)
+                this.mcp.assertBinding(id, w.mcp);
+            if (w.toolkit)
+                this.toolkit.assertBinding(id, w.toolkit);
+            if (w.station)
+                this.station.assertBinding(id, w.station);
+        }
+        catch (error) {
+            this.invalidate(w, 'Session execution authority revoked');
+            throw error;
+        }
         if (method === 'handshake') {
             try {
                 if (w.manifest)
@@ -483,6 +677,15 @@ export class Supervisor extends EventEmitter {
                     route: route,
                     context_digest: textDigest(w.frame),
                     ...(boundary ? { worker_binding: boundary } : {}),
+                    ...(w.mcp ? { mcp: w.mcp } : {}),
+                    ...(w.operatorMcp ? { operator_mcp: w.operatorMcp } : {}),
+                    ...(w.mcpServers
+                        ? { mcp_servers: w.mcpServers, mcp_servers_digest: digest(w.mcpServers) }
+                        : {}),
+                    ...(w.toolkit ? { toolkit: w.toolkit } : {}),
+                    ...(w.station ? { station: w.station } : {}),
+                    // Item 9: the worker proves it runs with the host's pinned persona.
+                    ...(this.persona ? { persona_digest: this.persona.digest } : {}),
                 };
                 for (const [key, value] of Object.entries(expected))
                     if (canonical(body[key]) !== canonical(value))
@@ -553,7 +756,7 @@ export class Supervisor extends EventEmitter {
                 });
             }
             if (method === 'provider.auth') {
-                if (!this.children?.owned(id)) {
+                if (!this.children?.owned(id) && !this.store.localWorkspace(id)) {
                     const auth = await this.providerAuth();
                     if (canonical(this.route) !== canonical(route))
                         throw new Error('Provider route changed');
@@ -564,15 +767,167 @@ export class Supervisor extends EventEmitter {
                 const prepared = await this.prepareProviderRoute(route);
                 const expectedCap = this.children?.owned(id)
                     ? this.store.workerBoundary.view(this.children.owned(id).id).binding.agent?.output_cap
-                    : this.outputCap;
+                    : (this.store.localOutputCap(id) ?? this.outputCap);
                 if (canonical(prepared.route) !== canonical(route) ||
                     (expectedCap ?? this.outputCap) !== prepared.output_cap)
                     throw new Error('Provider capability or route changed; restart or renew admission');
                 w.providerOutputCap = prepared.output_cap;
                 this.assertSessionProviderSupported(id, prepared.output_cap);
                 const auth = prepared.auth;
+                w.secrets = [...new Set([...(w.secrets ?? []), ...credentialStrings(auth)])];
                 return auth;
             }
+            if (method.startsWith('operator_mcp.')) {
+                if (!this.declaredMcp(id) || !w.operatorMcp || !w.attempt)
+                    throw new ServiceError('mcp_disabled', 'Worker has no declared MCP servers', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                if (method === 'operator_mcp.catalog')
+                    return await this.operatorMcp.catalog(id, body.server, body.tool);
+                if (method !== 'operator_mcp.call')
+                    throw new ServiceError('invalid_field', 'Unknown declared MCP method', 400);
+                const attempt = w.attempt;
+                const args = body.arguments ?? {};
+                const server = String(body.server ?? ''), tool = String(body.tool ?? '');
+                // A host failing again and again is paused briefly (never called, so no operator MCP call
+                // is recorded); the agent gets a tool error and the run carries on.
+                return await callThroughBreaker(this.fetchBreaker, id, args, (paused) => this.store.transaction(() => this.store.event(id, 'fetch.host_paused', { attempt_id: attempt, ...paused })), async () => {
+                    try {
+                        const result = await this.operatorMcp.call(id, body.server, body.tool, args);
+                        this.store.transaction(() => this.store.event(id, 'operator_mcp.call', {
+                            attempt_id: attempt,
+                            server,
+                            tool,
+                            argument_digest: digest(args),
+                            outcome: result.is_error ? 'tool_error' : 'returned',
+                            result_digest: digest(result),
+                        }));
+                        return result;
+                    }
+                    catch (error) {
+                        this.store.transaction(() => this.store.event(id, 'operator_mcp.call', {
+                            attempt_id: attempt,
+                            server,
+                            tool,
+                            argument_digest: digest(args),
+                            outcome: 'failed',
+                            error: error.code ?? 'mcp_server_failed',
+                        }));
+                        throw error;
+                    }
+                });
+            }
+            if (method.startsWith('toolkit.')) {
+                if (!this.toolkit || !w.toolkit || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('toolkit_disabled', 'Worker has no native Toolkit authority', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.toolkit.assertBinding(id, w.toolkit);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'toolkit.catalog')
+                    return this.toolkit.catalog(id, w.toolkit, body.category === undefined ? undefined : string(body.category, 'category', 128), body.action === undefined ? undefined : string(body.action, 'action', 128));
+                if (!['toolkit.prepare', 'toolkit.run', 'toolkit.status'].includes(method))
+                    throw new ServiceError('invalid_field', 'Unsupported native Toolkit action', 400);
+                const call = method === 'toolkit.prepare'
+                    ? this.toolkit.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), body.args)
+                    : this.toolkit.calls.get(string(body.call_id, 'call_id', 128));
+                if (call.session_id !== id ||
+                    call.worker_epoch !== w.epoch ||
+                    call.attempt_id !== w.attempt)
+                    throw new ServiceError('mcp_call_scope', 'Native Toolkit call belongs to another invocation', 403);
+                if (method === 'toolkit.run')
+                    this.toolkit.start(call.id, id, w.epoch, w.attempt);
+                return this.toolkit.view(call.id);
+            }
+            if (method.startsWith('mcp.')) {
+                if (!this.mcp || !w.mcp || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('mcp_disabled', 'Worker has no managed MCP authority', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.mcp.assertBinding(id, w.mcp);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'mcp.catalog')
+                    return this.mcp.describe(id, w.mcp, body.server === undefined ? undefined : string(body.server, 'server', 128), body.tool === undefined ? undefined : string(body.tool, 'tool', 128));
+                const call = method === 'mcp.prepare'
+                    ? this.mcp.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), body.args)
+                    : this.mcp.get(string(body.call_id, 'call_id', 128));
+                if (call.session_id !== id ||
+                    call.worker_epoch !== w.epoch ||
+                    call.attempt_id !== w.attempt)
+                    throw new ServiceError('mcp_call_scope', 'MCP call belongs to another invocation', 403);
+                if (!['mcp.prepare', 'mcp.run', 'mcp.status'].includes(method))
+                    throw new ServiceError('invalid_field', 'Unsupported MCP action', 400);
+                const current = method === 'mcp.run' ? this.mcp.start(call.id, id, w.epoch, w.attempt) : call;
+                return {
+                    call: current,
+                    result: current.result_artifact
+                        ? JSON.parse(this.mcp.artifacts.read(current.result_artifact))
+                        : null,
+                    ...(current.operation_id && this.managed
+                        ? {
+                            operation: this.managed.operation(current.operation_id),
+                            approval: this.managed.forOperation(current.operation_id),
+                        }
+                        : {}),
+                };
+            }
+            if (method === 'board.read' || method === 'board.status') {
+                // Read-only board reads, served by the hub (operator ruling 2026-10-28, option iii).
+                if (!this.station || !w.station || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('station_disabled', 'Board reads need protected station work');
+                this.assertActive(id, w.epoch, w.attempt);
+                return method === 'board.read'
+                    ? this.boardReads.request(id, string(body.tool_call_id, 'tool_call_id', 512), object(body.args))
+                    : this.boardReads.get(id, string(body.read_id, 'read_id', 64));
+            }
+            if (method.startsWith('station.')) {
+                if (!this.station || !w.station || !w.attempt || this.children?.owned(id))
+                    throw new ServiceError('station_disabled', 'Station execution is unavailable');
+                this.assertActive(id, w.epoch, w.attempt);
+                this.store.taskGrantCheck?.(id);
+                if (method === 'station.read')
+                    return this.station.read(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                if (method === 'station.prepare')
+                    return this.station.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                const c = this.station.get(string(body.call_id, 'call_id', 128));
+                if (c.session_id !== id || c.worker_epoch !== w.epoch || c.attempt_id !== w.attempt)
+                    throw new ServiceError('station_scope', 'Station call belongs to another invocation', 403);
+                if (method === 'station.run')
+                    return this.station.run(c.id);
+                if (method === 'station.status')
+                    return this.station.view(c.id);
+                throw new ServiceError('invalid_field', 'Unsupported station method');
+            }
+            if (method.startsWith('local.') && method !== 'local.read') {
+                if (!this.localCoding ||
+                    !this.store.localCoding(id) ||
+                    this.children?.owned(id) ||
+                    !w.attempt)
+                    throw new ServiceError('local_denied', 'Local coding is not admitted', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                if (method === 'local.prepare')
+                    return this.localCoding.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                const c = this.localCoding.get(string(body.call_id, 'call_id'));
+                if (c.session_id !== id || c.epoch !== w.epoch || c.attempt_id !== w.attempt)
+                    throw new ServiceError('local_scope', 'Operation belongs to another invocation', 403);
+                if (method === 'local.run')
+                    return this.localCoding.run(c.id);
+                if (method === 'local.status')
+                    return this.localCoding.view(c.id);
+                throw new ServiceError('invalid_field', 'Unsupported local method');
+            }
+            if (method === 'local.read') {
+                if (!this.store.localWorkspace(id) || this.children?.owned(id) || !w.attempt)
+                    throw new ServiceError('workspace_denied', 'Local workspace is not admitted', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                this.store.taskGrantCheck?.(id);
+                const args = object(body.args);
+                const result = readLocalWorkspace(this.store.session(id).cwd, args);
+                this.store.transaction(() => this.store.event(id, 'workspace.read', {
+                    attempt_id: w.attempt,
+                    tool_call_id: string(body.tool_call_id, 'tool_call_id', 512),
+                    argument_digest: digest(args),
+                    result_digest: digest(result),
+                }));
+                return result;
+            }
             if (method === 'coding.files' || method === 'coding.command') {
                 if (!this.coding || !this.codingBinding(id) || !w.attempt)
                     throw new Error('Coding authority is unavailable');
@@ -713,12 +1068,14 @@ export class Supervisor extends EventEmitter {
                         epoch: w.epoch,
                         provider: body.provider,
                         context_digest: body.context_digest,
+                        context_admission_digest: this.tasks.admitted?.currentDigest(id) ?? null,
                         payload_digest: body.payload_digest,
                         task_version: this.tasks.state(id).version,
                     });
                 });
             }
             else if (method === 'policy' || method === 'tool') {
+                this.tasks.admitted?.assertFresh(id);
                 this.store.taskGrantCheck?.(id);
                 if (!this.tools(id).includes(String(body.tool)))
                     throw new Error('Tool is outside policy');
@@ -736,6 +1093,46 @@ export class Supervisor extends EventEmitter {
         }
         catch (error) {
             this.store.taskBudgetDenied?.(id, error);
+            if (method.startsWith('station.'))
+                this.recordStationRefusal(id, method, body, error);
+            if (method.startsWith('station.') &&
+                error instanceof ServiceError &&
+                [
+                    'invalid_field',
+                    'request_conflict',
+                    'station_files_changed',
+                    'station_scope',
+                    'station_call_limit',
+                    'station_busy',
+                    'not_found',
+                ].includes(error.code))
+                throw error;
+            if (method.startsWith('operator_mcp.') &&
+                error instanceof ServiceError &&
+                [
+                    'invalid_field',
+                    'invalid_mcp_server',
+                    'invalid_mcp_tool',
+                    'invalid_mcp_arguments',
+                    'mcp_server_failed',
+                ].includes(error.code))
+                throw error;
+            if ((method.startsWith('mcp.') || method.startsWith('toolkit.')) &&
+                error instanceof ServiceError &&
+                [
+                    'invalid_field',
+                    'invalid_mcp_call',
+                    'invalid_mcp_arguments',
+                    'invalid_mcp_server',
+                    'invalid_mcp_tool',
+                    'mcp_tool_unadmitted',
+                    'mcp_input_limit',
+                    'mcp_call_limit',
+                    'invalid_toolkit_request',
+                    'toolkit_busy',
+                    'request_conflict',
+                ].includes(error.code))
+                throw error;
             if (method.startsWith('specialist.') &&
                 error instanceof ServiceError &&
                 [
@@ -743,13 +1140,17 @@ export class Supervisor extends EventEmitter {
                     'binary_file',
                     'line_limit',
                     'invalid_field',
+                    'local_busy',
+                    'workspace_read_failed',
                     'unsafe_path',
                     'request_conflict',
                 ].includes(error.code))
                 throw error;
-            if (method.startsWith('coding.') &&
+            if ((method.startsWith('coding.') || method.startsWith('local.')) &&
                 error instanceof ServiceError &&
                 [
+                    'local_busy',
+                    'workspace_read_failed',
                     'unsafe_path',
                     'workspace_changed',
                     'workspace_busy',
@@ -790,13 +1191,24 @@ export class Supervisor extends EventEmitter {
         }
     }
     inspect(id) {
+        if (this.store.execution.revocation(id)) {
+            const session = this.store.session(id);
+            return {
+                ...session,
+                state: ['starting', 'ready'].includes(session.state) ? 'unhealthy' : session.state,
+                capabilities: [],
+                error: 'Session execution authority revoked',
+            };
+        }
         const externalChild = this.children?.owned(id);
         if (externalChild && this.store.workerBoundary.view(externalChild.id).binding.external)
             return this.store.session(id);
         const child = this.children?.owned(id);
         const cap = child
             ? this.store.workerBoundary.view(child.id).binding.agent?.output_cap
-            : undefined;
+            : this.store.localWorkspace(id)
+                ? this.store.localOutputCap(id)
+                : undefined;
         const state = {
             ...this.store.session(id),
             provider_route: this.store.providerRoute(id) ?? undefined,
@@ -809,6 +1221,7 @@ export class Supervisor extends EventEmitter {
                         ? null
                         : 'No provider-enforced output cap; tasks must explicitly disable token budgeting',
                 },
+            ...(this.mcpServers(id) ? { mcp_servers: this.mcpServers(id) } : {}),
         };
         const w = this.workers.get(id);
         if (w?.invalid)
@@ -830,6 +1243,8 @@ export class Supervisor extends EventEmitter {
         return state;
     }
     assertActive(id, epoch, attempt) {
+        this.tasks.admitted?.assertFresh(id);
+        this.store.execution.assert(id);
         const w = this.workers.get(id);
         if (!w ||
             !w.ready ||
@@ -852,19 +1267,69 @@ export class Supervisor extends EventEmitter {
         if (w)
             this.invalidate(w, 'Managed control failed: ' + error.message);
     }
+    async steer(id, request, text, controller) {
+        const input = { kind: 'steer', id, text };
+        const saved = this.store.cachedRequest('local-operator', request, input);
+        if (saved)
+            return saved;
+        const worker = this.workers.get(id);
+        const intent = this.store.request('local-operator', request, input, () => {
+            this.store.authorizeControl(id, controller);
+            this.store.execution.assert(id);
+            if (!this.store.localWorkspace(id) ||
+                !worker?.ready ||
+                worker.invalid ||
+                worker.stopping ||
+                !worker.pi ||
+                !worker.busy ||
+                !worker.attempt)
+                throw new ServiceError('steer_unavailable', 'Steering requires an active local model turn; use /queue for the next turn');
+            if (this.store.hasUnknown(id))
+                throw new ServiceError('outcome_unknown', 'Resolve uncertain work before steering');
+            if (this.store.attempt(worker.attempt).state !== 'running')
+                throw new ServiceError('steer_unavailable', 'The active attempt is no longer running');
+            const receipt = { state: 'delivery_unknown', attempt: worker.attempt, epoch: worker.epoch };
+            this.store.event(id, 'steering.saved', { ...receipt, text }, request);
+            return receipt;
+        });
+        try {
+            await worker.pi.command('steer', { message: text });
+            return this.store.transaction(() => {
+                const receipt = { ...intent, state: 'received' };
+                this.store.event(id, 'steering.received', receipt, request);
+                this.store.db
+                    .prepare('UPDATE requests SET response=? WHERE actor=? AND id=?')
+                    .run(JSON.stringify(receipt), 'local-operator', request);
+                return receipt;
+            });
+        }
+        catch (error) {
+            // The worker may have received it. Never retry this message across reconnect/restart.
+            this.store.transaction(() => this.store.event(id, 'steering.delivery_unknown', intent, request));
+            throw new ServiceError('steer_delivery_unknown', 'Steering receipt was lost. Inspect history; this steering request will not be replayed.');
+        }
+    }
     async cancelAttempt(attempt) {
         const work = this.store.attempt(attempt);
         const w = this.workers.get(work.session_id);
         if (!w?.pi || w.attempt !== attempt)
             return;
+        const settled = w.pi.waitFor('agent_settled', 5000);
+        void settled.catch(() => { });
         try {
             await w.pi.command('abort', {}, 5000);
+            await settled;
         }
         catch {
             await this.stopWorker(w);
         }
     }
+    attemptActive(attempt) {
+        const work = this.store.attempt(attempt), worker = this.workers.get(work.session_id);
+        return worker?.attempt === attempt && worker.busy;
+    }
     assertIdle(id) {
+        this.store.execution.assert(id);
         const w = this.workers.get(id);
         if (!w?.ready || w.invalid || w.stopping || !w.pi || this.store.session(id).state !== 'ready')
             throw new ServiceError('not_ready', 'A ready worker is required');
@@ -989,16 +1454,39 @@ export class Supervisor extends EventEmitter {
         // Approval deadlines belong to the journal, not an adapter-side timer.
         const settled = w.pi.waitFor('agent_settled', 0);
         void settled.catch(() => { });
-        let outcomeError = null;
+        let outcome;
         const record = (value) => {
             if (value.type === 'message_end') {
                 const message = object(value.message);
-                if (message.role === 'assistant' &&
-                    ['error', 'aborted'].includes(String(message.stopReason)))
-                    outcomeError = String(message.errorMessage ?? message.stopReason);
+                if (message.role === 'assistant') {
+                    const explicit = parseAcpFailure(message.salaamFailure);
+                    const candidate = explicit
+                        ? {
+                            version: 1,
+                            stopReason: explicit.kind === 'refusal'
+                                ? 'refusal'
+                                : explicit.kind === 'max_tokens'
+                                    ? 'max_tokens'
+                                    : 'error',
+                            failure: { ...explicit, message: redactFailureText(explicit.message, w.secrets) },
+                        }
+                        : providerOutcome(String(message.stopReason), String(message.errorMessage ?? ''), w.route, undefined, w.secrets);
+                    if (candidate.stopReason !== 'end_turn')
+                        outcome = candidate;
+                }
             }
-            if (value.type === 'tool_execution_end' && value.isError === true)
-                outcomeError = 'Tool execution failed';
+            // A checked task step is decided by its checks, not by a tool error the model went on
+            // to recover from (operator decision, 2026-10-23). The error stays in the journal
+            // (tool.finished failed=true). A delegated child turn, whose denied probes are its
+            // boundary proof, and any attempt outside a checked step still fail on it.
+            if (value.type === 'tool_execution_end' &&
+                value.isError === true &&
+                (this.children?.owned(id) || !this.checkedStepAttempt(work.attempt.id)))
+                outcome ??= {
+                    version: 1,
+                    stopReason: 'error',
+                    failure: acpFailure(new ServiceError('tool_failed', toolFailureMessage(value.toolName))),
+                };
         };
         w.pi.on('record', record);
         try {
@@ -1013,12 +1501,13 @@ export class Supervisor extends EventEmitter {
             const entries = await this.readEntries(w);
             const result = object((await w.pi.command('get_last_assistant_text')).data);
             this.childBoundary(id, w.epoch);
-            this.store.finish(work.attempt.id, outcomeError ? 'failed' : 'completed', String(result.text ?? ''), outcomeError, { epoch: w.epoch, ...entries });
+            this.store.finish(work.attempt.id, outcome ? 'failed' : 'completed', String(result.text ?? ''), outcome?.failure?.message ?? null, { epoch: w.epoch, ...entries }, outcome);
         }
         catch (error) {
+            const message = redactFailureText(error.message, w.secrets);
             if (!w.stopping && !this.store.cancelled(work.attempt.id))
-                this.invalidate(w, 'Attempt interrupted: ' + error.message);
-            this.store.finish(work.attempt.id, 'interrupted', null, error.message);
+                this.invalidate(w, 'Attempt interrupted: ' + message);
+            this.store.finish(work.attempt.id, 'interrupted', null, message);
         }
         finally {
             w.pi.off('record', record);
@@ -1046,6 +1535,11 @@ export class Supervisor extends EventEmitter {
             leaf: typeof entries.leafId === 'string' ? entries.leafId : null,
         };
     }
+    async stopSession(id) {
+        const w = this.workers.get(id);
+        if (w)
+            await this.stopWorker(w);
+    }
     async stopWorker(w) {
         if (w.stopping) {
             await w.pi?.closed;
@@ -1055,6 +1549,8 @@ export class Supervisor extends EventEmitter {
         w.ready = false;
         try {
             this.managed?.invalidateWorker(w.id, w.epoch);
+            this.cancelMcpWorker(w);
+            void this.operatorMcp?.stopSession(w.id).catch(() => { });
             this.children?.workerLost(w.id, 'Worker stopped before child dispatch');
         }
         catch {
@@ -1083,3 +1579,10 @@ export class Supervisor extends EventEmitter {
             throw new AggregateError(errors, 'Worker shutdown could not persist all final states');
     }
 }
+/** Names the failing tool (never its arguments or output), so a failed step says which call
+ * failed it. Only a plain tool identifier is echoed. */
+export function toolFailureMessage(toolName) {
+    return typeof toolName === 'string' && /^[A-Za-z0-9_.:-]{1,64}$/.test(toolName)
+        ? `Tool execution failed (tool ${toolName})`
+        : 'Tool execution failed';
+}