@themoltnet/agent-daemon 0.44.1 → 0.46.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { defaultPiDaemonAdapter } from "./pi.js";
+import { a as cryptoService, defaultPiDaemonAdapter, i as compileExecutionPlan, n as createExecutionPlanSnapshot, r as parseCredentialRequirements, t as runtimeExecutionOffer } from "./pi.js";
 import { assertRuntimeAdapterSupportsProfile } from "./runtime.js";
 import { Type } from "typebox";
 import "multiformats/cid";
@@ -10,21 +10,11 @@ import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
+import { connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
-import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig } from "@themoltnet/sdk";
-import { createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
+import { AuthenticationError, MoltNetError, createExecutorAttestor, readConfig, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
 import { createHash, randomUUID } from "node:crypto";
-import * as ed from "@noble/ed25519";
-import { createHash as createHash$1, randomBytes } from "crypto";
-import "multiformats/codecs/raw";
-import "multiformats/hashes/digest";
-import "@noble/hashes/sha2";
-import "multiformats/bases/base32";
-import { ed25519 } from "@noble/curves/ed25519.js";
-import "@ipld/dag-cbor";
-import "@noble/ciphers/chacha";
-import "@noble/hashes/hkdf";
 import { once } from "node:events";
 import { pino, transport } from "pino";
 import { metrics } from "@opentelemetry/api";
@@ -2405,8 +2395,8 @@ async function validateJudgePackInputAsync(input, ctx) {
 //#endregion
 //#region ../../libs/tasks/src/task-types/judge-eval-attempt.ts
 /**
-* `judge_eval_attempt` — score one completed `run_eval` attempt against a
-* hidden judge rubric.
+* `judge_eval_attempt` — score one completed artifact-producing attempt
+* against a hidden judge rubric.
 *
 * output_kind: judgment
 * criteria: required (`successCriteria.rubric`)
@@ -2510,9 +2500,9 @@ async function validateJudgeEvalAttemptInputAsync(input, ctx) {
 		field: "targetTaskId",
 		message: `targetTaskId=${inp.targetTaskId} does not resolve to a task you can read`
 	}];
-	if (target.taskType !== "run_eval") errors.push({
+	if (target.outputKind !== "artifact") errors.push({
 		field: "targetTaskId",
-		message: `targetTaskId=${inp.targetTaskId} is a ${target.taskType}, not a run_eval`
+		message: `targetTaskId=${inp.targetTaskId} has outputKind=${target.outputKind}; only artifact-producing tasks can be judged`
 	});
 	if (!ctx.deferReadinessChecks && (target.status !== "completed" || target.acceptedAttemptN === null)) errors.push({
 		field: "targetTaskId",
@@ -2524,7 +2514,7 @@ async function validateJudgeEvalAttemptInputAsync(input, ctx) {
 	});
 	if (!target.correlationId) errors.push({
 		field: "targetTaskId",
-		message: "target run_eval has no correlation_id; cannot enforce duplicate-judge protection"
+		message: "target producer has no correlation_id; cannot enforce duplicate-judge protection"
 	});
 	if (errors.length > 0 || !target.correlationId) return errors;
 	const rubric = inp.successCriteria.rubric;
@@ -3433,7 +3423,8 @@ Commands:
 Run \`agent-daemon <command> --help\` for command-specific flags.
 
 Prerequisites:
-  - agent-key mode: MOLTNET_AGENT_KEY and MOLTNET_PRIVATE_KEY; no agent files
+  - agent-key mode: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
+    MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
   - OAuth2 and sync-sessions: <agent-root>/.moltnet/<agent>/moltnet.json
   - --profile — remote runtime profile supplies provider/model/sandbox
     policy and CWD is used as the VM mountPath.
@@ -3563,7 +3554,8 @@ function isHelpFlag(args) {
 /**
 * Report which auth mode `connect()` will use, without ever reading the secret
 * value into anything logged. Agent-key mode is selected when
-* `MOLTNET_AGENT_KEY` holds a non-blank value — mirroring the SDK precedence
+* `MOLTNET_AGENT_KEY` or `MOLTNET_AGENT_KEY_REF` holds a non-blank value —
+* mirroring the SDK precedence
 * where an environment key opts into key mode ahead of the config-file OAuth2
 * credentials. The daemon never passes explicit in-code credentials to
 * `connect()`, so this env-only check matches what `connect()` actually does.
@@ -3571,7 +3563,7 @@ function isHelpFlag(args) {
 * Pure: `env` is passed in (the config module owns the `process.env` read).
 */
 function detectAuthMode(env) {
-	return env.MOLTNET_AGENT_KEY?.trim() ? "agent-key" : "oauth2";
+	return env.MOLTNET_AGENT_KEY?.trim() || env.MOLTNET_AGENT_KEY_REF?.trim() ? "agent-key" : "oauth2";
 }
 /**
 * Pure check: may the identity described by `whoami` operate the daemon as
@@ -3637,7 +3629,9 @@ async function resolveAgentContext(agentName, options = {}) {
 		return {
 			agentDir: join(rootDir, ".moltnet", agentName),
 			agentRootDir: rootDir,
-			agent: await connect()
+			agent: await connect({ secretProviders: createNodeSecretProviderRegistry() }),
+			credentialSource: "environment",
+			authMechanism: "agent-key"
 		};
 	}
 	const located = locateAgentConfig(roots, agentName);
@@ -3646,10 +3640,13 @@ async function resolveAgentContext(agentName, options = {}) {
 			configDir: located.agentDir,
 			secretProviders: createNodeSecretProviderRegistry()
 		});
+		const config = await readConfig(located.agentDir);
 		return {
 			agentDir: located.agentDir,
 			agentRootDir: located.rootDir,
-			agent
+			agent,
+			credentialSource: "config",
+			authMechanism: config?.agent_key_ref ? "agent-key" : "oauth2"
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -3691,6 +3688,8 @@ function resolveCredentialRoots(agentRootDir) {
 * sprinkling string lookups across the codebase.
 */
 function loadConfig() {
+	assertSingleCredentialForm("MOLTNET_AGENT_KEY", "MOLTNET_AGENT_KEY_REF");
+	assertSingleCredentialForm("MOLTNET_PRIVATE_KEY", "MOLTNET_PRIVATE_KEY_REF");
 	return {
 		otelEndpoint: process.env["MOLTNET_OTEL_ENDPOINT"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? "",
@@ -3699,10 +3698,17 @@ function loadConfig() {
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
 		authMode: detectAuthMode(process.env),
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
+		signingPrivateKeyRef: process.env["MOLTNET_PRIVATE_KEY_REF"] ?? "",
 		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
+		profileCredentialRequirements: process.env["MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS"] ?? "",
+		credentialBindings: process.env["MOLTNET_CREDENTIAL_BINDINGS"] ?? "",
+		credentialEnforcement: process.env["MOLTNET_CREDENTIAL_ENFORCEMENT"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"])
 	};
 }
+function assertSingleCredentialForm(valueName, refName) {
+	if (process.env[valueName]?.trim() && process.env[refName]?.trim()) throw new Error(`Set only one of ${valueName} or ${refName}`);
+}
 function readBoolean(name, value) {
 	if (value === void 0 || value === "") return false;
 	if (value === "true") return true;
@@ -3910,6 +3916,7 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 	return {
 		descriptor,
 		workspaceMode,
+		workspaceKind: workspaceMode === "scratch_mount" ? "scratch" : void 0,
 		sessionKey: slotId,
 		slotKey,
 		slotId,
@@ -4203,15 +4210,16 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 	if (resolution.kind === "missing") throw new ProducerContextResolutionError(`No live producer runtime slot found for task ${targetTaskId} attempt ${targetAttemptN}`);
 	if (resolution.kind === "no-session-path") throw new ProducerContextResolutionError(`Producer task ${targetTaskId} attempt ${targetAttemptN} has no persisted Pi session path`);
 	if (resolution.kind === "remote-session") throw new ProducerContextResolutionError(`Producer task ${targetTaskId} attempt ${targetAttemptN} has a durable runtime session but no workspace metadata to copy`);
+	const producerWorkspaceCopySource = resolveProducerWorkspaceCopySource(resolution.producerSlot, stateDirs);
 	return {
 		...basePlan,
 		workspaceMode: "scratch_mount",
 		worktreeBranch: null,
 		workspaceKind: "scratch",
-		workspaceSeed: {
-			copyFromPath: resolveProducerWorkspaceCopySource(resolution.producerSlot, stateDirs),
+		workspaceSeed: producerWorkspaceCopySource ? {
+			copyFromPath: producerWorkspaceCopySource,
 			source: "producer"
-		},
+		} : null,
 		sessionPersistence: {
 			sessionDir: `${stateDirs.piSessionsDir}/judge-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`,
 			forkFromSessionPath: resolution.sessionPath
@@ -4254,12 +4262,18 @@ function resolveProducerWorkspaceCopySource(producer, stateDirs) {
 		if (existsSync(workspacePath)) return workspacePath;
 		const recoveredPath = recoverScratchWorkspacePath(producer, stateDirs);
 		if (recoveredPath) return recoveredPath;
+		if (isDisposableScratchWorkspace(producer, stateDirs)) return null;
 		throw new ProducerContextResolutionError(`Producer workspace path is missing on disk: ${workspacePath}`);
 	}
 	const sharedMountRoot = dirname(dirname(stateDirs.rootDir));
 	if (!existsSync(sharedMountRoot)) throw new ProducerContextResolutionError(`Shared producer mount root is missing on disk: ${sharedMountRoot}`);
 	return sharedMountRoot;
 }
+function isDisposableScratchWorkspace(producer, stateDirs) {
+	if (producer.workspace?.kind === "scratch") return true;
+	if (!producer.workspace?.workspaceId) return false;
+	return producer.workspace.worktreePath === join(stateDirs.rootDir, "task-workspaces", producer.workspace.workspaceId);
+}
 function recoverScratchWorkspacePath(producer, stateDirs) {
 	if (producer.workspace?.worktreeBranch) return null;
 	if (!producer.workspace?.workspaceId) return null;
@@ -4267,183 +4281,30 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 	return existsSync(fallback) ? fallback : null;
 }
 //#endregion
-//#region ../../libs/crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-new TextEncoder();
-//#endregion
-//#region ../../libs/crypto-service/src/crypto.service.ts
-/**
-* MoltNet Crypto Service
-*
-* Ed25519 cryptographic operations for agent identity
-* Uses @noble/ed25519 for pure TypeScript implementation
-*/
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-/** Domain-separation prefix for the signing payload envelope. */
-var DOMAIN_PREFIX = "moltnet:v1";
-/**
-* Build deterministic signing bytes with domain separation and
-* length-prefixed binary framing.
-*
-* Layout:
-*   UTF-8("moltnet:v1") || u32be(len(msg_hash)) || msg_hash || u32be(len(nonce_bytes)) || nonce_bytes
-*
-* Where msg_hash = SHA-256(UTF-8(message)).
-*
-* This produces a fixed-structure byte sequence immune to whitespace,
-* newline, and encoding differences between runtimes.
-*/
-function buildSigningBytes(message, nonce) {
-	const msgHash = createHash$1("sha256").update(Buffer.from(message, "utf-8")).digest();
-	const nonceBytes = Buffer.from(nonce, "utf-8");
-	const prefix = Buffer.from(DOMAIN_PREFIX, "utf-8");
-	const buf = Buffer.alloc(prefix.length + 4 + msgHash.length + 4 + nonceBytes.length);
-	let offset = 0;
-	prefix.copy(buf, offset);
-	offset += prefix.length;
-	buf.writeUInt32BE(msgHash.length, offset);
-	offset += 4;
-	msgHash.copy(buf, offset);
-	offset += msgHash.length;
-	buf.writeUInt32BE(nonceBytes.length, offset);
-	offset += 4;
-	nonceBytes.copy(buf, offset);
-	return new Uint8Array(buf);
-}
-var cryptoService = {
-	async generateKeyPair() {
-		const privateKeyBytes = ed.utils.randomPrivateKey();
-		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
-		const privateKey = Buffer.from(privateKeyBytes).toString("base64");
-		return {
-			publicKey: `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`,
-			privateKey,
-			fingerprint: this.generateFingerprint(publicKeyBytes)
-		};
-	},
-	generateFingerprint(publicKeyBytes) {
-		return (createHash$1("sha256").update(publicKeyBytes).digest("hex").slice(0, 16).toUpperCase().match(/.{4}/g) ?? []).join("-");
-	},
-	parsePublicKey(publicKey) {
-		const base64 = publicKey.replace(/^ed25519:/, "");
-		return new Uint8Array(Buffer.from(base64, "base64"));
-	},
-	async sign(message, privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const messageBytes = new TextEncoder().encode(message);
-		const signature = await ed.signAsync(messageBytes, privateKeyBytes);
-		return Buffer.from(signature).toString("base64");
-	},
-	async verify(message, signature, publicKey) {
-		try {
-			const publicKeyBytes = this.parsePublicKey(publicKey);
-			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
-			const messageBytes = new TextEncoder().encode(message);
-			return await ed.verifyAsync(signatureBytes, messageBytes, publicKeyBytes);
-		} catch {
-			return false;
-		}
-	},
-	async signWithNonce(message, nonce, privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const signingBytes = buildSigningBytes(message, nonce);
-		const signature = await ed.signAsync(signingBytes, privateKeyBytes);
-		return Buffer.from(signature).toString("base64");
-	},
-	async verifyWithNonce(message, nonce, signature, publicKey) {
-		try {
-			const publicKeyBytes = this.parsePublicKey(publicKey);
-			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
-			const signingBytes = buildSigningBytes(message, nonce);
-			return await ed.verifyAsync(signatureBytes, signingBytes, publicKeyBytes);
-		} catch {
-			return false;
-		}
-	},
-	async createSignedMessage(message, privateKeyBase64, publicKey) {
-		return {
-			message,
-			signature: await this.sign(message, privateKeyBase64),
-			publicKey
-		};
-	},
-	async verifySignedMessage(signedMessage) {
-		return this.verify(signedMessage.message, signedMessage.signature, signedMessage.publicKey);
-	},
-	generateChallenge() {
-		return `moltnet:challenge:${randomBytes(32).toString("hex")}:${Date.now()}`;
-	},
-	async derivePublicKey(privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
-		return `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`;
-	},
-	getFingerprintFromPublicKey(publicKey) {
-		const publicKeyBytes = this.parsePublicKey(publicKey);
-		return this.generateFingerprint(publicKeyBytes);
-	},
-	deriveX25519PrivateKey(ed25519PrivateKeyBase64) {
-		const seed = new Uint8Array(Buffer.from(ed25519PrivateKeyBase64, "base64"));
-		const x25519Priv = ed25519.utils.toMontgomerySecret(seed);
-		return Buffer.from(x25519Priv).toString("base64");
-	},
-	deriveX25519PublicKey(ed25519PublicKey) {
-		const edPubBytes = this.parsePublicKey(ed25519PublicKey);
-		const x25519Pub = ed25519.utils.toMontgomery(edPubBytes);
-		return `x25519:${Buffer.from(x25519Pub).toString("base64")}`;
-	},
-	async createIdentityProof(identityId, privateKeyBase64) {
-		const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-		const message = `moltnet:register:${identityId}:${timestamp}`;
-		return {
-			message,
-			signature: await this.sign(message, privateKeyBase64),
-			timestamp
-		};
-	},
-	async verifyIdentityProof(proof, publicKey, expectedIdentityId) {
-		if (!await this.verify(proof.message, proof.signature, publicKey)) return false;
-		const expectedPrefix = `moltnet:register:${expectedIdentityId}:`;
-		if (!proof.message.startsWith(expectedPrefix)) return false;
-		const proofTime = new Date(proof.timestamp).getTime();
-		if (Date.now() - proofTime > 300 * 1e3) return false;
-		return true;
-	}
-};
-//#endregion
-//#region ../../libs/crypto-service/src/executor-attestation.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-new TextEncoder().encode("SSHSIG");
-//#endregion
 //#region src/lib/executor-attestation.ts
 var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
 async function resolveExecutorSigningPrivateKey(input) {
 	if (input.authMode === "agent-key") {
 		const privateKey = input.configuredPrivateKey.trim();
-		if (!privateKey) throw new Error("Agent-key daemon startup requires MOLTNET_PRIVATE_KEY containing the base64-encoded Ed25519 private key seed.");
-		return privateKey;
+		if (privateKey) return privateKey;
+		const reference = input.configuredPrivateKeyRef?.trim();
+		if (!reference) throw new Error("Agent-key daemon startup requires MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF) containing the base64-encoded Ed25519 private key seed.");
+		let resolved;
+		try {
+			resolved = await resolveEnvSecretReference(reference, createNodeSecretProviderRegistry());
+		} catch (cause) {
+			throw new Error(`Agent-key daemon startup could not resolve MOLTNET_PRIVATE_KEY_REF: ${cause.message}`, { cause });
+		}
+		if (Buffer.from(resolved, "base64").length !== 32) throw new Error("MOLTNET_PRIVATE_KEY_REF must resolve to a base64-encoded 32-byte Ed25519 seed.");
+		return resolved;
+	}
+	const config = await readConfig(input.agentDir);
+	if (!config) throw new Error(`OAuth2 daemon startup requires ${input.agentDir}/moltnet.json.`);
+	try {
+		return await resolveIdentitySeed(config, createNodeSecretProviderRegistry());
+	} catch (cause) {
+		throw new Error(`OAuth2 daemon startup could not resolve the signing seed from ${input.agentDir}/moltnet.json (keys.private_key or keys.private_key_ref): ${cause.message}`, { cause });
 	}
-	const privateKey = (await readConfig(input.agentDir))?.keys?.private_key?.trim();
-	if (!privateKey) throw new Error(`OAuth2 daemon startup requires keys.private_key in ${input.agentDir}/moltnet.json.`);
-	return privateKey;
 }
 function validateDaemonScopes(whoami) {
 	const available = new Set(whoami.scopes ?? []);
@@ -4825,6 +4686,257 @@ async function maybeWriteAnchors(output, ctx) {
 	}
 }
 //#endregion
+//#region ../../libs/execution-integrations/src/credential-broker.ts
+async function checkCredentialReadiness(requirements, bindings, providers) {
+	const records = [];
+	for (const requirement of requirements) {
+		const binding = ownBinding(bindings, requirement.name);
+		if (binding === void 0) {
+			records.push({
+				name: requirement.name,
+				required: requirement.required,
+				status: requirement.required ? "required_binding_missing" : "binding_absent"
+			});
+			continue;
+		}
+		const bindingDigest = await digestBindingReference(binding.reference);
+		const source = binding.source ?? "local-activation";
+		if (providers.get(binding.reference.provider) === void 0) {
+			records.push({
+				name: requirement.name,
+				required: requirement.required,
+				status: "provider_unavailable",
+				bindingDigest,
+				source
+			});
+			continue;
+		}
+		const probe = await providers.probe(binding.reference);
+		records.push({
+			name: requirement.name,
+			required: requirement.required,
+			status: probe === "present" ? "ready" : probe === "absent" ? "binding_absent" : "host_store_inaccessible",
+			bindingDigest,
+			source
+		});
+	}
+	return records;
+}
+async function digestBindingReference(reference) {
+	const bytes = new TextEncoder().encode(`${reference.provider}\u0000${reference.key}`);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+	return `sha256:${[...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 16)}`;
+}
+function ownBinding(bindings, name) {
+	return Object.hasOwn(bindings, name) ? bindings[name] : void 0;
+}
+//#endregion
+//#region ../../libs/execution-integrations/src/runtime-profile.ts
+var CURRENT_EFFECTIVE_POLICY_SNAPSHOT_VERSION = "effective-policy:v1";
+/**
+* Maps resolved product authority into portable intent. Policy composition is
+* deliberately upstream: this boundary accepts no policy IDs and performs no
+* union, lookup, or precedence handling.
+*/
+function executionIntentFromRuntimeProfile(input) {
+	if (input.policy.snapshot.runtimeKind !== input.profile.runtimeKind) throw new Error("resolved policy authority does not match runtime profile");
+	const network = input.profile.sandboxConfig.network;
+	return {
+		mode: input.mode,
+		profile: {
+			id: input.profile.id,
+			revision: input.profileRevision,
+			definitionCid: input.profile.definitionCid
+		},
+		authority: {
+			policySnapshotHash: input.policy.hash,
+			policySnapshotVersion: input.policy.snapshot.version,
+			...input.policy.authorizedControls !== void 0 && { authorizedControls: [...input.policy.authorizedControls] }
+		},
+		credentialRequirements: structuredClone(input.credentialRequirements),
+		requiredCapabilities: [...input.requiredCapabilities ?? []],
+		lease: {
+			ttlSec: input.profile.leaseTtlSec,
+			requiredControls: [...input.requiredLeaseControls ?? []]
+		},
+		network: {
+			allowedHosts: [...network?.allowedHosts ?? []],
+			allowedInternalHosts: [...network?.allowedInternalHosts ?? []]
+		},
+		provenance: {
+			profile: input.profile.source,
+			policy: `runtime-policy-snapshot:${input.policy.hash}`,
+			requirements: input.requirementsProvenance
+		}
+	};
+}
+//#endregion
+//#region src/lib/governance-plan.ts
+/**
+* Observe-only governance-plan compilation (#1970 private slice).
+*
+* Distinct from `task-execution-plan.ts` (workspace/session planning): this
+* module compiles the CREDENTIAL/CAPABILITY governance plan from trusted
+* local configuration and logs its value-free decisions. It gates nothing
+* yet — enforcement is a separate, later change.
+*/
+var DEFAULT_GOVERNANCE_OBSERVE_TIMEOUT_MS = 2e3;
+/**
+* Two distinct provenance sources (#2022 review): requirements come from a
+* profile-side/private input (`MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS`, a
+* JSON map of profile id → requirements) and bindings from trusted
+* local/deployment configuration (`MOLTNET_CREDENTIAL_BINDINGS`). Both raw
+* values are read once in config.ts. Both empty → null (observer disabled).
+* Malformed configuration throws — a truncated credential policy must never
+* be silently ignored.
+*/
+function loadRuntimeCredentialConfig(raw) {
+	const hasRequirements = raw.profileRequirements.trim() !== "";
+	const hasBindings = raw.bindings.trim() !== "";
+	if (!hasRequirements && !hasBindings) return null;
+	const requirementsByProfile = {};
+	if (hasRequirements) {
+		const parsed = JSON.parse(raw.profileRequirements);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS must be a JSON object keyed by profile id");
+		for (const [profileId, value] of Object.entries(parsed)) requirementsByProfile[profileId] = parseCredentialRequirements(value);
+	}
+	const bindings = {};
+	if (hasBindings) {
+		const parsed = JSON.parse(raw.bindings);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("MOLTNET_CREDENTIAL_BINDINGS must be a JSON object");
+		for (const [name, binding] of Object.entries(parsed)) {
+			if (typeof binding?.reference?.provider !== "string" || typeof binding.reference.key !== "string") throw new Error(`MOLTNET_CREDENTIAL_BINDINGS binding "${name}" must carry a { reference: { provider, key } }`);
+			bindings[name] = {
+				...binding,
+				source: "local-bindings-config"
+			};
+		}
+	}
+	return {
+		requirementsByProfile,
+		bindings,
+		sources: {
+			requirements: "profile-requirements-config",
+			bindings: "local-bindings-config"
+		}
+	};
+}
+/**
+* Resolve the credential-governance enforcement mode, mirroring the runtime
+* tool-policy `off | watch | enforce` ladder. Unset defaults to `watch` when
+* requirement/binding sources are configured, `off` otherwise. `enforce` is
+* rejected until the enforcement flip (skip-before-claim) is implemented —
+* accepting it as a silent watch would misrepresent the deployment.
+*/
+function resolveCredentialEnforcement(raw, sources) {
+	const configured = sources.profileRequirements.trim() !== "" || sources.bindings.trim() !== "";
+	const value = raw.trim();
+	if (value === "") return configured ? "watch" : "off";
+	if (value === "off" || value === "watch") return value;
+	if (value === "enforce") throw new Error("MOLTNET_CREDENTIAL_ENFORCEMENT=enforce is not implemented yet: the skip-before-claim flip is a separate change. Use watch (audit only).");
+	throw new Error(`MOLTNET_CREDENTIAL_ENFORCEMENT must be off, watch or enforce; got "${value}"`);
+}
+async function observeGovernancePlan(input) {
+	const unavailableReason = authorityUnavailableReason(input);
+	if (unavailableReason !== null) {
+		(input.logger.warn ?? input.logger.info).call(input.logger, {
+			mode: "observe",
+			taskId: input.taskId,
+			attemptN: input.attemptN,
+			profileId: input.profile.id,
+			reason: unavailableReason
+		}, "agent-daemon.governance_plan_unavailable");
+		return {
+			status: "unavailable",
+			snapshot: null,
+			reason: unavailableReason
+		};
+	}
+	const { runtimeProfileRevision, policySnapshotHash } = input.claimAuthority;
+	if (runtimeProfileRevision === void 0 || policySnapshotHash === void 0) throw new Error("validated claim authority is missing immutable pins");
+	if (input.offer === void 0) throw new Error("validated execution offer is missing");
+	const requirements = input.config.requirementsByProfile[input.profile.id] ?? [];
+	const credentialReadiness = await checkCredentialReadiness(requirements, input.config.bindings, input.registry);
+	const intent = executionIntentFromRuntimeProfile({
+		mode: "watch",
+		profile: input.profile,
+		profileRevision: runtimeProfileRevision,
+		policy: {
+			hash: policySnapshotHash,
+			snapshot: {
+				version: CURRENT_EFFECTIVE_POLICY_SNAPSHOT_VERSION,
+				runtimeKind: input.profile.runtimeKind
+			},
+			authorizedControls: void 0
+		},
+		credentialRequirements: requirements,
+		requiredCapabilities: [],
+		requirementsProvenance: input.config.sources.requirements
+	});
+	const plan = compileExecutionPlan({
+		intent,
+		offer: input.offer,
+		credentialReadiness
+	});
+	const snapshot = await createExecutionPlanSnapshot({
+		intent,
+		offer: input.offer,
+		credentialReadiness,
+		plan
+	});
+	const logObject = {
+		mode: "observe",
+		taskId: input.taskId,
+		attemptN: input.attemptN,
+		profileId: input.profile.id,
+		sources: input.config.sources,
+		snapshotCid: snapshot.cid,
+		profileRevision: snapshot.intent.profile.revision,
+		policySnapshotHash: snapshot.intent.authority.policySnapshotHash,
+		launchable: plan.launchable,
+		decisions: plan.decisions,
+		credentialReadiness
+	};
+	if (plan.launchable) input.logger.info(logObject, "agent-daemon.governance_plan");
+	else (input.logger.warn ?? input.logger.info).call(input.logger, logObject, "agent-daemon.governance_plan_would_block");
+	return {
+		status: "observed",
+		snapshot
+	};
+}
+/**
+* Observe without allowing a stuck keyring/provider to delay task execution.
+* The observer is intentionally non-gating: failures and deadlines are logged
+* with claim correlation and converted to `null`.
+*/
+async function observeGovernancePlanSafely(input, timeoutMs = DEFAULT_GOVERNANCE_OBSERVE_TIMEOUT_MS) {
+	let timeout;
+	try {
+		return await Promise.race([observeGovernancePlan(input), new Promise((_resolve, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("governance observation timed out")), timeoutMs);
+		})]);
+	} catch (error) {
+		(input.logger.warn ?? input.logger.info).call(input.logger, {
+			mode: "observe",
+			taskId: input.taskId,
+			attemptN: input.attemptN,
+			err: error instanceof Error ? error.message : String(error)
+		}, "agent-daemon.governance_plan_observe_failed");
+		return null;
+	} finally {
+		if (timeout !== void 0) clearTimeout(timeout);
+	}
+}
+function authorityUnavailableReason(input) {
+	const authority = input.claimAuthority;
+	if (authority.runtimeProfileId === void 0 || authority.runtimeProfileRevision === void 0 || authority.policySnapshotHash === void 0 || authority.executorFingerprint === void 0) return "claim_authority_unpinned";
+	if (authority.runtimeProfileId !== input.profile.id) return "runtime_profile_mismatch";
+	if (authority.executorFingerprint !== input.executorFingerprint) return "executor_fingerprint_mismatch";
+	if (input.offer === void 0) return "execution_offer_unavailable";
+	if (input.offer.executor.fingerprint !== input.executorFingerprint) return "executor_fingerprint_mismatch";
+	return null;
+}
+//#endregion
 //#region src/lib/logger.ts
 /**
 * Logger setup + teardown for the agent-daemon CLI commands.
@@ -5662,6 +5774,11 @@ async function runPolling(opts) {
 	}
 	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
+	const credentialSources = {
+		profileRequirements: cfg.profileCredentialRequirements,
+		bindings: cfg.credentialBindings
+	};
+	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
 	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
@@ -5679,7 +5796,8 @@ async function runPolling(opts) {
 			const privateKey = await resolveExecutorSigningPrivateKey({
 				authMode: cfg.authMode,
 				agentDir: resolvedContext.agentDir,
-				configuredPrivateKey: cfg.signingPrivateKey
+				configuredPrivateKey: cfg.signingPrivateKey,
+				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
 			});
 			gate = "validate_scopes";
 			validateDaemonScopes(whoami);
@@ -5814,7 +5932,7 @@ async function runPolling(opts) {
 		resourceAttributes: {
 			"moltnet.team.id": teamId,
 			"moltnet.agent.name": baseCommon.agent,
-			"moltnet.auth.mode": cfg.authMode,
+			"moltnet.auth.mode": ctx.authMechanism,
 			"moltnet.runtime_profile.count": String(profiles.length),
 			"moltnet.runtime_profile.ids": profiles.map((p) => p.id).join(",")
 		}
@@ -6027,6 +6145,17 @@ async function runPolling(opts) {
 			executeTask: async (claimedTask, reporter) => {
 				const selected = runtimeForClaimedTask(runtimes, claimedTask);
 				const { common, executionPlans, profile, sandbox, slotIdentity, stateDirs } = selected;
+				if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+					config: runtimeCredentialConfig,
+					profile,
+					offer: runtimeExecutionOffer(selected.preparedRuntime, selected.preparedRuntime.attestor.fingerprint),
+					registry: createNodeSecretProviderRegistry(),
+					executorFingerprint: selected.preparedRuntime.attestor.fingerprint,
+					claimAuthority: claimedTask.claimAuthority ?? {},
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					logger: rootLogger
+				});
 				const taskLogger = rootLogger.child({
 					runtimeProfileId: profile.id,
 					runtimeProfileName: profile.name,
@@ -6297,6 +6426,11 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		return 1;
 	}
 	const cfg = loadConfig();
+	const credentialSources = {
+		profileRequirements: cfg.profileCredentialRequirements,
+		bindings: cfg.credentialBindings
+	};
+	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
 	const initialOpts = opts;
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
 	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
@@ -6315,7 +6449,8 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			const privateKey = await resolveExecutorSigningPrivateKey({
 				authMode: cfg.authMode,
 				agentDir: resolvedContext.agentDir,
-				configuredPrivateKey: cfg.signingPrivateKey
+				configuredPrivateKey: cfg.signingPrivateKey,
+				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
 			});
 			gate = "validate_scopes";
 			validateDaemonScopes(whoami);
@@ -6415,7 +6550,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		resourceAttributes: {
 			"moltnet.task.id": taskId,
 			"moltnet.agent.name": opts.agent,
-			"moltnet.auth.mode": cfg.authMode,
+			"moltnet.auth.mode": ctx.authMechanism,
 			"moltnet.llm.provider": profile.provider,
 			"moltnet.llm.model": profile.model,
 			...profile.thinkingLevel ? { "moltnet.llm.thinking_level": profile.thinkingLevel } : {},
@@ -6545,6 +6680,17 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			maxBashTimeouts: opts.maxBashTimeouts
 		});
 		const executeTask = async (claimedTask, reporter) => {
+			if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+				config: runtimeCredentialConfig,
+				profile,
+				offer: runtimeExecutionOffer(preparedRuntime, preparedRuntime.attestor.fingerprint),
+				registry: createNodeSecretProviderRegistry(),
+				executorFingerprint: preparedRuntime.attestor.fingerprint,
+				claimAuthority: claimedTask.claimAuthority ?? {},
+				taskId: claimedTask.task.id,
+				attemptN: claimedTask.attemptN,
+				logger: rootLogger
+			});
 			let executionPlan;
 			try {
 				executionPlan = await executionPlans.getOrCreate(claimedTask);