@twin3-ai/agent-id 0.1.0 → 0.2.0

package/artifact-bundle.js

@@ -0,0 +1,92 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const { AUTO_MANAGED_PATHS } = require("./repository-connector.js");
+
+const SCHEMA = "agentx-signed-artifact-bundle-v0.2";
+const MAX_LIFETIME_SECONDS = 7 * 24 * 60 * 60;
+const SECRET_CONTENT = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\bak_aeo_[A-Za-z0-9_-]{6,}\b|\bav_[A-Za-z0-9_-]{8,}\b|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b)/i;
+
+function bundleError(code) {
+  const error = new Error(code);
+  error.code = code;
+  return error;
+}
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+}
+function canonical(value) { return Buffer.from(JSON.stringify(stableValue(value)), "utf8"); }
+function hash(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function sameSubject(left, right) {
+  return ["tenant_id", "host", "environment", "agent_id"].every((field) => String(left && left[field] || "") === String(right && right[field] || ""));
+}
+function keyId(key) {
+  const publicKey = key && key.type === "public" ? key : crypto.createPublicKey(key);
+  const der = publicKey.export({ type: "spki", format: "der" });
+  return `ed25519:${crypto.createHash("sha256").update(der).digest("hex").slice(0, 24)}`;
+}
+function normalizeArtifacts(artifacts) {
+  if (!Array.isArray(artifacts) || artifacts.length === 0) throw bundleError("ARTIFACT_BUNDLE_ARTIFACTS_REQUIRED");
+  const seen = new Set();
+  return artifacts.map((artifact) => {
+    const path = String(artifact && artifact.path || "").replace(/^\/+/, "");
+    const content = artifact && artifact.content;
+    if (!AUTO_MANAGED_PATHS.has(path)) throw bundleError("ARTIFACT_BUNDLE_PATH_NOT_ALLOWED");
+    if (seen.has(path)) throw bundleError("ARTIFACT_BUNDLE_DUPLICATE_PATH");
+    if (typeof content !== "string" || Buffer.byteLength(content, "utf8") > 1024 * 1024 || SECRET_CONTENT.test(content)) throw bundleError("ARTIFACT_BUNDLE_INVALID_CONTENT");
+    if (path.endsWith(".json")) {
+      try { JSON.parse(content); } catch (_error) { throw bundleError("ARTIFACT_BUNDLE_INVALID_JSON"); }
+    }
+    seen.add(path);
+    return {
+      path,
+      content_type: String(artifact.content_type || "text/plain; charset=utf-8").slice(0, 120),
+      content,
+      content_hash: hash(Buffer.from(content, "utf8"))
+    };
+  });
+}
+function unsignedBundle(bundle) {
+  const copy = { ...bundle };
+  delete copy.signature;
+  return copy;
+}
+function createArtifactBundle({ subject, artifacts, issuerPrivateKey, issuerPublicKey, source = {}, issuedAt = Math.floor(Date.now() / 1000), expiresAt = issuedAt + 3600 } = {}) {
+  if (!subject || !issuerPrivateKey || !issuerPublicKey) throw bundleError("ARTIFACT_BUNDLE_CONFIGURATION_INVALID");
+  if (!["tenant_id", "host", "environment", "agent_id"].every((field) => typeof subject[field] === "string" && subject[field])) throw bundleError("ARTIFACT_BUNDLE_SUBJECT_INVALID");
+  if (typeof source.run_id !== "string" || !source.run_id || typeof source.receipt_hash !== "string" || !/^sha256:[a-f0-9]{6,}$/i.test(source.receipt_hash)) throw bundleError("ARTIFACT_BUNDLE_SOURCE_INVALID");
+  if (!Number.isInteger(issuedAt) || !Number.isInteger(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > MAX_LIFETIME_SECONDS) throw bundleError("ARTIFACT_BUNDLE_TIME_INVALID");
+  const bundle = {
+    schema: SCHEMA,
+    bundle_version: 2,
+    subject: stableValue(subject),
+    source: { run_id: source.run_id, receipt_hash: source.receipt_hash },
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    issuer_key_id: keyId(issuerPublicKey),
+    artifacts: normalizeArtifacts(artifacts)
+  };
+  bundle.bundle_hash = hash(canonical(bundle));
+  bundle.signature = crypto.sign(null, canonical(bundle), issuerPrivateKey).toString("base64url");
+  return bundle;
+}
+function verifyArtifactBundle(bundle, { issuerPublicKey, expectedSubject, now = Math.floor(Date.now() / 1000) } = {}) {
+  if (!bundle || bundle.schema !== SCHEMA || bundle.bundle_version !== 2 || !issuerPublicKey || !bundle.signature) throw bundleError("ARTIFACT_BUNDLE_INVALID");
+  if (!sameSubject(bundle.subject, expectedSubject)) throw bundleError("ARTIFACT_BUNDLE_SUBJECT_MISMATCH");
+  if (!Number.isInteger(bundle.issued_at) || !Number.isInteger(bundle.expires_at) || now < bundle.issued_at || now >= bundle.expires_at || bundle.expires_at - bundle.issued_at > MAX_LIFETIME_SECONDS) throw bundleError("ARTIFACT_BUNDLE_EXPIRED");
+  if (bundle.issuer_key_id !== keyId(issuerPublicKey)) throw bundleError("ARTIFACT_BUNDLE_SIGNATURE_INVALID");
+  const artifacts = normalizeArtifacts(bundle.artifacts);
+  if (artifacts.some((artifact, index) => artifact.content_hash !== bundle.artifacts[index].content_hash)) throw bundleError("ARTIFACT_BUNDLE_SIGNATURE_INVALID");
+  const unsigned = unsignedBundle(bundle);
+  const claimedHash = unsigned.bundle_hash;
+  delete unsigned.bundle_hash;
+  if (claimedHash !== hash(canonical(unsigned))) throw bundleError("ARTIFACT_BUNDLE_SIGNATURE_INVALID");
+  const verificationKey = issuerPublicKey && issuerPublicKey.type === "public" ? issuerPublicKey : crypto.createPublicKey(issuerPublicKey);
+  const verified = crypto.verify(null, canonical({ ...unsigned, bundle_hash: claimedHash }), verificationKey, Buffer.from(bundle.signature, "base64url"));
+  if (!verified) throw bundleError("ARTIFACT_BUNDLE_SIGNATURE_INVALID");
+  return { verified: true, bundle_hash: claimedHash, subject: bundle.subject, artifacts: artifacts.map(({ content, ...item }) => item) };
+}
+
+module.exports = { SCHEMA, MAX_LIFETIME_SECONDS, createArtifactBundle, verifyArtifactBundle };

package/bin/agent-id.js

@@ -3,11 +3,15 @@ const { configuredEndpoint, TRUSTED_ISSUER_KEY_SHA256 } = require("../runtime-co
 const endpoint = configuredEndpoint();
 const fs = require("fs");
 const path = require("path");
-const { buildInstallPlan, resumeInstall, uninstallInstall, enterpriseInstallStatus, prepareEnterpriseSecretDirectory, writeEnterpriseBootstrapCredential, readEnterpriseBootstrapCredential, replaceEnterpriseBootstrapCredential, removeEnterpriseBootstrapCredential, writeEnterpriseEnrollmentState } = require("../installer.js");
+const { buildInstallPlan, applyInstallPlan, resumeInstall, uninstallInstall, enterpriseInstallStatus, prepareEnterpriseSecretDirectory, writeEnterpriseBootstrapCredential, readEnterpriseBootstrapCredential, replaceEnterpriseBootstrapCredential, removeEnterpriseBootstrapCredential, writeEnterpriseEnrollmentState } = require("../installer.js");
 const { buildRepositoryPatch, applyRepositoryPatch, rollbackRepositoryPatch } = require("../repository-connector.js");
+const { createRepositoryConnector } = require("../repository-connector.js");
 const { generateSiteAgentIdentity, createEnterpriseSession } = require("../enterprise-identity.js");
 const { buildWellKnownProofDocument, resolveProofTarget, writeWellKnownProofDocument } = require("../domain-proof.js");
 const { initializeLocalPolicy, loadLocalPolicy, approvePolicyRule } = require("../local-policy.js");
+const { createTaskExecutor } = require("../task-executor.js");
+const { createOptimizationLoop } = require("../optimization-loop.js");
+const crypto = require("node:crypto");
 const { verifyPortableBundle } = require("../trust-verifier.js");
 const { verifyReleaseManifest } = require("../release-verifier.js");
 const { runProductionPreflight } = require("../production-preflight.js");
@@ -62,7 +66,17 @@ async function enterpriseSessionForProject(projectRoot) {
     credential: existing.credential,
     identity
   });
-  return { root, state, session };
+  return { root, state, session, identity, credential: existing.credential };
+}
+
+async function trustedIssuerPublicKey() {
+  const response = await fetch(endpoint + "/.well-known/agentx-issuer-key.json");
+  if (!response.ok) throw new Error("enterprise issuer key unavailable");
+  const descriptor = await response.json();
+  const publicKey = String(descriptor.public_key_pem || "");
+  const actual = `sha256:${crypto.createHash("sha256").update(publicKey).digest("hex")}`;
+  if (!publicKey || actual !== TRUSTED_ISSUER_KEY_SHA256) throw new Error("enterprise issuer key pin mismatch");
+  return publicKey;
 }
 
 function printManagedResult(value) {
@@ -1364,6 +1378,8 @@ async function runCli(argv) {
       "  agent-id enterprise-managed-pause [--project-root <dir>] [--json]",
       "  agent-id enterprise-managed-resume [--project-root <dir>] [--json]",
       "  agent-id enterprise-managed-runs [--project-root <dir>] [--limit <1-100>] [--json]",
+      "  agent-id enterprise-optimize-once [--project-root <dir>] [--approve-task <task-id>] [--json]",
+      "  agent-id enterprise-rollback-once --task-id <task-id> --project-root <dir> --approve [--json]",
       "  agent-id enterprise-contract",
       "  agent-id repository-patch-plan <root> <changes-json-file>",
       "  agent-id repository-patch-apply <plan-json-file> --approve",
@@ -2533,12 +2549,19 @@ async function runCli(argv) {
       applyProof: true,
     });
     if (!enrollment.ok) throw new Error(enrollment.error || "enterprise_enrollment_failed");
+    // Enrollment creates the customer's key and publishes the proof, but the
+    // runtime that polls for work is a separate set of files. Without this the
+    // installer that writes them was never called from the CLI, so nothing was
+    // installed, install-resume always reported not_installed, and
+    // install-uninstall removed nothing because there was no state to find.
+    const receipt = await applyInstallPlan(detectedPlan, { approved: true });
     return printSignedInstallResult({
       ok: true,
       dry_run: false,
       plan,
       release: gate,
       enrollment,
+      runtime_install: receipt,
       non_claims: ["domain_verification_still_required", "shared_site_agent_key_not_used", "does_not_modify_customer_content"]
     });
   }
@@ -2737,6 +2760,55 @@ async function runCli(argv) {
       session.clear();
     }
   }
+  if (cmd === "enterprise-optimize-once") {
+    const projectRoot = readFlagValue(argv, "--project-root") || process.cwd();
+    const { root, state, session, identity, credential } = await enterpriseSessionForProject(projectRoot);
+    const policy = loadLocalPolicy(path.join(root, ".agent-id", "enterprise-policy.json"));
+    identity.subject = { tenant_id: credential.tenant_id, host: credential.host, environment: state.environment, agent_id: credential.agent_id };
+    const executor = createTaskExecutor({
+      issuerPublicKey: await trustedIssuerPublicKey(),
+      identity,
+      policy,
+      connectors: { repository_patch: createRepositoryConnector({ repositoryRoot: root }) },
+      statePath: path.join(root, ".agent-id", "executor-state.json")
+    });
+    const approvedTask = readFlagValue(argv, "--approve-task");
+    try {
+      return print(await createOptimizationLoop({ session, executor }).runOnce({ approvedTaskIds: approvedTask ? [approvedTask] : [] }));
+    } finally {
+      session.clear();
+    }
+  }
+  if (cmd === "enterprise-rollback-once") {
+    const projectRoot = readFlagValue(argv, "--project-root") || process.cwd();
+    const taskId = readFlagValue(argv, "--task-id");
+    if (!taskId) throw new Error("enterprise-rollback-once requires --task-id");
+    if (!argv.includes("--approve")) throw new Error("enterprise rollback requires --approve");
+    const { root, state, session, identity, credential } = await enterpriseSessionForProject(projectRoot);
+    const policy = loadLocalPolicy(path.join(root, ".agent-id", "enterprise-policy.json"));
+    identity.subject = { tenant_id: credential.tenant_id, host: credential.host, environment: state.environment, agent_id: credential.agent_id };
+    const executor = createTaskExecutor({
+      issuerPublicKey: await trustedIssuerPublicKey(),
+      identity,
+      policy,
+      connectors: { repository_patch: createRepositoryConnector({ repositoryRoot: root }) },
+      statePath: path.join(root, ".agent-id", "executor-state.json")
+    });
+    try {
+      const listed = await session.listTasks();
+      let task = (listed.tasks || []).find((item) => item.task_id === taskId);
+      if (!task) throw new Error("enterprise_task_not_found");
+      if (["deployed", "failed"].includes(task.state)) {
+        task = (await session.transitionTask(taskId, "rollback", task.version)).task;
+      }
+      if (task.state !== "rollback_pending") throw new Error(`enterprise_task_not_rollbackable:${task.state}`);
+      const rollbackReceipt = await executor.rollback(taskId, { approved: true, task_id: taskId });
+      const completed = await session.transitionTask(taskId, "rollback-receipt", task.version, { rollback_receipt: rollbackReceipt });
+      return print({ ok: true, task: completed.task, rollback_receipt: rollbackReceipt });
+    } finally {
+      session.clear();
+    }
+  }
   if (cmd === "repository-patch-plan") {
     const root = url;
     const changesFile = argv[2];
@@ -2790,7 +2862,7 @@ function runMcp() {
 
 async function handleMcpLine(line) {
   const msg = JSON.parse(line);
-  if (msg.method === "initialize") return send(msg.id, { protocolVersion: "2024-11-05", serverInfo: { name: "agent-id", version: "0.1.0" } });
+  if (msg.method === "initialize") return send(msg.id, { protocolVersion: "2024-11-05", serverInfo: { name: "agent-id", version: "0.2.0" } });
   if (msg.method === "tools/list") {
     const tools = [
         { name: "audit_url", description: "Audit a website for SEO/AEO/GEO/Agent readiness.", inputSchema: { type: "object", properties: { url: { type: "string" } }, required: ["url"] } },

package/enterprise-identity.js

@@ -145,6 +145,13 @@ function createEnterpriseSession({ serviceOrigin, siteUrl, environment, credenti
     return responseJson(await fetcher(`${origin}/api/site_agents/v1/managed/${pathname}`, request));
   }
 
+  async function taskRequest(pathname, { method = "GET", body = null, scopes = ["tasks:read"] } = {}) {
+    const accessToken = await session.getAccessToken(scopes);
+    const request = { method, headers: { "content-type": "application/json", authorization: `Bearer ${accessToken}` } };
+    if (body !== null) request.body = JSON.stringify(body);
+    return responseJson(await fetcher(`${origin}/api/site_agents/v1/tasks${pathname}`, request));
+  }
+
   const session = {
     schema: "agentx-enterprise-session-v1",
     site_url: site.url,
@@ -194,6 +201,26 @@ function createEnterpriseSession({ serviceOrigin, siteUrl, environment, credenti
       const bounded = Math.max(1, Math.min(Number(limit) || 20, 100));
       return managedRequest(`runs?limit=${encodeURIComponent(Math.trunc(bounded))}`);
     },
+    async listTasks() {
+      return taskRequest("");
+    },
+    async getTaskComparison(taskId) {
+      const id = encodeURIComponent(String(taskId || ""));
+      if (!id) throw enterpriseError("enterprise_task_id_required");
+      return taskRequest(`/${id}/comparison`);
+    },
+    async createTaskComparison(taskId) {
+      const id = encodeURIComponent(String(taskId || ""));
+      if (!id) throw enterpriseError("enterprise_task_id_required");
+      return taskRequest(`/${id}/comparison`, { method: "POST", scopes: ["tasks:read"], body: {} });
+    },
+    async transitionTask(taskId, action, expectedVersion, payload = {}) {
+      const id = encodeURIComponent(String(taskId || ""));
+      const supported = new Set(["propose", "approve", "execute", "reject", "receipt", "verify", "complete", "rollback", "rollback-receipt"]);
+      if (!id || !supported.has(action) || !Number.isInteger(expectedVersion)) throw enterpriseError("enterprise_task_transition_invalid");
+      const scopes = ["receipt", "rollback-receipt"].includes(action) ? ["evidence:write"] : (["verify", "complete"].includes(action) ? ["tasks:read"] : ["tasks:execute"]);
+      return taskRequest(`/${id}/${action}`, { method: "POST", scopes, body: { ...payload, expected_version: expectedVersion } });
+    },
     clear() { cachedToken = ""; cachedExpiry = 0; cachedScopes = []; }
   };
   return Object.freeze(session);

package/installer.js

@@ -169,7 +169,7 @@ async function main() {
   const observedAt = new Date().toISOString();
   const heartbeat = SYNC_MODE === "monthly" ? { skipped: true, reason: "monthly_insights_run" } : await call("site_agent_events", {
     source: "customer_owned_github_actions_runner",
-    events: [{ event: "heartbeat", url: SITE_URL, ts: Math.floor(Date.now() / 1000), data: { runtime: "github_actions", sdk_version: "0.1.0" } }]
+    events: [{ event: "heartbeat", url: SITE_URL, ts: Math.floor(Date.now() / 1000), data: { runtime: "github_actions", sdk_version: "0.2.0" } }]
   });
   const insights = SYNC_MODE === "heartbeat" ? { skipped: true, reason: "daily_heartbeat_only" } : await call("insights_feed", {
     source: "customer_owned_github_actions_runner",
@@ -300,6 +300,90 @@ function stateTemplate(plan) {
   };
 }
 
+const OPPORTUNITY_CHECKS = Object.freeze([
+  { id: "package_manifest", paths: ["package.json"] },
+  { id: "llms_txt", paths: ["llms.txt", "public/llms.txt"] },
+  { id: "robots_txt", paths: ["robots.txt", "public/robots.txt"] },
+  { id: "agent_card", paths: [".well-known/agent-card.json", "public/.well-known/agent-card.json"] },
+  { id: "agent_id", paths: [".well-known/agent-id.json", "public/.well-known/agent-id.json"] },
+  { id: "aeo_agent", paths: [".well-known/aeo-agent.json", "public/.well-known/aeo-agent.json"] },
+  { id: "agent_knowledge", paths: [".well-known/agent-knowledge.json", "public/.well-known/agent-knowledge.json"] }
+]);
+
+async function inspectAgentIdOpportunities({ projectRoot = process.cwd(), fsImpl = fs, checks = OPPORTUNITY_CHECKS } = {}) {
+  const root = normalizeProjectRoot(projectRoot);
+  const reportChecks = [];
+  for (const definition of checks) {
+    const presentPaths = [];
+    const unavailablePaths = [];
+    const unavailableErrors = {};
+    const symlinkPaths = [];
+    for (const relativePath of definition.paths) {
+      if (typeof fsImpl.lstat !== "function") {
+        unavailablePaths.push(relativePath);
+        unavailableErrors[relativePath] = "LSTAT_UNAVAILABLE";
+        continue;
+      }
+      try {
+        const candidate = path.resolve(root, relativePath);
+        const withinRoot = path.relative(root, candidate);
+        if (withinRoot === ".." || withinRoot.startsWith(`..${path.sep}`) || path.isAbsolute(withinRoot)) {
+          unavailablePaths.push(relativePath);
+          unavailableErrors[relativePath] = "PATH_ESCAPE";
+          continue;
+        }
+        const stat = await fsImpl.lstat(candidate);
+        if (stat.isSymbolicLink()) {
+          symlinkPaths.push(relativePath);
+          unavailablePaths.push(relativePath);
+          unavailableErrors[relativePath] = "SYMLINK_REJECTED";
+          continue;
+        }
+        if (typeof stat.isFile === "function" && !stat.isFile()) {
+          unavailablePaths.push(relativePath);
+          unavailableErrors[relativePath] = "NOT_REGULAR_FILE";
+          continue;
+        }
+        presentPaths.push(relativePath);
+      } catch (error) {
+        if (!error || error.code !== "ENOENT") {
+          unavailablePaths.push(relativePath);
+          unavailableErrors[relativePath] = (error && ["EACCES", "EPERM"].includes(error.code))
+            ? "PERMISSION_DENIED"
+            : "UNAVAILABLE";
+        }
+      }
+    }
+    reportChecks.push({
+      id: definition.id,
+      status: presentPaths.length ? "present" : unavailablePaths.length ? "unavailable" : "missing",
+      present_paths: presentPaths,
+      unavailable_paths: unavailablePaths,
+      unavailable_errors: unavailableErrors,
+      symlink_paths: symlinkPaths,
+      candidate_paths: [...definition.paths]
+    });
+  }
+  const present = reportChecks.filter((item) => item.status === "present").length;
+  const unavailable = reportChecks.filter((item) => item.status === "unavailable").length;
+  return {
+    schema: "agentx-local-opportunity-report-v1",
+    local_only: true,
+    source_uploaded: false,
+    secrets_scanned: false,
+    content_validated: false,
+    verified: 0,
+    checks: reportChecks,
+    symlink_policy: "skip_and_exclude",
+    summary: {
+      total: reportChecks.length,
+      present,
+      missing: reportChecks.length - present - unavailable,
+      unavailable
+    }
+  };
+}
+
 function buildInstallPlan({ url, projectRoot = process.cwd(), endpoint = DEFAULT_ENDPOINT, framework, packageManager, detected } = {}) {
   return Promise.resolve().then(async () => {
     const siteUrl = normalizeSiteUrl(url);
@@ -307,6 +391,7 @@ function buildInstallPlan({ url, projectRoot = process.cwd(), endpoint = DEFAULT
     const detectedProject = detected || await detectProject({ projectRoot: root });
     const selectedFramework = framework || detectedProject.framework;
     const selectedPackageManager = packageManager || detectedProject.package_manager;
+    const opportunityReport = await inspectAgentIdOpportunities({ projectRoot: root });
     if (!/^[a-z][a-z0-9._-]{0,31}$/.test(String(selectedFramework))) throw installError("INVALID_FRAMEWORK", "Framework identifier is invalid.");
     if (!/^[a-z][a-z0-9._-]{0,31}$/.test(String(selectedPackageManager))) throw installError("INVALID_PACKAGE_MANAGER", "Package manager identifier is invalid.");
     const parentEndpoint = String(endpoint || DEFAULT_ENDPOINT).replace(/\/+$/, "");
@@ -328,6 +413,7 @@ function buildInstallPlan({ url, projectRoot = process.cwd(), endpoint = DEFAULT
       project_root: root,
       framework: selectedFramework,
       package_manager: selectedPackageManager,
+      opportunity_report: opportunityReport,
       approval_required: true,
       side_effects: selectedFramework === "static"
         ? ["write_agent_id_namespace", "write_dedicated_github_actions_workflow"]
@@ -338,9 +424,33 @@ function buildInstallPlan({ url, projectRoot = process.cwd(), endpoint = DEFAULT
         : ["verify_domain_ownership", "install_server_package", "store_SITE_AGENT_KEY_in_server_secret_store", "start_site_agent_sync"],
       files: files.map(({ path: filePath, mode, content }) => ({ path: filePath, mode, sha256: hashText(content) }))
     };
-    base.install_id = hashText(stableJson(base)).slice(0, 24);
-    base.files[0].sha256 = hashText(JSON.stringify(stateTemplate({ ...base, files: base.files }), null, 2) + "\n");
-    return Object.freeze({ ...base, files: files.map((file, index) => ({ ...base.files[index], content: file.content })) });
+    // install_id identifies the deterministic install plan, not the mutable
+    // state file that is generated from that plan at apply time.
+    const installIdentity = {
+      schema: base.schema,
+      version: base.version,
+      site_url: base.site_url,
+      parent_endpoint: base.parent_endpoint,
+      framework: base.framework,
+      package_manager: base.package_manager,
+      approval_required: base.approval_required,
+      side_effects: base.side_effects,
+      excluded_side_effects: base.excluded_side_effects,
+      next_steps: base.next_steps,
+      files: base.files.filter((file) => file.path !== `${MANAGED_DIR}/install-state.json`)
+    };
+    base.install_id = hashText(stableJson(installIdentity)).slice(0, 24);
+    const stateContent = JSON.stringify(stateTemplate({ ...base, files: base.files }), null, 2) + "\n";
+    const stateFileIndex = base.files.findIndex((file) => file.path === `${MANAGED_DIR}/install-state.json`);
+    if (stateFileIndex < 0) throw installError("INSTALL_STATE_FILE_MISSING", "The install plan must include its managed state file.");
+    base.files[stateFileIndex].sha256 = hashText(stateContent);
+    return Object.freeze({
+      ...base,
+      files: files.map((file, index) => ({
+        ...base.files[index],
+        content: file.path === `${MANAGED_DIR}/install-state.json` ? stateContent : file.content
+      }))
+    });
   });
 }
 
@@ -708,6 +818,7 @@ module.exports = {
   buildInstallPlan,
   preflightInstallPlan,
   detectProject,
+  inspectAgentIdOpportunities,
   applyInstallPlan,
   resumeInstall,
   uninstallInstall,

package/local-policy.js

@@ -7,6 +7,7 @@ const crypto = require("node:crypto");
 const POLICY_SCHEMA = "agentx-local-policy-v1";
 const MAX_BYTES = 1024 * 1024;
 const OPERATIONS = new Set(["upsert", "replace", "delete"]);
+const APPROVAL_MODES = new Set(["auto", "review", "explicit"]);
 const SENSITIVE_PATHS = /(^|\/)(\.env(?:\.|$)|\.git|id_rsa|id_ed25519|secrets?|credentials?|private[-_.]?key|package-lock\.json)(\/|$)/i;
 const EXECUTABLE_PATHS = /\.(?:sh|bash|zsh|fish|cmd|bat|ps1|exe|dll|so|dylib|js|mjs|cjs|py|rb|php|pl)$/i;
 const SECRET_CONTENT = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:SITE_AGENT_KEY|AEO_AGENT_KEY|API_KEY|ACCESS_TOKEN|SECRET)\s*[:=]|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b)/i;
@@ -57,7 +58,7 @@ function validRule(rule) {
     && safeRelative(rule.path_prefix) && !rule.path_prefix.includes("*")
     && Array.isArray(rule.allowed_operations) && rule.allowed_operations.length > 0 && rule.allowed_operations.every((item) => OPERATIONS.has(item))
     && Number.isInteger(rule.max_bytes) && rule.max_bytes > 0 && rule.max_bytes <= MAX_BYTES
-    && rule.approval_mode === "explicit" && Number.isInteger(rule.version) && rule.version > 0;
+    && APPROVAL_MODES.has(rule.approval_mode) && Number.isInteger(rule.version) && rule.version > 0;
 }
 function approvePolicyRule(policy, rule, { approved = false, approvedBy = "", now = Math.floor(Date.now() / 1000) } = {}) {
   if (approved !== true || typeof approvedBy !== "string" || !approvedBy.trim()) throw policyError("policy_approval_required");
@@ -112,7 +113,8 @@ function authorizeTask(policy, task, currentResource) {
   for (const operation of task.operations) {
     if (!rule.allowed_operations.includes(operation.operation) || !pathWithinPrefix(operation.path, rule.path_prefix) || Buffer.byteLength(operation.value || "", "utf8") > rule.max_bytes) throw policyError("policy_denied");
   }
-  return { authorized: true, policy_version: policy.version, policy_digest: policy.digest, rule_version: rule.version, approval_mode: rule.approval_mode };
+  const decision = rule.approval_mode === "auto" ? "auto" : "review";
+  return { authorized: true, decision, policy_version: policy.version, policy_digest: policy.digest, rule_version: rule.version, approval_mode: rule.approval_mode };
 }
 
 module.exports = { POLICY_SCHEMA, initializeLocalPolicy, loadLocalPolicy, approvePolicyRule, authorizeTask };

package/optimization-loop.js

@@ -0,0 +1,48 @@
+"use strict";
+
+function loopError(code) { const error = new Error(code); error.code = code; return error; }
+
+function createOptimizationLoop({ session, executor } = {}) {
+  if (!session || !executor || typeof session.listTasks !== "function") throw loopError("OPTIMIZATION_LOOP_CONFIGURATION_INVALID");
+  async function advance(input, approvals) {
+    let task = input;
+    if (task.state === "draft") task = (await session.transitionTask(task.task_id, "propose", task.version)).task;
+    if (task.state === "proposed") {
+      const plan = await executor.plan(task);
+      if (plan.approval_required && !approvals.has(task.task_id)) return { task_id: task.task_id, status: "pending_customer_review", plan };
+      task = (await session.transitionTask(task.task_id, "approve", task.version)).task;
+    }
+    if (task.state === "approved") task = (await session.transitionTask(task.task_id, "execute", task.version)).task;
+    if (task.state === "executing") {
+      const approval = { approved: true, task_id: task.task_id, policy_digest: task.policy_digest };
+      const receipt = await executor.apply(task, approval);
+      task = (await session.transitionTask(task.task_id, "receipt", task.version, { receipt })).task;
+    }
+    if (task.state === "deployed") {
+      const result = await session.transitionTask(task.task_id, "verify", task.version, { attempt: 0 });
+      if (result.pending) return { task_id: task.task_id, status: "public_verification_pending", retry_after_seconds: result.public_result && result.public_result.retry_after_seconds || 30 };
+      task = result.task;
+    }
+    if (task.state === "verifying") task = (await session.transitionTask(task.task_id, "complete", task.version)).task;
+    let comparison = null;
+    if (task.state === "completed" && typeof session.createTaskComparison === "function") {
+      comparison = await session.createTaskComparison(task.task_id);
+    }
+    return { task_id: task.task_id, status: task.state, version: task.version, comparison_receipt_id: comparison && comparison.receipt && comparison.receipt.receipt_id || null };
+  }
+  return Object.freeze({
+    async runOnce({ approvedTaskIds = [] } = {}) {
+      const payload = await session.listTasks();
+      const approvals = new Set(approvedTaskIds.map(String));
+      const results = [];
+      for (const task of payload.tasks || []) {
+        if (["rejected", "expired", "rolled_back", "rollback_failed", "failed"].includes(task.state)) continue;
+        try { results.push(await advance(task, approvals)); }
+        catch (error) { results.push({ task_id: task.task_id, status: "error", error: String(error.code || error.message || "optimization_loop_failed") }); }
+      }
+      return { schema: "agentx-optimization-loop-run-v0.2", processed: results.length, results };
+    }
+  });
+}
+
+module.exports = { createOptimizationLoop };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twin3-ai/agent-id",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Domain-bound Agent identity, AEO evidence, and website-Agent integration SDK.",
   "license": "UNLICENSED",
   "private": false,
@@ -16,7 +16,7 @@
     "npm": ">=10"
   },
   "scripts": {
-    "prepublishOnly": "node --check bin/agent-id.js && node --check installer.js && node --check enterprise-identity.js && node --check release-verifier.js && node --check production-preflight.js"
+    "prepublishOnly": "node --check bin/agent-id.js && node --check installer.js && node --check enterprise-identity.js && node --check release-verifier.js && node --check production-preflight.js && node --check static-edge-adapter.js && node --check optimization-loop.js && node --check artifact-bundle.js"
   },
   "main": "site-agent.js",
   "exports": {
@@ -34,6 +34,9 @@
     "./trust-verifier": "./trust-verifier.js",
     "./repository-connector": "./repository-connector.js",
     "./cloudflare-worker-adapter": "./cloudflare-worker-adapter.js",
+    "./static-edge-adapter": "./static-edge-adapter.js",
+    "./optimization-loop": "./optimization-loop.js",
+    "./artifact-bundle": "./artifact-bundle.js",
     "./release-verifier": "./release-verifier.js",
     "./production-preflight": "./production-preflight.js"
   },

package/repository-connector.js

@@ -4,14 +4,15 @@ const fs = require("node:fs/promises");
 const path = require("node:path");
 const crypto = require("node:crypto");
 
-const ALLOWED_PATHS = new Set([
+const AUTO_MANAGED_PATHS = new Set([
   "llms.txt",
-  "robots.txt",
   ".well-known/agent-card.json",
   ".well-known/agent-id.json",
   ".well-known/aeo-agent.json",
   ".well-known/agent-knowledge.json"
 ]);
+const REVIEW_ONLY_PATHS = new Set(["robots.txt"]);
+const ALLOWED_PATHS = AUTO_MANAGED_PATHS;
 const SECRET_PATTERNS = [
   /\bak_aeo_[A-Za-z0-9_-]{6,}\b/,
   /\bav_[A-Za-z0-9_-]{8,}\b/,
@@ -35,6 +36,7 @@ function rootPath(value = process.cwd()) {
 
 function normalizeRelativePath(value) {
   const relative = String(value || "").replace(/\\/g, "/").replace(/^\.\//, "");
+  if (REVIEW_ONLY_PATHS.has(relative)) throw connectorError("CONNECTOR_REVIEW_ONLY_PATH", `Path requires customer-owned review and is not automatically managed: ${relative}`);
   if (!ALLOWED_PATHS.has(relative)) throw connectorError("CONNECTOR_PATH_NOT_ALLOWED", `Path is not on the connector allowlist: ${relative}`);
   return relative;
 }
@@ -157,6 +159,25 @@ async function buildImplementationPatch({ repositoryRoot = process.cwd(), implem
   });
 }
 
+async function buildVerifiedArtifactPatch({ repositoryRoot = process.cwd(), artifactBundle, issuerPublicKey, expectedSubject, now } = {}) {
+  const { verifyArtifactBundle } = require("./artifact-bundle.js");
+  const verification = verifyArtifactBundle(artifactBundle, { issuerPublicKey, expectedSubject, now });
+  const plan = await buildRepositoryPatch({
+    repositoryRoot,
+    changes: artifactBundle.artifacts.map((artifact) => ({
+      path: artifact.path,
+      content: artifact.content,
+      reason: `Signed Agent ID artifact bundle ${verification.bundle_hash}`
+    }))
+  });
+  return {
+    ...plan,
+    artifact_bundle_hash: verification.bundle_hash,
+    artifact_bundle_source: { ...artifactBundle.source },
+    artifact_bundle_expires_at: artifactBundle.expires_at
+  };
+}
+
 function validatePlan(plan, expectedRoot) {
   if (!plan || plan.schema !== "agentx-repository-patch-plan-v1" || plan.approval_required !== true) throw connectorError("CONNECTOR_INVALID_PLAN", "Invalid repository patch plan.");
   const root = rootPath(plan.repository_root);
@@ -216,6 +237,9 @@ async function applyRepositoryPatch(plan, { approved = false } = {}) {
     repository_root: root,
     applied: true,
     default_branch_push: false,
+    artifact_bundle_hash: String(plan.artifact_bundle_hash || ""),
+    artifact_bundle_source: plan.artifact_bundle_source ? { ...plan.artifact_bundle_source } : null,
+    artifact_bundle_expires_at: Number(plan.artifact_bundle_expires_at || 0),
     applied_changes: appliedChanges,
     rollback_entries: rollbackEntries
   };
@@ -249,13 +273,16 @@ async function rollbackRepositoryPatch(receiptOrRoot, { approved = false } = {})
     else await fs.rm(absolute, { force: true });
     restored.push({ path: relative, before_sha256: item.before_sha256 });
   }
-  return { schema: "agentx-repository-rollback-receipt-v1", connector: "repository_patch", plan_id: receipt.plan_id || "", rolled_back: true, files: restored };
+  return { schema: "agentx-repository-rollback-receipt-v1", connector: "repository_patch", plan_id: receipt.plan_id || "", artifact_bundle_hash: String(receipt.artifact_bundle_hash || ""), rolled_back: true, files: restored };
 }
 
 module.exports = {
   ALLOWED_PATHS,
+  AUTO_MANAGED_PATHS,
+  REVIEW_ONLY_PATHS,
   buildRepositoryPatch,
   buildImplementationPatch,
+  buildVerifiedArtifactPatch,
   deploymentChanges,
   applyRepositoryPatch,
   rollbackRepositoryPatch,

package/site-agent.js

@@ -362,7 +362,7 @@ function createSiteAgentClient(options = {}) {
           ts: payload.ts == null ? Math.floor(Date.now() / 1000) : payload.ts,
           data: {
             runtime: payload.runtime || "server_side_site_agent",
-            sdk_version: payload.sdk_version || payload.sdkVersion || "0.1.0"
+            sdk_version: payload.sdk_version || payload.sdkVersion || "0.2.0"
           }
         }]
       });
@@ -379,7 +379,7 @@ function createSiteAgentClient(options = {}) {
               ts: payload.ts == null ? Math.floor(Date.now() / 1000) : payload.ts,
               data: {
                 runtime: payload.runtime || "server_side_site_agent",
-                sdk_version: payload.sdk_version || payload.sdkVersion || "0.1.0"
+                sdk_version: payload.sdk_version || payload.sdkVersion || "0.2.0"
               }
             }]
           });

package/static-edge-adapter.js

@@ -0,0 +1,115 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const { AUTO_MANAGED_PATHS } = require("./repository-connector.js");
+const SECRET_CONTENT = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\bak_aeo_[A-Za-z0-9_-]{6,}\b|\bav_[A-Za-z0-9_-]{8,}\b|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b)/i;
+
+function edgeError(code) { const error = new Error(code); error.code = code; return error; }
+function hashText(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function normalizePath(value) {
+  const path = String(value || "").replace(/^\/+/, "");
+  if (!AUTO_MANAGED_PATHS.has(path)) throw edgeError("EDGE_PATH_NOT_ALLOWED");
+  return path;
+}
+function assertPublicAsset(path, content) {
+  if (typeof content !== "string" || Buffer.byteLength(content, "utf8") > 1024 * 1024 || SECRET_CONTENT.test(content)) throw edgeError("EDGE_CONTENT_INVALID");
+  if (path.endsWith(".json")) {
+    try { JSON.parse(content); } catch (_error) { throw edgeError("EDGE_JSON_INVALID"); }
+  }
+}
+function createMemoryAssetStore(initial = {}) {
+  const values = new Map(Object.entries(initial));
+  return Object.freeze({
+    async get(key) { return values.has(key) ? structuredClone(values.get(key)) : null; },
+    async put(key, value) { values.set(key, structuredClone(value)); },
+    async delete(key) { values.delete(key); },
+    async list() { return [...values.keys()].sort(); }
+  });
+}
+function createStaticEdgeConnector({ store, verifiedRoutes = [...AUTO_MANAGED_PATHS] } = {}) {
+  if (!store || !["get", "put", "delete"].every((name) => typeof store[name] === "function")) throw edgeError("EDGE_STORE_REQUIRED");
+  const allowed = new Set(verifiedRoutes.map(normalizePath));
+  return Object.freeze({
+    describeCapabilities() {
+      return { connector: "static_edge", operations: ["upsert", "replace", "delete"], paths: [...allowed].sort(), customer_site_write_access: false };
+    },
+    async readResource(resource) {
+      const path = normalizePath(resource && resource.path);
+      if (!allowed.has(path)) throw edgeError("EDGE_ROUTE_NOT_VERIFIED");
+      const current = await store.get(path);
+      return { connector: "static_edge", environment: String(resource.environment || "production"), resource_type: "route", resource_id: String(resource.resource_id || path), path, content: current && current.content || null, sha256: current && current.sha256 || "" };
+    },
+    async planOperations(task, currentResource) {
+      if (!task || !Array.isArray(task.operations) || !task.operations.length) throw edgeError("EDGE_OPERATIONS_REQUIRED");
+      const changes = task.operations.map((operation) => {
+        const path = normalizePath(operation.path);
+        if (!allowed.has(path) || path !== currentResource.path) throw edgeError("EDGE_ROUTE_NOT_VERIFIED");
+        if (!["upsert", "replace", "delete"].includes(operation.operation)) throw edgeError("EDGE_OPERATION_NOT_SUPPORTED");
+        const content = operation.operation === "delete" ? "" : operation.value;
+        assertPublicAsset(path, content);
+        if (operation.expected_hash !== currentResource.sha256) throw edgeError("EDGE_STALE_RESOURCE");
+        return { path, operation: operation.operation, before_sha256: currentResource.sha256, after_sha256: operation.operation === "delete" ? "" : hashText(content), after_content: content, content_type: path.endsWith(".json") ? "application/json; charset=utf-8" : "text/plain; charset=utf-8" };
+      });
+      return { schema: "agentx-static-edge-plan-v1", approval_required: true, customer_site_write_access: false, changes };
+    },
+    async applyOperations(plan) {
+      if (!plan || plan.schema !== "agentx-static-edge-plan-v1") throw edgeError("EDGE_PLAN_INVALID");
+      const rollbackEntries = [];
+      for (const change of plan.changes) {
+        const current = await store.get(change.path);
+        const currentHash = current && current.sha256 || "";
+        if (currentHash !== change.before_sha256) throw edgeError("EDGE_STALE_RESOURCE");
+        rollbackEntries.push({ path: change.path, before: current, after_sha256: change.after_sha256 });
+      }
+      const applied = [];
+      try {
+        for (const change of plan.changes) {
+          if (change.operation === "delete") await store.delete(change.path);
+          else await store.put(change.path, { content: change.after_content, content_type: change.content_type, sha256: change.after_sha256, updated_at: Date.now() });
+          applied.push(change.path);
+        }
+      } catch (error) {
+        for (const item of rollbackEntries.filter((entry) => applied.includes(entry.path)).reverse()) {
+          if (item.before) await store.put(item.path, item.before);
+          else await store.delete(item.path);
+        }
+        throw error;
+      }
+      return { schema: "agentx-static-edge-receipt-v1", connector: "static_edge", applied_changes: plan.changes.map(({ after_content, ...change }) => change), rollback_entries: rollbackEntries, customer_site_write_access: false };
+    },
+    async verifyLocalResult(receipt) {
+      for (const change of receipt.applied_changes || []) {
+        const current = await store.get(change.path);
+        const currentHash = current && current.sha256 || "";
+        if (currentHash !== change.after_sha256) throw edgeError("EDGE_VERIFY_FAILED");
+      }
+      return { verified: true };
+    },
+    async rollback(receipt) {
+      if (!receipt || receipt.schema !== "agentx-static-edge-receipt-v1") throw edgeError("EDGE_ROLLBACK_RECEIPT_INVALID");
+      for (const item of receipt.rollback_entries || []) {
+        const current = await store.get(item.path);
+        if ((current && current.sha256 || "") !== item.after_sha256) throw edgeError("EDGE_ROLLBACK_CONFLICT");
+      }
+      for (const item of [...(receipt.rollback_entries || [])].reverse()) {
+        if (item.before) await store.put(item.path, item.before);
+        else await store.delete(item.path);
+      }
+      return { schema: "agentx-static-edge-rollback-receipt-v1", connector: "static_edge", rolled_back: true, paths: (receipt.rollback_entries || []).map((item) => item.path) };
+    }
+  });
+}
+function createStaticEdgeHandler({ store } = {}) {
+  if (!store || typeof store.get !== "function") throw edgeError("EDGE_STORE_REQUIRED");
+  return async function handle(request) {
+    const method = String(request && request.method || "GET").toUpperCase();
+    if (!['GET', 'HEAD'].includes(method)) return new Response("Method Not Allowed", { status: 405, headers: { Allow: "GET, HEAD" } });
+    let path;
+    try { path = normalizePath(new URL(request.url).pathname); } catch (_error) { return new Response("Not Found", { status: 404 }); }
+    const asset = await store.get(path);
+    if (!asset) return new Response("Not Found", { status: 404 });
+    return new Response(method === "HEAD" ? null : asset.content, { status: 200, headers: { "Content-Type": asset.content_type, "Cache-Control": "public, max-age=300", "ETag": `\"${asset.sha256}\"`, "X-Agent-ID-Managed": "true", "X-Content-Type-Options": "nosniff" } });
+  };
+}
+
+module.exports = { createMemoryAssetStore, createStaticEdgeConnector, createStaticEdgeHandler };

package/sync-service.js

@@ -125,7 +125,7 @@ function createSiteAgentSyncService(options = {}) {
   const intervalMs = Math.max(1000, Number(options.intervalMs || process.env.AGENT_ID_SYNC_INTERVAL_MS || 900000));
   const heartbeatIntervalMs = Math.max(300000, Number(options.heartbeatIntervalMs || process.env.AGENT_ID_HEARTBEAT_INTERVAL_MS || options.intervalMs || 900000));
   const collector = options.collector || null;
-  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.1.0");
+  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.2.0");
   const capabilities = Array.from(new Set((Array.isArray(options.capabilities) ? options.capabilities : ["heartbeat", "insights_feed"]).map((item) => String(item).trim()).filter(Boolean))).sort();
   const now = options.now || Date.now;
   const sleep = options.sleep || ((ms, signal) => new Promise((resolve) => {

package/task-executor.js

@@ -15,6 +15,44 @@ function stableValue(value) {
 }
 function canonical(value) { return Buffer.from(JSON.stringify(stableValue(value)), "utf8"); }
 function hash(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function rollbackEvidence(connectorReceipt) {
+  if (!connectorReceipt || typeof connectorReceipt !== "object" || connectorReceipt.rolled_back !== true) {
+    throw executorError("rollback_not_confirmed");
+  }
+  return {
+    schema: String(connectorReceipt.schema || ""),
+    connector: String(connectorReceipt.connector || ""),
+    plan_id: String(connectorReceipt.plan_id || ""),
+    artifact_bundle_hash: String(connectorReceipt.artifact_bundle_hash || ""),
+    rolled_back: true,
+    files: Array.isArray(connectorReceipt.files)
+      ? connectorReceipt.files.map((item) => ({
+        path: String(item && (item.path || item.relative_path) || ""),
+        before_sha256: String(item && item.before_sha256 || "")
+      }))
+      : [],
+    paths: Array.isArray(connectorReceipt.paths) ? connectorReceipt.paths.map((item) => String(item)) : []
+  };
+}
+function signedRollbackReceipt({ task, subject, originalReceipt, connectorReceipt, privateKey, now }) {
+  const connectorRollbackReceipt = rollbackEvidence(connectorReceipt);
+  const payload = {
+    schema: "agentx-customer-rollback-receipt-v1",
+    receipt_nonce: crypto.randomUUID(),
+    task_id: task.task_id,
+    subject,
+    connector: task.connector,
+    policy_digest: task.policy_digest,
+    resource: task.resource,
+    original_receipt_hash: String(originalReceipt && originalReceipt.receipt_hash || ""),
+    connector_rollback_hash: hash(canonical(connectorRollbackReceipt)),
+    connector_rollback_receipt: connectorRollbackReceipt,
+    rolled_back: true,
+    rolled_back_at: Number(now),
+  };
+  const signature = crypto.sign(null, canonical(payload), privateKey).toString("base64url");
+  return { ...payload, signature, receipt_hash: hash(canonical({ ...payload, signature })) };
+}
 function exactSubject(left, right) {
   return ["tenant_id","host","environment","agent_id"].every((field) => String(left && left[field] || "") === String(right && right[field] || ""));
 }
@@ -69,23 +107,28 @@ function createTaskExecutor({ issuerPublicKey, identity, policy, connectors, sta
       environment: task.subject.environment,
       operations: task.operations.map((operation) => ({ ...operation, operation: operation.op }))
     };
-    authorizeTask(policy, policyTask, current);
+    const authorization = authorizeTask(policy, policyTask, current);
     const plan = await connector.planOperations(policyTask, current);
-    return { connector, current, plan, policyTask };
+    return { connector, current, plan, policyTask, authorization };
   }
   return Object.freeze({
     async plan(task) {
       const prepared = await prepare(task);
       runtime.set(task.task_id, { task, ...prepared });
-      state.tasks[task.task_id] = { task_id: task.task_id, connector: task.connector, idempotency_key: task.idempotency_key, state: "planned", policy_digest: task.policy_digest, envelope_hash: hash(canonical(Object.fromEntries(SIGNED_FIELDS.map((field) => [field, task[field]])))) };
+      state.tasks[task.task_id] = { task_id: task.task_id, connector: task.connector, idempotency_key: task.idempotency_key, resource: task.resource, state: "planned", policy_digest: task.policy_digest, envelope_hash: hash(canonical(Object.fromEntries(SIGNED_FIELDS.map((field) => [field, task[field]])))) };
       persist();
-      return { schema: "agentx-local-execution-plan-v1", task_id: task.task_id, connector: task.connector, approval_required: true, plan_hash: hash(canonical(prepared.plan)), changes: prepared.plan.changes.map(({ after_content, rollback_entries, ...item }) => item) };
+      return { schema: "agentx-local-execution-plan-v1", task_id: task.task_id, connector: task.connector, decision: prepared.authorization.decision, approval_required: prepared.authorization.decision !== "auto", plan_hash: hash(canonical(prepared.plan)), changes: prepared.plan.changes.map(({ after_content, rollback_entries, ...item }) => item) };
     },
     async apply(task, approval = {}) {
       const existing = state.tasks[task.task_id];
-      if (existing && existing.state === "deployed" && existing.result) return existing.result;
-      if (approval.approved !== true || approval.task_id !== task.task_id || approval.policy_digest !== policy.digest) throw executorError("approval_required");
+      if (existing && existing.state === "deployed" && existing.result) {
+        const connector = connectors && connectors[task.connector];
+        if (!connector) throw executorError("unknown_connector");
+        if (existing.connector_receipt) runtime.set(task.task_id, { task, connector, connectorReceipt: existing.connector_receipt });
+        return existing.result;
+      }
       const prepared = runtime.get(task.task_id) || { task, ...(await prepare(task)) };
+      if (prepared.authorization.decision !== "auto" && (approval.approved !== true || approval.task_id !== task.task_id || approval.policy_digest !== policy.digest)) throw executorError("approval_required");
       const receipt = await prepared.connector.applyOperations(prepared.plan);
       await prepared.connector.verifyLocalResult(receipt);
       const appliedResource = (receipt.applied_changes || []).find((item) => item.path === task.resource.path) || {};
@@ -105,20 +148,47 @@ function createTaskExecutor({ issuerPublicKey, identity, policy, connectors, sta
       const privateKey = crypto.createPrivateKey(fs.readFileSync(identity.key_path, "utf8"));
       publicReceipt.signature = crypto.sign(null, canonical(publicReceipt), privateKey).toString("base64url");
       publicReceipt.receipt_hash = hash(canonical(publicReceipt));
-      state.tasks[task.task_id] = { ...state.tasks[task.task_id], state: "deployed", receipt_hash: publicReceipt.receipt_hash, result: publicReceipt };
+      state.tasks[task.task_id] = {
+        ...state.tasks[task.task_id],
+        state: "deployed",
+        receipt_hash: publicReceipt.receipt_hash,
+        result: publicReceipt,
+        connector_receipt: receipt,
+      };
       runtime.set(task.task_id, { ...prepared, connectorReceipt: receipt });
       persist();
       return publicReceipt;
     },
     async rollback(taskId, approval = {}) {
       if (approval.approved !== true || approval.task_id !== taskId) throw executorError("approval_required");
-      const prepared = runtime.get(taskId);
       const taskState = state.tasks[taskId];
+      const prepared = runtime.get(taskId) || {
+        task: {
+          task_id: taskId,
+          connector: taskState && taskState.connector,
+          policy_digest: taskState && taskState.policy_digest,
+          subject: identity.subject,
+          resource: taskState && taskState.resource,
+        },
+        connector: connectors && connectors[taskState && taskState.connector],
+        connectorReceipt: taskState && taskState.connector_receipt,
+      };
       if (!taskState || taskState.state !== "deployed") throw executorError("rollback_receipt_unavailable");
+      if (!taskState.connector_receipt) throw executorError("rollback_receipt_unavailable");
       const connector = prepared && prepared.connector || connectors && connectors[taskState.connector];
       if (!connector) throw executorError("unknown_connector");
-      const receipt = await connector.rollback(prepared && prepared.connectorReceipt);
-      state.tasks[taskId] = { ...taskState, state: "rolled_back", rollback_receipt_hash: hash(canonical(receipt)) };
+      const connectorReceipt = await connector.rollback(prepared && prepared.connectorReceipt);
+      rollbackEvidence(connectorReceipt);
+      const privateKey = crypto.createPrivateKey(fs.readFileSync(identity.key_path, "utf8"));
+      const receipt = signedRollbackReceipt({
+        task: prepared.task,
+        subject: identity.subject,
+        originalReceipt: taskState.result,
+        connectorReceipt,
+        privateKey,
+        now: now(),
+      });
+      state.tasks[taskId] = { ...taskState, state: "rolled_back", rollback_receipt_hash: receipt.receipt_hash };
       persist();
       return receipt;
     },