@themoltnet/agent-daemon 0.45.0 → 0.46.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { defaultPiDaemonAdapter } from "./pi.js";
+import { a as cryptoService, defaultPiDaemonAdapter, i as compileExecutionPlan, n as createExecutionPlanSnapshot, r as parseCredentialRequirements, t as runtimeExecutionOffer } from "./pi.js";
 import { assertRuntimeAdapterSupportsProfile } from "./runtime.js";
 import { Type } from "typebox";
 import "multiformats/cid";
@@ -10,21 +10,11 @@ import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
+import { connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
-import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
-import { createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
+import { AuthenticationError, MoltNetError, createExecutorAttestor, readConfig, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
 import { createHash, randomUUID } from "node:crypto";
-import * as ed from "@noble/ed25519";
-import { createHash as createHash$1, randomBytes } from "crypto";
-import "multiformats/codecs/raw";
-import "multiformats/hashes/digest";
-import "@noble/hashes/sha2";
-import "multiformats/bases/base32";
-import { ed25519 } from "@noble/curves/ed25519.js";
-import "@ipld/dag-cbor";
-import "@noble/ciphers/chacha";
-import "@noble/hashes/hkdf";
 import { once } from "node:events";
 import { pino, transport } from "pino";
 import { metrics } from "@opentelemetry/api";
@@ -3710,6 +3700,9 @@ function loadConfig() {
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
 		signingPrivateKeyRef: process.env["MOLTNET_PRIVATE_KEY_REF"] ?? "",
 		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
+		profileCredentialRequirements: process.env["MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS"] ?? "",
+		credentialBindings: process.env["MOLTNET_CREDENTIAL_BINDINGS"] ?? "",
+		credentialEnforcement: process.env["MOLTNET_CREDENTIAL_ENFORCEMENT"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"])
 	};
 }
@@ -4288,172 +4281,6 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 	return existsSync(fallback) ? fallback : null;
 }
 //#endregion
-//#region ../../libs/crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-new TextEncoder();
-//#endregion
-//#region ../../libs/crypto-service/src/crypto.service.ts
-/**
-* MoltNet Crypto Service
-*
-* Ed25519 cryptographic operations for agent identity
-* Uses @noble/ed25519 for pure TypeScript implementation
-*/
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-/** Domain-separation prefix for the signing payload envelope. */
-var DOMAIN_PREFIX = "moltnet:v1";
-/**
-* Build deterministic signing bytes with domain separation and
-* length-prefixed binary framing.
-*
-* Layout:
-*   UTF-8("moltnet:v1") || u32be(len(msg_hash)) || msg_hash || u32be(len(nonce_bytes)) || nonce_bytes
-*
-* Where msg_hash = SHA-256(UTF-8(message)).
-*
-* This produces a fixed-structure byte sequence immune to whitespace,
-* newline, and encoding differences between runtimes.
-*/
-function buildSigningBytes(message, nonce) {
-	const msgHash = createHash$1("sha256").update(Buffer.from(message, "utf-8")).digest();
-	const nonceBytes = Buffer.from(nonce, "utf-8");
-	const prefix = Buffer.from(DOMAIN_PREFIX, "utf-8");
-	const buf = Buffer.alloc(prefix.length + 4 + msgHash.length + 4 + nonceBytes.length);
-	let offset = 0;
-	prefix.copy(buf, offset);
-	offset += prefix.length;
-	buf.writeUInt32BE(msgHash.length, offset);
-	offset += 4;
-	msgHash.copy(buf, offset);
-	offset += msgHash.length;
-	buf.writeUInt32BE(nonceBytes.length, offset);
-	offset += 4;
-	nonceBytes.copy(buf, offset);
-	return new Uint8Array(buf);
-}
-var cryptoService = {
-	async generateKeyPair() {
-		const privateKeyBytes = ed.utils.randomPrivateKey();
-		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
-		const privateKey = Buffer.from(privateKeyBytes).toString("base64");
-		return {
-			publicKey: `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`,
-			privateKey,
-			fingerprint: this.generateFingerprint(publicKeyBytes)
-		};
-	},
-	generateFingerprint(publicKeyBytes) {
-		return (createHash$1("sha256").update(publicKeyBytes).digest("hex").slice(0, 16).toUpperCase().match(/.{4}/g) ?? []).join("-");
-	},
-	parsePublicKey(publicKey) {
-		const base64 = publicKey.replace(/^ed25519:/, "");
-		return new Uint8Array(Buffer.from(base64, "base64"));
-	},
-	async sign(message, privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const messageBytes = new TextEncoder().encode(message);
-		const signature = await ed.signAsync(messageBytes, privateKeyBytes);
-		return Buffer.from(signature).toString("base64");
-	},
-	async verify(message, signature, publicKey) {
-		try {
-			const publicKeyBytes = this.parsePublicKey(publicKey);
-			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
-			const messageBytes = new TextEncoder().encode(message);
-			return await ed.verifyAsync(signatureBytes, messageBytes, publicKeyBytes);
-		} catch {
-			return false;
-		}
-	},
-	async signWithNonce(message, nonce, privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const signingBytes = buildSigningBytes(message, nonce);
-		const signature = await ed.signAsync(signingBytes, privateKeyBytes);
-		return Buffer.from(signature).toString("base64");
-	},
-	async verifyWithNonce(message, nonce, signature, publicKey) {
-		try {
-			const publicKeyBytes = this.parsePublicKey(publicKey);
-			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
-			const signingBytes = buildSigningBytes(message, nonce);
-			return await ed.verifyAsync(signatureBytes, signingBytes, publicKeyBytes);
-		} catch {
-			return false;
-		}
-	},
-	async createSignedMessage(message, privateKeyBase64, publicKey) {
-		return {
-			message,
-			signature: await this.sign(message, privateKeyBase64),
-			publicKey
-		};
-	},
-	async verifySignedMessage(signedMessage) {
-		return this.verify(signedMessage.message, signedMessage.signature, signedMessage.publicKey);
-	},
-	generateChallenge() {
-		return `moltnet:challenge:${randomBytes(32).toString("hex")}:${Date.now()}`;
-	},
-	async derivePublicKey(privateKeyBase64) {
-		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
-		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
-		return `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`;
-	},
-	getFingerprintFromPublicKey(publicKey) {
-		const publicKeyBytes = this.parsePublicKey(publicKey);
-		return this.generateFingerprint(publicKeyBytes);
-	},
-	deriveX25519PrivateKey(ed25519PrivateKeyBase64) {
-		const seed = new Uint8Array(Buffer.from(ed25519PrivateKeyBase64, "base64"));
-		const x25519Priv = ed25519.utils.toMontgomerySecret(seed);
-		return Buffer.from(x25519Priv).toString("base64");
-	},
-	deriveX25519PublicKey(ed25519PublicKey) {
-		const edPubBytes = this.parsePublicKey(ed25519PublicKey);
-		const x25519Pub = ed25519.utils.toMontgomery(edPubBytes);
-		return `x25519:${Buffer.from(x25519Pub).toString("base64")}`;
-	},
-	async createIdentityProof(identityId, privateKeyBase64) {
-		const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-		const message = `moltnet:register:${identityId}:${timestamp}`;
-		return {
-			message,
-			signature: await this.sign(message, privateKeyBase64),
-			timestamp
-		};
-	},
-	async verifyIdentityProof(proof, publicKey, expectedIdentityId) {
-		if (!await this.verify(proof.message, proof.signature, publicKey)) return false;
-		const expectedPrefix = `moltnet:register:${expectedIdentityId}:`;
-		if (!proof.message.startsWith(expectedPrefix)) return false;
-		const proofTime = new Date(proof.timestamp).getTime();
-		if (Date.now() - proofTime > 300 * 1e3) return false;
-		return true;
-	}
-};
-//#endregion
-//#region ../../libs/crypto-service/src/executor-attestation.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-new TextEncoder().encode("SSHSIG");
-//#endregion
 //#region src/lib/executor-attestation.ts
 var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
 async function resolveExecutorSigningPrivateKey(input) {
@@ -4859,6 +4686,257 @@ async function maybeWriteAnchors(output, ctx) {
 	}
 }
 //#endregion
+//#region ../../libs/execution-integrations/src/credential-broker.ts
+async function checkCredentialReadiness(requirements, bindings, providers) {
+	const records = [];
+	for (const requirement of requirements) {
+		const binding = ownBinding(bindings, requirement.name);
+		if (binding === void 0) {
+			records.push({
+				name: requirement.name,
+				required: requirement.required,
+				status: requirement.required ? "required_binding_missing" : "binding_absent"
+			});
+			continue;
+		}
+		const bindingDigest = await digestBindingReference(binding.reference);
+		const source = binding.source ?? "local-activation";
+		if (providers.get(binding.reference.provider) === void 0) {
+			records.push({
+				name: requirement.name,
+				required: requirement.required,
+				status: "provider_unavailable",
+				bindingDigest,
+				source
+			});
+			continue;
+		}
+		const probe = await providers.probe(binding.reference);
+		records.push({
+			name: requirement.name,
+			required: requirement.required,
+			status: probe === "present" ? "ready" : probe === "absent" ? "binding_absent" : "host_store_inaccessible",
+			bindingDigest,
+			source
+		});
+	}
+	return records;
+}
+async function digestBindingReference(reference) {
+	const bytes = new TextEncoder().encode(`${reference.provider}\u0000${reference.key}`);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+	return `sha256:${[...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 16)}`;
+}
+function ownBinding(bindings, name) {
+	return Object.hasOwn(bindings, name) ? bindings[name] : void 0;
+}
+//#endregion
+//#region ../../libs/execution-integrations/src/runtime-profile.ts
+var CURRENT_EFFECTIVE_POLICY_SNAPSHOT_VERSION = "effective-policy:v1";
+/**
+* Maps resolved product authority into portable intent. Policy composition is
+* deliberately upstream: this boundary accepts no policy IDs and performs no
+* union, lookup, or precedence handling.
+*/
+function executionIntentFromRuntimeProfile(input) {
+	if (input.policy.snapshot.runtimeKind !== input.profile.runtimeKind) throw new Error("resolved policy authority does not match runtime profile");
+	const network = input.profile.sandboxConfig.network;
+	return {
+		mode: input.mode,
+		profile: {
+			id: input.profile.id,
+			revision: input.profileRevision,
+			definitionCid: input.profile.definitionCid
+		},
+		authority: {
+			policySnapshotHash: input.policy.hash,
+			policySnapshotVersion: input.policy.snapshot.version,
+			...input.policy.authorizedControls !== void 0 && { authorizedControls: [...input.policy.authorizedControls] }
+		},
+		credentialRequirements: structuredClone(input.credentialRequirements),
+		requiredCapabilities: [...input.requiredCapabilities ?? []],
+		lease: {
+			ttlSec: input.profile.leaseTtlSec,
+			requiredControls: [...input.requiredLeaseControls ?? []]
+		},
+		network: {
+			allowedHosts: [...network?.allowedHosts ?? []],
+			allowedInternalHosts: [...network?.allowedInternalHosts ?? []]
+		},
+		provenance: {
+			profile: input.profile.source,
+			policy: `runtime-policy-snapshot:${input.policy.hash}`,
+			requirements: input.requirementsProvenance
+		}
+	};
+}
+//#endregion
+//#region src/lib/governance-plan.ts
+/**
+* Observe-only governance-plan compilation (#1970 private slice).
+*
+* Distinct from `task-execution-plan.ts` (workspace/session planning): this
+* module compiles the CREDENTIAL/CAPABILITY governance plan from trusted
+* local configuration and logs its value-free decisions. It gates nothing
+* yet — enforcement is a separate, later change.
+*/
+var DEFAULT_GOVERNANCE_OBSERVE_TIMEOUT_MS = 2e3;
+/**
+* Two distinct provenance sources (#2022 review): requirements come from a
+* profile-side/private input (`MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS`, a
+* JSON map of profile id → requirements) and bindings from trusted
+* local/deployment configuration (`MOLTNET_CREDENTIAL_BINDINGS`). Both raw
+* values are read once in config.ts. Both empty → null (observer disabled).
+* Malformed configuration throws — a truncated credential policy must never
+* be silently ignored.
+*/
+function loadRuntimeCredentialConfig(raw) {
+	const hasRequirements = raw.profileRequirements.trim() !== "";
+	const hasBindings = raw.bindings.trim() !== "";
+	if (!hasRequirements && !hasBindings) return null;
+	const requirementsByProfile = {};
+	if (hasRequirements) {
+		const parsed = JSON.parse(raw.profileRequirements);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("MOLTNET_PROFILE_CREDENTIAL_REQUIREMENTS must be a JSON object keyed by profile id");
+		for (const [profileId, value] of Object.entries(parsed)) requirementsByProfile[profileId] = parseCredentialRequirements(value);
+	}
+	const bindings = {};
+	if (hasBindings) {
+		const parsed = JSON.parse(raw.bindings);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("MOLTNET_CREDENTIAL_BINDINGS must be a JSON object");
+		for (const [name, binding] of Object.entries(parsed)) {
+			if (typeof binding?.reference?.provider !== "string" || typeof binding.reference.key !== "string") throw new Error(`MOLTNET_CREDENTIAL_BINDINGS binding "${name}" must carry a { reference: { provider, key } }`);
+			bindings[name] = {
+				...binding,
+				source: "local-bindings-config"
+			};
+		}
+	}
+	return {
+		requirementsByProfile,
+		bindings,
+		sources: {
+			requirements: "profile-requirements-config",
+			bindings: "local-bindings-config"
+		}
+	};
+}
+/**
+* Resolve the credential-governance enforcement mode, mirroring the runtime
+* tool-policy `off | watch | enforce` ladder. Unset defaults to `watch` when
+* requirement/binding sources are configured, `off` otherwise. `enforce` is
+* rejected until the enforcement flip (skip-before-claim) is implemented —
+* accepting it as a silent watch would misrepresent the deployment.
+*/
+function resolveCredentialEnforcement(raw, sources) {
+	const configured = sources.profileRequirements.trim() !== "" || sources.bindings.trim() !== "";
+	const value = raw.trim();
+	if (value === "") return configured ? "watch" : "off";
+	if (value === "off" || value === "watch") return value;
+	if (value === "enforce") throw new Error("MOLTNET_CREDENTIAL_ENFORCEMENT=enforce is not implemented yet: the skip-before-claim flip is a separate change. Use watch (audit only).");
+	throw new Error(`MOLTNET_CREDENTIAL_ENFORCEMENT must be off, watch or enforce; got "${value}"`);
+}
+async function observeGovernancePlan(input) {
+	const unavailableReason = authorityUnavailableReason(input);
+	if (unavailableReason !== null) {
+		(input.logger.warn ?? input.logger.info).call(input.logger, {
+			mode: "observe",
+			taskId: input.taskId,
+			attemptN: input.attemptN,
+			profileId: input.profile.id,
+			reason: unavailableReason
+		}, "agent-daemon.governance_plan_unavailable");
+		return {
+			status: "unavailable",
+			snapshot: null,
+			reason: unavailableReason
+		};
+	}
+	const { runtimeProfileRevision, policySnapshotHash } = input.claimAuthority;
+	if (runtimeProfileRevision === void 0 || policySnapshotHash === void 0) throw new Error("validated claim authority is missing immutable pins");
+	if (input.offer === void 0) throw new Error("validated execution offer is missing");
+	const requirements = input.config.requirementsByProfile[input.profile.id] ?? [];
+	const credentialReadiness = await checkCredentialReadiness(requirements, input.config.bindings, input.registry);
+	const intent = executionIntentFromRuntimeProfile({
+		mode: "watch",
+		profile: input.profile,
+		profileRevision: runtimeProfileRevision,
+		policy: {
+			hash: policySnapshotHash,
+			snapshot: {
+				version: CURRENT_EFFECTIVE_POLICY_SNAPSHOT_VERSION,
+				runtimeKind: input.profile.runtimeKind
+			},
+			authorizedControls: void 0
+		},
+		credentialRequirements: requirements,
+		requiredCapabilities: [],
+		requirementsProvenance: input.config.sources.requirements
+	});
+	const plan = compileExecutionPlan({
+		intent,
+		offer: input.offer,
+		credentialReadiness
+	});
+	const snapshot = await createExecutionPlanSnapshot({
+		intent,
+		offer: input.offer,
+		credentialReadiness,
+		plan
+	});
+	const logObject = {
+		mode: "observe",
+		taskId: input.taskId,
+		attemptN: input.attemptN,
+		profileId: input.profile.id,
+		sources: input.config.sources,
+		snapshotCid: snapshot.cid,
+		profileRevision: snapshot.intent.profile.revision,
+		policySnapshotHash: snapshot.intent.authority.policySnapshotHash,
+		launchable: plan.launchable,
+		decisions: plan.decisions,
+		credentialReadiness
+	};
+	if (plan.launchable) input.logger.info(logObject, "agent-daemon.governance_plan");
+	else (input.logger.warn ?? input.logger.info).call(input.logger, logObject, "agent-daemon.governance_plan_would_block");
+	return {
+		status: "observed",
+		snapshot
+	};
+}
+/**
+* Observe without allowing a stuck keyring/provider to delay task execution.
+* The observer is intentionally non-gating: failures and deadlines are logged
+* with claim correlation and converted to `null`.
+*/
+async function observeGovernancePlanSafely(input, timeoutMs = DEFAULT_GOVERNANCE_OBSERVE_TIMEOUT_MS) {
+	let timeout;
+	try {
+		return await Promise.race([observeGovernancePlan(input), new Promise((_resolve, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("governance observation timed out")), timeoutMs);
+		})]);
+	} catch (error) {
+		(input.logger.warn ?? input.logger.info).call(input.logger, {
+			mode: "observe",
+			taskId: input.taskId,
+			attemptN: input.attemptN,
+			err: error instanceof Error ? error.message : String(error)
+		}, "agent-daemon.governance_plan_observe_failed");
+		return null;
+	} finally {
+		if (timeout !== void 0) clearTimeout(timeout);
+	}
+}
+function authorityUnavailableReason(input) {
+	const authority = input.claimAuthority;
+	if (authority.runtimeProfileId === void 0 || authority.runtimeProfileRevision === void 0 || authority.policySnapshotHash === void 0 || authority.executorFingerprint === void 0) return "claim_authority_unpinned";
+	if (authority.runtimeProfileId !== input.profile.id) return "runtime_profile_mismatch";
+	if (authority.executorFingerprint !== input.executorFingerprint) return "executor_fingerprint_mismatch";
+	if (input.offer === void 0) return "execution_offer_unavailable";
+	if (input.offer.executor.fingerprint !== input.executorFingerprint) return "executor_fingerprint_mismatch";
+	return null;
+}
+//#endregion
 //#region src/lib/logger.ts
 /**
 * Logger setup + teardown for the agent-daemon CLI commands.
@@ -5696,6 +5774,11 @@ async function runPolling(opts) {
 	}
 	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
+	const credentialSources = {
+		profileRequirements: cfg.profileCredentialRequirements,
+		bindings: cfg.credentialBindings
+	};
+	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
 	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
@@ -6062,6 +6145,17 @@ async function runPolling(opts) {
 			executeTask: async (claimedTask, reporter) => {
 				const selected = runtimeForClaimedTask(runtimes, claimedTask);
 				const { common, executionPlans, profile, sandbox, slotIdentity, stateDirs } = selected;
+				if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+					config: runtimeCredentialConfig,
+					profile,
+					offer: runtimeExecutionOffer(selected.preparedRuntime, selected.preparedRuntime.attestor.fingerprint),
+					registry: createNodeSecretProviderRegistry(),
+					executorFingerprint: selected.preparedRuntime.attestor.fingerprint,
+					claimAuthority: claimedTask.claimAuthority ?? {},
+					taskId: claimedTask.task.id,
+					attemptN: claimedTask.attemptN,
+					logger: rootLogger
+				});
 				const taskLogger = rootLogger.child({
 					runtimeProfileId: profile.id,
 					runtimeProfileName: profile.name,
@@ -6332,6 +6426,11 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		return 1;
 	}
 	const cfg = loadConfig();
+	const credentialSources = {
+		profileRequirements: cfg.profileCredentialRequirements,
+		bindings: cfg.credentialBindings
+	};
+	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
 	const initialOpts = opts;
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
 	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
@@ -6581,6 +6680,17 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			maxBashTimeouts: opts.maxBashTimeouts
 		});
 		const executeTask = async (claimedTask, reporter) => {
+			if (runtimeCredentialConfig) await observeGovernancePlanSafely({
+				config: runtimeCredentialConfig,
+				profile,
+				offer: runtimeExecutionOffer(preparedRuntime, preparedRuntime.attestor.fingerprint),
+				registry: createNodeSecretProviderRegistry(),
+				executorFingerprint: preparedRuntime.attestor.fingerprint,
+				claimAuthority: claimedTask.claimAuthority ?? {},
+				taskId: claimedTask.task.id,
+				attemptN: claimedTask.attemptN,
+				logger: rootLogger
+			});
 			let executionPlan;
 			try {
 				executionPlan = await executionPlans.getOrCreate(claimedTask);

package/dist/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CA4DtB;AAED,eAAO,MAAM,0BAA0B,qBASrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AACA,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CAkEtB;AAED,eAAO,MAAM,0BAA0B,qBASrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}

package/dist/pi.js

@@ -1,5 +1,558 @@
 #!/usr/bin/env node
+import { Type } from "typebox";
+import { CID } from "multiformats/cid";
+import * as json from "multiformats/codecs/json";
+import { sha256 } from "multiformats/hashes/sha2";
+import { Value } from "typebox/value";
 import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, agentSigningCapability, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
+import { createHash } from "node:crypto";
+import * as ed from "@noble/ed25519";
+import { createHash as createHash$1, randomBytes } from "crypto";
+import "multiformats/codecs/raw";
+import "multiformats/hashes/digest";
+import "@noble/hashes/sha2";
+import "multiformats/bases/base32";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import "@ipld/dag-cbor";
+import "@noble/ciphers/chacha";
+import "@noble/hashes/hkdf";
+//#region ../../libs/crypto-service/src/ssh.ts
+/**
+* SSH key format conversion for MoltNet Ed25519 keys
+*
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
+*/
+if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+new TextEncoder();
+//#endregion
+//#region ../../libs/crypto-service/src/crypto.service.ts
+/**
+* MoltNet Crypto Service
+*
+* Ed25519 cryptographic operations for agent identity
+* Uses @noble/ed25519 for pure TypeScript implementation
+*/
+ed.etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+/** Domain-separation prefix for the signing payload envelope. */
+var DOMAIN_PREFIX = "moltnet:v1";
+/**
+* Build deterministic signing bytes with domain separation and
+* length-prefixed binary framing.
+*
+* Layout:
+*   UTF-8("moltnet:v1") || u32be(len(msg_hash)) || msg_hash || u32be(len(nonce_bytes)) || nonce_bytes
+*
+* Where msg_hash = SHA-256(UTF-8(message)).
+*
+* This produces a fixed-structure byte sequence immune to whitespace,
+* newline, and encoding differences between runtimes.
+*/
+function buildSigningBytes(message, nonce) {
+	const msgHash = createHash$1("sha256").update(Buffer.from(message, "utf-8")).digest();
+	const nonceBytes = Buffer.from(nonce, "utf-8");
+	const prefix = Buffer.from(DOMAIN_PREFIX, "utf-8");
+	const buf = Buffer.alloc(prefix.length + 4 + msgHash.length + 4 + nonceBytes.length);
+	let offset = 0;
+	prefix.copy(buf, offset);
+	offset += prefix.length;
+	buf.writeUInt32BE(msgHash.length, offset);
+	offset += 4;
+	msgHash.copy(buf, offset);
+	offset += msgHash.length;
+	buf.writeUInt32BE(nonceBytes.length, offset);
+	offset += 4;
+	nonceBytes.copy(buf, offset);
+	return new Uint8Array(buf);
+}
+var cryptoService = {
+	async generateKeyPair() {
+		const privateKeyBytes = ed.utils.randomPrivateKey();
+		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
+		const privateKey = Buffer.from(privateKeyBytes).toString("base64");
+		return {
+			publicKey: `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`,
+			privateKey,
+			fingerprint: this.generateFingerprint(publicKeyBytes)
+		};
+	},
+	generateFingerprint(publicKeyBytes) {
+		return (createHash$1("sha256").update(publicKeyBytes).digest("hex").slice(0, 16).toUpperCase().match(/.{4}/g) ?? []).join("-");
+	},
+	parsePublicKey(publicKey) {
+		const base64 = publicKey.replace(/^ed25519:/, "");
+		return new Uint8Array(Buffer.from(base64, "base64"));
+	},
+	async sign(message, privateKeyBase64) {
+		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
+		const messageBytes = new TextEncoder().encode(message);
+		const signature = await ed.signAsync(messageBytes, privateKeyBytes);
+		return Buffer.from(signature).toString("base64");
+	},
+	async verify(message, signature, publicKey) {
+		try {
+			const publicKeyBytes = this.parsePublicKey(publicKey);
+			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
+			const messageBytes = new TextEncoder().encode(message);
+			return await ed.verifyAsync(signatureBytes, messageBytes, publicKeyBytes);
+		} catch {
+			return false;
+		}
+	},
+	async signWithNonce(message, nonce, privateKeyBase64) {
+		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
+		const signingBytes = buildSigningBytes(message, nonce);
+		const signature = await ed.signAsync(signingBytes, privateKeyBytes);
+		return Buffer.from(signature).toString("base64");
+	},
+	async verifyWithNonce(message, nonce, signature, publicKey) {
+		try {
+			const publicKeyBytes = this.parsePublicKey(publicKey);
+			const signatureBytes = new Uint8Array(Buffer.from(signature, "base64"));
+			const signingBytes = buildSigningBytes(message, nonce);
+			return await ed.verifyAsync(signatureBytes, signingBytes, publicKeyBytes);
+		} catch {
+			return false;
+		}
+	},
+	async createSignedMessage(message, privateKeyBase64, publicKey) {
+		return {
+			message,
+			signature: await this.sign(message, privateKeyBase64),
+			publicKey
+		};
+	},
+	async verifySignedMessage(signedMessage) {
+		return this.verify(signedMessage.message, signedMessage.signature, signedMessage.publicKey);
+	},
+	generateChallenge() {
+		return `moltnet:challenge:${randomBytes(32).toString("hex")}:${Date.now()}`;
+	},
+	async derivePublicKey(privateKeyBase64) {
+		const privateKeyBytes = new Uint8Array(Buffer.from(privateKeyBase64, "base64"));
+		const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
+		return `ed25519:${Buffer.from(publicKeyBytes).toString("base64")}`;
+	},
+	getFingerprintFromPublicKey(publicKey) {
+		const publicKeyBytes = this.parsePublicKey(publicKey);
+		return this.generateFingerprint(publicKeyBytes);
+	},
+	deriveX25519PrivateKey(ed25519PrivateKeyBase64) {
+		const seed = new Uint8Array(Buffer.from(ed25519PrivateKeyBase64, "base64"));
+		const x25519Priv = ed25519.utils.toMontgomerySecret(seed);
+		return Buffer.from(x25519Priv).toString("base64");
+	},
+	deriveX25519PublicKey(ed25519PublicKey) {
+		const edPubBytes = this.parsePublicKey(ed25519PublicKey);
+		const x25519Pub = ed25519.utils.toMontgomery(edPubBytes);
+		return `x25519:${Buffer.from(x25519Pub).toString("base64")}`;
+	},
+	async createIdentityProof(identityId, privateKeyBase64) {
+		const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+		const message = `moltnet:register:${identityId}:${timestamp}`;
+		return {
+			message,
+			signature: await this.sign(message, privateKeyBase64),
+			timestamp
+		};
+	},
+	async verifyIdentityProof(proof, publicKey, expectedIdentityId) {
+		if (!await this.verify(proof.message, proof.signature, publicKey)) return false;
+		const expectedPrefix = `moltnet:register:${expectedIdentityId}:`;
+		if (!proof.message.startsWith(expectedPrefix)) return false;
+		const proofTime = new Date(proof.timestamp).getTime();
+		if (Date.now() - proofTime > 300 * 1e3) return false;
+		return true;
+	}
+};
+//#endregion
+//#region ../../libs/crypto-service/src/executor-attestation.ts
+ed.etc.sha512Sync = (...m) => {
+	const hash = createHash("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+//#endregion
+//#region ../../libs/crypto-service/src/json-cid.ts
+/**
+* Generic JSON CID — CIDv1 for arbitrary JSON-serialisable values.
+*
+* Uses the dag-json codec and sha2-256, producing a base32lower CIDv1.
+* Suitable for content-addressing task inputs, schema objects, and other
+* JSON payloads that don't need diary-entry canonical normalisation.
+*/
+async function computeJsonCid(value) {
+	const bytes = json.encode(value);
+	const hash = await sha256.digest(bytes);
+	return CID.create(1, json.code, hash).toString();
+}
+new TextEncoder().encode("SSHSIG");
+//#endregion
+//#region ../../libs/execution-plan/src/control-ids.ts
+var CREDENTIAL_AUTHORITY_PREFIX = "credential:";
+var CREDENTIAL_PROJECTION_PREFIX = "credential-projection:";
+var HOST_CAPABILITY_PREFIX = "host-capability:";
+function credentialAuthorityControl(name) {
+	return `${CREDENTIAL_AUTHORITY_PREFIX}${name}`;
+}
+function credentialProjectionControl(projection) {
+	return `${CREDENTIAL_PROJECTION_PREFIX}${projection}`;
+}
+function hostCapabilityControl(name) {
+	return `${HOST_CAPABILITY_PREFIX}${name}`;
+}
+//#endregion
+//#region ../../libs/execution-plan/src/compile-execution-plan.ts
+/**
+* Compile resolved authority and portable intent against one executor offer.
+* The compiler never reads policy identifiers, host bindings, provider
+* coordinates, runtime manifests, or implementation names.
+*/
+function compileExecutionPlan(input) {
+	const { intent, offer } = input;
+	const stamp = {
+		mode: intent.mode,
+		phase: "preflight",
+		basis: "declared"
+	};
+	const decisions = [];
+	const deliverables = [];
+	const readinessByName = uniqueReadiness(input.credentialReadiness);
+	const offersByControl = groupOffers(offer.controls);
+	const authorized = intent.authority.authorizedControls;
+	const networkPatterns = [...intent.network.allowedHosts, ...intent.network.allowedInternalHosts];
+	let blocked = false;
+	for (const requirement of intent.credentialRequirements) {
+		const control = credentialAuthorityControl(requirement.name);
+		const fail = (reason, state) => {
+			const decisionState = state ?? (requirement.required ? "failed" : "degraded");
+			decisions.push({
+				control,
+				state: decisionState,
+				...stamp,
+				reason
+			});
+			blocked ||= requirement.required;
+		};
+		if (authorized === void 0) {
+			fail("credential_authority_unresolved");
+			continue;
+		}
+		if (!authorized.includes(control)) {
+			fail("credential_authority_denied");
+			continue;
+		}
+		const readiness = readinessByName.get(requirement.name);
+		if (readiness === void 0) {
+			fail("credential_readiness_missing");
+			continue;
+		}
+		if (readiness.status !== "ready") {
+			fail(readiness.status);
+			continue;
+		}
+		if (requirement.destinations.some((destination) => !hostCovered(destination.host, networkPatterns))) {
+			fail("destination_not_in_network_intent");
+			continue;
+		}
+		if (requirement.lifecycle !== void 0 && requirement.lifecycle.maxTtlSec > intent.lease.ttlSec) {
+			fail("lifecycle_exceeds_lease");
+			continue;
+		}
+		const offerControl = credentialProjectionControl(requirement.projection);
+		const candidates = offersByControl.get(offerControl) ?? [];
+		const matchingCandidates = candidates.filter((candidate) => offerContainsRequirement(candidate, requirement));
+		if (matchingCandidates.length !== 1) {
+			fail(candidates.length === 0 ? "control_not_offered" : matchingCandidates.length === 0 ? "offer_constraints_mismatch" : "offer_ambiguous", "unsupported");
+			continue;
+		}
+		const candidate = matchingCandidates[0];
+		decisions.push({
+			control,
+			state: "enforced",
+			...stamp,
+			offerControl,
+			enforcement: candidate.enforcement,
+			locus: candidate.locus
+		});
+		deliverables.push({
+			name: requirement.name,
+			projection: requirement.projection,
+			...requirement.projection === "brokered-http" && { guestEnv: requirement.guestEnv },
+			required: requirement.required,
+			destinations: cloneDestinations(requirement.destinations),
+			offerControl,
+			enforcement: candidate.enforcement,
+			locus: candidate.locus
+		});
+	}
+	for (const name of intent.requiredCapabilities) {
+		const control = hostCapabilityControl(name);
+		if (authorized === void 0) {
+			decisions.push({
+				control,
+				state: "failed",
+				...stamp,
+				reason: "capability_authority_unresolved"
+			});
+			blocked = true;
+			continue;
+		}
+		if (!authorized.includes(control)) {
+			decisions.push({
+				control,
+				state: "failed",
+				...stamp,
+				reason: "capability_authority_denied"
+			});
+			blocked = true;
+			continue;
+		}
+		const candidates = offersByControl.get(control) ?? [];
+		if (candidates.length !== 1) {
+			decisions.push({
+				control,
+				state: "unsupported",
+				...stamp,
+				reason: candidates.length === 0 ? "control_not_offered" : "offer_ambiguous"
+			});
+			blocked = true;
+			continue;
+		}
+		const candidate = candidates[0];
+		decisions.push({
+			control,
+			state: "enforced",
+			...stamp,
+			offerControl: candidate.id,
+			enforcement: candidate.enforcement,
+			locus: candidate.locus
+		});
+	}
+	for (const control of intent.lease.requiredControls) {
+		const candidates = offersByControl.get(control) ?? [];
+		if (candidates.length !== 1) {
+			decisions.push({
+				control,
+				state: "unsupported",
+				...stamp,
+				reason: candidates.length === 0 ? "control_not_offered" : "offer_ambiguous"
+			});
+			blocked = true;
+			continue;
+		}
+		const candidate = candidates[0];
+		decisions.push({
+			control,
+			state: "enforced",
+			...stamp,
+			offerControl: candidate.id,
+			enforcement: candidate.enforcement,
+			locus: candidate.locus
+		});
+	}
+	return {
+		mode: intent.mode,
+		launchable: !blocked,
+		executor: { ...offer.executor },
+		decisions,
+		deliverables,
+		effectiveNetwork: {
+			allowedHosts: [...new Set(intent.network.allowedHosts)].sort(),
+			allowedInternalHosts: [...new Set(intent.network.allowedInternalHosts)].sort()
+		}
+	};
+}
+function groupOffers(controls) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const control of controls) {
+		const existing = grouped.get(control.id) ?? [];
+		existing.push(control);
+		grouped.set(control.id, existing);
+	}
+	return grouped;
+}
+function uniqueReadiness(readiness) {
+	const result = /* @__PURE__ */ new Map();
+	for (const record of readiness) {
+		if (result.has(record.name)) throw new Error(`duplicate credential readiness for "${record.name}"`);
+		result.set(record.name, record);
+	}
+	return result;
+}
+function offerContainsRequirement(offer, requirement) {
+	const offeredDestinations = offer.constraints?.destinations;
+	if (offeredDestinations === void 0 || !sameDestinationSet(offeredDestinations, requirement.destinations)) return false;
+	if (requirement.projection === "brokered-http") return offer.constraints?.guestEnvs?.includes(requirement.guestEnv) ?? false;
+	return true;
+}
+function sameDestinationSet(offered, requested) {
+	const offeredKeys = offered.map(destinationKey).sort();
+	const requestedKeys = requested.map(destinationKey).sort();
+	return offeredKeys.length === requestedKeys.length && offeredKeys.every((key, index) => key === requestedKeys[index]);
+}
+function destinationKey(destination) {
+	return `${destination.protocol}\0${destination.host}\0${destination.port}`;
+}
+function cloneDestinations(destinations) {
+	return destinations.map((destination) => ({ ...destination }));
+}
+/** Exact host, or a profile wildcard covering one or more subdomains. */
+function hostCovered(host, patterns) {
+	return patterns.some((pattern) => {
+		if (pattern === host) return true;
+		if (!pattern.startsWith("*.")) return false;
+		const suffix = pattern.slice(1);
+		return host.endsWith(suffix) && host.length > suffix.length;
+	});
+}
+//#endregion
+//#region ../../libs/execution-plan/src/credential-requirements.ts
+var CredentialDestination = Type.Object({
+	protocol: Type.Union([Type.Literal("https"), Type.Literal("http")]),
+	host: Type.String({
+		minLength: 1,
+		maxLength: 255,
+		pattern: "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$"
+	}),
+	port: Type.Integer({
+		minimum: 1,
+		maximum: 65535
+	})
+}, { additionalProperties: false });
+var GuestEnvName = Type.String({
+	minLength: 1,
+	maxLength: 128,
+	pattern: "^(?!MOLTNET_)[A-Z][A-Z0-9_]*$"
+});
+var CredentialLifecycleIntent = Type.Object({
+	maxTtlSec: Type.Integer({
+		minimum: 1,
+		maximum: 86400
+	}),
+	refreshBeforeSec: Type.Integer({
+		minimum: 1,
+		maximum: 86400
+	})
+}, { additionalProperties: false });
+var credentialRequirementBase = {
+	name: Type.String({ minLength: 1 }),
+	kind: Type.Union([
+		Type.Literal("http-bearer"),
+		Type.Literal("http-basic"),
+		Type.Literal("api-key-header")
+	]),
+	destinations: Type.Array(CredentialDestination, { minItems: 1 }),
+	required: Type.Boolean({ default: true }),
+	lifecycle: Type.Optional(CredentialLifecycleIntent)
+};
+var HostToolCredentialRequirement = Type.Object({
+	...credentialRequirementBase,
+	projection: Type.Literal("host-tool")
+}, { additionalProperties: false });
+var BrokeredHttpCredentialRequirement = Type.Object({
+	...credentialRequirementBase,
+	projection: Type.Literal("brokered-http"),
+	guestEnv: GuestEnvName
+}, { additionalProperties: false });
+var CredentialRequirement = Type.Union([HostToolCredentialRequirement, BrokeredHttpCredentialRequirement]);
+function parseCredentialRequirements(input) {
+	const withDefaults = Value.Default(Type.Array(CredentialRequirement), Value.Clone(input));
+	const requirements = Value.Parse(Type.Array(CredentialRequirement), withDefaults);
+	const names = /* @__PURE__ */ new Set();
+	const guestEnvs = /* @__PURE__ */ new Set();
+	for (const requirement of requirements) {
+		if (names.has(requirement.name)) throw new Error(`duplicate credential requirement name "${requirement.name}"`);
+		names.add(requirement.name);
+		if (requirement.projection === "brokered-http") {
+			if (guestEnvs.has(requirement.guestEnv)) throw new Error(`duplicate brokered guestEnv "${requirement.guestEnv}"`);
+			guestEnvs.add(requirement.guestEnv);
+		}
+		const lifecycle = requirement.lifecycle;
+		if (lifecycle && lifecycle.refreshBeforeSec >= lifecycle.maxTtlSec) throw new Error(`credential requirement "${requirement.name}": refreshBeforeSec must be shorter than maxTtlSec`);
+	}
+	return requirements;
+}
+//#endregion
+//#region ../../libs/execution-plan/src/execution-snapshot.ts
+/**
+* Create an immutable, content-addressed, value-free execution snapshot. The
+* existing policy snapshot hash is pinned inside intent; policy composition
+* has already happened before this boundary.
+*/
+async function createExecutionPlanSnapshot(input) {
+	const body = structuredClone(input);
+	return deepFreeze({
+		cid: await computeJsonCid(snapshotBody(body)),
+		...body
+	});
+}
+function snapshotBody(input) {
+	return {
+		v: "moltnet:execution-plan-snapshot:v1",
+		...input
+	};
+}
+function deepFreeze(value) {
+	if (value !== null && typeof value === "object") {
+		for (const child of Object.values(value)) deepFreeze(child);
+		Object.freeze(value);
+	}
+	return value;
+}
+//#endregion
+//#region src/lib/runtime-governance.ts
+var executionOffers = /* @__PURE__ */ new WeakMap();
+/** Attach private governance metadata without widening the public adapter API. */
+function registerRuntimeExecutionOffer(runtime, factory) {
+	executionOffers.set(runtime, factory);
+}
+/** Resolve the selected runtime's offer for the observe-only orchestrator. */
+function runtimeExecutionOffer(runtime, executorFingerprint) {
+	return executionOffers.get(runtime)?.(executorFingerprint);
+}
+//#endregion
+//#region ../../libs/execution-integrations/src/pi.ts
+/** Convert the canonical Pi manifest to a portable, open-ended offer. */
+function executionCapabilityOfferFromPiManifest(manifest, options) {
+	const enforcement = options.enforcement ?? "native";
+	const locus = options.locus ?? "pi:isolated-runtime";
+	return {
+		executor: {
+			id: `${manifest.runtime.id}@${manifest.runtime.version}`,
+			fingerprint: options.executorFingerprint
+		},
+		controls: [...(manifest.brokeredHttpSecrets ?? []).map((secret) => ({
+			id: credentialProjectionControl("brokered-http"),
+			enforcement,
+			locus,
+			constraints: {
+				destinations: manifestDestinations(secret),
+				guestEnvs: [secret.guestEnv]
+			}
+		})), ...(manifest.hostCapabilities ?? []).map((capability) => ({
+			id: hostCapabilityControl(capability.name),
+			enforcement,
+			locus
+		}))]
+	};
+}
+function manifestDestinations(secret) {
+	return secret.hosts.flatMap((host) => secret.ports.map((port) => ({
+		protocol: secret.protocol,
+		host,
+		port
+	})));
+}
+//#endregion
 //#region src/pi.ts
 var PI_KERNEL_TOOL_NAMES = [
 	...GONDOLIN_TOOL_NAMES,
@@ -29,7 +582,7 @@ function createPiDaemonAdapter(runtime) {
 				builtInToolNames: PI_KERNEL_TOOL_NAMES
 			});
 			const extensionTools = runtime.extensions.flatMap((extension) => extension.declaredTools);
-			return {
+			const prepared = {
 				runtimeKind: runtime.runtimeKind,
 				manifest,
 				tools: [
@@ -49,6 +602,8 @@ function createPiDaemonAdapter(runtime) {
 					resolvedVmTemplate: resolvedTemplate
 				})
 			};
+			registerRuntimeExecutionOffer(prepared, (executorFingerprint) => executionCapabilityOfferFromPiManifest(manifest, { executorFingerprint }));
+			return prepared;
 		}
 	};
 }
@@ -64,4 +619,4 @@ var defaultPiRuntimeDefinition = definePiRuntime({
 });
 var defaultPiDaemonAdapter = createPiDaemonAdapter(defaultPiRuntimeDefinition);
 //#endregion
-export { PI_KERNEL_TOOL_NAMES, createPiDaemonAdapter, defaultPiDaemonAdapter, defaultPiRuntimeDefinition };
+export { PI_KERNEL_TOOL_NAMES, cryptoService as a, createPiDaemonAdapter, defaultPiDaemonAdapter, defaultPiRuntimeDefinition, compileExecutionPlan as i, createExecutionPlanSnapshot as n, parseCredentialRequirements as r, runtimeExecutionOffer as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -56,7 +56,7 @@
     "@noble/curves": "^2.0.0",
     "@noble/ed25519": "^2.0.0",
     "@noble/hashes": "^1.7.0",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-proto": "^0.212.0",
     "@opentelemetry/exporter-trace-otlp-proto": "^0.212.0",
     "@opentelemetry/instrumentation": "^0.212.0",
@@ -78,10 +78,10 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
+    "@themoltnet/agent-runtime": "0.45.1",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/agent-runtime": "0.45.0",
-    "@themoltnet/pi-runtime": "0.12.2",
-    "@themoltnet/sdk": "0.138.0"
+    "@themoltnet/pi-runtime": "0.13.0",
+    "@themoltnet/sdk": "0.139.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -91,10 +91,12 @@
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/models": "0.1.0",
+    "@moltnet/execution-plan": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0"
   },
   "nx": {
     "projectType": "application",