@superjackfruitlabs/salaam 0.0.2 → 0.0.4

package/src/service.ts

@@ -1,9 +1,26 @@
 import { createServer, type Server, type ServerResponse, type IncomingMessage } from 'node:http';
-import { mkdirSync, chmodSync, existsSync, unlinkSync, realpathSync, statSync } from 'node:fs';
+import { loadPersona } from './persona.js';
+import {
+  mkdirSync,
+  chmodSync,
+  chownSync,
+  existsSync,
+  unlinkSync,
+  realpathSync,
+  statSync,
+} from 'node:fs';
 import { join, resolve } from 'node:path';
+import { providerRoute } from './provider-config.js';
 import { TaskContext } from './task-context.js';
+import { ContextAdmission } from './context-admission.js';
+import { SLASH_COMMANDS } from './tui-commands.js';
 import { TaskWork } from './task-work.js';
 import { TaskBudget } from './task-budget.js';
+import { AgentPodWorkDecisions } from './agentpod-work-decisions.js';
+import { RunGrants } from './run-grants.js';
+import { TaskCritic } from './task-critic.js';
+import { AgentPodWork } from './agentpod-work.js';
+import { agentpodWorkAdmission } from './agentpod-work-protocol.js';
 import { TaskVerification } from './task-verification.js';
 import { TaskCheckpoints } from './task-checkpoints.js';
 import { TaskDriver } from './task-driver.js';
@@ -33,9 +50,48 @@ import { ExternalWork } from './external-work.js';
 import type { ExternalBackend } from './external-runtime.js';
 import { DockerHarnessBackend } from './harness-backend.js';
 import { A2AInbound } from './a2a-inbound.js';
+import { AgentPodAuthority, readAgentPodPins } from './agentpod-authority.js';
+import { ToolkitResources } from './toolkit-resources.js';
+import { OperatorMcp } from './operator-mcp.js';
+import { cancelToolkitCalls, recoverToolkitCalls } from './toolkit-calls.js';
+import { ToolkitOwners } from './toolkit-owners.js';
+import { ToolkitResolutions, resolvedToolkitCallSql } from './toolkit-resolutions.js';
 import { A2ABackend, ExternalBackends } from './a2a-backend.js';
+import { VERSION } from './config.js';
+import { TurnCancellations } from './turn-cancellations.js';
+import { McpAdmission } from './mcp-admission.js';
+import { McpWork } from './mcp-work.js';
+import { ToolkitWork, type ToolkitWorkConfig } from './toolkit-work.js';
+import { permissionPolicy, configurePermissions } from './autonomy.js';
+import { chooseLocalSandbox, type SandboxLevel } from './command-sandbox.js';
+import { LocalCoding, type LocalSandbox } from './local-coding.js';
+import { localDiff } from './local-diff.js';
+import { reviewUndo, applyUndo, reconcileUndo } from './local-undo.js';
+import { forkPiSession } from './pi-sessions.js';
+import { StationWork } from './station-work.js';
+import { readToolkitConfig } from './toolkit-config.js';
+import { probeToolsUser, serviceToolIdentity, type ToolIdentity } from './tool-identity.js';
 
 export interface ServiceOptions extends Omit<SupervisorOptions, 'stateDir' | 'bridgeSocket'> {
+  hostManifestDigest?: string;
+  /** Receipt fields for the launcher profile; reported only by a manifest-served host. */
+  hostReceipt?: Record<string, unknown>;
+  /** Launcher profile: one group may traverse state and use the operator socket. */
+  operatorAccess?: { group: string; gid: number };
+  agentpodConfig?: string;
+  /** Operator-declared MCP file (never a workspace path); absent means none declared. */
+  operatorMcpConfig?: string;
+  /** Item 9: the host's pinned persona file and the digest host plan reviewed. */
+  personaConfig?: { config: string; digest: string };
+  /** Environment that ${VAR} references resolve from; defaults to process.env. */
+  operatorMcpEnvironment?: NodeJS.ProcessEnv;
+  managedMcp?: { config: string; profile_digest: string };
+  /** Internal trusted host seam; never accepted from ACP or a worker. */
+  managedToolkit?: ToolkitWorkConfig;
+  managedToolkitConfig?: { config: string; configuration_digest: string };
+  /** Explicit acceptance opt-in; not advertised by default host manifests. */
+  agentpodWorkProgression?: boolean;
+  stationConfig?: { config: string; configuration_digest: string };
   externalBackend?: ExternalBackend;
   harnessConfig?: string;
   a2aConfig?: string;
@@ -51,11 +107,34 @@ export interface ServiceOptions extends Omit<SupervisorOptions, 'stateDir' | 'br
   effectConnector?: EffectConnector;
   approvalTtlMs?: number;
   codingRoot?: string;
+  /** Unprivileged OS user for agent-initiated local commands and edits (Linux, sudo -n -u). */
+  toolsUser?: string;
+  /** Item 10: the sandbox level for agent-initiated local commands (default workspace-write).
+   * full-access is unsandboxed and must be chosen explicitly. */
+  localSandbox?: SandboxLevel;
+  /** Host config `unsandboxed_commands: "allow"`: run local commands unsandboxed on a host with no
+   * usable sandbox. Absent, they are refused (operator ruling 2026-10-30, option A). */
+  unsandboxedCommands?: 'allow';
+  /** Host config `command_network: "broker"`: sandboxed local commands reach the network only
+   * through this stk local-commands socket (operator rulings 2026-10-30). */
+  commandNetwork?: { socket: string };
+  /** Internal test seam: argv prefix replacing `sudo -n -u <toolsUser> --`. */
+  toolsLauncher?: string[];
   codingSocket?: string;
   codingBackend?: ExecutionBackend;
   expectedExecution?: { profile_digest: string; engine_id: string };
 }
 export class SalaamService {
+  operatorMcpPath?: string;
+  readonly agentpod?: AgentPodAuthority;
+  readonly agentpodWork?: AgentPodWork;
+  readonly toolkitResources: ToolkitResources;
+  readonly toolkitOwners: ToolkitOwners;
+  readonly toolkitResolutions: ToolkitResolutions;
+  readonly mcp?: McpWork;
+  readonly toolkit?: ToolkitWork;
+  readonly station?: StationWork;
+  readonly cancellations: TurnCancellations;
   readonly external: ExternalWork;
   a2aInbound?: A2AInbound;
   readonly stateDir: string;
@@ -82,6 +161,8 @@ export class SalaamService {
   readonly workerWorkspaces: WorkerWorkspaces;
   readonly workspaces: Workspaces;
   readonly coding: CodingWork;
+  readonly localCoding: LocalCoding;
+  readonly toolIdentity: ToolIdentity;
   readonly codingSocket: string | null;
   readonly closed: Promise<void>;
   private resolveClosed!: () => void;
@@ -89,13 +170,60 @@ export class SalaamService {
   private bridgeServer: Server;
   private release: () => void;
   private stopping = false;
+  private shutdownFailure?: AggregateError;
   private handlers = new Set<Promise<void>>();
+  private revocationStops = new Set<Promise<void>>();
+  private authorityTimer?: NodeJS.Timeout;
+  private readonly hostManifestDigest: string | null;
+  private readonly hostReceipt: Record<string, unknown> | null;
+  private readonly operatorAccess: { group: string; gid: number } | null;
+  private readonly agentpodWorkProgression: boolean;
   private constructor(options: ServiceOptions) {
+    this.agentpodWorkProgression = options.agentpodWorkProgression === true;
+    if (this.agentpodWorkProgression && (!options.stationConfig || !options.agentpodConfig))
+      throw Error('Strict work requires reviewed AgentPod protected station configuration');
+    this.hostManifestDigest = options.hostManifestDigest ?? null;
+    this.hostReceipt = options.hostManifestDigest ? (options.hostReceipt ?? null) : null;
+    if (options.operatorAccess && !this.agentpodWorkProgression)
+      throw Error('Operator group access is only for the strict work launcher profile');
+    this.operatorAccess = options.operatorAccess ?? null;
     if (process.platform === 'win32') throw new Error('Windows transport is not implemented');
     this.stateDir = resolve(options.stateDir);
+    if (options.managedMcp && !options.agentpodConfig)
+      throw Error('Managed MCP requires reviewed AgentPod authority pins');
+    if ((options.managedToolkit || options.managedToolkitConfig) && !options.agentpodConfig)
+      throw Error('Native Toolkit requires reviewed AgentPod authority pins');
+    if (options.stationConfig && !options.agentpodConfig)
+      throw Error('Station execution requires reviewed AgentPod authority');
+    if (options.managedToolkit && options.managedToolkitConfig)
+      throw Error('Use one reviewed native Toolkit assignment');
+    if (
+      options.agentpodConfig &&
+      (options.codingRoot ||
+        options.codingBackend ||
+        options.codingSocket ||
+        options.effectConnector ||
+        options.externalBackend ||
+        options.harnessConfig ||
+        options.a2aConfig ||
+        options.a2aListenConfig)
+    )
+      throw new Error(
+        'AgentPod authority profile does not enable station writes, fixture effects or external runtimes',
+      );
     this.codingSocket = options.codingSocket ? resolve(options.codingSocket) : null;
     mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
     this.stateDir = realpathSync(this.stateDir);
+    this.toolIdentity = options.toolsUser
+      ? probeToolsUser(options.toolsUser, this.stateDir, options.toolsLauncher)
+      : serviceToolIdentity();
+    const mcpAdmission = options.managedMcp
+      ? new McpAdmission(
+          options.managedMcp.config,
+          readAgentPodPins(resolve(options.agentpodConfig!), this.stateDir),
+          options.managedMcp.profile_digest,
+        )
+      : undefined;
     this.socket = join(this.stateDir, 'operator.sock');
     this.bridgeSocket = join(this.stateDir, 'bridge.sock');
     if (Buffer.byteLength(this.bridgeSocket) > 100)
@@ -103,9 +231,15 @@ export class SalaamService {
     this.release = acquireStateLock(this.stateDir);
     try {
       this.store = new Store(join(this.stateDir, 'journal.sqlite'));
+      this.store.toolExecution = {
+        mode: this.toolIdentity.mode,
+        user: this.toolIdentity.user,
+        uid: this.toolIdentity.uid,
+      };
       try {
         this.artifacts = new Artifacts(join(this.stateDir, 'artifacts'), this.store);
         this.tasks = new TaskContext(this.store, this.artifacts);
+        this.tasks.admitted = new ContextAdmission(this.store);
         this.taskWork = new TaskWork(this.store, this.tasks);
         this.taskBudget = new TaskBudget(this.store, this.taskWork);
         if (options.admitModelRequest) {
@@ -167,6 +301,26 @@ export class SalaamService {
           this.coding,
           this.artifacts,
         );
+        // Item 8: the completion critic. Its reviewer grant is the narrow built-in one, admitted
+        // only while the task's admitted plan still declares a critic.
+        this.taskVerification.critic = new TaskCritic(this.store, this.artifacts, {
+          admit: (task, request) =>
+            this.agents.admitCritic(task.session_id, request, () => {
+              if (!this.taskWork.get(task.id).completion_gate?.critic)
+                throw new ServiceError('authority_denied', 'The admitted plan declares no critic');
+            }),
+          spawn: (task, parentAttempt, step, prompt, budget, grant, snapshot) =>
+            this.children.spawnCritic(
+              task.session_id,
+              parentAttempt,
+              step,
+              prompt,
+              budget,
+              grant,
+              snapshot,
+            ),
+          workerId: (childId) => this.store.workerBoundary.view(childId).binding.worker_id,
+        });
         this.taskCheckpoints = new TaskCheckpoints(
           this.store,
           this.taskWork,
@@ -181,8 +335,24 @@ export class SalaamService {
           effectsEnabled: !!options.effectConnector,
         });
         this.supervisor.tasks = this.tasks;
-        this.taskWork.providerCheck = (limits) =>
-          this.supervisor.assertTaskProviderSupported(limits);
+        if (options.personaConfig) {
+          const persona = loadPersona(options.personaConfig.config);
+          if (persona.digest !== options.personaConfig.digest)
+            throw Error('Host persona changed; run host plan again');
+          this.supervisor.persona = persona;
+        }
+        if (options.operatorMcpConfig) {
+          this.operatorMcpPath = options.operatorMcpConfig;
+          this.supervisor.operatorMcp = OperatorMcp.load(
+            options.operatorMcpConfig,
+            options.operatorMcpEnvironment ?? process.env,
+          );
+        }
+        this.taskWork.providerCheck = (limits, session) =>
+          this.supervisor.assertTaskProviderSupported(
+            limits,
+            session ? this.store.localOutputCap(session) : undefined,
+          );
         this.supervisor.coding = this.coding;
         this.managed = new ManagedWork(this.store, {
           connector: options.effectConnector,
@@ -199,6 +369,21 @@ export class SalaamService {
               : this.supervisor.failControl(id, error),
         });
         this.supervisor.managed = this.managed;
+        // Item 10: Linux runs local commands under bubblewrap and macOS under Seatbelt when
+        // usable; a host with neither refuses them unless the operator allowed them unsandboxed.
+        const localSandbox: LocalSandbox = {
+          ...chooseLocalSandbox(options.localSandbox ?? 'workspace-write'),
+          allowUnsandboxed: options.unsandboxedCommands === 'allow',
+          ...(options.commandNetwork ? { network: { socket: options.commandNetwork.socket } } : {}),
+        };
+        this.localCoding = new LocalCoding(
+          this.store,
+          this.managed,
+          (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt),
+          this.toolIdentity,
+          localSandbox,
+        );
+        this.supervisor.localCoding = this.localCoding;
         this.agents = new AgentProfiles(
           this.store,
           this.supervisor.route,
@@ -294,6 +479,169 @@ export class SalaamService {
           const error = this.recurring.controlError ?? this.inbox.controlError;
           if (error) throw new ServiceError('host_control_unavailable', error, 503);
         };
+        if (options.agentpodConfig)
+          this.agentpod = new AgentPodAuthority(
+            this.store,
+            this.stateDir,
+            resolve(options.agentpodConfig),
+            (attempt) => {
+              this.managed.cancelInTransaction(attempt, 'agentpod-revocation', 'agentpod-node');
+              this.mcp?.cancelInTransaction(attempt, 'agentpod-revocation');
+              this.station?.cancelInTransaction(attempt);
+              cancelToolkitCalls(this.store, this.managed, attempt, this.toolkitResources);
+            },
+            (session) =>
+              (this.mcp?.stopped(session) ?? true) &&
+              this.toolkitResources.stopped(session) &&
+              (this.station?.stopped(session) ?? true),
+          );
+        this.toolkitResources = new ToolkitResources(this.store, this.agentpod);
+        this.toolkitOwners = new ToolkitOwners(this.store, this.toolkitResources, this.socket);
+        this.toolkitResolutions = new ToolkitResolutions(
+          this.store,
+          this.managed,
+          this.toolkitResources,
+          this.toolkitOwners,
+        );
+        this.store.nativeResourceCheck = (session) => {
+          this.toolkitResources.assertSession(session);
+          this.station?.assertResources(session);
+        };
+        if (options.managedToolkit || options.managedToolkitConfig) {
+          if (!this.agentpod)
+            throw new Error('Native Toolkit requires AgentPod execution authority');
+          this.toolkit = new ToolkitWork(
+            this.store,
+            this.managed,
+            this.agentpod,
+            this.toolkitResources,
+            this.toolkitOwners,
+            options.managedToolkit ??
+              readToolkitConfig(
+                options.managedToolkitConfig!.config,
+                options.managedToolkitConfig!.configuration_digest,
+                this.agentpod.pins.workspace,
+              ),
+            {
+              configurationCheck: () => {
+                if (options.managedToolkitConfig)
+                  readToolkitConfig(
+                    options.managedToolkitConfig.config,
+                    options.managedToolkitConfig.configuration_digest,
+                    this.agentpod!.pins.workspace,
+                  );
+              },
+              assertActive: (session, epoch, attempt) =>
+                this.supervisor.assertActive(session, epoch, attempt),
+              failed: (session, error) => this.supervisor.failControl(session, error),
+            },
+          );
+          this.supervisor.toolkit = this.toolkit;
+        }
+        this.taskDriver.awaitingAuthorityRenewal = (session) =>
+          this.agentpod?.awaitingRenewal(session) ?? false;
+        if (options.stationConfig) {
+          if (!this.agentpod) throw Error('Station execution requires AgentPod authority');
+          this.station = new StationWork(
+            this.store,
+            this.managed,
+            this.artifacts,
+            this.agentpod,
+            options.stationConfig,
+            this.stateDir,
+            {
+              assertActive: (session, epoch, attempt) =>
+                this.supervisor.assertActive(session, epoch, attempt),
+              failed: (session, error) => this.supervisor.failControl(session, error),
+            },
+          );
+          this.supervisor.station = this.station;
+          // "Approve for this run": one grant store for decisions and the station.
+          this.station.grants = this.runGrants();
+          this.station.grantScope = (session) => {
+            const row = this.store.db
+              .prepare('SELECT task_id FROM agentpod_work WHERE session_id=?')
+              .get(session) as { task_id?: string } | undefined;
+            if (!row?.task_id) return null;
+            const task = this.taskWork.get(row.task_id);
+            return { task_id: task.id, plan_revision: task.plan_revision, task_state: task.state };
+          };
+          this.taskVerification.installStation(this.station);
+          this.agentpodWork = new AgentPodWork(
+            this.store,
+            this.agentpod,
+            this.taskWork,
+            this.taskVerification,
+          );
+          const cancelOwned = this.store.cancelChildren;
+          this.store.cancelChildren = (attempt) => {
+            cancelOwned?.(attempt);
+            this.station!.cancelInTransaction(attempt);
+          };
+        }
+        if (options.managedMcp) {
+          this.mcp = new McpWork(this.store, this.managed, this.artifacts, {
+            admission: mcpAdmission!,
+            current: (session) => this.agentpod!.binding(session),
+            assertActive: (session, epoch, attempt) =>
+              this.supervisor.assertActive(session, epoch, attempt),
+            failed: (session, error) => this.supervisor.failControl(session, error),
+          });
+          this.supervisor.mcp = this.mcp;
+        }
+        this.cancellations = new TurnCancellations(
+          this.store,
+          this.managed,
+          (id) => this.supervisor.attemptActive(id),
+          async (attempt) => {
+            this.managed.abortCancelled(attempt);
+            this.mcp?.abortAttempt(attempt);
+            this.toolkit?.abortAttempt(attempt);
+
+            const stopped = await Promise.allSettled([
+              this.station?.abortAttempt(attempt),
+              this.toolkitResources.stopAttempt(attempt),
+              (async () => {
+                this.coding.cancelAttempt(attempt);
+                const owned = this.children.owned(this.store.attempt(attempt).session_id);
+                if (owned && this.store.workerBoundary.view(owned.id).binding.external)
+                  await this.external.cancel(owned);
+                else {
+                  await this.children.cancelOwned(attempt);
+                  await this.supervisor.cancelAttempt(attempt);
+                }
+              })(),
+            ]);
+            const failures = stopped.filter((r) => r.status === 'rejected');
+            if (failures.length)
+              throw new AggregateError(
+                failures.map((r) => r.reason),
+                'Turn resource stop is unconfirmed',
+              );
+          },
+        );
+        this.cancellations.cancelAdditional = (attempt) => {
+          this.mcp?.cancelInTransaction(attempt);
+          this.station?.cancelInTransaction(attempt);
+          cancelToolkitCalls(this.store, this.managed, attempt, this.toolkitResources);
+        };
+        this.cancellations.additionalResources = (session, attempt) => [
+          ...(this.station?.unconfirmed(session, attempt) ?? []),
+          ...(this.mcp && !this.mcp.stopped(session) ? ['managed-mcp:' + session] : []),
+          ...(this.store.db
+            .prepare(
+              "SELECT 1 FROM toolkit_resources r JOIN toolkit_calls c ON c.resource_id=r.id WHERE c.attempt_id=? AND c.cancel_requested=1 AND r.state!='stopped' LIMIT 1",
+            )
+            .get(attempt)
+            ? ['managed-toolkit:' + session]
+            : []),
+          ...this.store.db
+            .prepare(
+              `SELECT id FROM toolkit_calls c WHERE attempt_id=? AND state IN ('delivered','dispatching','outcome_unknown') AND NOT ${resolvedToolkitCallSql('c')}`,
+            )
+            .all(attempt)
+            .map((row) => 'toolkit-call:' + row.id),
+        ];
       } catch (error) {
         this.store.close();
         throw error;
@@ -346,7 +694,11 @@ export class SalaamService {
         throw new Error('Host executor does not match reviewed manifest');
       await service.supervisor.providerAuth();
       await service.external.backend?.prepare?.();
+      await service.toolkitResources.recover();
+      await service.station?.initialize();
+      recoverToolkitCalls(service.store, service.managed);
       await service.supervisor.recover();
+      service.cancellations.recover();
       await service.external.recover();
       service.store.recoverWork();
       service.taskWork.recover();
@@ -356,6 +708,7 @@ export class SalaamService {
       service.children.recover();
       service.workerWorkspaces.recover();
       service.managed.recover();
+      service.mcp?.recover();
       await service.managed.reconcileAll();
       service.taskCheckpoints.recover();
       await service.jobs.recover();
@@ -367,16 +720,89 @@ export class SalaamService {
       }
       await service.listen(service.bridgeServer, service.bridgeSocket);
       await service.listen(service.operator, service.socket);
+      service.shareOperatorSocket();
       service.taskDriver.start();
       service.jobs.start();
       service.recurring.start();
       service.inbox.start();
+      service.authorityTimer = setInterval(() => {
+        try {
+          for (const binding of service.agentpod?.expired() ?? []) {
+            const status = service.agentpod!.revoke(
+              binding,
+              'expired:' + binding.hub_session_id,
+              'AgentPod authority lease expired',
+            );
+            service.scheduleRevocationStop(service.store.execution.revocation(status.session_id)!);
+          }
+        } catch (error) {
+          for (const session of service.store.sessions())
+            if (
+              service.store.db
+                .prepare('SELECT 1 FROM agentpod_admissions WHERE session_id=?')
+                .get(session.id)
+            )
+              service.supervisor.failControl(session.id, error as Error);
+        }
+      }, 250);
+      service.authorityTimer.unref();
       return service;
     } catch (error) {
       await service.close();
       throw error;
     }
   }
+  private scheduleRevocationStop(
+    receipt: import('./execution-authority.js').SessionRevocation,
+  ): void {
+    const cleanup = this.stopRevoked(receipt).finally(() => this.revocationStops.delete(cleanup));
+    this.revocationStops.add(cleanup);
+  }
+  private async stopRevoked(
+    receipt: import('./execution-authority.js').SessionRevocation,
+  ): Promise<void> {
+    const jobs: Promise<unknown>[] = receipt.attempt_ids.map(async (attempt) => {
+      this.managed.abortCancelled(attempt);
+      this.mcp?.abortAttempt(attempt);
+      this.toolkit?.abortAttempt(attempt);
+      await this.station?.abortAttempt(attempt);
+    });
+    for (const session of receipt.session_ids) {
+      jobs.push(this.toolkitResources.stopSession(session));
+      if (this.mcp) jobs.push(this.mcp.stopSession(session));
+      if (this.toolkit) jobs.push(this.toolkit.stopSession(session));
+      if (this.station) jobs.push(this.station.stopSession(session));
+      jobs.push(Promise.resolve().then(() => this.supervisor.stopSession(session)));
+      jobs.push(
+        Promise.resolve().then(async () => {
+          const child = this.children.owned(session);
+          if (child && this.store.workerBoundary.view(child.id).binding.external)
+            await this.external.cancel(child);
+        }),
+      );
+      jobs.push(
+        Promise.resolve().then(() => {
+          for (const run of this.store.db
+            .prepare(
+              "SELECT id FROM command_runs WHERE session_id=? AND state NOT IN ('succeeded','failed','cancelled','timed_out','output_limited','interrupted')",
+            )
+            .all(session))
+            this.coding.cancel(session, String(run.id), 'session-revocation:' + run.id, () => {});
+        }),
+      );
+    }
+    await Promise.allSettled(jobs);
+  }
+  /** The launcher profile's only widening: group traverse on state and rw on operator.sock.
+   * The bridge socket, journal, keys and every file below state stay owner-only. */
+  private shareOperatorSocket(): void {
+    if (!this.operatorAccess) return;
+    const { gid } = this.operatorAccess;
+    chownSync(this.socket, process.getuid!(), gid);
+    chmodSync(this.socket, 0o660);
+    chownSync(this.stateDir, process.getuid!(), gid);
+    chmodSync(this.stateDir, 0o710);
+  }
   private async listen(server: Server, path: string): Promise<void> {
     // The exclusive state lock is held before removing a stale socket.
     if (existsSync(path)) unlinkSync(path);
@@ -389,6 +815,11 @@ export class SalaamService {
       });
     });
   }
+  private grantStore?: RunGrants;
+  /** One "Approve for this run" grant store, shared by decisions and the station. */
+  private runGrants(): RunGrants {
+    return (this.grantStore ??= new RunGrants(this.store));
+  }
   private send(res: ServerResponse, status: number, value: unknown): void {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(value));
@@ -398,6 +829,14 @@ export class SalaamService {
       if (this.stopping) throw new ServiceError('stopping', 'Service is stopping', 503);
       const url = new URL(req.url ?? '/', 'http://local');
       const parts = url.pathname.split('/').filter(Boolean);
+      if (!bridge && req.method === 'POST' && req.url === '/managed-toolkit/v1/verify') {
+        this.send(res, 200, await this.toolkitOwners.verify(req));
+        return;
+      }
+      if (!bridge && req.method === 'POST' && req.url === '/managed-toolkit/v1/control') {
+        this.send(res, 200, await this.toolkitOwners.control(req));
+        return;
+      }
       if (
         !bridge &&
         req.method === 'GET' &&
@@ -459,6 +898,416 @@ export class SalaamService {
         this.send(res, 200, value);
         return;
       }
+      if (
+        parts[0] === 'v1' &&
+        parts[1] === 'agentpod' &&
+        parts.length === 3 &&
+        req.method === 'POST'
+      ) {
+        if (!this.agentpod)
+          throw new ServiceError(
+            'authority_disabled',
+            'AgentPod authority requires reviewed --agentpod-config pins',
+          );
+        const body = object(await readJson(req));
+        if (parts[2] === 'attach') {
+          const attached = this.agentpod.authenticate(
+            string(body.admission_id, 'admission_id', 128),
+            string(body.token, 'token', 128),
+          );
+          this.send(res, 200, {
+            ...attached,
+            ...(this.agentpodWorkProgression &&
+            this.agentpodWork &&
+            attached.binding.run.source === 'superpipeline'
+              ? { work_control: { version: 1, owner: 'superpipeline' } }
+              : {}),
+            ...(this.mcp ? { managed_mcp: this.mcp.status(attached.session_id).assignment } : {}),
+          });
+          return;
+        }
+        if (parts[2] === 'status') {
+          this.send(res, 200, this.agentpod.inspect(body.binding));
+          return;
+        }
+        if (parts[2] === 'work-capability') {
+          if (Object.keys(body).length)
+            throw new ServiceError('invalid_work_payload', 'Empty capability request required');
+          this.send(res, 200, {
+            version: 1,
+            enabled: !!this.agentpodWork && this.agentpodWorkProgression,
+          });
+          return;
+        }
+        // Item 11b: restore a checkpoint's files, exactly as approved, for an ended run.
+        if (parts[2] === 'work-restore') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !==
+            'approved_by,binding,checkpoint_id,request_id,restore_digest'
+          )
+            throw new ServiceError('invalid_work_payload', 'Closed restore request required');
+          const restoreDigest = string(body.restore_digest, 'restore_digest', 64);
+          if (!/^[a-f0-9]{64}$/.test(restoreDigest))
+            throw new ServiceError('invalid_work_payload', 'A restore names its exact digest');
+          this.send(
+            res,
+            200,
+            await this.agentpodWork.restore(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.checkpoint_id, 'checkpoint_id', 128),
+              restoreDigest,
+              string(body.approved_by, 'approved_by', 128),
+            ),
+          );
+          return;
+        }
+        // Item 11: read-only checkpoints of the bound run and one checkpoint's diff.
+        if (parts[2] === 'work-checkpoints' || parts[2] === 'work-checkpoint-diff') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          const keys = parts[2] === 'work-checkpoints' ? 'binding' : 'binding,checkpoint_id';
+          if (Object.keys(body).sort().join(',') !== keys)
+            throw new ServiceError('invalid_work_payload', 'Closed checkpoint request required');
+          this.send(
+            res,
+            200,
+            parts[2] === 'work-checkpoints'
+              ? this.agentpodWork.checkpoints(body.binding)
+              : await this.agentpodWork.checkpointDiff(
+                  body.binding,
+                  string(body.checkpoint_id, 'checkpoint_id', 128),
+                ),
+          );
+          return;
+        }
+        if (parts[2] === 'work-status' || parts[2] === 'work-progress') {
+          if (!this.agentpodWork || !this.agentpodWorkProgression)
+            throw new ServiceError('work_disabled', 'Strict progression is not enabled');
+          if (parts[2] === 'work-status') {
+            if (Object.keys(body).join(',') !== 'binding')
+              throw new ServiceError('invalid_work_payload', 'Closed status request required');
+            this.send(res, 200, await this.agentpodWork.status(body.binding, this.taskDriver));
+          } else {
+            if (
+              Object.keys(body).sort().join(',') !==
+                'binding,compact,max_steps,request_id,work_request_id' ||
+              body.compact !== false
+            )
+              throw new ServiceError(
+                'invalid_work_payload',
+                'Closed bounded progression request required',
+              );
+            this.send(
+              res,
+              200,
+              this.agentpodWork.progress(
+                body.binding,
+                string(body.request_id, 'request_id', 128),
+                string(body.work_request_id, 'work_request_id', 128),
+                integer(body.max_steps, 'max_steps'),
+                this.taskDriver,
+              ),
+            );
+          }
+          return;
+        }
+        if (parts[2] === 'work-abandon') {
+          if (!this.agentpodWork || !this.agentpodWorkProgression)
+            throw new ServiceError(
+              'work_disabled',
+              'Strict work historical success retirement is not enabled',
+            );
+          if (
+            Object.keys(body).sort().join(',') !==
+            'binding,producer_terminal_digest,request_id,work_request_id'
+          )
+            throw new ServiceError(
+              'invalid_work_payload',
+              'Closed explicit failure request required',
+            );
+          this.send(
+            res,
+            200,
+            this.agentpodWork.abandon(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.work_request_id, 'work_request_id', 128),
+              string(body.producer_terminal_digest, 'producer_terminal_digest', 64),
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'work-fail') {
+          if (!this.agentpodWork || !this.agentpodWorkProgression)
+            throw new ServiceError(
+              'work_disabled',
+              'Strict work failure retirement is not enabled',
+            );
+          if (
+            Object.keys(body).sort().join(',') !==
+            'binding,producer_terminal_digest,request_id,work_request_id'
+          )
+            throw new ServiceError(
+              'invalid_work_payload',
+              'Closed explicit failure request required',
+            );
+          this.send(
+            res,
+            200,
+            this.agentpodWork.fail(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.work_request_id, 'work_request_id', 128),
+              string(body.producer_terminal_digest, 'producer_terminal_digest', 64),
+              this.taskDriver,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'work-expire') {
+          if (!this.agentpodWork || !this.agentpodWorkProgression)
+            throw new ServiceError('work_disabled', 'Strict work expiry is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !==
+            'binding,decision_request_id,producer_terminal_digest,request_id,work_request_id'
+          )
+            throw new ServiceError(
+              'invalid_work_payload',
+              'Closed explicit expiry request required',
+            );
+          this.send(
+            res,
+            200,
+            this.agentpodWork.expire(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.work_request_id, 'work_request_id', 128),
+              string(body.decision_request_id, 'decision_request_id', 128),
+              string(body.producer_terminal_digest, 'producer_terminal_digest', 64),
+              this.taskDriver,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'work-settle') {
+          if (!this.agentpodWork || !this.agentpodWorkProgression)
+            throw new ServiceError('work_disabled', 'Strict work settlement is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !==
+            'binding,producer_terminal_digest,request_id,work_request_id'
+          )
+            throw new ServiceError(
+              'invalid_work_payload',
+              'Closed explicit settlement request required',
+            );
+          this.send(
+            res,
+            200,
+            this.agentpodWork.settle(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.work_request_id, 'work_request_id', 128),
+              string(body.producer_terminal_digest, 'producer_terminal_digest', 64),
+              this.taskDriver,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'work-trace') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !== 'binding,schema_version,traceparent' ||
+            body.schema_version !== 'salaam-work-trace/v1'
+          )
+            throw new ServiceError(
+              'invalid_trace_context',
+              'Closed versioned trace context required',
+            );
+          this.send(res, 200, this.agentpodWork.trace(body.binding, body.traceparent));
+          return;
+        }
+        if (parts[2] === 'work-evidence-artifacts') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !== 'artifact_ids,binding,schema_version' ||
+            body.schema_version !== 'salaam-execution-artifacts/v1'
+          )
+            throw new ServiceError(
+              'unsupported_evidence_version',
+              'Closed versioned artifact selection required',
+            );
+          this.send(res, 200, this.agentpodWork.evidenceArtifacts(body.binding, body.artifact_ids));
+          return;
+        }
+        if (parts[2] === 'work-evidence') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !== 'binding,schema_version' ||
+            body.schema_version !== 'salaam-execution-evidence/v1'
+          )
+            throw new ServiceError(
+              'unsupported_evidence_version',
+              'Explicit supported evidence version required',
+            );
+          this.send(res, 200, this.agentpodWork.evidence(body.binding));
+          return;
+        }
+        if (parts[2] === 'work-completion') {
+          if (!this.agentpodWork)
+            throw new ServiceError(
+              'verification_unavailable',
+              'Reviewed protected station backend required',
+            );
+          if (Object.keys(body).join(',') !== 'binding')
+            throw new ServiceError('invalid_work_payload', 'Closed completion request required');
+          this.send(res, 200, await this.agentpodWork.completion(body.binding));
+          return;
+        }
+        if (parts[2] === 'work-read') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict progression is not enabled');
+          if (Object.keys(body).sort().join(',') !== 'answer,binding')
+            throw new ServiceError('invalid_board_read', 'Closed board read answer required');
+          this.send(res, 200, this.agentpodWork.answerBoardRead(body.binding, body.answer));
+          return;
+        }
+        if (parts[2] === 'work-decisions' || parts[2] === 'work-decision') {
+          if (!this.agentpodWork)
+            throw new ServiceError(
+              'verification_unavailable',
+              'Reviewed protected station backend required',
+            );
+          const answering = parts[2] === 'work-decision';
+          if (Object.keys(body).sort().join(',') !== (answering ? 'answer,binding' : 'binding'))
+            throw new ServiceError('invalid_work_decision', 'Closed decision payload required');
+          const decisions = new AgentPodWorkDecisions(
+            this.agentpodWork,
+            this.managed,
+            this.runGrants(),
+          );
+          this.send(
+            res,
+            200,
+            answering ? decisions.answer(body.binding, body.answer) : decisions.list(body.binding),
+          );
+          return;
+        }
+        if (parts[2] === 'work-admit') {
+          // This is the private owner socket, never the worker bridge. The native
+          // node authenticates its Hub reservation; board/card/stage are that
+          // trusted producer's assertion. Runtime pins and byte digests are local.
+          if (!this.agentpodWork)
+            throw new ServiceError(
+              'verification_unavailable',
+              'Reviewed protected station work backend required',
+            );
+          if (Object.keys(body).sort().join(',') !== 'admission,input,plan')
+            throw new ServiceError('invalid_work_payload', 'Closed work payload required');
+          const admission = agentpodWorkAdmission(body.admission),
+            input = object(body.input);
+          if (
+            Object.keys(input).sort().join(',') !== 'incoming_handoff,instructions,references' ||
+            typeof input.instructions !== 'string' ||
+            input.instructions.length < 1 ||
+            input.instructions.length > 65536 ||
+            !Array.isArray(input.references) ||
+            input.references.length > 64 ||
+            input.references.some(
+              (v) => typeof v !== 'string' || v.length < 1 || v.length > 4096,
+            ) ||
+            (input.incoming_handoff !== null &&
+              (typeof input.incoming_handoff !== 'string' || input.incoming_handoff.length > 65536))
+          )
+            throw new ServiceError('invalid_work_payload', 'Closed work input required');
+          if (canonical(this.taskWork.parse(body.plan)) !== canonical(body.plan))
+            throw new ServiceError(
+              'invalid_work_payload',
+              'Fully expanded canonical task plan required',
+            );
+          const owner = this.agentpod.inspect(admission.binding);
+          this.send(
+            res,
+            200,
+            this.agentpodWork.admit(
+              owner.session_id,
+              admission,
+              {
+                board_id: admission.work.board_id,
+                card_id: admission.work.card_id,
+                stage_key: admission.work.stage_key,
+              },
+              input,
+              body.plan,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'mcp-assign') {
+          if (!this.mcp)
+            throw new ServiceError('mcp_disabled', 'No reviewed managed MCP host profile', 403);
+          const current = this.agentpod.inspect(body.binding);
+          const old = this.mcp.status(current.session_id).assignment;
+          const assigned = this.mcp.assign(current.session_id, body.assignment);
+          if (old && old.assignment_digest !== assigned.assignment_digest) {
+            this.supervisor.failControl(
+              current.session_id,
+              new Error('MCP assignment changed; restart required'),
+            );
+            await Promise.all([
+              this.supervisor.stopSession(current.session_id),
+              this.mcp.stopSession(current.session_id),
+            ]);
+          }
+          this.send(res, 200, await this.mcp.ready(current.session_id));
+          return;
+        }
+        const request = string(body.request_id, 'request_id', 128);
+        if (parts[2] === 'admit') {
+          this.send(
+            res,
+            200,
+            this.agentpod.admit(
+              body.binding,
+              request,
+              body.continue_from === undefined
+                ? undefined
+                : string(body.continue_from, 'continue_from', 128),
+              body.approval_rules,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'renew') {
+          this.send(
+            res,
+            200,
+            this.agentpod.renew(
+              body.binding,
+              request,
+              integer(body.lease_sequence, 'lease_sequence'),
+              body.approval_rules,
+            ),
+          );
+          return;
+        }
+        if (parts[2] === 'revoke') {
+          const status = this.agentpod.revoke(
+            body.binding,
+            request,
+            string(body.reason, 'reason', 1024),
+          );
+          this.scheduleRevocationStop(this.store.execution.revocation(status.session_id)!);
+          this.send(res, 202, status);
+          return;
+        }
+        throw new ServiceError('not_found', 'Unknown AgentPod authority method', 404);
+      }
       if (
         parts[0] === 'v1' &&
         parts[1] === 'job-occurrences' &&
@@ -822,7 +1671,7 @@ export class SalaamService {
           const session = string(url.searchParams.get('session_id'), 'session_id', 128);
           this.store.session(session);
           const current = this.taskWork.forSession(session);
-          this.send(res, 200, current ? this.taskDriver.view(current.id) : null);
+          this.send(res, 200, current ? await this.taskDriver.viewAsync(current.id) : null);
           return;
         }
         const taskId = parts[2];
@@ -844,7 +1693,7 @@ export class SalaamService {
         }
 
         if (req.method === 'GET' && taskId && parts.length === 3) {
-          this.send(res, 200, this.taskDriver.view(taskId));
+          this.send(res, 200, await this.taskDriver.viewAsync(taskId));
           return;
         }
         if (req.method === 'GET' && taskId && parts.length === 4 && parts[3] === 'history') {
@@ -874,7 +1723,7 @@ export class SalaamService {
               body.plan,
               controller,
             );
-            this.send(res, 201, this.taskDriver.view(task.id));
+            this.send(res, 201, await this.taskDriver.viewAsync(task.id));
             return;
           }
           if (
@@ -896,7 +1745,7 @@ export class SalaamService {
               );
             else if (parts[3] === 'finish') {
               const exception = body.exception == null ? null : object(body.exception);
-              this.taskVerification.finish(
+              await this.taskVerification.finishAsync(
                 taskId,
                 request,
                 expected,
@@ -912,7 +1761,7 @@ export class SalaamService {
                   : null,
                 authorize,
               );
-              result = this.taskDriver.view(taskId);
+              result = await this.taskDriver.viewAsync(taskId);
             } else if (parts[3] === 'checkpoint')
               result = this.taskCheckpoints.capture(taskId, request, expected, authorize);
             else if (parts[3] === 'restore')
@@ -936,10 +1785,10 @@ export class SalaamService {
                 body.compact === true,
                 controller,
               );
-              result = this.taskDriver.view(taskId);
+              result = await this.taskDriver.viewAsync(taskId);
             } else {
               await this.taskDriver.cancel(taskId, request, expected, controller);
-              result = this.taskDriver.view(taskId);
+              result = await this.taskDriver.viewAsync(taskId);
             }
             this.send(res, 200, result);
             return;
@@ -949,7 +1798,7 @@ export class SalaamService {
               res,
               200,
               (this.taskWork.revise(taskId, request, expected, body.plan, controller),
-              this.taskDriver.view(taskId)),
+              await this.taskDriver.viewAsync(taskId)),
             );
             return;
           }
@@ -984,17 +1833,61 @@ export class SalaamService {
                   string(body.review, 'review', 4096),
                   controller,
                 ),
-                this.taskDriver.view(taskId)),
+                await this.taskDriver.viewAsync(taskId)),
               );
               return;
             }
           }
         }
       }
+      if (url.pathname === '/v1/command-inventory' && req.method === 'GET') {
+        this.send(res, 200, {
+          version: 1,
+          surface: 'salaam-tui',
+          commands: SLASH_COMMANDS,
+          automatic_discovery: false,
+        });
+        return;
+      }
       if (url.pathname === '/v1/health' && req.method === 'GET') {
         const sessions = this.store.sessions().map((x) => this.supervisor.inspect(x.id));
         this.send(res, 200, {
+          pid: process.pid,
+          host_manifest_digest: this.hostManifestDigest,
+          host_supervisor_connected: this.hostManifestDigest ? process.connected === true : null,
+          host_receipt: this.hostReceipt,
+          runtime_node: realpathSync(process.execPath),
+          service_version: VERSION,
+          context_admission: { version: 1, automatic_discovery: false, child_inheritance: false },
+          agentpod_config: this.agentpod?.configPath ?? null,
+          agentpod_pins_digest: this.agentpod ? digest(this.agentpod.pins) : null,
+          persona: this.supervisor.persona
+            ? { digest: this.supervisor.persona.digest, text: this.supervisor.persona.text }
+            : null,
+          operator_mcp: this.operatorMcpPath
+            ? {
+                config: this.operatorMcpPath,
+                digest: this.supervisor.operatorMcp!.digest,
+                servers: this.supervisor.operatorMcp!.provenance(),
+              }
+            : null,
+          managed_mcp: this.mcp
+            ? { profile_digest: this.mcp.options.admission.profileDigest }
+            : null,
+          managed_toolkit: this.toolkit
+            ? { configuration_digest: this.toolkit.configurationDigest }
+            : null,
+          strict_work: this.agentpodWorkProgression && this.agentpodWork ? { version: 1 } : null,
+          station_execution: this.station
+            ? { configuration_digest: this.station.configurationDigest }
+            : null,
           service: 'healthy',
+          tool_execution: {
+            mode: this.toolIdentity.mode,
+            user: this.toolIdentity.user,
+            uid: this.toolIdentity.uid,
+            warning: this.toolIdentity.warning,
+          },
           a2a: {
             inbound_enabled: !!this.a2aInbound,
             listener: this.a2aInbound?.server.address() ?? null,
@@ -1036,6 +1929,12 @@ export class SalaamService {
             checkpoints: true,
             deterministic_compaction: 'operator-bounded-idle-only',
           },
+          local_workspace: {
+            inspection: true,
+            session_routes: true,
+            coding: true,
+            reasoning: true,
+          },
           provider_route: this.supervisor.route,
           provider_capabilities: this.supervisor.providerCapabilities(),
           effect_connector: this.managed.options.connector?.id ?? null,
@@ -1050,9 +1949,11 @@ export class SalaamService {
                 backend: this.coding.executor?.evidence ?? null,
               }
             : EXECUTION_STATUS,
+          last_activity_at: new Date(this.store.lastActivityAny()).toISOString(),
           sessions: sessions.map((x) => ({
             id: x.id,
             state: x.state,
+            last_activity_at: iso(this.store.lastActivity(x.id)),
             error: x.error,
             capabilities: x.capabilities,
             pending_approvals: this.store
@@ -1082,6 +1983,11 @@ export class SalaamService {
         return;
       }
       if (url.pathname === '/v1/sessions' && req.method === 'POST') {
+        if (this.agentpod)
+          throw new ServiceError(
+            'admission_required',
+            'This daemon requires a trusted AgentPod admission; unbound session creation is disabled',
+          );
         const body = object(await readJson(req));
         const cwd = realpathSync(string(body.cwd, 'cwd'));
         if (!statSync(cwd).isDirectory())
@@ -1090,10 +1996,98 @@ export class SalaamService {
           throw new ServiceError('invalid_field', 'coding must be a boolean', 400);
         if (body.coding && !this.workspaces.root)
           throw new ServiceError('coding_disabled', 'Start with an explicit --coding-root');
+        if (
+          body.local_coding !== undefined &&
+          (typeof body.local_coding !== 'boolean' || !body.local_workspace)
+        )
+          throw new ServiceError('invalid_field', 'local_coding requires a local workspace');
+        if (body.local_workspace !== undefined && typeof body.local_workspace !== 'boolean')
+          throw new ServiceError('invalid_field', 'local_workspace must be a boolean', 400);
+        if (body.local_workspace && body.coding)
+          throw new ServiceError(
+            'invalid_field',
+            'Choose local inspection or an owned coding workspace',
+            400,
+          );
+        if (body.route !== undefined && !body.local_workspace)
+          throw new ServiceError(
+            'invalid_field',
+            'Session route selection requires a local workspace',
+            400,
+          );
+        const selected =
+          body.route === undefined
+            ? this.supervisor.route
+            : (() => {
+                const input = object(body.route);
+                return providerRoute(
+                  string(input.provider, 'provider'),
+                  input.model === undefined ? undefined : string(input.model, 'model'),
+                  input.max_tokens === undefined
+                    ? undefined
+                    : integer(input.max_tokens, 'max_tokens'),
+                  undefined,
+                  undefined,
+                  input.reasoning as import('./provider-config.js').ReasoningLevel | undefined,
+                );
+              })();
+        if (body.local_workspace) {
+          const saved = this.store.cachedRequest<import('./protocol.js').Session>(
+            'local-operator',
+            string(body.request_id, 'request_id', 128),
+            {
+              kind: 'create',
+              cwd,
+              local: {
+                workspace: true,
+                route: selected,
+                ...(body.local_coding ? { coding: true } : {}),
+              },
+            },
+          );
+          if (saved) {
+            this.send(res, 201, saved);
+            return;
+          }
+          if (this.mcp || this.toolkit || this.station)
+            throw new ServiceError(
+              'admission_required',
+              'Local inspection cannot be combined with managed host capabilities',
+            );
+        }
+        const preparedLocal = body.local_workspace
+          ? await this.supervisor.prepareProviderRoute(selected).catch(() => {
+              throw new ServiceError(
+                'provider_auth_required',
+                `Provider authentication or routing configuration is unavailable. Configure ${selected.provider} with sal auth login ${selected.provider} or sal auth set ${selected.provider}, then retry.`,
+                400,
+              );
+            })
+          : undefined;
+        if (
+          preparedLocal?.output_cap === false &&
+          body.route !== undefined &&
+          object(body.route).max_tokens !== undefined
+        )
+          throw new ServiceError(
+            'provider_output_cap_unavailable',
+            'This authentication route cannot enforce an output token cap; omit max_tokens for an interactive session.',
+            400,
+          );
+        const local = body.local_workspace
+          ? {
+              workspace: true as const,
+              coding: body.local_coding === true,
+              requestedRoute: selected,
+              route: preparedLocal!.route,
+              outputCap: preparedLocal!.output_cap,
+            }
+          : undefined;
         const session = this.store.create(
           cwd,
           string(body.request_id, 'request_id', 128),
           body.coding === true,
+          local,
         );
         if (body.coding) this.workspaces.import(session.id, cwd);
         if (this.store.session(session.id).state === 'stopped')
@@ -1127,6 +2121,188 @@ export class SalaamService {
       }
       if (parts[0] === 'v1' && parts[1] === 'sessions' && parts[2]) {
         const id = parts[2];
+        if (parts.length === 4 && parts[3] === 'permissions') {
+          if (req.method === 'GET') {
+            this.send(res, 200, {
+              policy: permissionPolicy(this.store, id),
+              configurable: this.store.localWorkspace(id),
+              coding: this.store.localCoding(id),
+              command_auto_approval: false,
+            });
+            return;
+          }
+          if (req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.send(
+              res,
+              200,
+              configurePermissions(
+                this.store,
+                id,
+                string(body.request_id, 'request_id', 128),
+                integer(body.expected_revision, 'expected_revision'),
+                body.policy,
+                {
+                  client_id: string(body.client_id, 'client_id', 128),
+                  token: string(body.token, 'token', 128),
+                },
+              ),
+            );
+            return;
+          }
+        }
+        if (parts.length === 4 && parts[3] === 'local-diff' && req.method === 'GET') {
+          if (!this.store.localWorkspace(id))
+            throw new ServiceError('local_denied', 'Local workspace required');
+          this.send(res, 200, { text: await localDiff(this.store.session(id).cwd) });
+          return;
+        }
+        if (parts.length === 4 && parts[3] === 'steer' && req.method === 'POST') {
+          const body = object(await readJson(req));
+          this.send(
+            res,
+            200,
+            await this.supervisor.steer(
+              id,
+              string(body.request_id, 'request_id', 128),
+              string(body.text, 'text', 65536),
+              {
+                client_id: string(body.client_id, 'client_id', 128),
+                token: string(body.token, 'token', 128),
+              },
+            ),
+          );
+          return;
+        }
+        if (parts.length === 4 && parts[3] === 'undo-reconcile' && req.method === 'POST') {
+          const body = object(await readJson(req));
+          this.send(
+            res,
+            200,
+            reconcileUndo(
+              this.store,
+              id,
+              {
+                client_id: string(body.client_id, 'client_id', 128),
+                token: string(body.token, 'token', 128),
+              },
+              () => this.supervisor.assertIdle(id),
+            ),
+          );
+          return;
+        }
+        if (parts.length === 4 && parts[3] === 'undo') {
+          if (req.method === 'GET') {
+            this.send(res, 200, reviewUndo(this.store, id));
+            return;
+          }
+          if (req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.send(
+              res,
+              200,
+              applyUndo(
+                this.store,
+                id,
+                string(body.request_id, 'request_id', 128),
+                string(body.review_digest, 'review_digest', 128),
+                {
+                  client_id: string(body.client_id, 'client_id', 128),
+                  token: string(body.token, 'token', 128),
+                },
+                () => {
+                  this.supervisor.assertIdle(id);
+                  if (
+                    this.store.db
+                      .prepare(
+                        "SELECT 1 FROM attempts WHERE session_id=? AND state IN ('accepted','dispatching','running')",
+                      )
+                      .get(id)
+                  )
+                    throw new ServiceError('session_busy', 'Wait for queued work before undo');
+                },
+                this.toolIdentity,
+              ),
+            );
+            return;
+          }
+        }
+        if (parts.length === 4 && parts[3] === 'fork' && req.method === 'POST') {
+          if (this.agentpod)
+            throw new ServiceError(
+              'admission_required',
+              'Managed station sessions cannot be forked locally',
+            );
+          const body = object(await readJson(req));
+          const session = this.store.forkLocal(
+            id,
+            string(body.request_id, 'request_id', 128),
+            integer(body.expected_revision, 'expected_revision'),
+            {
+              client_id: string(body.client_id, 'client_id', 128),
+              token: string(body.token, 'token', 128),
+            },
+            (source, target) => {
+              this.supervisor.assertIdle(id);
+              const dir = join(this.stateDir, 'workers', target, 'sessions');
+              mkdirSync(dir, { recursive: true, mode: 0o700 });
+              return forkPiSession(source.pi_session_file!, source.cwd, dir, target);
+            },
+          );
+          this.send(res, 201, session);
+          return;
+        }
+        if (parts.length === 4 && parts[3] === 'name') {
+          if (req.method === 'GET') {
+            this.send(res, 200, { name: this.store.sessionName(id) ?? null });
+            return;
+          }
+          if (req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.send(
+              res,
+              200,
+              this.store.nameSession(
+                id,
+                string(body.request_id, 'request_id', 128),
+                string(body.name, 'name', 120),
+                {
+                  client_id: string(body.client_id, 'client_id', 128),
+                  token: string(body.token, 'token', 128),
+                },
+              ),
+            );
+            return;
+          }
+        }
+        if (parts.length === 4 && parts[3] === 'revocation' && req.method === 'GET') {
+          this.send(res, 200, this.store.execution.revocation(id));
+          return;
+        }
+        if (parts.length === 4 && parts[3] === 'revoke' && req.method === 'POST') {
+          const body = object(await readJson(req));
+          const request = string(body.request_id, 'request_id', 128);
+          const receipt = this.store.execution.revoke(
+            id,
+            request,
+            integer(body.expected_revision, 'expected_revision'),
+            string(body.reason, 'reason', 1024),
+            {
+              client_id: string(body.client_id, 'client_id', 128),
+              token: string(body.token, 'token', 128),
+            },
+            (attempt) => {
+              this.managed.cancelInTransaction(attempt, request, 'session-revocation');
+              this.mcp?.cancelInTransaction(attempt, 'session-revocation');
+              this.station?.cancelInTransaction(attempt);
+            },
+          );
+          // The receipt commits before any asynchronous process/executor cleanup.
+          // Cleanup failure never restores authority or implies a confirmed stop.
+          this.scheduleRevocationStop(receipt);
+          this.send(res, 202, receipt);
+          return;
+        }
         if (parts[3] === 'agents') {
           if (req.method === 'GET') {
             const profile = url.searchParams.get('profile');
@@ -1290,6 +2466,41 @@ export class SalaamService {
             }
           }
         }
+        if (parts[3] === 'context') {
+          const contexts = this.tasks.admitted!;
+          if (parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, contexts.inspect(id));
+            return;
+          }
+          if (req.method === 'POST' && (parts[4] === 'plan' || parts[4] === 'admit')) {
+            const body = object(await readJson(req));
+            const authorize = () => {
+              this.store.authorizeControl(id, {
+                client_id: string(body.client_id, 'client_id', 128),
+                token: string(body.token, 'token', 128),
+              });
+              this.supervisor.assertIdle(id);
+            };
+            if (parts[4] === 'plan') {
+              authorize();
+              this.send(res, 200, contexts.plan(id, body.selection));
+            } else {
+              this.send(
+                res,
+                200,
+                contexts.admit(
+                  id,
+                  string(body.request_id, 'request_id', 128),
+                  integer(body.expected_revision, 'expected_revision'),
+                  string(body.digest, 'digest', 128),
+                  body.selection,
+                  authorize,
+                ),
+              );
+            }
+            return;
+          }
+        }
         if (parts[3] === 'task' && req.method === 'GET') {
           this.send(res, 200, this.tasks.state(id));
           return;
@@ -1370,6 +2581,32 @@ export class SalaamService {
           return;
         }
       }
+      if (parts[0] === 'v1' && parts[1] === 'toolkit' && parts[2] === 'calls' && parts[3]) {
+        const id = parts[3];
+        if (parts.length === 4 && req.method === 'GET') {
+          this.send(res, 200, this.toolkitResolutions.inspect(id));
+          return;
+        }
+        if (parts.length === 5 && parts[4] === 'resolution' && req.method === 'POST') {
+          const body = object(await readJson(req)),
+            outcome = string(body.outcome, 'outcome');
+          if (outcome !== 'succeeded' && outcome !== 'failed_definite')
+            throw new ServiceError('invalid_field', 'Invalid resolution outcome', 400);
+          this.send(
+            res,
+            200,
+            await this.toolkitResolutions.resolveRead(
+              id,
+              string(body.request_id, 'request_id', 128),
+              integer(body.expected_revision, 'expected_revision'),
+              string(body.context_digest, 'context_digest', 128),
+              outcome,
+              string(body.evidence, 'evidence', 4096),
+            ),
+          );
+          return;
+        }
+      }
       if (parts[0] === 'v1' && parts[1] === 'operations' && parts[2]) {
         const id = parts[2];
         if (parts.length === 3 && req.method === 'GET') {
@@ -1401,7 +2638,11 @@ export class SalaamService {
           this.send(
             res,
             200,
-            this.managed.resolve(
+            await (
+              this.toolkitResolutions.owns(id)
+                ? this.toolkitResolutions.resolveOperation.bind(this.toolkitResolutions)
+                : this.managed.resolve.bind(this.managed)
+            )(
               id,
               string(body.request_id, 'request_id', 128),
               integer(body.expected_revision, 'expected_revision'),
@@ -1413,6 +2654,19 @@ export class SalaamService {
           return;
         }
       }
+      if (
+        parts[0] === 'v1' &&
+        parts[1] === 'station' &&
+        parts[2] === 'calls' &&
+        parts[3] &&
+        parts.length === 4 &&
+        req.method === 'GET'
+      ) {
+        if (!this.station)
+          throw new ServiceError('station_disabled', 'Station execution is unavailable');
+        this.send(res, 200, this.station.view(parts[3]));
+        return;
+      }
       if (
         parts[0] === 'v1' &&
         parts[1] === 'attempts' &&
@@ -1512,11 +2766,51 @@ export class SalaamService {
             ...this.supervisor.inspect(id),
             job: this.jobs.forSession(id) ? this.jobs.view(this.jobs.forSession(id)!.id) : null,
             work_task: this.taskWork.forSession(id)
-              ? this.taskDriver.view(this.taskWork.forSession(id)!.id)
+              ? await this.taskDriver.viewAsync(this.taskWork.forSession(id)!.id)
               : null,
           });
           return;
         }
+        if (parts[3] === 'tool-metadata' && req.method === 'GET') {
+          this.send(
+            res,
+            200,
+            this.store.toolMetadata(id, string(url.searchParams.get('call_id'), 'call_id', 512)),
+          );
+          return;
+        }
+        if (parts[3] === 'cancellations') {
+          if (req.method === 'GET') {
+            const request = url.searchParams.get('request_id');
+            this.send(
+              res,
+              200,
+              request
+                ? this.cancellations.get(id, string(request, 'request_id', 128))
+                : this.cancellations.list(id),
+            );
+            return;
+          }
+          if (req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.send(
+              res,
+              202,
+              this.cancellations.begin(
+                id,
+                string(body.request_id, 'request_id', 128),
+                body.target_request_id == null
+                  ? null
+                  : string(body.target_request_id, 'target_request_id', 128),
+                {
+                  client_id: string(body.client_id, 'client_id', 128),
+                  token: string(body.token, 'token', 128),
+                },
+              ),
+            );
+            return;
+          }
+        }
         if (parts[3] === 'control' && req.method === 'POST') {
           const body = object(await readJson(req));
           const action = string(body.action, 'action');
@@ -1542,10 +2836,11 @@ export class SalaamService {
             client_id: string(body.client_id, 'client_id', 128),
             token: string(body.token, 'token', 128),
           });
+          this.store.execution.assert(id);
           const session = this.supervisor.inspect(id);
           if (
             session.provider_route &&
-            canonical(session.provider_route) !== canonical(this.supervisor.route)
+            canonical(session.provider_route) !== canonical(this.supervisor.routeFor(id))
           )
             throw new ServiceError(
               'provider_route_changed',
@@ -1676,53 +2971,74 @@ export class SalaamService {
   async close(): Promise<void> {
     if (this.stopping) {
       await this.closed;
+      if (this.shutdownFailure) throw this.shutdownFailure;
       return;
     }
     this.stopping = true;
-    this.inbox.close();
-    this.recurring.close();
-    this.jobs.close();
-    await this.taskDriver.close();
-    this.dispatcher.pause();
-    this.managed.pause();
-    this.children.pause();
+    this.toolkitResolutions.stop();
+    clearInterval(this.authorityTimer);
     const errors: unknown[] = [];
-    try {
-      await this.a2aInbound?.close();
-      await this.external.close();
-      await this.coding.close();
+    const attempt = async (cleanup: () => unknown) => {
       try {
-        await this.children.close();
-        await this.supervisor.close();
+        await cleanup();
       } catch (error) {
         errors.push(error);
       }
-      await this.dispatcher.drain();
-      await this.managed.close();
-      await Promise.all(
+    };
+    await attempt(() => this.inbox.close());
+    await attempt(() => this.recurring.close());
+    await attempt(() => this.jobs.close());
+    await attempt(() => this.taskDriver.close());
+    this.taskVerification.station?.stop();
+    await attempt(() => this.dispatcher.pause());
+    await attempt(() => this.managed.pause());
+    await attempt(() => this.children.pause());
+    await attempt(() => this.a2aInbound?.close());
+    await Promise.all([...this.revocationStops].map((stop) => attempt(() => stop)));
+    await attempt(() => this.external.close());
+    await attempt(() => this.localCoding.close());
+    await attempt(() => this.coding.close());
+    await attempt(() => this.mcp?.close());
+    await attempt(() => this.toolkit?.close());
+    await attempt(() => this.station?.close());
+    await attempt(() => this.taskVerification.station?.drain());
+    await attempt(() => this.toolkitResources.close());
+    await attempt(() => this.toolkitResolutions.close());
+    await attempt(() => this.children.close());
+    await attempt(() => this.supervisor.close());
+    await attempt(() => this.supervisor.operatorMcp?.close());
+    await attempt(() => this.dispatcher.drain());
+    await attempt(() => this.managed.close());
+    await attempt(() =>
+      Promise.all(
         [this.operator, this.bridgeServer].map(
           (server) =>
-            new Promise<void>((resolve) => {
+            new Promise<void>((resolve, reject) => {
               if (!server.listening) {
                 resolve();
                 return;
               }
-              server.close(() => resolve());
+              server.close((error) => (error ? reject(error) : resolve()));
               server.closeAllConnections();
             }),
         ),
-      );
-      await Promise.all(this.handlers);
-      try {
-        this.store.close();
-      } catch (error) {
-        errors.push(error);
-      }
-    } finally {
-      this.release();
-      this.resolveClosed();
-    }
+      ),
+    );
+    await Promise.all([...this.handlers].map((handler) => attempt(() => handler)));
+    await attempt(() => this.store.close());
+    // A replacement must not mistake an empty resource map for proof that this
+    // process stopped all of its workers. OS death releases a retained lock.
+    if (!errors.length) await attempt(() => this.release());
     if (errors.length)
-      throw new AggregateError(errors, 'Service shutdown could not persist all final states');
+      this.shutdownFailure = new AggregateError(
+        errors,
+        'Service shutdown could not confirm all resources and final states; state ownership retained until process exit',
+      );
+    this.resolveClosed();
+    if (this.shutdownFailure) throw this.shutdownFailure;
   }
 }
+
+function iso(ms: number | null): string | null {
+  return ms === null ? null : new Date(ms).toISOString();
+}