@tangle-network/agent-runtime 0.321.0 → 0.322.1

package/dist/{supervise-C4bLIU7J.js → supervise-BjrRk-AN.js}

@@ -1,10 +1,10 @@
-import { $i as runtimeOwnedExecutorProviderEvidence, A as scopeOwnerExecutorNodeContext, Ai as promptControlProfileMaterialization, An as resolveAgentEnvironmentProvider, Ar as persistHarnessTranscript, At as captureReusableExecutorConfig, B as consumeScopeRetainedOwnerResult, C as deriveNodeExecutionIdentity, Ct as createContinuationKeeper, D as recordScopeOwnerMaterialization, Di as defineProfileMaterializationContract, Dr as runAbortable, E as recordScopeOwnerDriverAttempt, Ei as controlProfileMaterialization, Er as linkAbort, F as seatExecutionProfile, Fi as renderUnsupported, Fn as retainedExecutorSeamKey, Ft as snapshotExecutorConfig, G as scopeRetainedOwnerContext, H as prepareScopeRetainedOwnerSeatSwitch, I as abandonScopeRetainedOwnerInvocation, J as scopeRetainedOwnerResourceReader, Ji as providerAttemptEvidence, Jn as isNoEntError, Jt as createActivityLog, K as scopeRetainedOwnerJournalRoot, L as beginScopeRetainedOwnerDrive, Li as unsupportedProfileDimensions, M as SeatChain, N as SeatChainExhaustedError, Nt as createExecutor, O as recordScopeOwnerPause, Oi as fullProfileMaterialization, P as authoredSeatStages, Pn as registerRetainedExecutorPreparation, Pr as contentAddress, Qi as runtimeOwnedExecutorMaterialization, Qr as createOtelExporter, R as bindScopeRetainedOwnerEnvironmentId, St as checkVerdictOf, T as meterRuntimeOwnedProviderAttempt, U as prepareScopeRetainedOwnerTask, V as noteScopeRetainedOwnerCoordination, Vi as attestRuntimeOwnedScopeOwner, Vt as WORKER_TRACE_PROPAGATION, W as reconcileScopeRetainedOwnerEnvironment, Wi as inheritRuntimeOwnedExecutorAttestation, X as scopeRetainedOwnerResult, Xi as runtimeOwnedDriveHarnessProviderEvidence, Xn as readCommittedJsonLines, Xt as createInbox, Y as scopeRetainedOwnerRestorePoint, Yi as recordRuntimeOwnedDriveHarnessProviderEvidence, Yn as prepareJsonlAppend, Z as scopeRetainedOwnerTurnEnded, Zi as runtimeOwnedExecutorExecutionBinding, _ as isDriverSpec, an as isLiveNodeStatus, b as assertRecursiveReservationPolicy, c as runTree, cn as bridgeModelRouteRefusal, cr as meterUsageEvent, dr as spendFromUsageTotals, ea as runtimeOwnedPendingExecutorMaterialization, ei as generateSpanId, f as runDriverWithRetry, fr as bridgeRuntimeAttachmentsKey, g as driverExecutorFactory, gt as CONTINUATIONS_DIR, h as driverChild, i as bestDelivered, ii as toOtelAttributes, it as providerVisibleProfile, ji as promptModelProfileMaterialization, jr as readHarnessTranscript, k as restoreScopeOwnerAcceptedExecution, ki as profileMaterializationAxes$1, kt as bindReusableExecutorExecutionId, lr as newUsageTotals, mr as errMessage, mt as gateOnDeliverable, n as createRootHandle, nt as coordinationMcpAlias, or as assertValidBudget, p as summarizeDriverAttempts, pr as bridgeStopSignalKey, q as scopeRetainedOwnerPriorSpend, r as createSupervisor, rr as executorFailure, rt as coordinationProfileToolPrefix, s as runFinalizer, sa as detachedSnapshot, sn as bridgeAdmissionRefusal, ta as runtimeOwnedScopeOwnerRuntime, tr as parseWorkerToolTraceArtifact, u as HarnessTurnFailedError, vt as CheckUnavailableError, w as meterRuntimeOwnedAccounting, wi as assertProfileMaterialization, wn as routerBrain, wr as RunCancellationReason, x as beginScopeOwnerAttempt, xt as bestComposite, yt as admitContinuationPolicy, z as bindScopeRetainedOwnerProvider, zi as worktreeCliProfileMaterialization, zt as createRouterTranscript } from "./supervisor-bkq2b8k-.js";
+import { $i as runtimeOwnedExecutorProviderEvidence, A as scopeOwnerExecutorNodeContext, Ai as promptControlProfileMaterialization, An as resolveAgentEnvironmentProvider, Ar as persistHarnessTranscript, At as captureReusableExecutorConfig, B as consumeScopeRetainedOwnerResult, C as deriveNodeExecutionIdentity, Ct as createContinuationKeeper, D as recordScopeOwnerMaterialization, Di as defineProfileMaterializationContract, Dr as runAbortable, E as recordScopeOwnerDriverAttempt, Ei as controlProfileMaterialization, Er as linkAbort, F as seatExecutionProfile, Fi as renderUnsupported, Fn as retainedExecutorSeamKey, Ft as snapshotExecutorConfig, G as scopeRetainedOwnerContext, H as prepareScopeRetainedOwnerSeatSwitch, I as abandonScopeRetainedOwnerInvocation, J as scopeRetainedOwnerResourceReader, Ji as providerAttemptEvidence, Jn as isNoEntError, Jt as createActivityLog, K as scopeRetainedOwnerJournalRoot, L as beginScopeRetainedOwnerDrive, Li as unsupportedProfileDimensions, M as SeatChain, N as SeatChainExhaustedError, Nt as createExecutor, O as recordScopeOwnerPause, Oi as fullProfileMaterialization, P as authoredSeatStages, Pn as registerRetainedExecutorPreparation, Pr as contentAddress, Qi as runtimeOwnedExecutorMaterialization, Qr as createOtelExporter, R as bindScopeRetainedOwnerEnvironmentId, St as checkVerdictOf, T as meterRuntimeOwnedProviderAttempt, U as prepareScopeRetainedOwnerTask, V as noteScopeRetainedOwnerCoordination, Vi as attestRuntimeOwnedScopeOwner, Vt as WORKER_TRACE_PROPAGATION, W as reconcileScopeRetainedOwnerEnvironment, Wi as inheritRuntimeOwnedExecutorAttestation, X as scopeRetainedOwnerResult, Xi as runtimeOwnedDriveHarnessProviderEvidence, Xn as readCommittedJsonLines, Xt as createInbox, Y as scopeRetainedOwnerRestorePoint, Yi as recordRuntimeOwnedDriveHarnessProviderEvidence, Yn as prepareJsonlAppend, Z as scopeRetainedOwnerTurnEnded, Zi as runtimeOwnedExecutorExecutionBinding, _ as isDriverSpec, an as isLiveNodeStatus, b as assertRecursiveReservationPolicy, c as runTree, cn as bridgeModelRouteRefusal, cr as meterUsageEvent, dr as spendFromUsageTotals, ea as runtimeOwnedPendingExecutorMaterialization, ei as generateSpanId, f as runDriverWithRetry, fr as bridgeRuntimeAttachmentsKey, g as driverExecutorFactory, gt as CONTINUATIONS_DIR, h as driverChild, i as bestDelivered, ii as toOtelAttributes, it as providerVisibleProfile, ji as promptModelProfileMaterialization, jr as readHarnessTranscript, k as restoreScopeOwnerAcceptedExecution, ki as profileMaterializationAxes$1, kt as bindReusableExecutorExecutionId, lr as newUsageTotals, mr as errMessage, mt as gateOnDeliverable, n as createRootHandle, nt as coordinationMcpAlias, or as assertValidBudget, p as summarizeDriverAttempts, pr as bridgeStopSignalKey, q as scopeRetainedOwnerPriorSpend, r as createSupervisor, rr as executorFailure, rt as coordinationProfileToolPrefix, s as runFinalizer, sa as detachedSnapshot, sn as bridgeAdmissionRefusal, ta as runtimeOwnedScopeOwnerRuntime, tr as parseWorkerToolTraceArtifact, u as HarnessTurnFailedError, vt as CheckUnavailableError, w as meterRuntimeOwnedAccounting, wi as assertProfileMaterialization, wn as routerBrain, wr as RunCancellationReason, x as beginScopeOwnerAttempt, xt as bestComposite, yt as admitContinuationPolicy, z as bindScopeRetainedOwnerProvider, zi as worktreeCliProfileMaterialization, zt as createRouterTranscript } from "./supervisor-BMMdI4T-.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-DodWX-cb.js";
 import { Dt as teardownSurfaces, Et as teardownExecutor, V as addSpend, Z as isAsyncIterable$1, ct as withTimeout, dt as addResourceSpend, lt as zeroSpend, mt as withBudgetResources, pt as resourceTelemetry, q as errorMessage, rt as sleep, st as unmeteredSpend, yt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS } from "./workspace-streams-DFAhW7hF.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-CNe257pB.js";
 import { n as assertNoSymlinkDescendant } from "./durable-file-DWQA4ooo.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-tXpAarhW.js";
-import { C as createFileRunContext, F as createCoordinationToolsForManager, N as coordinationVerbNames, O as applyRunCancellation, T as withRunContext, c as refreshedWake, g as progressStop, h as plateau, k as watchRunCancellation, l as resolveWakePolicy, n as createSteerAcknowledger, o as composeWakeInput, p as createProgressTracker, r as driverAgent, s as deadlineWarningAt, t as createCancelAcknowledger, w as createInMemoryRunContext } from "./coordination-driver-Bpn05N-Y.js";
+import { C as createFileRunContext, F as createCoordinationToolsForManager, N as coordinationVerbNames, O as applyRunCancellation, T as withRunContext, c as refreshedWake, g as progressStop, h as plateau, k as watchRunCancellation, l as resolveWakePolicy, n as createSteerAcknowledger, o as composeWakeInput, p as createProgressTracker, r as driverAgent, s as deadlineWarningAt, t as createCancelAcknowledger, w as createInMemoryRunContext } from "./coordination-driver-C2Zm5lU4.js";
 import { r as createStdioToolServer, t as PROTOCOL_VERSION } from "./tool-server-Dqer2M4_.js";
 import { k as writeRunCancellation, o as readRunCancelRequest, s as readRunCancellation } from "./run-layout-DSCWdbX2.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
@@ -523,6 +523,7 @@ function assertCoordinationTransport(options) {
 		if (!signingKeys.activeKeyId || !Object.hasOwn(signingKeys.keys, signingKeys.activeKeyId)) throw new ConfigError("coordination signingKeys must contain the active key");
 		for (const [id, key] of Object.entries(signingKeys.keys)) if (!/^[A-Za-z0-9_-]{1,64}$/.test(id) || typeof key !== "string" || Buffer.byteLength(key) < 32) throw new ConfigError("coordination signing keys require bounded key IDs and at least 32 secret bytes");
 	}
+	if (options.onReadReady && !options.authentication) throw new ConfigError("coordination read capability publication requires authentication");
 	coordinationHttpLimits(options);
 }
 /**
@@ -556,7 +557,6 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 	assertCoordinationTransport(opts);
 	const requestTimeoutMs = coordinationHttpLimits(opts).requestTimeoutMs;
 	const responseFenceMs = coordinationResponseFenceMs(requestTimeoutMs);
-	if (opts.peerMail && (!isLoopbackHost(host) || opts.publicUrl)) throw new ConfigError("remote peer mail requires a separate reachable capability transport; coordination authentication does not authorize the peer listener");
 	const identity = Object.freeze({ ...opts.identity ?? {
 		runId: opts.scope.view?.root ?? "",
 		actorId: opts.scope.view?.root ?? ""
@@ -567,6 +567,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		activeKeyId: auth.signingKeys.activeKeyId,
 		keys: { ...auth.signingKeys.keys }
 	} : void 0;
+	let readerToken = Buffer.from(randomBytes(32).toString("base64url"));
 	let token;
 	let credentialExpiresAt;
 	let headers = Object.freeze({});
@@ -596,6 +597,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 			})).toString("base64url");
 			text = `${payload}.${createHmac("sha256", signingKeys.keys[signingKeys.activeKeyId]).update(payload).digest("base64url")}`;
 		}
+		readerToken = Buffer.from(randomBytes(32).toString("base64url"));
 		token = Buffer.from(text);
 		headers = Object.freeze({ Authorization: `Bearer ${text}` });
 	};
@@ -698,7 +700,44 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		tools: servedTools
 	});
 	opts.onCoordinationTools?.([...mcp.tools.values()], coord);
-	const server = createServer(coordinationHttpHandler({
+	const authority = (req) => {
+		const address = req.socket.localAddress?.replace(/^::ffff:/, "");
+		const localAuthority = address?.includes(":") ? `[${address}]:${req.socket.localPort}` : `${address}:${req.socket.localPort}`;
+		const boundAuthority = audiences.size > 0 && (host === "0.0.0.0" || host === "::") && address !== void 0 && req.socket.localPort !== void 0 && req.headers.host === localAuthority;
+		if (!audiences.has(req.headers.host ?? "") && !boundAuthority) return {
+			status: 403,
+			reason: "wrong-host"
+		};
+		if (closed) return {
+			status: 401,
+			reason: "listener-closed"
+		};
+	};
+	const readMcp = createStdioToolServer({
+		serverName: "supervisor-reader",
+		serverVersion: "1",
+		tools: coord.tools.filter((tool) => tool.name === "observe_agent" || tool.name === "read_journal")
+	});
+	const readPaths = /* @__PURE__ */ new Set();
+	const readHandler = coordinationHttpHandler({
+		options: opts,
+		identity,
+		toolNames: /* @__PURE__ */ new Set(["observe_agent", "read_journal"]),
+		backgroundActions: () => 0,
+		authorize: (req) => {
+			const refused = authority(req);
+			if (refused) return refused;
+			const supplied = typeof req.headers.authorization === "string" && req.headers.authorization.startsWith("Bearer ") ? Buffer.from(req.headers.authorization.slice(7)) : Buffer.alloc(0);
+			if (supplied.length !== readerToken.length || !timingSafeEqual(supplied, readerToken) || credentialExpiresAt !== void 0 && credentialExpiresAt <= Date.now()) return {
+				status: 401,
+				reason: "credential-refused"
+			};
+		},
+		handle: (message) => readMcp.handle(message)
+	});
+	const peerHandlers = /* @__PURE__ */ new Map();
+	const mailPaths = /* @__PURE__ */ new Set();
+	const mainHandler = coordinationHttpHandler({
 		options: opts,
 		identity,
 		toolNames: new Set(servedTools.map((tool) => tool.name)),
@@ -713,17 +752,8 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 				status: 404,
 				reason: "unknown-path"
 			};
-			const address = req.socket.localAddress?.replace(/^::ffff:/, "");
-			const localAuthority = address?.includes(":") ? `[${address}]:${req.socket.localPort}` : `${address}:${req.socket.localPort}`;
-			const boundAuthority = audiences.size > 0 && (host === "0.0.0.0" || host === "::") && address !== void 0 && req.socket.localPort !== void 0 && req.headers.host === localAuthority;
-			if (!audiences.has(req.headers.host ?? "") && !boundAuthority) return {
-				status: 403,
-				reason: "wrong-host"
-			};
-			if (closed) return {
-				status: 401,
-				reason: "listener-closed"
-			};
+			const refusedAuthority = authority(req);
+			if (refusedAuthority) return refusedAuthority;
 			if (!opts.authentication) return void 0;
 			const authorization = req.headers.authorization;
 			const supplied = typeof authorization === "string" && authorization.startsWith("Bearer ") ? Buffer.from(authorization.slice(7)) : Buffer.alloc(0);
@@ -733,7 +763,44 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 				reason: refused
 			};
 		}
-	}));
+	});
+	const server = createServer((req, res) => {
+		if (readPaths.has(req.url ?? "")) return readHandler(req, res);
+		for (const base of mailPaths) {
+			if (!(req.url ?? "").startsWith(base + "/")) continue;
+			const capabilityId = (req.url ?? "").slice(base.length + 1);
+			const mailbox = coord.peerMail;
+			if (!/^[0-9a-f]{32}$/.test(capabilityId) || !mailbox?.hasCapability(capabilityId)) {
+				res.writeHead(404).end();
+				return;
+			}
+			let handler = peerHandlers.get(capabilityId);
+			if (!handler) {
+				const peerMcp = createStdioToolServer({
+					serverName: "peer-mail",
+					serverVersion: "1",
+					tools: mailbox.tools(capabilityId)
+				});
+				handler = coordinationHttpHandler({
+					options: opts,
+					identity: {
+						runId: identity.runId,
+						actorId: "peer"
+					},
+					toolNames: /* @__PURE__ */ new Set(["send_mail", "read_mail"]),
+					backgroundActions: () => 0,
+					authorize: (request) => authority(request) ?? (!mailbox.hasCapability(capabilityId) ? {
+						status: 401,
+						reason: "credential-refused"
+					} : void 0),
+					handle: (message) => peerMcp.handle(message)
+				});
+				peerHandlers.set(capabilityId, handler);
+			}
+			return handler(req, res);
+		}
+		return mainHandler(req, res);
+	});
 	server.requestTimeout = requestTimeoutMs;
 	server.headersTimeout = requestTimeoutMs;
 	const port = await new Promise((resolve, reject) => {
@@ -771,6 +838,10 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		audiences.add(publicAddress.host);
 		if (host === "0.0.0.0" || host === "::") audiences.add(`127.0.0.1:${port}`);
 		paths.add(publicAddress.pathname);
+		for (const path of paths) {
+			readPaths.add(path.replace(/\/$/, "") + "/read");
+			mailPaths.add(path.replace(/\/$/, "") + "/mail");
+		}
 		if (configured !== void 0) await preflightPublicCoordination({
 			url,
 			headers,
@@ -788,108 +859,55 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		throw error;
 	}
 	const mailbox = coord.peerMail;
-	const mailListener = mailbox === void 0 ? void 0 : await servePeerMail(mailbox, host);
-	return {
-		handle: {
-			url,
-			port,
-			get headers() {
-				return headers;
-			},
-			get credentialExpiresAt() {
-				return credentialExpiresAt;
-			},
-			rotateCredential,
-			settled: () => coord.settled(),
-			submittedResult: () => coord.submittedResult(),
-			drainResolved: () => coord.drainResolved(),
-			finishAnalysis: (input) => coord.finishAnalysis(input),
-			isStopped: () => coord.isStopped(),
-			history: () => coord.history(),
-			stats: () => coord.stats(),
-			raiseFinding: (finding) => coord.raiseFinding(finding),
-			mailHistory: () => mailbox?.history() ?? [],
-			stopMailThread: (threadId) => mailbox?.stopThread(threadId) ?? false,
-			close: async () => {
-				releaseAddress();
-				closed = true;
-				await new Promise((resolve) => {
-					server.close(() => resolve());
-				});
-				await mailListener?.close();
-			}
+	mailbox?.setEndpoint(url.replace(/\/$/, "") + "/mail");
+	const handle = {
+		url,
+		port,
+		get readOnly() {
+			if (!opts.authentication) throw new ConfigError("coordination read access requires authentication");
+			return {
+				url: url.replace(/\/$/, "") + "/read",
+				headers: Object.freeze({ Authorization: `Bearer ${readerToken.toString()}` })
+			};
 		},
-		controls: coord
+		get headers() {
+			return headers;
+		},
+		get credentialExpiresAt() {
+			return credentialExpiresAt;
+		},
+		rotateCredential,
+		settled: () => coord.settled(),
+		submittedResult: () => coord.submittedResult(),
+		drainResolved: () => coord.drainResolved(),
+		finishAnalysis: (input) => coord.finishAnalysis(input),
+		isStopped: () => coord.isStopped(),
+		history: () => coord.history(),
+		stats: () => coord.stats(),
+		raiseFinding: (finding) => coord.raiseFinding(finding),
+		mailHistory: () => mailbox?.history() ?? [],
+		stopMailThread: (threadId) => mailbox?.stopThread(threadId) ?? false,
+		close: async () => {
+			releaseAddress();
+			closed = true;
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+		}
 	};
-}
-/**
-* Stand up the peer-mail capability listener: one HTTP server, one secret path per worker, and on
-* each path a tool server carrying ONLY `send_mail` / `read_mail` with that worker's identity
-* closed over. An unknown path is a flat 404 — the path is the credential, so a request that does
-* not present a minted one is not a client to reason with.
-*
-* The host is the coordination host, which the caller has already had to justify: the loopback gate
-* above governs both listeners, and there is deliberately no way to bind mail somewhere else.
-*/
-async function servePeerMail(mailbox, host) {
-	const servers = /* @__PURE__ */ new Map();
-	const forCapability = (capabilityId) => {
-		const existing = servers.get(capabilityId);
-		if (existing) return existing;
-		const created = createStdioToolServer({
-			serverName: "peer-mail",
-			serverVersion: "1",
-			tools: mailbox.tools(capabilityId)
-		});
-		servers.set(capabilityId, created);
-		return created;
+	try {
+		await runAbortable(async () => opts.onReadReady?.({
+			...handle.readOnly,
+			...identity
+		}), opts.scope.signal, "read capability publication aborted");
+	} catch (error) {
+		await handle.close();
+		throw error;
+	}
+	return {
+		handle,
+		controls: coord
 	};
-	const listener = createServer((req, res) => {
-		const capabilityId = /^\/mail\/([0-9a-f]{32})$/.exec(req.url ?? "")?.[1];
-		if (req.method !== "POST" || capabilityId === void 0 || !mailbox.hasCapability(capabilityId)) {
-			res.writeHead(404).end();
-			return;
-		}
-		let body = "";
-		req.on("data", (chunk) => {
-			body += chunk;
-		});
-		req.on("end", () => {
-			(async () => {
-				try {
-					const message = JSON.parse(body);
-					const response = await forCapability(capabilityId).handle(message);
-					if (response === null) {
-						res.writeHead(202).end();
-						return;
-					}
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify(response));
-				} catch (e) {
-					res.writeHead(200, { "content-type": "application/json" });
-					res.end(JSON.stringify({
-						jsonrpc: "2.0",
-						id: null,
-						error: {
-							code: -32700,
-							message: e instanceof Error ? e.message : "parse error"
-						}
-					}));
-				}
-			})();
-		});
-	});
-	const port = await new Promise((resolve, reject) => {
-		listener.once("error", reject);
-		listener.listen(0, host, () => {
-			const addr = listener.address();
-			resolve(typeof addr === "object" && addr ? addr.port : 0);
-		});
-	});
-	mailbox.setEndpoint(`http://${host}:${port}/mail`);
-	return { close: () => new Promise((resolve) => {
-		listener.close(() => resolve());
-	}) };
 }
 //#endregion
 //#region src/runtime/supervise/otel-spans.ts
@@ -2775,14 +2793,31 @@ function workerFromBackend(backend, deliverable, seams) {
 		}));
 		const boundSessionId = boundBackend.backend === "bridge" ? boundBackend.sessionId : void 0;
 		const peerMailAttachment = peerMailRuntimeAttachment(profile, capturedBackend, spawnContext);
-		const baseFactory = createExecutor(boundBackend);
+		if (spawnContext?.peerMailUrl && boundBackend.backend === "provider" && Object.hasOwn(boundBackend.defaults?.runtimeAttachments?.mcp ?? {}, peerMailMcpAlias)) throw new ValidationError("workerFromBackend: provider defaults contain the reserved peer-mail attachment alias");
+		const baseFactory = createExecutor(spawnContext?.peerMailUrl && boundBackend.backend === "provider" ? {
+			...boundBackend,
+			steering: boundBackend.steering ?? {},
+			defaults: {
+				...boundBackend.defaults ?? {},
+				runtimeAttachments: {
+					...boundBackend.defaults?.runtimeAttachments ?? {},
+					mcp: {
+						...boundBackend.defaults?.runtimeAttachments?.mcp ?? {},
+						[peerMailMcpAlias]: {
+							transport: "http",
+							url: spawnContext.peerMailUrl
+						}
+					}
+				}
+			}
+		} : boundBackend);
 		const executorFactory = (spec, ctx) => {
 			if (boundSessionId !== void 0 && ctx.node?.nodeId !== void 0) bridgeSessionByWorker.set(ctx.node.nodeId, boundSessionId);
 			const extraSeams = seams?.();
-			const seamsForChild = extraSeams === void 0 && peerMailAttachment === void 0 ? ctx.seams : {
+			const seamsForChild = extraSeams === void 0 && (peerMailAttachment === void 0 || boundBackend.backend === "provider") ? ctx.seams : {
 				...extraSeams,
 				...ctx.seams,
-				...peerMailAttachment === void 0 ? {} : { [bridgeRuntimeAttachmentsKey]: {
+				...peerMailAttachment === void 0 || boundBackend.backend === "provider" ? {} : { [bridgeRuntimeAttachmentsKey]: {
 					...readCallerRuntimeAttachments(ctx.seams),
 					...peerMailAttachment
 				} }
@@ -2829,7 +2864,9 @@ const peerMailMcpAlias = "agent-runtime-peer-mail";
 *
 *  - `bridge` MOUNTS it. cli-bridge advertises `capabilities.runtimeAttachments.mcp` and mounts
 *    the named servers for the run without binding them into the session profile.
-*  - `router`, `router-tools` and `provider` mount NOTHING. Those workers are in-process tool
+*  - `provider` mounts the same capability through runtimeAttachments.mcp and uses the existing
+*    steerable session inbox so peer delivery can be acknowledged.
+*  - `router` and `router-tools` mount NOTHING. Those workers are in-process tool
 *    loops with no MCP client; their tool surface is the caller's own array, and
 *    `WorkerSpawnContext.peerMailUrl` is the deliverable a caller uses directly.
 *  - Every other backend REFUSES the spawn. A sandbox box or a local CLI harness receives tools
@@ -2840,10 +2877,11 @@ const peerMailMcpAlias = "agent-runtime-peer-mail";
 function peerMailRuntimeAttachment(profile, backend, spawnContext) {
 	const url = spawnContext?.peerMailUrl;
 	if (url === void 0) return void 0;
+	if (backend.backend === "provider" && backend.shared) throw new ValidationError("provider peer mail requires a dedicated steerable session; shared placement is not supported");
 	switch (backend.backend) {
 		case "router":
-		case "router-tools":
-		case "provider": return;
+		case "router-tools": return;
+		case "provider":
 		case "bridge": break;
 		default: throw new ValidationError(`workerFromBackend: the '${backend.backend}' backend seam cannot mount a peer-mail endpoint — it materializes tools only through the AgentProfile, and writing a per-process capability URL there would move the canonical profile digest. Run peer-mail workers on the 'bridge' backend, mount the endpoint yourself from WorkerSpawnContext.peerMailUrl through makeLeafAgent or makeWorkerAgent, or drop peerMail for this run`);
 	}
@@ -4889,4 +4927,4 @@ function rootProviderModelEvidenceFromExecution(evidence) {
 //#endregion
 export { readRootStreamReceipt as _, superviseWithTestBrain as a, createSupervisorSpanRecorder as b, resolveWorkerSpawnRetry as c, assertCoordinationBinding as d, resolveSupervisorProfile as f, readRootStream as g, ROOT_STREAM_FILE as h, superviseRootProfile as i, retryPreSpawnRefusals as l, supervisorAgentWithTestBrain as m, profileGuidanceComposer as n, workerFromBackend as o, supervisorAgent as p, supervise as r, isPreSpawnExecutorFailure as s, DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY as t, withWorkerSpawnRetry as u, UNPROVEN_CONTINUITY as v, serveCoordinationMcp as x, composeReentryTask as y };
 
-//# sourceMappingURL=supervise-C4bLIU7J.js.map
+//# sourceMappingURL=supervise-BjrRk-AN.js.map