@themoltnet/agent-daemon 0.43.0 → 0.44.1

package/README.md

@@ -102,32 +102,33 @@ any team where the agent is authorized. It fails fast if the key is rejected,
 is not an agent, or a team binding mismatches. See
 [Run the daemon with an agent key](../../docs/operate/running-agents.md#run-the-daemon-with-an-agent-key).
 
-Daemon authentication and guest credential projection are two separate
-boundaries. How the daemon authenticates (an agent key, or OAuth2 resolved
-from `.moltnet/<agent>/moltnet.json` through the host secret provider) decides
-how the host-side SDK `Agent` is built. `--guest-credential-mode` decides
-whether the local agent credential tree is copied into Gondolin. Pi guests
-default to the `host-authenticated` boundary in **both** auth modes, regardless
-of local files: no `.moltnet` file, gitconfig, SSH signing key, GitHub App PEM,
-or MoltNet environment credential is injected into Gondolin, and mounted
-`.moltnet` paths are hidden. Structured MoltNet tools execute through the
-host-side `Agent`. Operators may explicitly opt into the legacy
-credential-bearing boundary with `--guest-credential-mode guest-config`; that
-mode requires a complete local `moltnet.json` + `env` pair and copies the
-complete agent configuration and signing credentials into the guest. Reserve it
-for local or otherwise operator-trusted tasks that genuinely need guest-shell
-MoltNet CLI, Git signing, or GitHub authentication. OAuth2 daemons that relied
-on the previous `guest-config` default for such tasks must now pass the flag
-explicitly.
-
-Trusted custom runtimes can deliver destination-bound HTTP credentials without
-switching to `guest-config`: the guest receives an opaque placeholder and the
-Gondolin host proxy substitutes the value only for the attested protocol,
-hostname pattern, and port (HTTPS/443 by default). See
+Daemon authentication and the guest boundary are two separate concerns. How the
+daemon authenticates (an agent key, or OAuth2 resolved from
+`.moltnet/<agent>/moltnet.json` through the host secret provider) decides how the
+host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
+receives MoltNet credential material.** No `.moltnet` file, gitconfig, SSH
+signing key, GitHub App PEM, or MoltNet environment credential is injected into
+Gondolin, and mounted `.moltnet` paths are hidden. Structured MoltNet tools
+execute through the host-side `Agent`.
+
+Trusted custom runtimes can deliver destination-bound HTTP credentials to the
+guest: it receives an opaque placeholder and the Gondolin host proxy substitutes
+the value only for the attested protocol, hostname pattern, and port (HTTPS/443
+by default). See
 [Host-brokered HTTP credentials](../../docs/operate/running-agents.md#host-brokered-http-credentials).
 This does not provide diary or Git commit signing; private-key operations remain
 host capabilities.
 
+Host capabilities carry in-guest signing: the stock runtime
+declares `agent-signing`, so `git commit -S` and `moltnet entry create-signed`
+work inside the guest while the seed stays on the host (the daemon injects a
+signer bound to the authenticated identity and projects a non-secret gitconfig,
+an `SSH_AUTH_SOCK` service, and `MOLTNET_SIGNER_URL`). Grant
+`capability:agent-signing` (or per-operation `capability:agent-signing:<op>`)
+in the tool policy. `--git-author "Name <email>"` / `MOLTNET_GIT_AUTHOR`
+overrides the projected git identity. See
+[Host capabilities](../../docs/operate/running-agents.md#host-capabilities).
+
 `sync-sessions` does not prepare or attest executors, so it remains independent
 of `MOLTNET_PRIVATE_KEY`.
 

package/dist/cli.js

@@ -8,20 +8,20 @@ import "multiformats/hashes/sha2";
 import "typebox/value";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
-import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
+import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig } from "@themoltnet/sdk";
 import { createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { createHash, randomUUID } from "node:crypto";
+import * as ed from "@noble/ed25519";
+import { createHash as createHash$1, randomBytes } from "crypto";
 import "multiformats/codecs/raw";
 import "multiformats/hashes/digest";
 import "@noble/hashes/sha2";
 import "multiformats/bases/base32";
 import { ed25519 } from "@noble/curves/ed25519.js";
-import * as ed from "@noble/ed25519";
-import { createHash as createHash$1, randomBytes } from "crypto";
 import "@ipld/dag-cbor";
 import "@noble/ciphers/chacha";
 import "@noble/hashes/hkdf";
@@ -690,12 +690,12 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed unless the active runtime exposes and verifies a signing capability.\n- Do not disable commit signing when the active runtime provides it. A host-authenticated guest has no injected signing key, so do not recover one from host configuration or claim an unsigned commit is signed.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
 			slug: "accountable-delivery-v1"
 		},
 		"judgment-diary-v1": {
 			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the active runtime exposes and verifies a signing capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
 			slug: "judgment-diary-v1"
 		},
 		"proactive-memory-v1": {
@@ -710,7 +710,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"task-diary-discipline-v1": {
 			binding: "prompt_prefix",
-			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
 			slug: "task-diary-discipline-v1"
 		},
 		"verification-and-artifacts-v1": {
@@ -1132,7 +1132,11 @@ Type.Object({ name: Type.String({
 	maxLength: 255
 }) });
 Type.Object({
-	role: Type.Optional(Type.Union([Type.Literal("manager"), Type.Literal("member")])),
+	role: Type.Optional(Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])),
 	maxUses: Type.Optional(Type.Integer({
 		minimum: 1,
 		default: 1
@@ -1144,10 +1148,15 @@ Type.Object({
 	}))
 });
 Type.Object({ code: Type.String({ minLength: 1 }) });
-Type.Object({ role: Type.Union([Type.Literal("manager"), Type.Literal("member")]) });
+Type.Object({ role: Type.Union([
+	Type.Literal("manager"),
+	Type.Literal("executor"),
+	Type.Literal("member")
+]) });
 var TeamRoleSchema = Type.Union([
 	Type.Literal("owner"),
 	Type.Literal("manager"),
+	Type.Literal("executor"),
 	Type.Literal("member")
 ]);
 Type.Object({
@@ -1158,7 +1167,11 @@ var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
 Type.Object({
 	id: UuidSchema,
 	code: Type.String(),
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")]),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	]),
 	maxUses: Type.Integer(),
 	useCount: Type.Integer(),
 	expiresAt: DateTimeUnsafe,
@@ -1190,11 +1203,19 @@ Type.Object({
 });
 Type.Object({
 	teamId: UuidSchema,
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")])
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
 Type.Object({
 	updated: Type.Boolean(),
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")])
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
 Type.Object({ deleted: Type.Boolean() });
 Type.Object({ removed: Type.Boolean() });
@@ -1204,6 +1225,7 @@ var FoundingMemberSchema = Type.Object({
 	role: Type.Union([
 		Type.Literal("owner"),
 		Type.Literal("manager"),
+		Type.Literal("executor"),
 		Type.Literal("member")
 	])
 });
@@ -3359,12 +3381,12 @@ var COMMON_OPTIONAL_FLAGS = `\
                               sandbox policy.
   --agent-root <path>         Directory that owns .moltnet/<agent>. Default:
                               CWD, with git root fallback when available.
-  --guest-credential-mode <mode>
-                              Guest trust boundary: host-authenticated or
-                              guest-config. Defaults to host-authenticated for
-                              both agent-key and OAuth2 authentication.
-                              Explicit guest-config exposes the complete local
-                              agent credential tree to the VM.
+  --git-author <"Name <email>">
+                              Non-secret git identity projected into the
+                              guest for host-brokered commit signing. Default:
+                              host git config (OAuth2) or
+                              <identityId>+<agent>[bot]@users.noreply.github.com.
+                              Env: MOLTNET_GIT_AUTHOR.
   --lease-ttl-sec <n>         Sliding liveness window. Silence longer than
                               this ends the attempt with lease_expired.
                               Default: 300.
@@ -3539,21 +3561,6 @@ function isHelpFlag(args) {
 //#endregion
 //#region src/lib/agent-context.ts
 /**
-* Guest credentials are an explicit trust decision, never an incidental
-* consequence of files found on disk. The guest boundary is independent of
-* how the daemon itself authenticates: both agent-key and OAuth2 default to
-* the host-authenticated boundary, where structured MoltNet operations reuse
-* the trusted host-side Agent and the guest receives no credential material.
-* OAuth2 still resolves that Agent from the local config and secret provider
-* on the host — reading `moltnet.json` on the host does not imply projecting
-* it into the guest. `guest-config` remains an explicit compatibility opt-in
-* for tasks that need credential-bearing guest-shell operations.
-*/
-function resolveDaemonGuestCredentialMode(requested) {
-	if (requested !== void 0 && requested !== "guest-config" && requested !== "host-authenticated") throw new Error(`Invalid --guest-credential-mode "${requested}": expected guest-config or host-authenticated.`);
-	return requested ?? "host-authenticated";
-}
-/**
 * Report which auth mode `connect()` will use, without ever reading the secret
 * value into anything logged. Agent-key mode is selected when
 * `MOLTNET_AGENT_KEY` holds a non-blank value — mirroring the SDK precedence
@@ -3625,20 +3632,15 @@ async function validateStartupBinding(options) {
 async function resolveAgentContext(agentName, options = {}) {
 	if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) throw new Error(`Invalid agent name "${agentName}": must match /^[a-zA-Z0-9_-]+$/`);
 	const roots = resolveCredentialRoots(options.agentRootDir);
-	const guestCredentialMode = resolveDaemonGuestCredentialMode(options.guestCredentialMode);
 	if (options.authMode === "agent-key") {
-		const { rootDir, agentDir } = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : {
-			rootDir: roots[0] ?? process.cwd(),
-			agentDir: join(roots[0] ?? process.cwd(), ".moltnet", agentName)
-		};
+		const rootDir = roots[0] ?? process.cwd();
 		return {
-			agentDir,
+			agentDir: join(rootDir, ".moltnet", agentName),
 			agentRootDir: rootDir,
-			agent: await connect(),
-			guestCredentialMode
+			agent: await connect()
 		};
 	}
-	const located = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : locateAgentConfig(roots, agentName);
+	const located = locateAgentConfig(roots, agentName);
 	if (located) {
 		const agent = await connect({
 			configDir: located.agentDir,
@@ -3647,8 +3649,7 @@ async function resolveAgentContext(agentName, options = {}) {
 		return {
 			agentDir: located.agentDir,
 			agentRootDir: located.rootDir,
-			agent,
-			guestCredentialMode
+			agent
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -3669,22 +3670,6 @@ function locateAgentConfig(roots, agentName) {
 		};
 	}
 }
-function resolveCompleteGuestCredentials(roots, agentName) {
-	const partial = [];
-	for (const rootDir of roots) {
-		const agentDir = join(rootDir, ".moltnet", agentName);
-		const hasConfig = existsSync(join(agentDir, "moltnet.json"));
-		const hasEnv = existsSync(join(agentDir, "env"));
-		if (hasConfig && hasEnv) return {
-			rootDir,
-			agentDir
-		};
-		if (hasConfig || hasEnv) partial.push(agentDir);
-	}
-	if (partial.length > 0) throw new Error(`Incomplete guest credentials in ${partial.join(", ")}: moltnet.json and env must both exist for --guest-credential-mode guest-config.`);
-	const tried = roots.map((root) => join(root, ".moltnet", agentName));
-	throw new Error(`--guest-credential-mode guest-config requires an explicitly provisioned moltnet.json and env. Checked ${tried.join(", ")}.`);
-}
 function resolveCredentialRoots(agentRootDir) {
 	const roots = agentRootDir ? [agentRootDir] : [];
 	try {
@@ -3714,6 +3699,7 @@ function loadConfig() {
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
 		authMode: detectAuthMode(process.env),
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
+		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"])
 	};
 }
@@ -3738,6 +3724,30 @@ async function abortActiveAttemptOnSignal(opts) {
 	}
 }
 //#endregion
+//#region src/lib/agent-identity.ts
+/**
+* Build the non-secret identity projected into guests. Host git config is a
+* non-secret input and is consulted only on OAuth2 hosts, which already read
+* that configuration for the signing seed; configless agent-key hosts never
+* touch a config directory.
+*/
+async function resolveDaemonAgentIdentity(input) {
+	let hostGit;
+	if (input.gitAuthor === void 0 && input.authMode === "oauth2") {
+		const config = await readConfig(input.agentDir);
+		hostGit = config?.git ? {
+			name: config.git.name,
+			email: config.git.email
+		} : void 0;
+	}
+	return resolveAgentIdentity({
+		agentName: input.agentName,
+		whoami: input.whoami,
+		gitAuthor: input.gitAuthor,
+		hostGit
+	});
+}
+//#endregion
 //#region src/lib/correlation.ts
 var execFileAsync = promisify(execFile);
 var CORRELATION_TRAILER_KEY = "Moltnet-Correlation-Id";
@@ -4256,6 +4266,19 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 	const fallback = join(stateDirs.rootDir, "task-workspaces", producer.workspace.workspaceId);
 	return existsSync(fallback) ? fallback : null;
 }
+//#endregion
+//#region ../../libs/crypto-service/src/ssh.ts
+/**
+* SSH key format conversion for MoltNet Ed25519 keys
+*
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
+*/
+if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
 new TextEncoder();
 //#endregion
 //#region ../../libs/crypto-service/src/crypto.service.ts
@@ -4408,19 +4431,7 @@ ed.etc.sha512Sync = (...m) => {
 	m.forEach((msg) => hash.update(msg));
 	return hash.digest();
 };
-//#endregion
-//#region ../../libs/crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
+new TextEncoder().encode("SSHSIG");
 //#endregion
 //#region src/lib/executor-attestation.ts
 var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
@@ -4941,7 +4952,7 @@ function commonOptionDefs() {
 			short: "a"
 		},
 		"agent-root": { type: "string" },
-		"guest-credential-mode": { type: "string" },
+		"git-author": { type: "string" },
 		"lease-ttl-sec": { type: "string" },
 		"heartbeat-interval-ms": { type: "string" },
 		"max-batch-size": { type: "string" },
@@ -5652,13 +5663,12 @@ async function runPolling(opts) {
 	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
-	const { ctx, signingPrivateKey, startupWhoami } = await (async () => {
+	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -5678,10 +5688,24 @@ async function runPolling(opts) {
 				whoami,
 				signingPrivateKey: privateKey
 			});
+			gate = "resolve_agent_identity";
+			const agentIdentity = await resolveDaemonAgentIdentity({
+				agentName: baseCommon.agent,
+				whoami,
+				authMode: cfg.authMode,
+				agentDir: resolvedContext.agentDir,
+				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
+			});
 			return {
 				ctx: resolvedContext,
 				signingPrivateKey: privateKey,
-				startupWhoami: whoami
+				startupWhoami: whoami,
+				agentIdentity,
+				hostCapabilitySigner: createLocalSeedSigner({
+					privateKeySeed: privateKey,
+					agent: resolvedContext.agent,
+					identity: agentIdentity
+				})
 			};
 		} catch (error) {
 			await logDaemonStartupFailure({
@@ -5713,7 +5737,6 @@ async function runPolling(opts) {
 			executables: prepared.executables
 		});
 		assertGuestEnvironmentBoundary({
-			guestCredentialMode: ctx.guestCredentialMode,
 			forwardEnv: profile.requiredEnv,
 			sandboxEnv: profile.sandboxConfig.env
 		});
@@ -5844,7 +5867,6 @@ async function runPolling(opts) {
 		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
 		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
 		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
-		guestCredentialMode: ctx.guestCredentialMode,
 		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
 		correlationId: values["correlation-id"] ?? null,
 		diaryIds: diaryIds.length > 0 ? diaryIds : ["*"],
@@ -6112,7 +6134,9 @@ async function runPolling(opts) {
 				const rawExecuteTask = selected.preparedRuntime.createTaskExecutor({
 					agentName: common.agent,
 					moltnetAgent: ctx.agent,
-					guestCredentialMode: ctx.guestCredentialMode,
+					agentIdentity,
+					hostCapabilitySigner,
+					hostCapabilityLogger: taskLogger,
 					agentRootDir: ctx.agentRootDir,
 					mountPath: sandbox.rootDir,
 					provider: profile.provider,
@@ -6127,7 +6151,6 @@ async function runPolling(opts) {
 					onVmDiagnostic: (diagnostic) => {
 						const fields = {
 							event: diagnostic.event,
-							credentialMode: diagnostic.credentialMode,
 							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 						};
 						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
@@ -6276,13 +6299,12 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 	const cfg = loadConfig();
 	const initialOpts = opts;
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
-	const { ctx, signingPrivateKey } = await (async () => {
+	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -6302,9 +6324,23 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 				whoami,
 				signingPrivateKey: privateKey
 			});
+			gate = "resolve_agent_identity";
+			const agentIdentity = await resolveDaemonAgentIdentity({
+				agentName: initialOpts.agent,
+				whoami,
+				authMode: cfg.authMode,
+				agentDir: resolvedContext.agentDir,
+				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
+			});
 			return {
 				ctx: resolvedContext,
-				signingPrivateKey: privateKey
+				signingPrivateKey: privateKey,
+				agentIdentity,
+				hostCapabilitySigner: createLocalSeedSigner({
+					privateKeySeed: privateKey,
+					agent: resolvedContext.agent,
+					identity: agentIdentity
+				})
 			};
 		} catch (error) {
 			await logDaemonStartupFailure({
@@ -6331,7 +6367,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		executables: preparedRuntime.executables
 	});
 	assertGuestEnvironmentBoundary({
-		guestCredentialMode: ctx.guestCredentialMode,
 		forwardEnv: profile.requiredEnv,
 		sandboxEnv: profile.sandboxConfig.env
 	});
@@ -6419,7 +6454,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		profileId: profile.id,
 		profileSessionTtlSec: profile.sessionTtlSec,
 		profileWorkspaceTtlSec: profile.workspaceTtlSec,
-		guestCredentialMode: ctx.guestCredentialMode,
 		piAgentDir: piAgentDir.path,
 		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
@@ -6479,7 +6513,9 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		const rawExecuteTask = preparedRuntime.createTaskExecutor({
 			agentName: opts.agent,
 			moltnetAgent: ctx.agent,
-			guestCredentialMode: ctx.guestCredentialMode,
+			agentIdentity,
+			hostCapabilitySigner,
+			hostCapabilityLogger: rootLogger,
 			agentRootDir: ctx.agentRootDir,
 			mountPath: sandbox.rootDir,
 			provider: profile.provider,
@@ -6494,7 +6530,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			onVmDiagnostic: (diagnostic) => {
 				const fields = {
 					event: diagnostic.event,
-					credentialMode: diagnostic.credentialMode,
 					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 				};
 				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);

package/dist/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CA4DtB;AAED,eAAO,MAAM,0BAA0B,qBAQrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CA4DtB;AAED,eAAO,MAAM,0BAA0B,qBASrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}

package/dist/pi.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
+import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, agentSigningCapability, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
 //#region src/pi.ts
 var PI_KERNEL_TOOL_NAMES = [
 	...GONDOLIN_TOOL_NAMES,
@@ -59,7 +59,8 @@ var defaultPiRuntimeDefinition = definePiRuntime({
 		id: "moltnet-default-gondolin",
 		version: "1",
 		executables: GONDOLIN_BASE_EXECUTABLES
-	})
+	}),
+	hostCapabilities: [agentSigningCapability]
 });
 var defaultPiDaemonAdapter = createPiDaemonAdapter(defaultPiRuntimeDefinition);
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.43.0",
+  "version": "0.44.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -47,7 +47,7 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1",
+    "@earendil-works/gondolin": "^0.12.0",
     "@earendil-works/pi-ai": "0.79.4",
     "@earendil-works/pi-coding-agent": "0.79.4",
     "@fastify/otel": "^0.18.0",
@@ -78,10 +78,10 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.43.2",
+    "@themoltnet/agent-runtime": "0.44.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/pi-runtime": "0.11.0",
-    "@themoltnet/sdk": "0.136.0"
+    "@themoltnet/pi-runtime": "0.12.1",
+    "@themoltnet/sdk": "0.137.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -90,11 +90,11 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
+    "@moltnet/observability": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/observability": "0.1.0"
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "projectType": "application",