@tangle-network/agent-runtime 0.199.0 → 0.201.0

package/dist/{supervise-BGNXB8No.js → supervise-DmFO50N6.js}

@@ -1,12 +1,12 @@
-import { $ as bridgeAdmissionRefusal, Ar as worktreeCliProfileMaterialization, Ct as createInbox, Er as renderUnsupported, Gn as createOtelExporter, Gr as runtimeOwnedDriveHarnessProviderEvidence, Ir as attestRuntimeOwnedScopeOwner, J as teardownExecutor, Jn as generateSpanId, Jr as runtimeOwnedExecutorProviderEvidence, Kr as runtimeOwnedExecutorExecutionBinding, On as unmeteredSpend, Or as unsupportedProfileDimensions, Q as bindReusableExecutorExecutionId, Qn as toOtelAttributes, Sr as promptModelProfileMaterialization, Ur as providerAttemptEvidence, Wr as recordRuntimeOwnedDriveHarnessProviderEvidence, Xr as runtimeOwnedScopeOwnerRuntime, Xt as contentAddress, Y as assertValidBudget, Yr as runtimeOwnedPendingExecutorMaterialization, Z as spendFromUsageEvents, _ as meterRuntimeOwnedProviderAttempt, _r as controlProfileMaterialization, a as createSupervisor, br as profileMaterializationAxes$1, ct as snapshotExecutorConfig, d as driverChild, et as bridgeModelRouteRefusal, g as meterRuntimeOwnedAccounting, gr as assertProfileMaterialization, h as deriveNodeExecutionIdentity, i as createRootHandle, kn as zeroSpend, l as runFinalizer, ni as detachedSnapshot, nt as bridgeStopSignalKey, o as bestDelivered, ot as createExecutor, p as beginScopeOwnerAttempt, q as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, qr as runtimeOwnedExecutorMaterialization, rt as captureReusableExecutorConfig, sn as routerBrain, tt as bridgeRuntimeAttachmentsKey, u as runTree, ut as WORKER_TRACE_PROPAGATION, v as recordScopeOwnerMaterialization, vr as defineProfileMaterializationContract, xr as promptControlProfileMaterialization, y as scopeOwnerExecutorNodeContext, yr as fullProfileMaterialization, zr as inheritRuntimeOwnedExecutorAttestation } from "./redact-Dv8WcCKy.js";
+import { $ as bridgeAdmissionRefusal, $r as providerAttemptEvidence, $t as spendFromUsageEvents, A as consumeScopeRetainedOwnerResult, Ar as profileMaterializationAxes$1, Br as worktreeCliProfileMaterialization, Ct as createInbox, Dr as controlProfileMaterialization, Er as assertProfileMaterialization, Ir as renderUnsupported, Kr as attestRuntimeOwnedScopeOwner, M as scopeRetainedOwnerContext, Mn as zeroSpend, Mr as promptModelProfileMaterialization, N as scopeRetainedOwnerPriorSpend, Nn as registerRetainedExecutorPreparation, Or as defineProfileMaterializationContract, P as scopeRetainedOwnerResult, Pn as retainedExecutorSeamKey, Q as bindReusableExecutorExecutionId, Rr as unsupportedProfileDimensions, S as scopeOwnerExecutorNodeContext, X as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, Xt as contentAddress, Yr as inheritRuntimeOwnedExecutorAttestation, Z as teardownExecutor, Zt as assertValidBudget, _ as deriveNodeExecutionIdentity, _n as resolveAgentEnvironmentProvider, a as createSupervisor, ai as runtimeOwnedPendingExecutorMaterialization, b as recordScopeOwnerMaterialization, cr as toOtelAttributes, ct as snapshotExecutorConfig, d as driverChild, ei as recordRuntimeOwnedDriveHarnessProviderEvidence, et as bridgeModelRouteRefusal, f as driverExecutorFactory, fi as detachedSnapshot, h as beginScopeOwnerAttempt, i as createRootHandle, ii as runtimeOwnedExecutorProviderEvidence, ir as generateSpanId, j as prepareScopeRetainedOwnerTask, jn as unmeteredSpend, jr as promptControlProfileMaterialization, kr as fullProfileMaterialization, l as runFinalizer, ni as runtimeOwnedExecutorExecutionBinding, nt as bridgeStopSignalKey, o as bestDelivered, oi as runtimeOwnedScopeOwnerRuntime, ot as createExecutor, p as isDriverSpec, ri as runtimeOwnedExecutorMaterialization, rt as captureReusableExecutorConfig, ti as runtimeOwnedDriveHarnessProviderEvidence, tr as createOtelExporter, tt as bridgeRuntimeAttachmentsKey, u as runTree, un as routerBrain, ut as WORKER_TRACE_PROPAGATION, v as meterRuntimeOwnedAccounting, x as restoreScopeOwnerAcceptedExecution, y as meterRuntimeOwnedProviderAttempt, yn as addSpend } from "./redact-h-oaw11Q.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError, r as BackendTransportError, t as AgentEvalError } from "./errors-DodWX-cb.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, f as harnessRunsAgent, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-DKDyr-fc.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-tXpAarhW.js";
-import { C as coordinationVerbNames, M as createFileRunContext, N as createInMemoryRunContext, c as createProgressTracker, d as progressStop, r as driverAgent, v as watchRunCancellation, w as createCoordinationTools } from "./coordination-driver-vWb7kViA.js";
+import { C as coordinationVerbNames, M as createFileRunContext, N as createInMemoryRunContext, c as createProgressTracker, d as progressStop, r as driverAgent, v as watchRunCancellation, w as createCoordinationTools } from "./coordination-driver-qdAwriPV.js";
 import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-B8I_LXN-.js";
 import { t as createStdioToolServer } from "./tool-server-BJbCPhoW.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
-import { randomUUID } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { resolve } from "node:path";
 import { isMaterializerHarness } from "@tangle-network/agent-profile-materialize";
 import { createServer } from "node:http";
@@ -468,6 +468,194 @@ function truncate(value) {
 	return value.length > MAX_DETAIL_CHARS ? `${value.slice(0, MAX_DETAIL_CHARS)}…` : value;
 }
 //#endregion
+//#region src/runtime/supervise/coordination-http.ts
+function coordinationHttpLimits(options) {
+	const positive = (name, value, fallback) => {
+		const resolved = value ?? fallback;
+		if (!Number.isSafeInteger(resolved) || resolved <= 0) throw new ConfigError(`coordination ${name} must be a positive safe integer`);
+		return resolved;
+	};
+	const origins = new Set(options.allowedOrigins ?? []);
+	for (const origin of origins) {
+		const parsed = new URL(origin);
+		if (parsed.origin !== origin || !["http:", "https:"].includes(parsed.protocol)) throw new ConfigError("coordination allowedOrigins must contain canonical HTTP origins");
+	}
+	const requestTimeoutMs = positive("requestTimeoutMs", options.requestTimeoutMs, 3e4);
+	if (requestTimeoutMs > 2147483647) throw new ConfigError("coordination requestTimeoutMs exceeds the timer limit");
+	return {
+		maxRequestBytes: positive("maxRequestBytes", options.maxRequestBytes, 1024 * 1024),
+		requestTimeoutMs,
+		maxConcurrentRequests: positive("maxConcurrentRequests", options.maxConcurrentRequests, 32),
+		requestsPerMinute: positive("requestsPerMinute", options.requestsPerMinute, 600),
+		origins
+	};
+}
+/** One bounded HTTP adapter around the existing JSON-RPC handler; it owns no run commands. */
+function coordinationHttpHandler(input) {
+	const limits = coordinationHttpLimits(input.options);
+	let active = 0;
+	let controlActive = 0;
+	let controlRequests = 0;
+	let windowStart = Date.now();
+	let requests = 0;
+	const audit = async (outcome, status, action) => {
+		await input.options.onAudit?.({
+			...input.identity,
+			outcome,
+			status,
+			...action ? { action } : {}
+		});
+	};
+	return (req, res) => {
+		let finished = false;
+		let executing = false;
+		let timedOut = false;
+		let admitted = false;
+		let controlAdmission = false;
+		let action;
+		let timer;
+		const release = () => {
+			if (admitted) {
+				admitted = false;
+				if (controlAdmission) controlActive--;
+				else active--;
+			}
+			if (timer) clearTimeout(timer);
+		};
+		const respond = (status, value) => {
+			if (finished) return;
+			finished = true;
+			if (timer) clearTimeout(timer);
+			res.writeHead(status, {
+				"content-type": "application/json",
+				"cache-control": "no-store",
+				...status === 405 ? { allow: "POST" } : {}
+			});
+			res.end(value === void 0 ? void 0 : JSON.stringify(value));
+			if (!executing) release();
+		};
+		const reject = (status) => {
+			respond(status);
+			audit("rejected", status, action).catch(() => void 0);
+			req.resume();
+		};
+		req.on("error", () => reject(400));
+		req.on("aborted", () => {
+			finished = true;
+			if (!executing) release();
+		});
+		res.on("close", () => {
+			finished = true;
+			if (!executing) release();
+		});
+		if (req.method !== "POST") {
+			reject(405);
+			return;
+		}
+		const authorization = input.authorize(req);
+		if (authorization !== void 0) {
+			reject(authorization);
+			return;
+		}
+		const origin = req.headers.origin;
+		if (origin !== void 0 && !limits.origins.has(origin)) {
+			reject(403);
+			return;
+		}
+		if (req.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
+			reject(415);
+			return;
+		}
+		const length = req.headers["content-length"];
+		if (length !== void 0 && (!/^\d+$/.test(length) || Number(length) > limits.maxRequestBytes)) {
+			reject(413);
+			return;
+		}
+		const now = Date.now();
+		if (now - windowStart >= 6e4) {
+			windowStart = now;
+			requests = 0;
+			controlRequests = 0;
+		}
+		controlAdmission = active >= limits.maxConcurrentRequests || requests >= limits.requestsPerMinute;
+		if (controlAdmission) {
+			if (controlActive >= 2 || controlRequests >= 60) {
+				reject(429);
+				return;
+			}
+			controlActive++;
+		} else {
+			requests++;
+			active++;
+		}
+		admitted = true;
+		timer = setTimeout(() => {
+			timedOut = true;
+			reject(executing ? 504 : 408);
+		}, limits.requestTimeoutMs);
+		timer.unref();
+		let size = 0;
+		const chunks = [];
+		req.on("data", (chunk) => {
+			if (finished) return;
+			size += chunk.length;
+			if (size > limits.maxRequestBytes) {
+				reject(413);
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			if (finished) return;
+			let message;
+			try {
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+				if (!value || typeof value !== "object" || Array.isArray(value) || !("jsonrpc" in value) || value.jsonrpc !== "2.0" || !("method" in value) || typeof value.method !== "string" || "id" in value && value.id !== null && typeof value.id !== "string" && (typeof value.id !== "number" || !Number.isFinite(value.id))) {
+					reject(400);
+					return;
+				}
+				message = value;
+			} catch {
+				reject(400);
+				return;
+			}
+			const authorization = input.authorize(req);
+			if (authorization !== void 0) {
+				reject(authorization);
+				return;
+			}
+			if (message.method === "tools/call" && message.params && typeof message.params === "object" && "name" in message.params && typeof message.params.name === "string" && input.toolNames.has(message.params.name)) action = message.params.name;
+			if (controlAdmission) {
+				if (!(message.method === "initialize" || message.method === "tools/list" || action === "stop" || action === "observe_agent" || action === "read_journal")) {
+					reject(429);
+					return;
+				}
+				controlRequests++;
+			}
+			executing = true;
+			(async () => {
+				try {
+					await audit("accepted", 200, action);
+					if (finished) return;
+					const authorization = input.authorize(req);
+					if (authorization !== void 0) {
+						reject(authorization);
+						return;
+					}
+					const response = await input.handle(message);
+					if (!finished) respond(response === null ? 202 : 200, response ?? void 0);
+					await audit(timedOut ? "completed-after-deadline" : "completed", timedOut ? 504 : response === null ? 202 : 200, action);
+				} catch {
+					respond(500);
+				} finally {
+					executing = false;
+					release();
+				}
+			})();
+		});
+	};
+}
+//#endregion
 //#region src/runtime/supervise/coordination-mcp.ts
 /**
 *
@@ -498,12 +686,84 @@ function isLoopbackHost(host) {
 	if (h === "localhost" || h === "::1" || h === "0:0:0:0:0:0:0:1" || h === "::ffff:127.0.0.1") return true;
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
 }
-/** Stand up the coordination MCP over a live scope. The HOST address is `127.0.0.1` (the bridge runs
-*  opencode locally, same host); pass `host` to bind elsewhere when the harness is remote — a
-*  non-loopback host additionally requires `allowUnauthenticatedRemote`. */
+function assertCoordinationTransport(options) {
+	if (!isLoopbackHost(options.host ?? "127.0.0.1") && !options.authentication) throw new ConfigError("coordination non-loopback address requires authentication; allowUnauthenticatedRemote is no longer supported");
+	if (options.authentication !== void 0 && options.authentication !== true && (typeof options.authentication !== "object" || options.authentication === null || Array.isArray(options.authentication))) throw new ConfigError("coordination authentication must be true or a credential lifetime configuration");
+	const ttl = typeof options.authentication === "object" ? options.authentication.ttlMs : void 0;
+	if (ttl !== void 0 && (!Number.isSafeInteger(ttl) || ttl <= 0 || ttl > 864e5)) throw new ConfigError("coordination credential ttlMs must be a positive integer no greater than 24 hours");
+	if (options.publicUrl !== void 0 && !options.authentication) throw new ConfigError("coordination publicUrl requires authentication");
+	const signingKeys = typeof options.authentication === "object" ? options.authentication.signingKeys : void 0;
+	if (signingKeys !== void 0) {
+		if (!options.publicUrl) throw new ConfigError("coordination signingKeys requires a stable publicUrl");
+		if (!signingKeys.activeKeyId || !Object.hasOwn(signingKeys.keys, signingKeys.activeKeyId)) throw new ConfigError("coordination signingKeys must contain the active key");
+		for (const [id, key] of Object.entries(signingKeys.keys)) if (!/^[A-Za-z0-9_-]{1,64}$/.test(id) || typeof key !== "string" || Buffer.byteLength(key) < 32) throw new ConfigError("coordination signing keys require bounded key IDs and at least 32 secret bytes");
+	}
+	coordinationHttpLimits(options);
+}
+/** Stand up the existing coordination tools with bounded HTTP access over one live scope. */
 async function serveCoordinationMcp(opts) {
 	const host = opts.host ?? "127.0.0.1";
-	if (!isLoopbackHost(host) && opts.allowUnauthenticatedRemote !== true) throw new ConfigError(`coordination host=${JSON.stringify(host)} is not a loopback address and the coordination MCP has no authentication: any client that can reach the port could call spawn_worker/steer_agent and spend this run's budget. Bind a loopback host ("127.0.0.1", "localhost", "::1"), or set allowUnauthenticatedRemote: true to accept that exposure explicitly.`);
+	assertCoordinationTransport(opts);
+	if (opts.peerMail && (!isLoopbackHost(host) || opts.publicUrl)) throw new ConfigError("remote peer mail requires a separate reachable capability transport; coordination authentication does not authorize the peer listener");
+	const identity = Object.freeze({ ...opts.identity ?? {
+		runId: opts.scope.view?.root ?? "",
+		actorId: opts.scope.view?.root ?? ""
+	} });
+	if ((opts.authentication || opts.onAudit) && (!identity.runId.trim() || !identity.actorId.trim())) throw new ConfigError("authenticated coordination requires a trusted run and actor identity");
+	const auth = typeof opts.authentication === "object" ? opts.authentication : void 0;
+	const signingKeys = auth?.signingKeys ? {
+		activeKeyId: auth.signingKeys.activeKeyId,
+		keys: { ...auth.signingKeys.keys }
+	} : void 0;
+	let token;
+	let credentialExpiresAt;
+	let headers = Object.freeze({});
+	let credentialAudience = "";
+	let closed = false;
+	const revoked = /* @__PURE__ */ new Map();
+	const grantDigest = createHash("sha256").update(JSON.stringify([...opts.toolNames].sort())).digest("hex");
+	const rotateCredential = () => {
+		if (!opts.authentication) throw new ConfigError("coordination authentication is not configured");
+		if (closed) throw new ConfigError("coordination server is closed");
+		for (const [credential, expiry] of revoked) if (expiry <= Date.now()) revoked.delete(credential);
+		if (token) revoked.set(token.toString(), credentialExpiresAt);
+		credentialExpiresAt = Date.now() + (auth?.ttlMs ?? 9e5);
+		const nonce = randomBytes(32).toString("base64url");
+		let text = nonce;
+		if (signingKeys) {
+			const payload = Buffer.from(JSON.stringify({
+				key: signingKeys.activeKeyId,
+				run: identity.runId,
+				actor: identity.actorId,
+				audience: credentialAudience,
+				grants: grantDigest,
+				expires: credentialExpiresAt,
+				nonce
+			})).toString("base64url");
+			text = `${payload}.${createHmac("sha256", signingKeys.keys[signingKeys.activeKeyId]).update(payload).digest("base64url")}`;
+		}
+		token = Buffer.from(text);
+		headers = Object.freeze({ Authorization: `Bearer ${text}` });
+	};
+	const validCredential = (supplied) => {
+		if (closed || revoked.has(supplied.toString())) return false;
+		if (!signingKeys) return token !== void 0 && Date.now() < credentialExpiresAt && supplied.length === token.length && timingSafeEqual(supplied, token);
+		if (supplied.length > 8192) return false;
+		try {
+			const parts = supplied.toString().split(".");
+			if (parts.length !== 2) return false;
+			const payload = parts[0];
+			const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+			if (!claims || typeof claims.key !== "string" || !Object.hasOwn(signingKeys.keys, claims.key)) return false;
+			const expected = createHmac("sha256", signingKeys.keys[claims.key]).update(payload).digest();
+			const signature = Buffer.from(parts[1], "base64url");
+			return signature.length === expected.length && timingSafeEqual(signature, expected) && claims.run === identity.runId && claims.actor === identity.actorId && claims.audience === credentialAudience && claims.grants === grantDigest && Number.isSafeInteger(claims.expires) && claims.expires > Date.now();
+		} catch {
+			return false;
+		}
+	};
+	const audiences = /* @__PURE__ */ new Set();
+	const paths = /* @__PURE__ */ new Set(["/mcp"]);
 	const coord = createCoordinationTools({
 		scope: opts.scope,
 		blobs: opts.blobs,
@@ -542,51 +802,35 @@ async function serveCoordinationMcp(opts) {
 	if (!Array.isArray(opts.toolNames)) throw new ValidationError("serveCoordinationMcp: toolNames must name every granted tool explicitly");
 	const selectedNames = opts.toolNames;
 	if (new Set(selectedNames).size !== selectedNames.length) throw new ValidationError("serveCoordinationMcp: toolNames contains a duplicate name");
+	const servedTools = selectedNames.map((name) => {
+		const tool = availableByName.get(name);
+		if (tool === void 0) throw new ValidationError(`serveCoordinationMcp: requested tool ${JSON.stringify(name)} is unavailable`);
+		return tool;
+	});
 	const mcp = createStdioToolServer({
 		serverName: "coordination",
 		serverVersion: "1",
-		tools: selectedNames.map((name) => {
-			const tool = availableByName.get(name);
-			if (tool === void 0) throw new ValidationError(`serveCoordinationMcp: requested tool ${JSON.stringify(name)} is unavailable`);
-			return tool;
-		})
+		tools: servedTools
 	});
 	opts.onCoordinationTools?.([...mcp.tools.values()]);
-	const server = createServer((req, res) => {
-		if (req.method !== "POST") {
-			res.writeHead(405, { allow: "POST" });
-			res.end();
-			return;
+	const server = createServer(coordinationHttpHandler({
+		options: opts,
+		identity,
+		toolNames: new Set(servedTools.map((tool) => tool.name)),
+		handle: (message) => mcp.handle(message),
+		authorize: (req) => {
+			if (!paths.has(req.url ?? "")) return 404;
+			if (!audiences.has(req.headers.host ?? "")) return 403;
+			if (closed) return 401;
+			if (!opts.authentication) return void 0;
+			const authorization = req.headers.authorization;
+			const supplied = typeof authorization === "string" && authorization.startsWith("Bearer ") ? Buffer.from(authorization.slice(7)) : Buffer.alloc(0);
+			if (!validCredential(supplied)) return 401;
 		}
-		let body = "";
-		req.on("data", (c) => {
-			body += c;
-		});
-		req.on("end", () => {
-			(async () => {
-				try {
-					const message = JSON.parse(body);
-					const response = await mcp.handle(message);
-					if (response === null) {
-						res.writeHead(202).end();
-						return;
-					}
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify(response));
-				} catch (e) {
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify({
-						jsonrpc: "2.0",
-						id: null,
-						error: {
-							code: -32700,
-							message: e instanceof Error ? e.message : "parse error"
-						}
-					}));
-				}
-			})();
-		});
-	});
+	}));
+	const requestTimeoutMs = coordinationHttpLimits(opts).requestTimeoutMs;
+	server.requestTimeout = requestTimeoutMs;
+	server.headersTimeout = requestTimeoutMs;
 	const port = await new Promise((resolve, reject) => {
 		server.once("error", reject);
 		server.listen(opts.port ?? 0, host, () => {
@@ -594,11 +838,40 @@ async function serveCoordinationMcp(opts) {
 			resolve(typeof addr === "object" && addr ? addr.port : opts.port ?? 0);
 		});
 	});
+	const localUrl = `http://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}/mcp`;
+	let url;
+	try {
+		const configured = typeof opts.publicUrl === "function" ? opts.publicUrl({
+			host,
+			port,
+			...identity
+		}) : opts.publicUrl;
+		const publicAddress = new URL(configured ?? localUrl);
+		if (!["http:", "https:"].includes(publicAddress.protocol) || publicAddress.username || publicAddress.password || publicAddress.search || publicAddress.hash) throw new ConfigError("coordination publicUrl must be an HTTP endpoint without credentials, query, or fragment");
+		if (configured !== void 0 && publicAddress.protocol !== "https:" && !isLoopbackHost(publicAddress.hostname)) throw new ConfigError("remote coordination publicUrl must use HTTPS");
+		url = publicAddress.href;
+		credentialAudience = url;
+		if (opts.authentication) rotateCredential();
+		audiences.add(new URL(localUrl).host);
+		audiences.add(publicAddress.host);
+		if (host === "0.0.0.0" || host === "::") audiences.add(`127.0.0.1:${port}`);
+		paths.add(publicAddress.pathname);
+	} catch (error) {
+		await new Promise((resolve) => server.close(() => resolve()));
+		throw error;
+	}
 	const mailbox = coord.peerMail;
 	const mailListener = mailbox === void 0 ? void 0 : await servePeerMail(mailbox, host);
 	return {
-		url: `http://${host}:${port}/mcp`,
+		url,
 		port,
+		get headers() {
+			return headers;
+		},
+		get credentialExpiresAt() {
+			return credentialExpiresAt;
+		},
+		rotateCredential,
 		settled: () => coord.settled(),
 		submittedResult: () => coord.submittedResult(),
 		drainResolved: () => coord.drainResolved(),
@@ -609,6 +882,7 @@ async function serveCoordinationMcp(opts) {
 		mailHistory: () => mailbox?.history() ?? [],
 		stopMailThread: (threadId) => mailbox?.stopThread(threadId) ?? false,
 		close: async () => {
+			closed = true;
 			await new Promise((resolve) => {
 				server.close(() => resolve());
 			});
@@ -1105,18 +1379,9 @@ function resolveSupervisorProfile(profile) {
 		...systemPrompt !== void 0 ? { systemPrompt } : {}
 	};
 }
-/**
-* Fail closed on a non-loopback coordination bind. `serveCoordinationMcp` mounts spawn_worker /
-* steer_agent / stop with NO authentication of any kind (it is a bare JSON-RPC-over-HTTP handler),
-* so a non-loopback bind lets anyone who can reach the port spawn agents and spend the run's
-* conserved budget. There is no token to require yet, so the only honest options are loopback or an
-* explicit, recorded acknowledgment — never a silent bind.
-*/
+/** Validate a manager's coordination authentication and request limits before execution. */
 function assertCoordinationBinding(binding) {
-	const host = binding?.host;
-	if (host === void 0 || isLoopbackHost(host)) return;
-	if (binding?.allowUnauthenticatedRemote === true) return;
-	throw new ConfigError(`supervisorAgent: coordination.host=${JSON.stringify(host)} is not a loopback address and the coordination MCP has no authentication: any client that can reach the port could call spawn_worker/steer_agent and spend this run's budget. Bind a loopback host ("127.0.0.1", "localhost", "::1"), or set coordination.allowUnauthenticatedRemote: true to accept that exposure explicitly.`);
+	assertCoordinationTransport(binding ?? {});
 }
 function createVerbSlot() {
 	let bound;
@@ -1302,9 +1567,11 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 				makeWorkerAgent: deps.makeWorkerAgent,
 				...deps.authorizeDownMessage ? { authorizeDownMessage: deps.authorizeDownMessage } : {},
 				perWorker: deps.perWorker,
-				...coordination?.host !== void 0 ? { host: coordination.host } : {},
-				...coordination?.port !== void 0 ? { port: coordination.port } : {},
-				...coordination?.allowUnauthenticatedRemote === true ? { allowUnauthenticatedRemote: true } : {},
+				...coordination ?? {},
+				...context ? { identity: {
+					runId: context.runNamespace,
+					actorId: context.ownerId
+				} } : {},
 				...deps.deliverable ? { deliverable: deps.deliverable } : {},
 				onStop: (reason) => {
 					if (!stopController.signal.aborted) stopController.abort(reason ?? "coordination stop");
@@ -1368,6 +1635,7 @@ function buildSupervisorAgent(profile, deps, testBrain) {
 								task: reentry === void 0 ? task : reentry.steer,
 								scope,
 								coordinationMcpUrl: mcp.url,
+								coordinationMcpHeaders: mcp.headers,
 								stopSignal: stopController.signal,
 								coordinationTools
 							});
@@ -1995,6 +2263,8 @@ const routerSupervisorProfileMaterialization = defineProfileMaterializationContr
 		"modelDefault",
 		"modelProvider",
 		"modelReasoningEffort",
+		"modelMaxVisibleOutputTokens",
+		"modelMaxTotalOutputTokens",
 		"modelMetadata",
 		"harness",
 		"metadata"
@@ -2054,9 +2324,18 @@ function profileToolSpawnPreflight(runtimeOwnsManager, canResolveProductTools) {
 * environment nor a reservation exists yet. A router-brained child holds the same tools in-process
 * and needs no channel.
 */
-function coordinationChannelSpawnPreflight(runtimeOwnsManager, hasCustomDriveHarness, managerBackend) {
+function coordinationChannelSpawnPreflight(runtimeOwnsManager, hasCustomDriveHarness, managerBackend, coordination) {
 	if (!runtimeOwnsManager || hasCustomDriveHarness) return void 0;
-	if (managerBackend !== void 0 && automaticDriverBackendSupported(managerBackend)) return;
+	if (managerBackend !== void 0 && automaticDriverBackendSupported(managerBackend, coordination)) {
+		if (managerBackend.backend !== "provider") return void 0;
+		return async (profile) => {
+			if (!isExternalSupervisor(profile) || declaredRuntimeToolNames(profile).length === 0) return void 0;
+			return await providerAcceptsCoordinationAttachments(managerBackend) ? void 0 : {
+				cause: "unmountable-tool",
+				detail: "the 'provider' backend does not advertise create.runtimeAttachments.mcp; Runtime cannot mount this manager's coordination tools before dispatch"
+			};
+		};
+	}
 	const missingChannel = managerBackend === void 0 ? "this run has no driverBackend" : `the '${managerBackend.backend}' backend has no coordination channel`;
 	return async (profile) => {
 		if (!isExternalSupervisor(profile)) return void 0;
@@ -2064,7 +2343,7 @@ function coordinationChannelSpawnPreflight(runtimeOwnsManager, hasCustomDriveHar
 		if (declared.length === 0) return void 0;
 		return {
 			cause: "unmountable-tool",
-			detail: `the profile declares ${declared.map((name) => JSON.stringify(`${coordinationProfileToolPrefix}${name}`)).join(", ")} with harness ${JSON.stringify(profile.harness)}, but ${missingChannel}: Runtime's coordination MCP binds host loopback and reaches a harness only through the 'bridge' backend's runtime-attachments seam. Drive managers through a bridge driverBackend, or supply driveHarness/resolveDriveHarness with a relay this child can reach`
+			detail: `the profile declares ${declared.map((name) => JSON.stringify(`${coordinationProfileToolPrefix}${name}`)).join(", ")} with harness ${JSON.stringify(profile.harness)}, but ${missingChannel}: Use a local bridge, or a provider with runtime MCP attachments and an authenticated coordination.publicUrl this child can reach; an explicit driveHarness may supply its own channel`
 		};
 	};
 }
@@ -2091,8 +2370,14 @@ const DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY = Object.freeze({
 function isExternalSupervisor(profile) {
 	return harnessRunsAgent(profile.harness);
 }
-function automaticDriverBackendSupported(backend) {
-	return backend.backend === "bridge";
+function automaticDriverBackendSupported(backend, coordination) {
+	return backend.backend === "bridge" || backend.backend === "provider" && !backend.steering && coordination?.authentication !== void 0 && coordination.publicUrl !== void 0;
+}
+async function providerAcceptsCoordinationAttachments(backend) {
+	const create = (await resolveAgentEnvironmentProvider(backend.provider, backend.registry).capabilities()).create;
+	if (!create || !("runtimeAttachments" in create)) return false;
+	const attachments = create.runtimeAttachments;
+	return Boolean(attachments && typeof attachments === "object" && "mcp" in attachments && attachments.mcp === true);
 }
 /** Run a harness-brained manager through the same executor factory as its children. The manager's
 * full profile is preserved, the live coordination server is added under one reserved alias, and
@@ -2103,7 +2388,14 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 	const boundBackend = bindReusableExecutorExecutionId(captureReusableExecutorConfig(backend, "driveHarnessFromBackend"), executionId);
 	const baseFactory = createExecutor(boundBackend);
 	let activeExecutor;
-	const drive = async ({ profile, authoredProfile, task, scope, coordinationMcpUrl, stopSignal, coordinationTools }) => {
+	const drive = async ({ profile, authoredProfile, task, scope, coordinationMcpUrl, coordinationMcpHeaders, stopSignal, coordinationTools }) => {
+		const retainedOwner = boundBackend.backend === "provider" ? scopeRetainedOwnerContext(scope) : void 0;
+		const originalTask = retainedOwner ? await prepareScopeRetainedOwnerTask(scope, task) : task;
+		if (retainedOwner ? await scopeRetainedOwnerResult(scope) : void 0) {
+			await restoreScopeOwnerAcceptedExecution(scope);
+			consumeScopeRetainedOwnerResult(scope);
+			return;
+		}
 		const initialBudget = scope.budget;
 		if (!(scope.view.inFlight > 0 || scope.view.waiting > 0) && (initialBudget.tokensLeft <= 0 || initialBudget.iterationsLeft <= 0 || initialBudget.usdCapped && initialBudget.usdLeft <= 0 || initialBudget.deadlineMs > 0 && now() >= initialBudget.deadlineMs)) throw new ValidationError("driveHarnessFromBackend: supervisor budget exhausted");
 		const canonicalDriverProfile = agentProfileSchema.parse(authoredProfile);
@@ -2118,15 +2410,52 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 		};
 		const turnStop = turnCap > 0 ? new AbortController() : void 0;
 		const effectiveStopSignal = turnStop === void 0 ? stopSignal : stopSignal === void 0 ? turnStop.signal : AbortSignal.any([stopSignal, turnStop.signal]);
-		const executor = baseFactory(spec, {
+		const attachment = {
+			transport: "http",
+			url: coordinationMcpUrl,
+			...coordinationMcpHeaders ? { headers: coordinationMcpHeaders } : {}
+		};
+		let factory = baseFactory;
+		if (boundBackend.backend === "provider") {
+			const credentialName = "AGENT_RUNTIME_COORDINATION_TOKEN";
+			const authorization = coordinationMcpHeaders?.Authorization;
+			if (!authorization?.startsWith("Bearer ")) throw new ValidationError("driveHarnessFromBackend: provider coordination requires a bearer credential");
+			if (Object.hasOwn(boundBackend.defaults?.env ?? {}, credentialName)) throw new ValidationError("driveHarnessFromBackend: provider defaults contain the reserved coordination credential name");
+			if (Object.hasOwn(boundBackend.defaults?.runtimeAttachments?.mcp ?? {}, "agent-runtime-coordination")) throw new ValidationError("driveHarnessFromBackend: provider defaults contain the reserved coordination attachment alias");
+			if (!await providerAcceptsCoordinationAttachments(boundBackend)) throw new ValidationError("driveHarnessFromBackend: provider does not advertise create.runtimeAttachments.mcp; no environment was created");
+			factory = createExecutor({
+				...boundBackend,
+				defaults: {
+					...boundBackend.defaults ?? {},
+					env: {
+						...boundBackend.defaults?.env ?? {},
+						[credentialName]: authorization.slice(7)
+					},
+					runtimeAttachments: { mcp: {
+						...boundBackend.defaults?.runtimeAttachments?.mcp ?? {},
+						[coordinationMcpAlias]: {
+							transport: "http",
+							url: coordinationMcpUrl,
+							headers: { Authorization: {
+								kind: "secret-ref",
+								key: credentialName,
+								format: "bearer"
+							} }
+						}
+					} }
+				}
+			});
+		}
+		const executor = factory(spec, {
 			signal: scope.signal,
 			node: scopeOwnerExecutorNodeContext(scope),
 			seams: {
+				...retainedOwner ? { [retainedExecutorSeamKey]: {
+					...retainedOwner,
+					onResult: async (result) => commitOwnerResult(result)
+				} } : {},
 				...effectiveStopSignal === void 0 ? {} : { [bridgeStopSignalKey]: effectiveStopSignal },
-				[bridgeRuntimeAttachmentsKey]: { [coordinationMcpAlias]: {
-					transport: "http",
-					url: coordinationMcpUrl
-				} }
+				[bridgeRuntimeAttachmentsKey]: { [coordinationMcpAlias]: attachment }
 			}
 		});
 		activeExecutor = executor;
@@ -2134,6 +2463,19 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 		let started = false;
 		let terminalAccountingCaptured = false;
 		let pendingUsage = [];
+		let observedOwnerSpend = zeroSpend();
+		let committedOwnerSpend = retainedOwner ? await scopeRetainedOwnerPriorSpend(scope) : zeroSpend();
+		const ownerDelta = (total) => ({
+			iterations: Math.max(0, total.iterations - committedOwnerSpend.iterations),
+			tokens: {
+				input: Math.max(0, total.tokens.input - committedOwnerSpend.tokens.input),
+				output: Math.max(0, total.tokens.output - committedOwnerSpend.tokens.output)
+			},
+			usd: Math.max(0, total.usd - committedOwnerSpend.usd),
+			ms: Math.max(0, total.ms - committedOwnerSpend.ms),
+			...total.tokensKnown === false ? { tokensKnown: false } : {},
+			...total.usdKnown === false ? { usdKnown: false } : {}
+		});
 		let meteredProviderAttempts = 0;
 		const providerEvidenceForNextMeter = () => {
 			const attempt = runtimeOwnedExecutorProviderEvidence(executor)?.attempts[meteredProviderAttempts++];
@@ -2176,14 +2518,17 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 			const batch = pendingUsage;
 			pendingUsage = [];
 			const measured = spendFromUsageEvents(batch);
+			observedOwnerSpend = addSpend(observedOwnerSpend, measured);
+			const charge = retainedOwner ? ownerDelta(observedOwnerSpend) : measured;
 			await meterRuntimeOwnedProviderAttempt(scope, forceUnknown ? {
-				...measured,
+				...charge,
 				tokensKnown: false,
 				usdKnown: false
-			} : measured, providerEvidenceForNextMeter(), {
+			} : charge, providerEvidenceForNextMeter(), {
 				role: "driver",
 				runtime: executor.runtime
 			});
+			if (retainedOwner) committedOwnerSpend = addSpend(committedOwnerSpend, charge);
 			const budget = scope.budget;
 			if (budget.tokensLeft <= 0 || budget.usdCapped && budget.usdLeft <= 0 || budget.deadlineMs > 0 && now() >= budget.deadlineMs) throw new ValidationError("driveHarnessFromBackend: supervisor budget exhausted");
 		};
@@ -2217,6 +2562,28 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 				}
 			});
 		};
+		const commitOwnerResult = async (result) => {
+			const declaration = runtimeOwnedExecutorMaterialization(executor);
+			const binding = runtimeOwnedExecutorExecutionBinding(executor);
+			if (!declaration || !binding) throw new ValidationError("retained owner result requires terminal materialization before release");
+			if (!ownerMaterializationPublished) {
+				await publishMaterialization(declaration, binding);
+				ownerMaterializationPublished = true;
+			}
+			await meterPending();
+			const total = {
+				...result.spent,
+				iterations: 0
+			};
+			const delta = ownerDelta(total);
+			await meterRuntimeOwnedAccounting(scope, delta, {
+				role: "driver",
+				runtime: executor.runtime
+			});
+			committedOwnerSpend = addSpend(committedOwnerSpend, delta);
+			await retainedOwner.onResult(result);
+			terminalAccountingCaptured = true;
+		};
 		try {
 			const declaration = runtimeOwnedExecutorMaterialization(executor);
 			const executionBinding = runtimeOwnedExecutorExecutionBinding(executor);
@@ -2224,10 +2591,14 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 			if (pending !== void 0) {
 				if (pending.runtime !== executor.runtime || pending.binding.attemptId !== scopeOwnerExecutorNodeContext(scope).attemptId) throw new ValidationError("driveHarnessFromBackend: pending executor did not bind the kernel-minted attempt");
 				if (canonicalAgentProfileDigest(pending.declaration.effectiveProfile) !== canonicalAgentProfileDigest(providerDriverProfile)) throw new ValidationError("driveHarnessFromBackend: pending executor changed the provider-visible AgentProfile before execution");
-			} else await publishMaterialization(declaration, executionBinding);
+			} else {
+				await publishMaterialization(declaration, executionBinding);
+				ownerMaterializationPublished = true;
+			}
 			if (executor.budgetExempt) throw new ValidationError(`driveHarnessFromBackend: runtime ${JSON.stringify(executor.runtime)} does not report usage and cannot drive a budgeted supervisor`);
 			started = true;
-			const run = executor.execute(task, scope.signal);
+			if (retainedOwner?.admissions.length && !executor.recover) throw new ValidationError("retained owner executor does not support recovery");
+			const run = retainedOwner?.admissions.length ? executor.recover(originalTask, scope.signal) : executor.execute(originalTask, scope.signal);
 			if (isAsyncIterable(run)) {
 				let turns = 0;
 				for await (const event of run) if (event.kind === "iteration") {
@@ -2238,7 +2609,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 				await meterPending();
 				const artifact = executor.resultArtifact();
 				terminalAccountingCaptured = true;
-				if (artifact.spent.tokensKnown === false || artifact.spent.usdKnown === false) await meterRuntimeOwnedAccounting(scope, {
+				if (!retainedOwner && (artifact.spent.tokensKnown === false || artifact.spent.usdKnown === false)) await meterRuntimeOwnedAccounting(scope, {
 					iterations: 0,
 					tokens: {
 						input: 0,
@@ -2264,7 +2635,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 					runtime: executor.runtime
 				});
 			}
-			if (pending !== void 0) {
+			if (pending !== void 0 && !ownerMaterializationPublished) {
 				const acknowledged = runtimeOwnedExecutorMaterialization(executor);
 				const acknowledgedBinding = runtimeOwnedExecutorExecutionBinding(executor);
 				if (acknowledged === void 0 || acknowledgedBinding === void 0) throw new ValidationError("driveHarnessFromBackend: external executor completed without a terminal materialization acknowledgement");
@@ -2335,7 +2706,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns)
 		if (!deliver) return false;
 		return deliver.call(activeExecutor, message) !== false;
 	};
-	return attestRuntimeOwnedScopeOwner(drive, "cli");
+	return attestRuntimeOwnedScopeOwner(drive, boundBackend.backend === "provider" ? boundBackend.runtime ?? resolveAgentEnvironmentProvider(boundBackend.provider, boundBackend.registry).name : "cli");
 }
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && Symbol.asyncIterator in value && typeof value[Symbol.asyncIterator] === "function";
@@ -2470,9 +2841,17 @@ function assertNoUncapturedExecutableOption(decisionData) {
 * mutable options object can no longer change an in-flight run. */
 function captureSuperviseOptions(opts) {
 	assertSuperviseOptionKeys(opts, "supervise");
-	const { backend, driverBackend, deliverable, resolveDeliverable, router, compaction, watchWorkers, analysts, makeWorkerAgent, makeLeafAgent, resolveSpawnProfile, blobs, journal, probes, registry, hooks, otel, authorizeSpawn, authorizeMessage, driveHarness, resolveDriveHarness, resolveSupervisorTools, escalateQuestion, onCoordinationEvent, executeExtraTool, stopRule, onProgressStop, onDriverAttempt, onUnmetContract, workerRetry, onWorkerRetry, finalizer, now, signal, rootHandle, ...decisionData } = opts;
+	const { backend, coordination, driverBackend, deliverable, resolveDeliverable, router, compaction, watchWorkers, analysts, makeWorkerAgent, makeLeafAgent, resolveSpawnProfile, blobs, journal, probes, registry, hooks, otel, authorizeSpawn, authorizeMessage, driveHarness, resolveDriveHarness, resolveSupervisorTools, escalateQuestion, onCoordinationEvent, executeExtraTool, stopRule, onProgressStop, onDriverAttempt, onUnmetContract, workerRetry, onWorkerRetry, finalizer, now, signal, rootHandle, ...decisionData } = opts;
 	assertNoUncapturedExecutableOption(decisionData);
 	const capturedData = detachedSnapshot(decisionData, "supervise options");
+	const capturedCoordination = coordination === void 0 ? void 0 : (() => {
+		const { publicUrl, onAudit, ...configuration } = coordination;
+		return Object.freeze({
+			...detachedSnapshot(configuration, "supervise coordination configuration"),
+			...publicUrl === void 0 ? {} : { publicUrl },
+			...onAudit === void 0 ? {} : { onAudit }
+		});
+	})();
 	const capturedBackend = backend === void 0 ? void 0 : snapshotExecutorConfig(backend);
 	const capturedDriverBackend = driverBackend === void 0 ? void 0 : snapshotExecutorConfig(driverBackend);
 	const capturedDeliverable = deliverable === void 0 || typeof deliverable === "string" ? deliverable : captureDeliverable(deliverable, "supervise deliverable");
@@ -2512,6 +2891,7 @@ function captureSuperviseOptions(opts) {
 	});
 	return Object.freeze({
 		...capturedData,
+		...capturedCoordination === void 0 ? {} : { coordination: capturedCoordination },
 		...capturedBackend === void 0 ? {} : { backend: capturedBackend },
 		...capturedDriverBackend === void 0 ? {} : { driverBackend: capturedDriverBackend },
 		...capturedDeliverable === void 0 ? {} : { deliverable: capturedDeliverable },
@@ -2753,9 +3133,9 @@ function superviseInternal(profile, task, opts, testBrain) {
 	const managerBackend = options.driverBackend ?? (options.rootDriverFromBackend === false ? void 0 : options.backend);
 	if (options.driveHarness && options.resolveDriveHarness) throw new ValidationError("supervise: provide driveHarness or resolveDriveHarness, not both");
 	const hasCustomDriveHarness = Boolean(options.driveHarness || options.resolveDriveHarness);
-	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0);
-	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriverBackendSupported(managerBackend) ? backendProfileMaterialization(managerBackend) : void 0;
-	if (isExternalSupervisor(canonicalProfile) && !options.driveHarness && !options.resolveDriveHarness && (!managerBackend || !automaticDriverBackendSupported(managerBackend))) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge driverBackend, an explicit driveHarness, or resolveDriveHarness with reachable coordination transport`);
+	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0);
+	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriverBackendSupported(managerBackend, options.coordination) ? backendProfileMaterialization(managerBackend) : void 0;
+	if (isExternalSupervisor(canonicalProfile) && !options.driveHarness && !options.resolveDriveHarness && (!managerBackend || !automaticDriverBackendSupported(managerBackend, options.coordination))) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 	const harnessClaims = /* @__PURE__ */ new WeakMap();
 	const claimDriveHarness = (rawHarness, ownerId) => {
 		if (typeof rawHarness !== "function") throw new ValidationError("supervise: resolveDriveHarness must return a DriveHarness function");
@@ -2778,7 +3158,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 	const driveHarnessForOwner = (context) => {
 		if (options.resolveDriveHarness) return claimDriveHarness(options.resolveDriveHarness(context), context.ownerId);
 		if (options.driveHarness) return claimDriveHarness(options.driveHarness, context.ownerId);
-		return managerBackend && automaticDriverBackendSupported(managerBackend) ? driveHarnessFromBackend(managerBackend, externalExecutionId("supervised-manager", {
+		return managerBackend && automaticDriverBackendSupported(managerBackend, options.coordination) ? driveHarnessFromBackend(managerBackend, externalExecutionId("supervised-manager", {
 			runNamespace,
 			ownerId: context.ownerId
 		}), options.now ?? Date.now, options.maxTurns) : void 0;
@@ -2797,6 +3177,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 	const now = options.now ?? Date.now;
 	let spans;
 	const traceUnpropagated = options.backend ? workerTraceUnpropagatedDeclaration(options.backend.backend) : void 0;
+	const recoveryFactories = /* @__PURE__ */ new WeakMap();
 	let makeWorkerAgent = options.makeWorkerAgent;
 	if (!makeWorkerAgent) {
 		if (!options.backend && !options.makeLeafAgent) throw new ValidationError("supervise: provide opts.backend (where workers run), opts.makeLeafAgent, or opts.makeWorkerAgent");
@@ -2804,7 +3185,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 		const makeLeaf = withRetry(options.makeLeafAgent ?? workerFromBackend(options.backend, deliverable));
 		const securityPolicy = options.profileSecurity ?? DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY;
 		const makeRecursiveWorkerFor = (parent, parentIdentity, depth, parentOwnerId) => {
-			const makeRecursiveWorker = (authoredProfile, spawnContext) => {
+			const makeRecursiveWorker = (authoredProfile, spawnContext, recovering = false) => {
 				if (!spawnContext) throw new ValidationError("supervise: backend-derived workers require spawn context");
 				const input = freezeDetachedProfile(authoredProfile);
 				const authorizationInput = Object.freeze({
@@ -2821,7 +3202,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 					...spawnContext.analyst !== void 0 ? { analyst: spawnContext.analyst } : {},
 					...spawnContext.continuity !== void 0 ? { continuity: spawnContext.continuity } : {}
 				});
-				const decision = options.authorizeSpawn ? freezeDetached(options.authorizeSpawn(authorizationInput)) : Object.freeze({
+				const decision = !recovering && options.authorizeSpawn ? freezeDetached(options.authorizeSpawn(authorizationInput)) : Object.freeze({
 					profile: input,
 					...spawnContext.execution ? { execution: spawnContext.execution } : {}
 				});
@@ -2868,7 +3249,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 					profile: authorized,
 					task: spawnContext.task
 				})) : void 0;
-				if (isExternalSupervisor(authorized) && !nestedDriveHarness) throw new ValidationError(`supervise: authored external supervisor profile.harness=${JSON.stringify(authorized.harness)} requires a local bridge driverBackend, an explicit driveHarness, or resolveDriveHarness with reachable coordination transport`);
+				if (isExternalSupervisor(authorized) && !nestedDriveHarness) throw new ValidationError(`supervise: authored external supervisor profile.harness=${JSON.stringify(authorized.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 				assertProfileContract(authorized, isExternalSupervisor(authorized) ? driverMaterialization : promptModelProfileMaterialization, `supervise driver ${JSON.stringify(spawnContext.label)}`, true);
 				if (managerBackend) assertBridgeProfileMaterializes(profileWithoutDeclaredRuntimeCoordinationTools(authorized), managerBackend, `supervise driver ${JSON.stringify(spawnContext.label)}`);
 				const childFactory = makeRecursiveWorkerFor(authorized, childExecution.identity, depth + 1, ownerId);
@@ -2882,6 +3263,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 					perWorker: nestedPerWorker,
 					...options.router ? { router: options.router } : {},
 					...nestedDriveHarness ? { driveHarness: nestedDriveHarness } : {},
+					...options.coordination && isExternalSupervisor(authorized) ? { coordination: options.coordination } : {},
 					nodeContext: {
 						runId,
 						runNamespace,
@@ -2924,8 +3306,32 @@ function superviseInternal(profile, task, opts, testBrain) {
 						controlDir: resolve(options.runDir),
 						controlScope: "subtree"
 					}
-				}), journal, childExecution.ref, () => acceptedSubmission);
+				}), journal, childExecution.ref, () => acceptedSubmission, recoveryFactories.get(childFactory));
 			};
+			if (options.makeLeafAgent === void 0 && options.backend?.backend === "provider" && !options.backend.steering) {
+				const factory = registerRetainedExecutorPreparation(createExecutor(options.backend), ({ spawned, profile, task }) => {
+					if (!spawned.ownedTreeRoot || !spawned.parent || !spawned.assignmentId || !spawned.identity) return void 0;
+					const execution = {
+						...spawned.identity.candidateDigest ? { candidateDigest: spawned.identity.candidateDigest } : {},
+						...spawned.identity.correlation ? { correlation: spawned.identity.correlation } : {}
+					};
+					const spec = makeRecursiveWorker(profile, {
+						assignmentId: spawned.assignmentId,
+						parentNodeId: spawned.parent,
+						budget: spawned.budget,
+						task,
+						label: spawned.label,
+						...spawned.key === void 0 ? {} : { key: spawned.key },
+						execution
+					}, true).executorSpec;
+					if (!spec || !isDriverSpec(spec)) return void 0;
+					return {
+						spec,
+						factory: driverExecutorFactory
+					};
+				});
+				recoveryFactories.set(makeRecursiveWorker, factory);
+			}
 			return makeRecursiveWorker;
 		};
 		makeWorkerAgent = makeRecursiveWorkerFor(canonicalProfile, rootExecution.identity, 1, rootOwnerId);
@@ -2947,7 +3353,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 			},
 			...priorCoordination && (priorCoordination.questions.length > 0 || priorCoordination.findings.length > 0 || priorCoordination.continuations.length > 0 || priorCoordination.deliveryEvidence.length > 0 || priorCoordination.records.some((record) => record.event.type === "submission")) ? { priorCoordination } : {},
 			...finalizer ? { finalizer } : {},
-			...options.coordination ? { coordination: options.coordination } : {},
+			...options.coordination && isExternalSupervisor(canonicalProfile) ? { coordination: options.coordination } : {},
 			...spawnPreflight ? { preflightSpawn: spawnPreflight } : {},
 			...options.resolveSpawnProfile ? { resolveSpawnProfile: options.resolveSpawnProfile } : {},
 			...options.peerMail ? { peerMail: options.peerMail } : {},
@@ -3005,6 +3411,7 @@ function superviseInternal(profile, task, opts, testBrain) {
 			journal,
 			blobs,
 			executors: ctx.executors,
+			...recoveryFactories.get(workerFactory) ? { recoverExecutor: recoveryFactories.get(workerFactory) } : {},
 			rootIdentity: rootExecution.identity,
 			...rootOwnerRuntime === void 0 ? {} : { rootMaterialization: {
 				runtime: rootOwnerRuntime,
@@ -3065,4 +3472,4 @@ function rootProviderModelEvidenceFromExecution(evidence) {
 //#endregion
 export { serveCoordinationMcp as _, isPreSpawnExecutorFailure as a, mapExecutorResult as b, withWorkerSpawnRetry as c, resolveSupervisorProfile as d, supervisorAgent as f, defaultUnmetContractSteer as g, classifyDriverFailure as h, workerFromBackend as i, assertCoordinationBinding as l, DriverAttemptsExhaustedError as m, supervise as n, resolveWorkerSpawnRetry as o, supervisorAgentWithTestBrain as p, superviseWithTestBrain as r, retryPreSpawnRefusals as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, coordinationProfileToolPrefix as u, createSupervisorSpanRecorder as v, gateOnDeliverable as y };
 
-//# sourceMappingURL=supervise-BGNXB8No.js.map
+//# sourceMappingURL=supervise-DmFO50N6.js.map