agent-embassy 1.6.0 → 1.7.0

package/dist/src/gateway/store.js

@@ -6,9 +6,8 @@ import path from "node:path";
 import { BridgeError } from "../errors.js";
 import { KeyedMutex } from "../mutex.js";
 import { isCodexRegistrationGeneration } from "./codex-registration-generation.js";
-import { compatibilityCacheKey, isCompatibilityAttestation, isPersistedCompatibilityAttestation, } from "./compatibility.js";
 import { PROGRESS_WATCH_DEFAULT_CAPACITY, PROGRESS_WATCH_HARD_CAPACITY, PROGRESS_WATCH_MAX_IDLE_MS, PROGRESS_WATCH_MIN_IDLE_MS, commitProgressWatchNudge, createProgressWatch, deferProgressWatchNudge, inspectProgressWatchDue, progressWatchJournalKinds, recordProgressWatchActivity, } from "./progress-watch-machine.js";
-import { CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY, CODEX_ORPHAN_REMOVAL_JOURNAL_CAPACITY, compatibilityStates, connectorHealthStates, deliveryStates, gatewayPublicSnapshotLimits, gatewayProviders, messageDirections, projectGatewayPublicSnapshot, routeRegistrationModes, routeStates, } from "./types.js";
+import { CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY, CODEX_ORPHAN_REMOVAL_JOURNAL_CAPACITY, connectorHealthStates, directionId, deliveryStates, gatewayPublicSnapshotLimits, gatewayProviders, gatewayRegistrationIngressPrefixes, messageDirections, parseDirection, projectGatewayPublicSnapshot, routeRegistrationModes, routeStates, } from "./types.js";
 const STATE_MARKER = ".agent-embassy-state";
 const STATE_MARKER_CONTENT = "agent-embassy-state-v1\n";
 const STATE_FILE = "gateway-state.json";
@@ -17,7 +16,6 @@ const MAX_MARKER_FILE_BYTES = 128;
 const MAX_LOCK_FILE_BYTES = 4 * 1024;
 export const GATEWAY_MAX_STATE_FILE_BYTES = 8 * 1024 * 1024;
 const DEFAULT_RETAINED_BODY_BYTES = 1 * 1024 * 1024;
-const COMPATIBILITY_ATTESTATION_CAPACITY = 16;
 const ALIAS_PATTERN = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
 const HOST_PATTERN = /^[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
 const PRIVATE_TOKEN_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
@@ -39,7 +37,6 @@ class PostRenamePersistenceError extends BridgeError {
 }
 const PROVIDERS = new Set(gatewayProviders);
 const CONNECTOR_HEALTH = new Set(connectorHealthStates);
-const COMPATIBILITY = new Set(compatibilityStates);
 const ROUTE_STATES = new Set(routeStates);
 const REGISTRATION_MODES = new Set(routeRegistrationModes);
 const DIRECTIONS = new Set(messageDirections);
@@ -221,7 +218,6 @@ function isRouteRecord(value) {
             "registrationMode",
             "enabled",
             "state",
-            "compatibility",
             "busyPolicy",
             "registeredAt",
             "updatedAt",
@@ -238,8 +234,6 @@ function isRouteRecord(value) {
         typeof value.enabled === "boolean" &&
         typeof value.state === "string" &&
         ROUTE_STATES.has(value.state) &&
-        typeof value.compatibility === "string" &&
-        COMPATIBILITY.has(value.compatibility) &&
         value.busyPolicy === "queue" &&
         isIsoTimestamp(value.registeredAt) &&
         isIsoTimestamp(value.updatedAt) &&
@@ -248,23 +242,19 @@ function isRouteRecord(value) {
         isRouteCounters(value.counters) &&
         (value.safeErrorCode === undefined || isSafeCode(value.safeErrorCode)));
 }
-function isPairRecord(value) {
+function isConsentEndpoint(value) {
     return (isObject(value) &&
-        hasOnlyKeys(value, [
-            "claudeAlias",
-            "codexAlias",
-            "claudeOwnerLease",
-            "codexOwnerLease",
-            "createdAt",
-            "updatedAt",
-            "counters",
-        ]) &&
-        typeof value.claudeAlias === "string" &&
-        ALIAS_PATTERN.test(value.claudeAlias) &&
-        typeof value.codexAlias === "string" &&
-        ALIAS_PATTERN.test(value.codexAlias) &&
-        isPrivateToken(value.claudeOwnerLease) &&
-        isPrivateToken(value.codexOwnerLease) &&
+        hasOnlyKeys(value, ["alias", "provider", "ownerLease"]) &&
+        typeof value.alias === "string" && ALIAS_PATTERN.test(value.alias) &&
+        typeof value.provider === "string" && PROVIDERS.has(value.provider) &&
+        isPrivateToken(value.ownerLease));
+}
+function isConsentEdgeRecord(value) {
+    return (isObject(value) &&
+        hasOnlyKeys(value, ["endpoints", "createdAt", "updatedAt", "counters"]) &&
+        Array.isArray(value.endpoints) &&
+        value.endpoints.length === 2 &&
+        value.endpoints.every(isConsentEndpoint) &&
         isIsoTimestamp(value.createdAt) &&
         isIsoTimestamp(value.updatedAt) &&
         isRouteCounters(value.counters));
@@ -277,15 +267,16 @@ function progressWatchPairKey(watch) {
         .sort()
         .join("\0");
 }
-function progressWatchMatchesPair(watch, pair) {
-    return ((watch.ownerAlias === pair.claudeAlias &&
-        watch.ownerLease === pair.claudeOwnerLease &&
-        watch.workerAlias === pair.codexAlias &&
-        watch.workerLease === pair.codexOwnerLease) ||
-        (watch.ownerAlias === pair.codexAlias &&
-            watch.ownerLease === pair.codexOwnerLease &&
-            watch.workerAlias === pair.claudeAlias &&
-            watch.workerLease === pair.claudeOwnerLease));
+function progressWatchMatchesConsentEdge(watch, pair) {
+    const [left, right] = pair.endpoints;
+    return ((watch.ownerAlias === left.alias &&
+        watch.ownerLease === left.ownerLease &&
+        watch.workerAlias === right.alias &&
+        watch.workerLease === right.ownerLease) ||
+        (watch.ownerAlias === right.alias &&
+            watch.ownerLease === right.ownerLease &&
+            watch.workerAlias === left.alias &&
+            watch.workerLease === left.ownerLease));
 }
 function progressWatchJournalEvent(watch, timestamp, transition) {
     return {
@@ -459,11 +450,10 @@ function isProgressWatchJournalEvent(value) {
         return value.actor === "gateway" || value.actor === "operator";
     }
     if (value.reason === "idle_timeout" ||
-        value.reason === "tracking_disabled" ||
-        value.reason === "legacy_upgrade") {
+        value.reason === "tracking_disabled") {
         return value.actor === "gateway";
     }
-    return value.reason === "legacy_done" && value.actor === "unknown";
+    return false;
 }
 function isConnectorRecord(value) {
     if (!isObject(value) ||
@@ -472,7 +462,6 @@ function isConnectorRecord(value) {
             "hostId",
             "endpointGeneration",
             "health",
-            "compatibility",
             "protocol",
             "protocolVersion",
             "updatedAt",
@@ -486,8 +475,6 @@ function isConnectorRecord(value) {
     }) &&
         typeof value.health === "string" &&
         CONNECTOR_HEALTH.has(value.health) &&
-        typeof value.compatibility === "string" &&
-        COMPATIBILITY.has(value.compatibility) &&
         typeof value.protocol === "string" &&
         PROTOCOL_PATTERN.test(value.protocol) &&
         typeof value.protocolVersion === "string" &&
@@ -628,444 +615,6 @@ function isAccounting(value) {
     }
     return Object.values(value).every(isNonNegativeInteger);
 }
-const PRE_UNCONFIRMED_ROUTE_COUNTER_KEYS = [
-    "accepted",
-    "delivered",
-    "failed",
-    "ambiguous",
-    "expired",
-    "cancelled",
-    "abandoned",
-    "rejected",
-    "bytesAccepted",
-];
-const PRE_UNCONFIRMED_ACCOUNTING_KEYS = [
-    "accepted",
-    "duplicates",
-    "delivered",
-    "failed",
-    "ambiguous",
-    "expired",
-    "cancelled",
-    "abandoned",
-    "rejected",
-    "bytesAccepted",
-    "queuedBytes",
-];
-/**
- * One narrow migration for unpublished dogfood state created before the
- * `unconfirmed` terminal outcome existed. Atomic state replacement means a
- * valid old file has either every old counter shape or none of them; mixed or
- * otherwise unfamiliar shapes continue to fail strict validation.
- */
-function migratePreUnconfirmedCounters(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !isObject(value.accounting) ||
-        !hasOnlyKeys(value.accounting, PRE_UNCONFIRMED_ACCOUNTING_KEYS) ||
-        Object.hasOwn(value.accounting, "unconfirmed") ||
-        !Array.isArray(value.routes) ||
-        !value.routes.every((route) => isObject(route) &&
-            isObject(route.counters) &&
-            hasOnlyKeys(route.counters, PRE_UNCONFIRMED_ROUTE_COUNTER_KEYS) &&
-            !Object.hasOwn(route.counters, "unconfirmed"))) {
-        return value;
-    }
-    return {
-        ...value,
-        accounting: { ...value.accounting, unconfirmed: 0 },
-        routes: value.routes.map((route) => {
-            const record = route;
-            return {
-                ...record,
-                counters: {
-                    ...record.counters,
-                    unconfirmed: 0,
-                },
-            };
-        }),
-    };
-}
-const PRE_SUCCESSION_JOURNAL_STATE_KEYS = [
-    "schemaVersion",
-    "createdAt",
-    "updatedAt",
-    "eventSequence",
-    "routes",
-    "connectors",
-    "queue",
-    "inFlight",
-    "events",
-    "dedupe",
-    "rateBuckets",
-    "accounting",
-];
-/** Add the nullable internal journal to exact legacy v1 state only. */
-function migratePreSuccessionJournal(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_SUCCESSION_JOURNAL_STATE_KEYS)) {
-        return value;
-    }
-    return { ...value, codexSuccession: null };
-}
-const PRE_PAIR_GRAPH_STATE_KEYS = [
-    ...PRE_SUCCESSION_JOURNAL_STATE_KEYS,
-    "codexSuccession",
-];
-/**
- * Preserve the old explicit singleton-selection consent when adding the pair
- * graph. This migration accepts only the exact prior v1 top-level shape; final
- * state validation still proves every route, lease, host, and edge.
- */
-function migratePrePairGraph(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_PAIR_GRAPH_STATE_KEYS) ||
-        !Array.isArray(value.routes) ||
-        !isIsoTimestamp(value.updatedAt)) {
-        return value;
-    }
-    const routes = value.routes.filter(isObject);
-    const claudeRoutes = routes.filter((route) => route.registrationMode === "selected_live_peer" &&
-        isObject(route.binding) &&
-        route.binding.provider === "claude");
-    const codexRoutes = routes.filter((route) => route.registrationMode === "explicit_opt_in" &&
-        isObject(route.binding) &&
-        route.binding.provider === "codex");
-    const pairs = [];
-    for (const claude of claudeRoutes) {
-        for (const codex of codexRoutes) {
-            const claudeBinding = claude.binding;
-            const codexBinding = codex.binding;
-            if (claudeBinding.hostId !== codexBinding.hostId ||
-                typeof claude.alias !== "string" ||
-                typeof codex.alias !== "string" ||
-                typeof claudeBinding.ownerLease !== "string" ||
-                typeof codexBinding.ownerLease !== "string") {
-                continue;
-            }
-            pairs.push({
-                claudeAlias: claude.alias,
-                codexAlias: codex.alias,
-                claudeOwnerLease: claudeBinding.ownerLease,
-                codexOwnerLease: codexBinding.ownerLease,
-                createdAt: value.updatedAt,
-                updatedAt: value.updatedAt,
-                counters: emptyCounters(),
-            });
-        }
-    }
-    if (pairs.length > 256)
-        return value;
-    return { ...value, pairs };
-}
-const PRE_PROGRESS_WATCH_STATE_KEYS = [
-    ...PRE_PAIR_GRAPH_STATE_KEYS,
-    "pairs",
-];
-/** Add empty opt-in watch state to the exact preceding v1 schema only. */
-function migratePreProgressWatches(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_PROGRESS_WATCH_STATE_KEYS)) {
-        return value;
-    }
-    return {
-        ...value,
-        watchSequence: 0,
-        progressWatches: [],
-        progressWatchEvents: [],
-    };
-}
-const PRE_COMPATIBILITY_ATTESTATION_STATE_KEYS = [
-    ...PRE_PROGRESS_WATCH_STATE_KEYS,
-    "watchSequence",
-    "progressWatches",
-    "progressWatchEvents",
-];
-/** Add an empty compatibility cache to the exact preceding v1 schema only. */
-function migratePreCompatibilityAttestations(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_COMPATIBILITY_ATTESTATION_STATE_KEYS)) {
-        return value;
-    }
-    return { ...value, compatibilityAttestations: [] };
-}
-const PRE_CODEX_ENDPOINT_REFRESH_STATE_KEYS = [
-    ...PRE_COMPATIBILITY_ATTESTATION_STATE_KEYS,
-    "compatibilityAttestations",
-];
-/** Add an empty bounded private endpoint-refresh journal to exact legacy v1. */
-function migratePreCodexEndpointRefreshJournal(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_CODEX_ENDPOINT_REFRESH_STATE_KEYS)) {
-        return value;
-    }
-    return {
-        ...value,
-        codexEndpointRefreshSequence: 0,
-        codexEndpointRefreshEvents: [],
-    };
-}
-const PRE_CODEX_ORPHAN_REMOVAL_STATE_KEYS = [
-    ...PRE_CODEX_ENDPOINT_REFRESH_STATE_KEYS,
-    "codexEndpointRefreshSequence",
-    "codexEndpointRefreshEvents",
-];
-/** Add an empty private orphan-removal journal to exact preceding v1 state. */
-function migratePreCodexOrphanRemovalJournal(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !hasOnlyKeys(value, PRE_CODEX_ORPHAN_REMOVAL_STATE_KEYS)) {
-        return value;
-    }
-    return {
-        ...value,
-        codexOrphanRemovalSequence: 0,
-        codexOrphanRemovalEvents: [],
-    };
-}
-/**
- * v1.2.0 persisted hop counters on queue, in-flight, and event rows. Hop
- * policy no longer exists; accept only the old bounded shape and discard the
- * obsolete field before strict current-schema validation and persistence.
- */
-function migrateLegacyHopCounts(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !Array.isArray(value.queue) ||
-        !Array.isArray(value.inFlight) ||
-        !Array.isArray(value.events)) {
-        return value;
-    }
-    const strip = (entry) => {
-        if (!isObject(entry) || !Object.hasOwn(entry, "hopCount"))
-            return entry;
-        if (!isNonNegativeInteger(entry.hopCount) || entry.hopCount > 64) {
-            return entry;
-        }
-        const { hopCount: _legacyHopCount, ...current } = entry;
-        return current;
-    };
-    return {
-        ...value,
-        queue: value.queue.map(strip),
-        inFlight: value.inFlight.map(strip),
-        events: value.events.map(strip),
-    };
-}
-function isLegacyCompatibilityCertification(value) {
-    if (!isObject(value))
-        return false;
-    const required = ["depth", "outcome", "certifiedAt"];
-    if (!hasOnlyKeys(value, required, ["safeErrorCode"]))
-        return false;
-    if ((value.depth !== "wire" &&
-        value.depth !== "thread_ops" &&
-        value.depth !== "turn") ||
-        (value.outcome !== "pass" && value.outcome !== "fail") ||
-        !isIsoTimestamp(value.certifiedAt) ||
-        new Date(Date.parse(value.certifiedAt)).toISOString() !==
-            value.certifiedAt ||
-        (value.safeErrorCode !== undefined && !isSafeCode(value.safeErrorCode))) {
-        return false;
-    }
-    return (value.outcome === "pass") === (value.safeErrorCode === undefined);
-}
-/**
- * v1.1-v1.2 compatibility rows could contain manual live-certification
- * evidence. Discard only an exact old certification, retain the automatic
- * bounded probes as schema-attested evidence, and leave malformed rows
- * untouched for strict state validation to reject.
- */
-function migrateLegacyCompatibilityCertifications(value) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !Array.isArray(value.compatibilityAttestations)) {
-        return value;
-    }
-    let changed = false;
-    const compatibilityAttestations = value.compatibilityAttestations.map((entry) => {
-        let candidate = entry;
-        if (isObject(entry) &&
-            Object.hasOwn(entry, "certification") &&
-            isLegacyCompatibilityCertification(entry.certification)) {
-            const { certification: _legacyCertification, ...current } = entry;
-            candidate =
-                current.tier === "certified"
-                    ? { ...current, tier: "schema_attested" }
-                    : current;
-        }
-        if (!isPersistedCompatibilityAttestation(candidate))
-            return entry;
-        if (candidate !== entry)
-            changed = true;
-        return candidate;
-    });
-    return changed ? { ...value, compatibilityAttestations } : value;
-}
-function legacyProgressWatchGraphIsValid(value, watches) {
-    if (!isObject(value) ||
-        !Array.isArray(value.routes) ||
-        !value.routes.every(isRouteRecord) ||
-        !Array.isArray(value.pairs) ||
-        value.pairs.length > 256 ||
-        !value.pairs.every(isPairRecord) ||
-        new Set(watches.map((watch) => watch.conversationId)).size !==
-            watches.length ||
-        new Set(watches.map(progressWatchPairKey)).size !== watches.length) {
-        return false;
-    }
-    const routes = value.routes;
-    const pairs = value.pairs;
-    for (const watch of watches) {
-        const owner = routes.find((route) => route.alias === watch.ownerAlias &&
-            route.binding.ownerLease === watch.ownerLease);
-        const worker = routes.find((route) => route.alias === watch.workerAlias &&
-            route.binding.ownerLease === watch.workerLease);
-        if (owner === undefined ||
-            worker === undefined ||
-            owner.binding.provider === worker.binding.provider ||
-            owner.binding.hostId !== worker.binding.hostId) {
-            return false;
-        }
-        const claude = owner.binding.provider === "claude" ? owner : worker;
-        const codex = owner.binding.provider === "codex" ? owner : worker;
-        if (!pairs.some((pair) => pair.claudeAlias === claude.alias &&
-            pair.codexAlias === codex.alias &&
-            pair.claudeOwnerLease === claude.binding.ownerLease &&
-            pair.codexOwnerLease === codex.binding.ownerLease)) {
-            return false;
-        }
-    }
-    return true;
-}
-function mapLegacyProgressWatchEvent(event) {
-    const base = {
-        timestamp: event.timestamp,
-        conversationId: event.conversationId,
-        ownerAlias: event.ownerAlias,
-        workerAlias: event.workerAlias,
-    };
-    switch (event.kind) {
-        case "opened":
-            return { ...base, kind: "opened", actor: "owner" };
-        case "replaced":
-            // v1.4 used this kind for both owner replacement and an automatic
-            // duplicate migration. Its actor cannot be reconstructed honestly.
-            return { ...base, kind: "replaced", actor: "unknown" };
-        case "worker_reported_complete":
-            return { ...base, kind: "settled", actor: "worker", reason: "done" };
-        case "done":
-            return {
-                ...base,
-                kind: "settled",
-                actor: "unknown",
-                reason: "legacy_done",
-            };
-        case "unresponsive":
-            return {
-                ...base,
-                kind: "settled",
-                actor: "gateway",
-                reason: "idle_timeout",
-            };
-        case "pair_removed":
-            return {
-                ...base,
-                kind: "settled",
-                actor: "operator",
-                reason: "pair_removed",
-            };
-        case "endpoint_retired":
-            return {
-                ...base,
-                kind: "settled",
-                actor: "gateway",
-                reason: "endpoint_retired",
-            };
-        case "disabled":
-            return {
-                ...base,
-                kind: "settled",
-                actor: "gateway",
-                reason: "tracking_disabled",
-            };
-        case "activity":
-        case "nudge":
-        case "capability_degraded":
-        case "conversation_rebound":
-            return undefined;
-    }
-}
-/**
- * v1.4.x watches carried capability and phase state that no longer has product
- * meaning. Strictly recognize the complete old graph, preserve representable
- * history, and settle every live row once at upgrade. Rebase the bounded
- * private sequence so a historical counter cannot make the new format fatal.
- */
-function migrateV14ProgressWatchState(value, migratedAt) {
-    if (!isObject(value) ||
-        value.schemaVersion !== 1 ||
-        !isIsoTimestamp(value.updatedAt) ||
-        !isIsoTimestamp(migratedAt) ||
-        !isNonNegativeInteger(value.watchSequence) ||
-        !Array.isArray(value.progressWatches) ||
-        !Array.isArray(value.progressWatchEvents)) {
-        return value;
-    }
-    const hasLegacyRows = value.progressWatches.some(isLegacyV14ProgressWatch) ||
-        value.progressWatchEvents.some(isLegacyV14ProgressWatchJournalEvent);
-    if (!hasLegacyRows)
-        return value;
-    if (value.progressWatches.length > PROGRESS_WATCH_HARD_CAPACITY ||
-        !value.progressWatches.every(isLegacyV14ProgressWatch) ||
-        value.progressWatchEvents.length > gatewayPublicSnapshotLimits.messages ||
-        !value.progressWatchEvents.every(isLegacyV14ProgressWatchJournalEvent)) {
-        return value;
-    }
-    const watches = value.progressWatches;
-    const legacyEvents = value.progressWatchEvents;
-    const watchSequence = value.watchSequence;
-    if (!legacyProgressWatchGraphIsValid(value, watches) ||
-        legacyEvents.some((event, index) => event.sequence > watchSequence ||
-            (index > 0 && event.sequence <= legacyEvents[index - 1].sequence))) {
-        return value;
-    }
-    const pending = [];
-    for (const event of legacyEvents) {
-        const mapped = mapLegacyProgressWatchEvent(event);
-        if (mapped !== undefined)
-            pending.push(mapped);
-    }
-    const settlements = watches.map((watch) => ({
-        timestamp: migratedAt,
-        conversationId: watch.conversationId,
-        ownerAlias: watch.ownerAlias,
-        workerAlias: watch.workerAlias,
-        kind: "settled",
-        actor: "gateway",
-        reason: "legacy_upgrade",
-    }));
-    const retainedHistoryCount = gatewayPublicSnapshotLimits.messages - settlements.length;
-    const retained = [
-        ...pending.slice(Math.max(0, pending.length - retainedHistoryCount)),
-        ...settlements,
-    ];
-    const progressWatchEvents = retained.map((event, index) => ({
-        ...event,
-        sequence: index + 1,
-    }));
-    return {
-        ...value,
-        watchSequence: progressWatchEvents.length,
-        progressWatches: [],
-        progressWatchEvents,
-    };
-}
 function isPersistedState(value) {
     if (!isObject(value) ||
         !hasOnlyKeys(value, [
@@ -1074,7 +623,7 @@ function isPersistedState(value) {
             "updatedAt",
             "eventSequence",
             "routes",
-            "pairs",
+            "consentEdges",
             "connectors",
             "queue",
             "inFlight",
@@ -1085,14 +634,13 @@ function isPersistedState(value) {
             "watchSequence",
             "progressWatches",
             "progressWatchEvents",
-            "compatibilityAttestations",
             "codexEndpointRefreshSequence",
             "codexEndpointRefreshEvents",
             "codexOrphanRemovalSequence",
             "codexOrphanRemovalEvents",
             "codexSuccession",
         ]) ||
-        value.schemaVersion !== 1 ||
+        value.schemaVersion !== 2 ||
         !isIsoTimestamp(value.createdAt) ||
         !isIsoTimestamp(value.updatedAt) ||
         !isNonNegativeInteger(value.eventSequence) ||
@@ -1101,19 +649,15 @@ function isPersistedState(value) {
         !isNonNegativeInteger(value.codexOrphanRemovalSequence) ||
         !Array.isArray(value.routes) ||
         !value.routes.every(isRouteRecord) ||
-        !Array.isArray(value.pairs) ||
-        value.pairs.length > 256 ||
-        !value.pairs.every(isPairRecord) ||
+        !Array.isArray(value.consentEdges) ||
+        value.consentEdges.length > gatewayPublicSnapshotLimits.consentEdges ||
+        !value.consentEdges.every(isConsentEdgeRecord) ||
         !Array.isArray(value.progressWatches) ||
         value.progressWatches.length > PROGRESS_WATCH_HARD_CAPACITY ||
         !value.progressWatches.every(isProgressWatch) ||
         !Array.isArray(value.progressWatchEvents) ||
         value.progressWatchEvents.length > gatewayPublicSnapshotLimits.messages ||
         !value.progressWatchEvents.every(isProgressWatchJournalEvent) ||
-        !Array.isArray(value.compatibilityAttestations) ||
-        value.compatibilityAttestations.length >
-            COMPATIBILITY_ATTESTATION_CAPACITY ||
-        !value.compatibilityAttestations.every(isPersistedCompatibilityAttestation) ||
         !Array.isArray(value.codexEndpointRefreshEvents) ||
         value.codexEndpointRefreshEvents.length >
             CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY ||
@@ -1156,10 +700,6 @@ function isPersistedState(value) {
     const watchPairKeys = new Set(candidate.progressWatches.map(progressWatchPairKey));
     if (watchPairKeys.size !== candidate.progressWatches.length)
         return false;
-    const compatibilityKeys = candidate.compatibilityAttestations.map(compatibilityCacheKey);
-    if (new Set(compatibilityKeys).size !== compatibilityKeys.length) {
-        return false;
-    }
     for (const watch of candidate.progressWatches) {
         const owner = candidate.routes.find((route) => route.alias === watch.ownerAlias &&
             route.binding.ownerLease === watch.ownerLease);
@@ -1171,17 +711,10 @@ function isPersistedState(value) {
             owner.binding.hostId !== worker.binding.hostId) {
             return false;
         }
-        const pairAliases = pairAliasesForRoutes(owner, worker);
-        if (!candidate.pairs.some((pair) => pair.claudeAlias === pairAliases.claudeAlias &&
-            pair.codexAlias === pairAliases.codexAlias &&
-            pair.claudeOwnerLease ===
-                (owner.binding.provider === "claude"
-                    ? owner.binding.ownerLease
-                    : worker.binding.ownerLease) &&
-            pair.codexOwnerLease ===
-                (owner.binding.provider === "codex"
-                    ? owner.binding.ownerLease
-                    : worker.binding.ownerLease))) {
+        const endpoints = canonicalConsentEndpoints(owner, worker);
+        if (!candidate.consentEdges.some((edge) => edge.endpoints.every((endpoint, index) => endpoint.alias === endpoints[index].alias &&
+            endpoint.provider === endpoints[index].provider &&
+            endpoint.ownerLease === endpoints[index].ownerLease))) {
             return false;
         }
     }
@@ -1192,15 +725,18 @@ function isPersistedState(value) {
     ];
     const expectedQueuedBytes = candidate.queue.reduce((total, item) => total + item.bytes, 0);
     const routeByAlias = new Map(candidate.routes.map((route) => [route.alias, route]));
-    const pairKeys = candidate.pairs.map((pair) => `${pair.claudeAlias}\0${pair.codexAlias}`);
-    const pairsValid = candidate.pairs.every((pair) => {
-        const claude = routeByAlias.get(pair.claudeAlias);
-        const codex = routeByAlias.get(pair.codexAlias);
-        return (claude?.binding.provider === "claude" &&
-            codex?.binding.provider === "codex" &&
-            claude.binding.hostId === codex.binding.hostId &&
-            claude.binding.ownerLease === pair.claudeOwnerLease &&
-            codex.binding.ownerLease === pair.codexOwnerLease);
+    const edgeKeys = candidate.consentEdges.map((edge) => consentEdgeKey(edge.endpoints));
+    const edgesValid = candidate.consentEdges.every((edge) => {
+        const [leftEndpoint, rightEndpoint] = edge.endpoints;
+        const left = routeByAlias.get(leftEndpoint.alias);
+        const right = routeByAlias.get(rightEndpoint.alias);
+        return (compareConsentEndpoints(leftEndpoint, rightEndpoint) < 0 &&
+            left?.binding.provider === leftEndpoint.provider &&
+            right?.binding.provider === rightEndpoint.provider &&
+            left.binding.provider !== right.binding.provider &&
+            left.binding.hostId === right.binding.hostId &&
+            left.binding.ownerLease === leftEndpoint.ownerLease &&
+            right.binding.ownerLease === rightEndpoint.ownerLease);
     });
     const claudeConnectorHosts = new Set(candidate.connectors
         .filter((connector) => connector.provider === "claude")
@@ -1209,22 +745,23 @@ function isPersistedState(value) {
     const isValidPersistedMessagePair = (message) => {
         const source = routeByAlias.get(message.sourceAlias);
         const target = routeByAlias.get(message.targetAlias);
-        const routeShapeValid = message.direction === "codex_to_claude"
-            ? source?.binding.provider === "codex" &&
-                ((target?.binding.provider === "claude" &&
-                    target.binding.hostId === source.binding.hostId) ||
-                    (target === undefined &&
-                        claudeConnectorHosts.has(source.binding.hostId) &&
-                        aliasHost(message.targetAlias) === source.binding.hostId))
-            : target?.binding.provider === "codex" &&
-                ((source?.binding.provider === "claude" &&
-                    source.binding.hostId === target.binding.hostId) ||
-                    (source === undefined &&
-                        claudeConnectorHosts.has(target.binding.hostId) &&
-                        aliasHost(message.sourceAlias) === target.binding.hostId));
+        const parsed = parseDirection(message.direction);
+        if (parsed === undefined)
+            return false;
+        const sourceValid = source?.binding.provider === parsed.sourceProvider ||
+            (source === undefined && parsed.sourceProvider === "claude" && target !== undefined &&
+                claudeConnectorHosts.has(target.binding.hostId) &&
+                aliasHost(message.sourceAlias) === target.binding.hostId);
+        const targetValid = target?.binding.provider === parsed.targetProvider ||
+            (target === undefined && parsed.targetProvider === "claude" && source !== undefined &&
+                claudeConnectorHosts.has(source.binding.hostId) &&
+                aliasHost(message.targetAlias) === source.binding.hostId);
+        const routeShapeValid = sourceValid && targetValid &&
+            (source === undefined || target === undefined ||
+                source.binding.hostId === target.binding.hostId);
         return (routeShapeValid &&
             (message.pair !== true ||
-                candidate.pairs.some((pair) => pairMatchesMessage(pair, message))));
+                candidate.consentEdges.some((edge) => consentEdgeMatchesMessage(edge, message))));
     };
     const sequencesStrictlyIncrease = candidate.events.every((event, index) => index === 0 ||
         event.sequence > (candidate.events[index - 1]?.sequence ?? 0));
@@ -1250,8 +787,8 @@ function isPersistedState(value) {
                     (candidate.codexOrphanRemovalEvents[index - 1]?.sequence ?? 0) +
                         1);
     return (aliases.size === candidate.routes.length &&
-        new Set(pairKeys).size === pairKeys.length &&
-        pairsValid &&
+        new Set(edgeKeys).size === edgeKeys.length &&
+        edgesValid &&
         routeTargets.size === candidate.routes.length &&
         ownerLeases.size === candidate.routes.length &&
         connectorKeys.size === candidate.connectors.length &&
@@ -1267,10 +804,12 @@ function isPersistedState(value) {
         endpointRefreshSequenceConsistent &&
         orphanRemovalSequenceConsistent &&
         candidate.routes.every((route) => route.alias.endsWith(`@${route.binding.hostId}`) &&
-            ((route.binding.provider === "codex" &&
-                route.registrationMode === "explicit_opt_in") ||
-                (route.binding.provider === "claude" &&
-                    route.registrationMode === "selected_live_peer")) &&
+            ((route.binding.provider === "claude" &&
+                route.registrationMode === "selected_live_peer") ||
+                (route.binding.provider !== "claude" &&
+                    route.registrationMode === "explicit_opt_in")) &&
+            (gatewayRegistrationIngressPrefixes[route.binding.provider] === undefined ||
+                route.alias.startsWith(gatewayRegistrationIngressPrefixes[route.binding.provider])) &&
             route.queueDepth ===
                 candidate.queue.filter((item) => item.targetAlias === route.alias)
                     .length) &&
@@ -1281,8 +820,7 @@ function isPersistedState(value) {
         }) &&
         candidate.dedupe.every(isValidPersistedMessagePair) &&
         candidate.rateBuckets.every((bucket) => aliases.has(bucket.sourceAlias) ||
-            candidate.routes.some((route) => route.binding.provider === "codex" &&
-                claudeConnectorHosts.has(route.binding.hostId) &&
+            candidate.routes.some((route) => claudeConnectorHosts.has(route.binding.hostId) &&
                 route.binding.hostId === aliasHost(bucket.sourceAlias))) &&
         isPersistedSuccessionConsistent(candidate));
 }
@@ -1466,41 +1004,46 @@ function renameRateBucket(state, previousAlias, newAlias) {
     existing.count = Math.min(Number.MAX_SAFE_INTEGER, existing.count + previous.count);
     state.rateBuckets = state.rateBuckets.filter((bucket) => bucket !== previous);
 }
-function pairKey(claudeAlias, codexAlias) {
-    return `${claudeAlias}\0${codexAlias}`;
+function compareConsentEndpoints(left, right) {
+    return gatewayProviders.indexOf(left.provider) -
+        gatewayProviders.indexOf(right.provider) || left.alias.localeCompare(right.alias);
 }
-function pairAliasesForRoutes(source, target) {
-    if (source.binding.provider === "claude" &&
-        target.binding.provider === "codex") {
-        return { claudeAlias: source.alias, codexAlias: target.alias };
-    }
-    if (source.binding.provider === "codex" &&
-        target.binding.provider === "claude") {
-        return { claudeAlias: target.alias, codexAlias: source.alias };
-    }
-    throw new BridgeError("INVALID_GATEWAY_ROUTE_PAIR", "Gateway pairs must connect one Claude route and one Codex route.");
+function canonicalConsentEndpoints(source, target) {
+    const endpoints = [
+        { alias: source.alias, provider: source.binding.provider,
+            ownerLease: source.binding.ownerLease },
+        { alias: target.alias, provider: target.binding.provider,
+            ownerLease: target.binding.ownerLease },
+    ];
+    endpoints.sort(compareConsentEndpoints);
+    return endpoints;
+}
+function consentEdgeKey(endpoints) {
+    return endpoints.map(({ provider, alias }) => `${provider}\0${alias}`).join("\0");
 }
-function pairMatchesMessage(pair, message) {
-    return (message.pair === true &&
-        ((message.sourceAlias === pair.claudeAlias &&
-            message.targetAlias === pair.codexAlias) ||
-            (message.sourceAlias === pair.codexAlias &&
-                message.targetAlias === pair.claudeAlias)));
+function consentEdgeMatchesMessage(pair, message) {
+    const aliases = "endpoints" in pair
+        ? pair.endpoints.map((endpoint) => endpoint.alias)
+        : pair.aliases;
+    return message.pair === true &&
+        ((message.sourceAlias === aliases[0] && message.targetAlias === aliases[1]) ||
+            (message.sourceAlias === aliases[1] && message.targetAlias === aliases[0]));
 }
-function findPairForMessage(state, message) {
-    return state.pairs.find((pair) => pairMatchesMessage(pair, message));
+function findConsentEdgeForMessage(state, message) {
+    return state.consentEdges.find((edge) => consentEdgeMatchesMessage(edge, message));
 }
-function renamePairAlias(state, previousAlias, newAlias, now) {
+function renameConsentEdgeAlias(state, previousAlias, newAlias, now) {
     if (previousAlias === newAlias)
         return;
-    for (const pair of state.pairs) {
-        if (pair.claudeAlias === previousAlias)
-            pair.claudeAlias = newAlias;
-        if (pair.codexAlias === previousAlias)
-            pair.codexAlias = newAlias;
-        if (pair.claudeAlias === newAlias ||
-            pair.codexAlias === newAlias) {
-            pair.updatedAt = now.toISOString();
+    for (const edge of state.consentEdges) {
+        const endpoint = edge.endpoints.find(({ alias }) => alias === previousAlias);
+        if (endpoint !== undefined) {
+            const renamed = edge.endpoints.map((candidate) => candidate.alias === previousAlias
+                ? { ...candidate, alias: newAlias }
+                : candidate);
+            renamed.sort(compareConsentEndpoints);
+            edge.endpoints = renamed;
+            edge.updatedAt = now.toISOString();
         }
     }
 }
@@ -1513,8 +1056,8 @@ function renameProgressWatchAlias(state, previousAlias, newAlias) {
             ? { ...watch, workerAlias: newAlias }
             : watch);
 }
-function removePairsForAliases(state, aliases) {
-    state.pairs = state.pairs.filter((pair) => !aliases.has(pair.claudeAlias) && !aliases.has(pair.codexAlias));
+function removeConsentEdgesForAliases(state, aliases) {
+    state.consentEdges = state.consentEdges.filter((edge) => !edge.endpoints.some(({ alias }) => aliases.has(alias)));
 }
 function routeTerminationMatches(state, aliases, message) {
     for (const alias of [message.sourceAlias, message.targetAlias]) {
@@ -1528,15 +1071,10 @@ function routeTerminationMatches(state, aliases, message) {
     return false;
 }
 function directionFor(source, target) {
-    if (source.binding.provider === "codex" &&
-        target.binding.provider === "claude") {
-        return "codex_to_claude";
-    }
-    if (source.binding.provider === "claude" &&
-        target.binding.provider === "codex") {
-        return "claude_to_codex";
+    if (source.binding.provider !== target.binding.provider) {
+        return directionId(source.binding.provider, target.binding.provider);
     }
-    throw new BridgeError("INVALID_GATEWAY_ROUTE_PAIR", "Gateway messages must cross from one provider to the other.");
+    throw new BridgeError("INVALID_GATEWAY_ROUTE_PAIR", "Gateway messages must cross between distinct providers.");
 }
 export class GatewayStore {
     config;
@@ -1549,11 +1087,7 @@ export class GatewayStore {
     state;
     lockHandle;
     lockToken;
-    /**
-     * Startup admission may exercise migrated state in memory, but it must not
-     * strand an older binary by rewriting the durable schema before every
-     * provider and control-socket readiness check has passed.
-     */
+    /** Startup may defer the first native-v2 persistence until admission passes. */
     persistenceDeferred = false;
     constructor(config, dependencies = {}) {
         this.config = config;
@@ -1579,12 +1113,12 @@ export class GatewayStore {
                 const now = this.now();
                 const loaded = await this.loadStateFile(now);
                 this.state = loaded ?? {
-                    schemaVersion: 1,
+                    schemaVersion: 2,
                     createdAt: now.toISOString(),
                     updatedAt: now.toISOString(),
                     eventSequence: 0,
                     routes: [],
-                    pairs: [],
+                    consentEdges: [],
                     connectors: [],
                     queue: [],
                     inFlight: [],
@@ -1595,15 +1129,14 @@ export class GatewayStore {
                     watchSequence: 0,
                     progressWatches: [],
                     progressWatchEvents: [],
-                    compatibilityAttestations: [],
                     codexEndpointRefreshSequence: 0,
                     codexEndpointRefreshEvents: [],
                     codexOrphanRemovalSequence: 0,
                     codexOrphanRemovalEvents: [],
                     codexSuccession: null,
                 };
-                if (this.state.pairs.length > this.config.limits.maxPairs) {
-                    throw new BridgeError("PAIR_CAPACITY_REACHED", "The durable pair inventory exceeds the configured bound.");
+                if (this.state.consentEdges.length > this.config.limits.maxConsentEdges) {
+                    throw new BridgeError("CONSENT_EDGE_CAPACITY_REACHED", "The durable consent-edge inventory exceeds the configured bound.");
                 }
                 if (this.state.progressWatches.length >
                     (this.config.limits.maxWatches ?? PROGRESS_WATCH_DEFAULT_CAPACITY)) {
@@ -1661,7 +1194,6 @@ export class GatewayStore {
             const observed = {
                 ...input.identity,
                 health: input.health,
-                compatibility: input.compatibility,
                 protocol: input.protocol,
                 protocolVersion: input.protocolVersion,
                 updatedAt: now.toISOString(),
@@ -1671,7 +1203,8 @@ export class GatewayStore {
             if (existingIndex >= 0)
                 state.connectors[existingIndex] = observed;
             else {
-                if (state.connectors.length >= this.config.allowedHosts.length * 2) {
+                if (state.connectors.length >=
+                    this.config.allowedHosts.length * gatewayProviders.length) {
                     throw new BridgeError("CONNECTOR_CAPACITY_REACHED", "The bounded provider and host connector registry is full.");
                 }
                 state.connectors.push(observed);
@@ -1702,7 +1235,6 @@ export class GatewayStore {
                 if (!sameEndpoint(route.binding, identity))
                     continue;
                 route.state = route.enabled ? "stale" : "disabled";
-                route.compatibility = "expired";
                 route.updatedAt = now.toISOString();
                 route.safeErrorCode = safeErrorCode;
             }
@@ -1715,9 +1247,8 @@ export class GatewayStore {
             this.assertAllowedIdentity(endpointOf(input.binding));
             const connector = state.connectors.find((candidate) => sameEndpoint(candidate, input.binding));
             if (!connector ||
-                !["healthy", "degraded"].includes(connector.health) ||
-                connector.compatibility !== "compatible") {
-                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact compatible endpoint generation must be observed before a route can be registered.");
+                !["healthy", "degraded"].includes(connector.health)) {
+                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact live endpoint generation must be observed before a route can be registered.");
             }
             const byAlias = state.routes.find((route) => route.alias === input.alias);
             const byBinding = state.routes.find((route) => sameRouteTarget(route.binding, input.binding));
@@ -1730,7 +1261,6 @@ export class GatewayStore {
                 }
                 byAlias.enabled = true;
                 byAlias.state = input.state ?? "idle";
-                byAlias.compatibility = "compatible";
                 byAlias.updatedAt = now.toISOString();
                 byAlias.lastSeenAt = now.toISOString();
                 delete byAlias.safeErrorCode;
@@ -1751,7 +1281,6 @@ export class GatewayStore {
                 registrationMode: input.registrationMode,
                 enabled: true,
                 state: input.state ?? "idle",
-                compatibility: "compatible",
                 busyPolicy: "queue",
                 registeredAt: now.toISOString(),
                 updatedAt: now.toISOString(),
@@ -1778,9 +1307,8 @@ export class GatewayStore {
             }
             const connector = state.connectors.find((candidate) => sameEndpoint(candidate, replacement.binding));
             if (!connector ||
-                !["healthy", "degraded"].includes(connector.health) ||
-                connector.compatibility !== "compatible") {
-                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact compatible endpoint generation must be observed before a Claude selection can replace another.");
+                !["healthy", "degraded"].includes(connector.health)) {
+                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact live endpoint generation must be observed before a Claude selection can replace another.");
             }
             const selectedClaudeRoutes = state.routes.filter((route) => route.binding.provider === "claude" &&
                 route.registrationMode === "selected_live_peer");
@@ -1793,9 +1321,7 @@ export class GatewayStore {
             const retained = logicalMatches[0];
             if (retained !== undefined &&
                 !sameBinding(retained.binding, replacement.binding) &&
-                (!retained.enabled ||
-                    retained.state !== "stale" ||
-                    retained.compatibility !== "expired")) {
+                (!retained.enabled || retained.state !== "stale")) {
                 throw new BridgeError("ROUTE_REBIND_IDENTITY_MISMATCH", "Only a stale exact Claude session may adopt a newly observed endpoint generation during replacement.");
             }
             const aliasOwner = state.routes.find((route) => route.alias === replacement.alias);
@@ -1818,7 +1344,7 @@ export class GatewayStore {
             this.settleProgressWatchesForAliases(state, retiredAliases, now);
             const settlements = this.terminateAffectedMessages(state, retiredAliases, now, "ROUTE_UNREGISTERED", settlementPlan);
             state.routes = state.routes.filter((route) => !retired.includes(route));
-            removePairsForAliases(state, retiredAliases);
+            removeConsentEdgesForAliases(state, retiredAliases);
             state.rateBuckets = state.rateBuckets.filter((bucket) => !retiredAliases.has(bucket.sourceAlias));
             state.dedupe = state.dedupe.filter((record) => !retiredAliases.has(record.sourceAlias) &&
                 !retiredAliases.has(record.targetAlias));
@@ -1828,7 +1354,6 @@ export class GatewayStore {
                 retained.binding = { ...replacement.binding };
                 retained.enabled = true;
                 retained.state = replacement.state ?? "idle";
-                retained.compatibility = "compatible";
                 retained.updatedAt = now.toISOString();
                 retained.lastSeenAt = now.toISOString();
                 delete retained.safeErrorCode;
@@ -1850,7 +1375,7 @@ export class GatewayStore {
                         }
                     }
                     renameRateBucket(state, previousAlias, replacement.alias);
-                    renamePairAlias(state, previousAlias, replacement.alias, now);
+                    renameConsentEdgeAlias(state, previousAlias, replacement.alias, now);
                     renameProgressWatchAlias(state, previousAlias, replacement.alias);
                 }
             }
@@ -1864,7 +1389,6 @@ export class GatewayStore {
                     registrationMode: replacement.registrationMode,
                     enabled: true,
                     state: replacement.state ?? "idle",
-                    compatibility: "compatible",
                     busyPolicy: "queue",
                     registeredAt: now.toISOString(),
                     updatedAt: now.toISOString(),
@@ -1896,16 +1420,13 @@ export class GatewayStore {
                 throw new BridgeError("ROUTE_OWNERSHIP_MISMATCH", "No enabled route matches the exact private binding and ownership lease.");
             }
             const endpointObservationValid = input.state === "stale"
-                ? connector?.health === "degraded" &&
-                    connector.compatibility === "expired"
+                ? connector?.health === "degraded"
                 : connector !== undefined &&
-                    ["healthy", "degraded"].includes(connector.health) &&
-                    connector.compatibility === "compatible";
+                    ["healthy", "degraded"].includes(connector.health);
             if (!endpointObservationValid) {
-                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The route observation must match the exact endpoint generation's current health and compatibility.");
+                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The route observation must match the exact endpoint generation's current health.");
             }
             route.state = input.state;
-            route.compatibility = input.compatibility;
             route.lastSeenAt = now.toISOString();
             route.updatedAt = now.toISOString();
             if (input.safeErrorCode)
@@ -1928,7 +1449,6 @@ export class GatewayStore {
             const aliases = new Set([route.alias]);
             const settlementPlan = this.validateAffectedInFlightSettlements(state, aliases, inFlightSettlements);
             route.state = "stale";
-            route.compatibility = "expired";
             route.updatedAt = now.toISOString();
             route.safeErrorCode = safeErrorCode;
             return this.terminateAffectedMessages(state, aliases, now, safeErrorCode, settlementPlan);
@@ -1955,7 +1475,6 @@ export class GatewayStore {
             const route = this.requireOwnedRoute(state, input.alias, input.currentOwnerLease);
             if (!route.enabled ||
                 route.state !== "stale" ||
-                route.compatibility !== "expired" ||
                 state.inFlight.some((item) => item.sourceAlias === route.alias || item.targetAlias === route.alias)) {
                 throw new BridgeError("ROUTE_REBIND_NOT_SAFE", "Only an enabled, expired stale route without in-flight work can be rebound.");
             }
@@ -1979,9 +1498,8 @@ export class GatewayStore {
             }
             const connector = state.connectors.find((candidate) => sameEndpoint(candidate, input.newBinding));
             if (!connector ||
-                !["healthy", "degraded"].includes(connector.health) ||
-                connector.compatibility !== "compatible") {
-                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The replacement endpoint generation must be positively observed and compatible.");
+                !["healthy", "degraded"].includes(connector.health)) {
+                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The replacement endpoint generation must be positively observed and live.");
             }
             if (state.routes.some((candidate) => candidate !== route &&
                 (candidate.alias === newAlias ||
@@ -1998,7 +1516,6 @@ export class GatewayStore {
             route.binding = { ...input.newBinding };
             route.alias = newAlias;
             route.state = input.state ?? "idle";
-            route.compatibility = "compatible";
             route.updatedAt = now.toISOString();
             route.lastSeenAt = now.toISOString();
             delete route.safeErrorCode;
@@ -2020,7 +1537,7 @@ export class GatewayStore {
                     }
                 }
                 renameRateBucket(state, previousAlias, newAlias);
-                renamePairAlias(state, previousAlias, newAlias, now);
+                renameConsentEdgeAlias(state, previousAlias, newAlias, now);
             }
             if (input.journalReason === "boot_reactivation") {
                 this.appendCodexEndpointRefreshEvent(state, {
@@ -2058,9 +1575,8 @@ export class GatewayStore {
             this.assertAllowedIdentity(input.newEndpoint);
             const newConnector = state.connectors.find((candidate) => sameEndpoint(candidate, input.newEndpoint));
             if (newConnector === undefined ||
-                !["healthy", "degraded"].includes(newConnector.health) ||
-                newConnector.compatibility !== "compatible") {
-                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The replacement Codex endpoint generation must be positively observed and compatible.");
+                !["healthy", "degraded"].includes(newConnector.health)) {
+                throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The replacement Codex endpoint generation must be positively observed and live.");
             }
             const aliases = new Set();
             const threadIds = new Set();
@@ -2095,7 +1611,6 @@ export class GatewayStore {
                     route.registrationMode !== "explicit_opt_in" ||
                     !route.enabled ||
                     route.state !== "stale" ||
-                    route.compatibility !== "expired" ||
                     !sameEndpoint(route.binding, input.oldEndpoint) ||
                     route.binding.routeHandle !== candidate.threadId ||
                     route.binding.ownerLease !== candidate.ownerLease ||
@@ -2125,7 +1640,6 @@ export class GatewayStore {
                     endpointGeneration: input.newEndpoint.endpointGeneration,
                 };
                 replacement.route.state = replacement.state;
-                replacement.route.compatibility = "compatible";
                 replacement.route.updatedAt = now.toISOString();
                 replacement.route.lastSeenAt = now.toISOString();
                 delete replacement.route.safeErrorCode;
@@ -2155,18 +1669,15 @@ export class GatewayStore {
             }
             const route = this.requireStaleCodexOrphan(state, input.alias);
             const aliases = new Set([route.alias]);
-            const removedPairs = state.pairs
-                .filter((pair) => pair.claudeAlias === route.alias || pair.codexAlias === route.alias)
-                .map((pair) => ({
-                claudeAlias: pair.claudeAlias,
-                codexAlias: pair.codexAlias,
-            }));
+            const removedEdges = state.consentEdges
+                .filter((edge) => edge.endpoints.some(({ alias }) => alias === route.alias))
+                .map((edge) => ({ aliases: edge.endpoints.map(({ alias }) => alias) }));
             if (state.codexOrphanRemovalSequence >= Number.MAX_SAFE_INTEGER) {
                 throw new BridgeError("CODEX_ORPHAN_REMOVAL_SEQUENCE_EXHAUSTED", "The bounded Codex orphan-removal sequence is exhausted.");
             }
             this.settleProgressWatchesForAliases(state, aliases, now);
             state.routes = state.routes.filter((candidate) => candidate !== route);
-            removePairsForAliases(state, aliases);
+            removeConsentEdgesForAliases(state, aliases);
             state.rateBuckets = state.rateBuckets.filter((bucket) => bucket.sourceAlias !== route.alias);
             state.dedupe = state.dedupe.filter((record) => record.sourceAlias !== route.alias &&
                 record.targetAlias !== route.alias);
@@ -2178,7 +1689,7 @@ export class GatewayStore {
             return {
                 alias: route.alias,
                 binding: { ...route.binding },
-                removedPairs,
+                removedEdges,
             };
         });
     }
@@ -2201,7 +1712,7 @@ export class GatewayStore {
             this.settleProgressWatchesForAliases(state, aliases, now, progressWatchSettlementActor);
             const settlements = this.terminateAffectedMessages(state, aliases, now, "ROUTE_UNREGISTERED", settlementPlan);
             state.routes = state.routes.filter((candidate) => candidate !== route);
-            removePairsForAliases(state, aliases);
+            removeConsentEdgesForAliases(state, aliases);
             const remainingCodexHosts = new Set(state.routes
                 .filter((candidate) => candidate.binding.provider === "codex")
                 .map((candidate) => candidate.binding.hostId));
@@ -2246,7 +1757,7 @@ export class GatewayStore {
                     record.targetAlias = newAlias;
             }
             renameRateBucket(state, alias, newAlias);
-            renamePairAlias(state, alias, newAlias, now);
+            renameConsentEdgeAlias(state, alias, newAlias, now);
             renameProgressWatchAlias(state, alias, newAlias);
         });
     }
@@ -2262,8 +1773,7 @@ export class GatewayStore {
             }
             if (!route ||
                 !route.enabled ||
-                !["idle", "busy", "awaiting_approval"].includes(route.state) ||
-                route.compatibility !== "compatible") {
+                !["idle", "busy", "awaiting_approval"].includes(route.state)) {
                 throw new BridgeError("ROUTE_UNAVAILABLE", "The selected route is not currently enabled and positively observed.", true);
             }
             return { ...route.binding };
@@ -2289,7 +1799,6 @@ export class GatewayStore {
                 registrationMode: route.registrationMode,
                 enabled: route.enabled,
                 state: route.state,
-                compatibility: route.compatibility,
                 ...(route.safeErrorCode === undefined
                     ? {}
                     : { safeErrorCode: route.safeErrorCode }),
@@ -2372,7 +1881,6 @@ export class GatewayStore {
                 registrationMode: route.registrationMode,
                 enabled: route.enabled,
                 state: route.state,
-                compatibility: route.compatibility,
             }));
         });
     }
@@ -2432,7 +1940,7 @@ export class GatewayStore {
             if (!routeMatchesSuccessionIdentity(route, input.old)) {
                 throw new BridgeError("CODEX_SUCCESSION_OWNER_MISMATCH", "The old succession identity does not exactly own its Codex route.");
             }
-            this.requireCompatibleObservedEndpoint(state, input.new.binding);
+            this.requireObservedEndpoint(state, input.new.binding);
             this.assertNewSuccessionIdentityAvailable(state, route, input.new);
             state.codexSuccession = {
                 schemaVersion: 1,
@@ -2477,9 +1985,9 @@ export class GatewayStore {
             }, ["published"]);
             this.assertSuccessionLedgerEmpty(state, journal.old.alias);
             const route = this.requireJournalRoute(state, journal, "old");
-            this.requireCompatibleObservedEndpoint(state, journal.new.binding);
+            this.requireObservedEndpoint(state, journal.new.binding);
             this.assertNewSuccessionIdentityAvailable(state, route, journal.new);
-            this.replaceCodexRouteForSuccession(state, route, journal.new, now, input.state, "compatible");
+            this.replaceCodexRouteForSuccession(state, route, journal.new, now, input.state);
             state.codexSuccession = { ...journal, stage: "activated" };
         });
     }
@@ -2583,30 +2091,27 @@ export class GatewayStore {
                 registrationMode: route.registrationMode,
                 enabled: route.enabled,
                 state: route.state,
-                compatibility: route.compatibility,
             }));
         });
     }
-    /** Create one explicit, durable Claude↔Codex consent edge. */
-    async pairRoutes(input) {
+    /** Create one explicit, durable consent edge between distinct providers. */
+    async addConsentEdge(input) {
         return this.mutate(async (state, now) => {
-            const { claude, codex } = this.requirePairRoutes(state, input);
-            const existing = state.pairs.find((pair) => pair.claudeAlias === claude.alias && pair.codexAlias === codex.alias);
+            const [left, right] = this.requireConsentEdgeRoutes(state, input);
+            const endpoints = canonicalConsentEndpoints(left, right);
+            const key = consentEdgeKey(endpoints);
+            const existing = state.consentEdges.find((edge) => consentEdgeKey(edge.endpoints) === key);
             if (existing !== undefined) {
-                if (existing.claudeOwnerLease !== claude.binding.ownerLease ||
-                    existing.codexOwnerLease !== codex.binding.ownerLease) {
-                    throw new BridgeError("PAIR_AUTHORITY_MISMATCH", "The pair aliases no longer match their exact route authorities.");
+                if (existing.endpoints.some((endpoint, index) => endpoint.ownerLease !== endpoints[index].ownerLease)) {
+                    throw new BridgeError("CONSENT_EDGE_AUTHORITY_MISMATCH", "The edge aliases no longer match their exact route authorities.");
                 }
                 return { created: false };
             }
-            if (state.pairs.length >= this.config.limits.maxPairs) {
-                throw new BridgeError("PAIR_CAPACITY_REACHED", "The bounded permission graph cannot accept another pair.", true);
+            if (state.consentEdges.length >= this.config.limits.maxConsentEdges) {
+                throw new BridgeError("CONSENT_EDGE_CAPACITY_REACHED", "The bounded permission graph cannot accept another consent edge.", true);
             }
-            state.pairs.push({
-                claudeAlias: claude.alias,
-                codexAlias: codex.alias,
-                claudeOwnerLease: claude.binding.ownerLease,
-                codexOwnerLease: codex.binding.ownerLease,
+            state.consentEdges.push({
+                endpoints,
                 createdAt: now.toISOString(),
                 updatedAt: now.toISOString(),
                 counters: emptyCounters(),
@@ -2615,12 +2120,14 @@ export class GatewayStore {
         });
     }
     /** Bounded metadata-only graph inventory for controller inference. */
-    async inspectPairs() {
+    async inspectConsentEdges() {
         return this.mutex.run("gateway", async () => {
             const state = this.requireState();
-            return state.pairs
-                .map(({ claudeAlias, codexAlias }) => ({ claudeAlias, codexAlias }))
-                .sort((left, right) => pairKey(left.claudeAlias, left.codexAlias).localeCompare(pairKey(right.claudeAlias, right.codexAlias)));
+            return state.consentEdges
+                .map(({ endpoints }) => ({
+                aliases: endpoints.map(({ alias }) => alias),
+            }))
+                .sort((left, right) => left.aliases.join("\0").localeCompare(right.aliases.join("\0")));
         });
     }
     /** Resolve only an exact live watch; recovery may substitute its suffix. */
@@ -2647,11 +2154,11 @@ export class GatewayStore {
                         watch.workerAlias === input.sourceAlias)));
             if (watch === undefined)
                 return { markerActive: false };
-            const hasExactPair = state.pairs.some((candidate) => pairMatchesMessage(candidate, {
+            const hasExactPair = state.consentEdges.some((candidate) => consentEdgeMatchesMessage(candidate, {
                 sourceAlias: input.sourceAlias,
                 targetAlias: input.targetAlias,
                 pair: true,
-            }) && progressWatchMatchesPair(watch, candidate));
+            }) && progressWatchMatchesConsentEdge(watch, candidate));
             if (!hasExactPair)
                 return { markerActive: false };
             return {
@@ -2661,38 +2168,6 @@ export class GatewayStore {
             };
         });
     }
-    async inspectCompatibilityAttestation(surface, version) {
-        return this.mutex.run("gateway", async () => {
-            const attestation = this.requireState().compatibilityAttestations.find((candidate) => candidate.surface === surface && candidate.version === version);
-            return attestation === undefined
-                ? undefined
-                : structuredClone(attestation);
-        });
-    }
-    async inspectCompatibilityAttestations() {
-        return this.mutex.run("gateway", async () => this.requireState().compatibilityAttestations
-            .map((attestation) => structuredClone(attestation))
-            .sort((left, right) => compatibilityCacheKey(left).localeCompare(compatibilityCacheKey(right))));
-    }
-    async recordCompatibilityAttestation(attestation) {
-        if (!isCompatibilityAttestation(attestation)) {
-            throw new BridgeError("COMPAT_ATTESTATION_INVALID", "Compatibility evidence failed strict schema validation.");
-        }
-        await this.mutate(async (state) => {
-            const key = compatibilityCacheKey(attestation);
-            const index = state.compatibilityAttestations.findIndex((candidate) => compatibilityCacheKey(candidate) === key);
-            if (index >= 0) {
-                state.compatibilityAttestations[index] = structuredClone(attestation);
-                return;
-            }
-            if (state.compatibilityAttestations.length >=
-                COMPATIBILITY_ATTESTATION_CAPACITY) {
-                state.compatibilityAttestations.sort((left, right) => left.checkedAt.localeCompare(right.checkedAt));
-                state.compatibilityAttestations.shift();
-            }
-            state.compatibilityAttestations.push(structuredClone(attestation));
-        });
-    }
     async touchProgressWatchesForAlias(alias) {
         return this.mutate(async (state, now) => {
             if (!ALIAS_PATTERN.test(alias))
@@ -2788,15 +2263,15 @@ export class GatewayStore {
             return true;
         });
     }
-    async hasPair(input) {
+    async hasConsentEdge(input) {
         return this.mutex.run("gateway", async () => {
             const state = this.requireState();
             try {
-                const { claude, codex } = this.requirePairRoutes(state, input, false);
-                return state.pairs.some((pair) => pair.claudeAlias === claude.alias &&
-                    pair.codexAlias === codex.alias &&
-                    pair.claudeOwnerLease === claude.binding.ownerLease &&
-                    pair.codexOwnerLease === codex.binding.ownerLease);
+                const [left, right] = this.requireConsentEdgeRoutes(state, input, false);
+                const endpoints = canonicalConsentEndpoints(left, right);
+                return state.consentEdges.some((edge) => edge.endpoints.every((endpoint, index) => endpoint.alias === endpoints[index].alias &&
+                    endpoint.provider === endpoints[index].provider &&
+                    endpoint.ownerLease === endpoints[index].ownerLease));
             }
             catch (error) {
                 if (error instanceof BridgeError)
@@ -2805,32 +2280,34 @@ export class GatewayStore {
             }
         });
     }
-    async inspectAffectedPairInFlightMessages(input) {
+    async inspectAffectedConsentEdgeInFlightMessages(input) {
         return this.mutex.run("gateway", async () => {
             const state = this.requireState();
-            const { claude, codex } = this.requirePairRoutes(state, input, false);
-            this.requireExactPair(state, claude, codex);
+            const routes = this.requireConsentEdgeRoutes(state, input, false);
+            const edge = this.requireExactConsentEdge(state, ...routes);
             return state.inFlight
-                .filter((item) => pairMatchesMessage(input, item))
+                .filter((item) => consentEdgeMatchesMessage(edge, item))
                 .map(({ messageId, deadlineAt }) => ({ messageId, deadlineAt }));
         });
     }
     /**
      * Remove exactly one consent edge and settle only work owned by that edge.
-     * Adjacent pairs, terminal token metadata, and unrelated messages survive.
+     * Adjacent edges, terminal token metadata, and unrelated messages survive.
      */
-    async unpairRoutes(input) {
+    async removeConsentEdge(input) {
         return this.mutate(async (state, now) => {
-            const { claude, codex } = this.requirePairRoutes(state, input, false);
-            const pair = this.requireExactPair(state, claude, codex);
-            const plan = this.validateAffectedPairInFlightSettlements(state, pair, input.inFlightSettlements ?? []);
-            this.settleProgressWatchesForPair(state, pair, now);
-            const settlements = this.terminateAffectedPairMessages(state, pair, now, "PAIR_REMOVED", plan);
-            state.pairs = state.pairs.filter((candidate) => candidate !== pair);
-            state.dedupe = state.dedupe.filter((record) => !pairMatchesMessage(pair, record));
+            const routes = this.requireConsentEdgeRoutes(state, input, false);
+            const pair = this.requireExactConsentEdge(state, ...routes);
+            const plan = this.validateAffectedConsentEdgeInFlightSettlements(state, pair, input.inFlightSettlements ?? []);
+            this.settleProgressWatchesForConsentEdge(state, pair, now);
+            const settlements = this.terminateAffectedConsentEdgeMessages(state, pair, now, "PAIR_REMOVED", plan);
+            state.consentEdges = state.consentEdges.filter((candidate) => candidate !== pair);
+            state.dedupe = state.dedupe.filter((record) => !consentEdgeMatchesMessage(pair, record));
             return {
                 settlements,
-                claudeRouteUnreferenced: !state.pairs.some((candidate) => candidate.claudeAlias === pair.claudeAlias),
+                unreferencedAliases: pair.endpoints
+                    .filter(({ alias }) => !state.consentEdges.some((edge) => edge.endpoints.some((endpoint) => endpoint.alias === alias)))
+                    .map(({ alias }) => alias),
             };
         });
     }
@@ -2866,8 +2343,7 @@ export class GatewayStore {
                 targetRoute: target,
             };
             try {
-                const pairAliases = pairAliasesForRoutes(source, target);
-                this.requireExactPair(state, pairAliases.claudeAlias === source.alias ? source : target, pairAliases.codexAlias === source.alias ? source : target);
+                this.requireExactConsentEdge(state, source, target);
                 sides.pair = true;
             }
             catch (error) {
@@ -2889,24 +2365,26 @@ export class GatewayStore {
     async enqueueNativeIngress(input) {
         return this.mutate(async (state, now) => {
             const target = this.requireAvailableRoute(state, input.targetAlias);
-            if (target.binding.provider !== "codex") {
-                throw new BridgeError("INVALID_NATIVE_INGRESS_TARGET", "Native Claude ingress requires an explicitly registered Codex target.");
-            }
             this.validateTransientNativeClaudePeer(state, input.source, target);
+            const direction = directionId("claude", target.binding.provider);
             const selectedClaude = state.routes.find((route) => route.alias === input.source.alias &&
                 route.binding.provider === "claude" &&
                 route.registrationMode === "selected_live_peer" &&
                 route.enabled &&
-                route.compatibility === "compatible" &&
                 ["idle", "busy", "awaiting_approval"].includes(route.state) &&
                 sameBinding(route.binding, input.source.binding));
             const pair = selectedClaude === undefined
                 ? undefined
-                : state.pairs.find((candidate) => candidate.claudeAlias === selectedClaude.alias &&
-                    candidate.codexAlias === target.alias &&
-                    candidate.claudeOwnerLease ===
-                        selectedClaude.binding.ownerLease &&
-                    candidate.codexOwnerLease === target.binding.ownerLease);
+                : (() => {
+                    try {
+                        return this.requireExactConsentEdge(state, selectedClaude, target);
+                    }
+                    catch (error) {
+                        if (error instanceof BridgeError)
+                            return undefined;
+                        throw error;
+                    }
+                })();
             if (input.authorizedPairTeardownReply === true &&
                 selectedClaude === undefined) {
                 throw new BridgeError("SENDER_NOT_PAIRED", "The retained reply no longer matches the exact selected Claude route.");
@@ -2920,48 +2398,47 @@ export class GatewayStore {
                 this.recordRejection(state, {
                     sourceAlias: input.source.alias,
                     targetAlias: target.alias,
-                    direction: "claude_to_codex",
+                    direction,
                     targetRoute: target,
                 }, bytes, now, "SENDER_NOT_PAIRED", input.steer, input.conversationIdSuffix);
-                throw new BridgeError("SENDER_NOT_PAIRED", "The native Claude sender is not the exact session paired with this Codex task.");
+                throw new BridgeError("SENDER_NOT_PAIRED", "The native Claude sender does not share exact consent with this route.");
             }
             return this.enqueueResolvedMessage(state, now, input, {
                 sourceAlias: input.source.alias,
                 targetAlias: target.alias,
-                direction: "claude_to_codex",
+                direction,
                 targetRoute: target,
                 ...(pair === undefined ? {} : { pair: true }),
             });
         });
     }
     /**
-     * Queue a correlated Codex reply for a caller-attested transient Claude
+     * Queue a correlated provider reply for a caller-attested transient Claude
      * peer. The service owns conversation correlation and the live dispatch
      * capability; the store retains only bounded public-alias metadata.
      */
     async enqueueNativeReply(input) {
         return this.mutate(async (state, now) => {
             const source = this.requireAvailableRoute(state, input.sourceAlias);
-            if (source.binding.provider !== "codex") {
-                throw new BridgeError("INVALID_NATIVE_REPLY_SOURCE", "A native Claude reply requires an explicitly registered Codex source.");
-            }
             this.validateTransientNativeClaudePeer(state, input.target, source);
-            if (input.pair === true) {
-                const target = state.routes.find((route) => route.alias === input.target.alias &&
+            const target = input.pair === true
+                ? state.routes.find((route) => route.alias === input.target.alias &&
                     route.binding.provider === "claude" &&
-                    sameBinding(route.binding, input.target.binding));
+                    sameBinding(route.binding, input.target.binding))
+                : undefined;
+            if (input.pair === true) {
                 if (target === undefined) {
                     throw new BridgeError("SENDER_NOT_PAIRED", "The correlated reply no longer has its exact paired Claude route.");
                 }
-                this.requireExactPair(state, target, source);
+                this.requireExactConsentEdge(state, target, source);
             }
             return this.enqueueResolvedMessage(state, now, input, {
                 sourceAlias: source.alias,
                 targetAlias: input.target.alias,
-                direction: "codex_to_claude",
+                direction: directionId(source.binding.provider, "claude"),
                 sourceRoute: source,
-                ...(input.pair === true
-                    ? { pair: true }
+                ...(target !== undefined
+                    ? { pair: true, targetRoute: target }
                     : { transientTarget: true }),
             });
         });
@@ -3235,7 +2712,6 @@ export class GatewayStore {
                 provider: connector.provider,
                 host: connector.hostId,
                 health: connector.health,
-                compatibility: connector.compatibility,
                 protocol: connector.protocol,
                 protocolVersion: connector.protocolVersion,
                 ...(connector.lastSeenAt ? { lastSeenAt: connector.lastSeenAt } : {}),
@@ -3261,7 +2737,6 @@ export class GatewayStore {
                     host: route.binding.hostId,
                     enabled: route.enabled,
                     state: route.state,
-                    compatibility: route.compatibility,
                     busyPolicy: route.busyPolicy,
                     ...(route.lastSeenAt ? { lastSeenAt: route.lastSeenAt } : {}),
                     queueDepth: route.queueDepth,
@@ -3273,14 +2748,13 @@ export class GatewayStore {
                 };
             })
                 .sort((left, right) => left.alias.localeCompare(right.alias));
-            const pairs = state.pairs
-                .map((pair) => ({
-                claudeAlias: pair.claudeAlias,
-                codexAlias: pair.codexAlias,
-                host: pair.claudeAlias.slice(pair.claudeAlias.lastIndexOf("@") + 1),
-                counters: { ...pair.counters },
+            const consentEdges = state.consentEdges
+                .map((edge) => ({
+                endpoints: edge.endpoints.map(({ alias, provider }) => ({ alias, provider })),
+                host: edge.endpoints[0].alias.slice(edge.endpoints[0].alias.lastIndexOf("@") + 1),
+                counters: { ...edge.counters },
             }))
-                .sort((left, right) => `${left.claudeAlias}\0${left.codexAlias}`.localeCompare(`${right.claudeAlias}\0${right.codexAlias}`));
+                .sort((left, right) => consentEdgeKey(left.endpoints).localeCompare(consentEdgeKey(right.endpoints)));
             const progressWatches = state.progressWatches
                 .map((watch) => ({
                 conversationIdSuffix: watch.conversationId.slice(-8),
@@ -3368,14 +2842,14 @@ export class GatewayStore {
                 return `${left.code}\0${left.provider ?? ""}\0${left.host ?? ""}\0${left.alias ?? ""}`.localeCompare(`${right.code}\0${right.provider ?? ""}\0${right.host ?? ""}\0${right.alias ?? ""}`);
             });
             return projectGatewayPublicSnapshot({
-                schemaVersion: 1,
+                schemaVersion: 2,
                 generatedAt: now.toISOString(),
                 inboundMode: this.config.inboundMode,
                 health,
                 connectors,
                 availablePeers: [],
                 routes,
-                pairs,
+                consentEdges,
                 progressWatches,
                 progressWatchEvents,
                 deadlinePressure: {
@@ -3394,7 +2868,7 @@ export class GatewayStore {
                     connectors: 0,
                     availablePeers: 0,
                     routes: 0,
-                    pairs: 0,
+                    consentEdges: 0,
                     progressWatches: 0,
                     progressWatchEvents: 0,
                     messages: 0,
@@ -3517,7 +2991,7 @@ export class GatewayStore {
             throw new BridgeError("CODEX_SUCCESSION_BINDING_COLLISION", "The new Codex identity collides with another persisted route.");
         }
     }
-    replaceCodexRouteForSuccession(state, route, identity, now, routeState, compatibility) {
+    replaceCodexRouteForSuccession(state, route, identity, now, routeState) {
         const oldAlias = route.alias;
         const affectedAliases = new Set([oldAlias, identity.alias]);
         this.settleProgressWatchesForAliases(state, affectedAliases, now);
@@ -3526,7 +3000,6 @@ export class GatewayStore {
         route.registrationMode = "explicit_opt_in";
         route.enabled = true;
         route.state = routeState;
-        route.compatibility = compatibility;
         route.registeredAt = now.toISOString();
         route.updatedAt = now.toISOString();
         route.queueDepth = 0;
@@ -3545,7 +3018,7 @@ export class GatewayStore {
             record.targetAlias !== identity.alias);
         state.rateBuckets = state.rateBuckets.filter((bucket) => bucket.sourceAlias !== oldAlias &&
             bucket.sourceAlias !== identity.alias);
-        removePairsForAliases(state, affectedAliases);
+        removeConsentEdgesForAliases(state, affectedAliases);
     }
     assertAllowedIdentity(identity) {
         if (!isPrivateEndpointIdentity(identity)) {
@@ -3555,12 +3028,11 @@ export class GatewayStore {
             throw new BridgeError("GATEWAY_HOST_NOT_ALLOWED", "The route host is not in the fixed gateway allowlist.");
         }
     }
-    requireCompatibleObservedEndpoint(state, binding) {
+    requireObservedEndpoint(state, binding) {
         const connector = state.connectors.find((candidate) => sameEndpoint(candidate, binding));
         if (!connector ||
-            !["healthy", "degraded"].includes(connector.health) ||
-            connector.compatibility !== "compatible") {
-            throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact compatible endpoint generation must be observed before Codex succession can publish or activate it.");
+            !["healthy", "degraded"].includes(connector.health)) {
+            throw new BridgeError("ROUTE_ENDPOINT_NOT_OBSERVED", "The exact live endpoint generation must be observed before Codex succession can publish or activate it.");
         }
     }
     validateRouteInput(input) {
@@ -3574,11 +3046,15 @@ export class GatewayStore {
         if (aliasHost !== input.binding.hostId) {
             throw new BridgeError("ROUTE_HOST_MISMATCH", "The public alias host must match the allowlisted private route host.");
         }
-        if ((input.binding.provider === "codex" &&
-            input.registrationMode !== "explicit_opt_in") ||
-            (input.binding.provider === "claude" &&
-                input.registrationMode !== "selected_live_peer")) {
-            throw new BridgeError("ROUTE_OPT_IN_REQUIRED", "Codex routes require explicit self opt-in and Claude routes require a selected live peer.");
+        const requiredPrefix = gatewayRegistrationIngressPrefixes[input.binding.provider];
+        if (requiredPrefix !== undefined && !input.alias.startsWith(requiredPrefix)) {
+            throw new BridgeError("INVALID_GATEWAY_ALIAS", `The ${input.binding.provider} registration alias must use its required ingress prefix.`);
+        }
+        if ((input.binding.provider === "claude" &&
+            input.registrationMode !== "selected_live_peer") ||
+            (input.binding.provider !== "claude" &&
+                input.registrationMode !== "explicit_opt_in")) {
+            throw new BridgeError("ROUTE_OPT_IN_REQUIRED", "Non-Claude routes require explicit opt-in and Claude routes require a selected live peer.");
         }
     }
     requireOwnedRoute(state, alias, ownerLease) {
@@ -3602,7 +3078,6 @@ export class GatewayStore {
             route.registrationMode !== "explicit_opt_in" ||
             !route.enabled ||
             route.state !== "stale" ||
-            route.compatibility !== "expired" ||
             route.queueDepth !== 0 ||
             state.queue.some((item) => item.sourceAlias === route.alias || item.targetAlias === route.alias) ||
             state.inFlight.some((item) => item.sourceAlias === route.alias || item.targetAlias === route.alias)) {
@@ -3631,52 +3106,46 @@ export class GatewayStore {
         const route = state.routes.find((candidate) => candidate.alias === alias);
         if (!route ||
             !route.enabled ||
-            !["idle", "busy", "awaiting_approval"].includes(route.state) ||
-            route.compatibility !== "compatible") {
+            !["idle", "busy", "awaiting_approval"].includes(route.state)) {
             throw new BridgeError("ROUTE_UNAVAILABLE", "The selected route is not currently enabled and positively observed.", true);
         }
         return route;
     }
-    requirePairRoutes(state, input, requireAvailable = true) {
+    requireConsentEdgeRoutes(state, input, requireAvailable = true) {
         if (!isObject(input) ||
-            typeof input.claudeAlias !== "string" ||
-            typeof input.codexAlias !== "string" ||
-            !ALIAS_PATTERN.test(input.claudeAlias) ||
-            !ALIAS_PATTERN.test(input.codexAlias) ||
-            input.claudeAlias === input.codexAlias) {
-            throw new BridgeError("INVALID_GATEWAY_PAIR", "A pair requires distinct normalized Claude and Codex aliases.");
+            !Array.isArray(input.aliases) ||
+            input.aliases.length !== 2 ||
+            input.aliases.some((alias) => typeof alias !== "string" || !ALIAS_PATTERN.test(alias)) ||
+            input.aliases[0] === input.aliases[1]) {
+            throw new BridgeError("INVALID_CONSENT_EDGE", "A consent edge requires two distinct normalized aliases.");
         }
         const resolve = (alias) => {
             if (requireAvailable)
                 return this.requireAvailableRoute(state, alias);
             const route = state.routes.find((candidate) => candidate.alias === alias);
             if (route === undefined) {
-                throw new BridgeError("PAIR_ROUTE_NOT_FOUND", "The pair references a route that is not registered.");
+                throw new BridgeError("CONSENT_EDGE_ROUTE_NOT_FOUND", "The consent edge references a route that is not registered.");
             }
             return route;
         };
-        const claude = resolve(input.claudeAlias);
-        const codex = resolve(input.codexAlias);
-        if (claude.binding.provider !== "claude" ||
-            claude.registrationMode !== "selected_live_peer" ||
-            codex.binding.provider !== "codex" ||
-            codex.registrationMode !== "explicit_opt_in" ||
-            claude.binding.hostId !== codex.binding.hostId) {
-            throw new BridgeError("INVALID_GATEWAY_PAIR", "A pair must connect one selected Claude route and one registered Codex route on the same host.");
-        }
-        return { claude, codex };
-    }
-    requireExactPair(state, claude, codex) {
-        const pair = state.pairs.find((candidate) => candidate.claudeAlias === claude.alias &&
-            candidate.codexAlias === codex.alias);
+        const left = resolve(input.aliases[0]);
+        const right = resolve(input.aliases[1]);
+        if (left.binding.provider === right.binding.provider ||
+            left.binding.hostId !== right.binding.hostId) {
+            throw new BridgeError("INVALID_CONSENT_EDGE", "A consent edge must connect distinct providers on the same host.");
+        }
+        return [left, right];
+    }
+    requireExactConsentEdge(state, left, right) {
+        const endpoints = canonicalConsentEndpoints(left, right);
+        const pair = state.consentEdges.find((candidate) => consentEdgeKey(candidate.endpoints) === consentEdgeKey(endpoints));
         if (pair === undefined ||
-            pair.claudeOwnerLease !== claude.binding.ownerLease ||
-            pair.codexOwnerLease !== codex.binding.ownerLease) {
+            pair.endpoints.some((endpoint, index) => endpoint.ownerLease !== endpoints[index].ownerLease)) {
             throw new BridgeError("SENDER_NOT_PAIRED", "The two exact route authorities do not share a consent edge.");
         }
         return pair;
     }
-    validateTransientNativeClaudePeer(state, peer, codexRoute) {
+    validateTransientNativeClaudePeer(state, peer, route) {
         if (!isObject(peer) ||
             !hasOnlyKeys(peer, ["alias", "binding"]) ||
             typeof peer.alias !== "string" ||
@@ -3687,17 +3156,16 @@ export class GatewayStore {
         }
         this.assertAllowedIdentity(endpointOf(peer.binding));
         const aliasHost = peer.alias.slice(peer.alias.lastIndexOf("@") + 1);
-        if (codexRoute.binding.provider !== "codex" ||
+        if (route.binding.provider === "claude" ||
             aliasHost !== peer.binding.hostId ||
-            peer.binding.hostId !== codexRoute.binding.hostId ||
-            peer.alias === codexRoute.alias) {
-            throw new BridgeError("NATIVE_PEER_SCOPE_MISMATCH", "The transient Claude peer and registered Codex route must have distinct aliases on the same allowlisted host.");
+            peer.binding.hostId !== route.binding.hostId ||
+            peer.alias === route.alias) {
+            throw new BridgeError("NATIVE_PEER_SCOPE_MISMATCH", "The transient Claude peer and registered route must be distinct providers on the same allowlisted host.");
         }
         const connector = state.connectors.find((candidate) => sameEndpoint(candidate, peer.binding));
         if (!connector ||
-            !["healthy", "degraded"].includes(connector.health) ||
-            connector.compatibility !== "compatible") {
-            throw new BridgeError("NATIVE_PEER_ENDPOINT_NOT_OBSERVED", "The transient Claude peer's exact compatible connector generation is not live.", true);
+            !["healthy", "degraded"].includes(connector.health)) {
+            throw new BridgeError("NATIVE_PEER_ENDPOINT_NOT_OBSERVED", "The transient Claude peer's exact connector generation is not live.", true);
         }
     }
     enqueueResolvedMessage(state, now, input, sides) {
@@ -3841,7 +3309,7 @@ export class GatewayStore {
         this.transientBodies.set(messageId, input.body);
         state.accounting.accepted += 1;
         state.accounting.bytesAccepted += bytes;
-        const pair = findPairForMessage(state, metadata);
+        const pair = findConsentEdgeForMessage(state, metadata);
         if (pair !== undefined) {
             pair.counters.accepted += 1;
             pair.counters.bytesAccepted += bytes;
@@ -3931,7 +3399,7 @@ export class GatewayStore {
         state.accounting.rejected += 1;
         if (sides.sourceRoute)
             sides.sourceRoute.counters.rejected += 1;
-        const pair = findPairForMessage(state, sides);
+        const pair = findConsentEdgeForMessage(state, sides);
         if (pair !== undefined) {
             pair.counters.rejected += 1;
             pair.updatedAt = now.toISOString();
@@ -4035,13 +3503,13 @@ export class GatewayStore {
             throw new BridgeError("INVALID_PROGRESS_WATCH", "The message watch activity is malformed or contradictory.");
         }
         const pair = sides.pair === true
-            ? state.pairs.find((candidate) => pairMatchesMessage(candidate, sides))
+            ? state.consentEdges.find((candidate) => consentEdgeMatchesMessage(candidate, sides))
             : undefined;
         const index = state.progressWatches.findIndex((watch) => watch.conversationId === activity.conversationId);
         const existing = state.progressWatches[index];
         if (existing !== undefined) {
             if (pair === undefined ||
-                !progressWatchMatchesPair(existing, pair) ||
+                !progressWatchMatchesConsentEdge(existing, pair) ||
                 !((sides.sourceAlias === existing.ownerAlias &&
                     sides.targetAlias === existing.workerAlias) ||
                     (sides.sourceAlias === existing.workerAlias &&
@@ -4080,12 +3548,8 @@ export class GatewayStore {
             conversationId: activity.conversationId,
             ownerAlias: sides.sourceAlias,
             workerAlias: sides.targetAlias,
-            ownerLease: sides.sourceAlias === pair.claudeAlias
-                ? pair.claudeOwnerLease
-                : pair.codexOwnerLease,
-            workerLease: sides.targetAlias === pair.claudeAlias
-                ? pair.claudeOwnerLease
-                : pair.codexOwnerLease,
+            ownerLease: pair.endpoints.find(({ alias }) => alias === sides.sourceAlias).ownerLease,
+            workerLease: pair.endpoints.find(({ alias }) => alias === sides.targetAlias).ownerLease,
             idleMs: activity.openIdleMs,
             at: now.getTime(),
         });
@@ -4121,7 +3585,7 @@ export class GatewayStore {
         });
     }
     installProgressWatch(state, watch, pair, now) {
-        const replacedIndex = state.progressWatches.findIndex((candidate) => progressWatchMatchesPair(candidate, pair));
+        const replacedIndex = state.progressWatches.findIndex((candidate) => progressWatchMatchesConsentEdge(candidate, pair));
         if (replacedIndex < 0 &&
             state.progressWatches.length >=
                 (this.config.limits.maxWatches ?? PROGRESS_WATCH_DEFAULT_CAPACITY)) {
@@ -4183,11 +3647,11 @@ export class GatewayStore {
         this.appendProgressWatchEvents(state, events);
         state.progressWatches = retained;
     }
-    settleProgressWatchesForPair(state, pair, now) {
+    settleProgressWatchesForConsentEdge(state, pair, now) {
         const retained = [];
         const events = [];
         for (const watch of state.progressWatches) {
-            if (!progressWatchMatchesPair(watch, pair)) {
+            if (!progressWatchMatchesConsentEdge(watch, pair)) {
                 retained.push(watch);
                 continue;
             }
@@ -4203,7 +3667,7 @@ export class GatewayStore {
     finishMetadata(state, metadata, deliveryState, now, safeErrorCode) {
         const counterKey = deliveryState;
         state.accounting[counterKey] += 1;
-        const pair = findPairForMessage(state, metadata);
+        const pair = findConsentEdgeForMessage(state, metadata);
         if (pair !== undefined) {
             pair.counters[counterKey] += 1;
             pair.updatedAt = now.toISOString();
@@ -4263,12 +3727,12 @@ export class GatewayStore {
         }
         return byMessageId;
     }
-    validateAffectedPairInFlightSettlements(state, pair, requested) {
+    validateAffectedConsentEdgeInFlightSettlements(state, pair, requested) {
         if (requested.length > this.config.limits.maxInFlightMessages) {
             throw new BridgeError("INVALID_PAIR_TERMINATION_PLAN", "Unpairing requires one normalized terminal settlement per affected in-flight message.");
         }
         const affectedIds = new Set(state.inFlight
-            .filter((item) => pairMatchesMessage(pair, item))
+            .filter((item) => consentEdgeMatchesMessage(pair, item))
             .map((item) => item.messageId));
         const byMessageId = new Map();
         for (const settlement of requested) {
@@ -4321,10 +3785,10 @@ export class GatewayStore {
         }
         return settlements;
     }
-    terminateAffectedPairMessages(state, pair, now, safeErrorCode, inFlightSettlements) {
+    terminateAffectedConsentEdgeMessages(state, pair, now, safeErrorCode, inFlightSettlements) {
         const settlements = [];
-        const queued = state.queue.filter((item) => pairMatchesMessage(pair, item));
-        state.queue = state.queue.filter((item) => !pairMatchesMessage(pair, item));
+        const queued = state.queue.filter((item) => consentEdgeMatchesMessage(pair, item));
+        state.queue = state.queue.filter((item) => !consentEdgeMatchesMessage(pair, item));
         for (const item of queued) {
             this.transientBodies.delete(item.messageId);
             state.accounting.queuedBytes -= item.bytes;
@@ -4334,8 +3798,8 @@ export class GatewayStore {
             const deadlineReached = Date.parse(item.deadlineAt) <= now.getTime();
             settlements.push(this.finishMetadata(state, item, deadlineReached ? "expired" : "abandoned", now, deadlineReached ? "MESSAGE_EXPIRED" : safeErrorCode));
         }
-        const inFlight = state.inFlight.filter((item) => pairMatchesMessage(pair, item));
-        state.inFlight = state.inFlight.filter((item) => !pairMatchesMessage(pair, item));
+        const inFlight = state.inFlight.filter((item) => consentEdgeMatchesMessage(pair, item));
+        state.inFlight = state.inFlight.filter((item) => !consentEdgeMatchesMessage(pair, item));
         for (const item of inFlight) {
             const requested = inFlightSettlements.get(item.messageId);
             if (requested === undefined) {
@@ -4372,13 +3836,11 @@ export class GatewayStore {
         }
         for (const connector of state.connectors) {
             connector.health = "offline";
-            connector.compatibility = "expired";
             connector.updatedAt = now.toISOString();
             connector.safeErrorCode = "REOBSERVATION_REQUIRED";
         }
         for (const route of state.routes) {
             route.state = route.enabled ? "stale" : "disabled";
-            route.compatibility = "expired";
             route.updatedAt = now.toISOString();
             route.safeErrorCode = "REOBSERVATION_REQUIRED";
             route.queueDepth = 0;
@@ -4424,7 +3886,7 @@ export class GatewayStore {
         const route = this.requireAnyJournalRoute(state, journal);
         this.assertSuccessionLedgerEmpty(state, route.alias);
         this.assertNewSuccessionIdentityAvailable(state, route, journal.new);
-        this.replaceCodexRouteForSuccession(state, route, journal.new, now, "stale", "expired");
+        this.replaceCodexRouteForSuccession(state, route, journal.new, now, "stale");
         state.codexSuccession = {
             ...journal,
             stage: "recovery_forbidden",
@@ -4650,7 +4112,7 @@ export class GatewayStore {
             // Never remove a lock that cannot be proven to belong to this instance.
         }
     }
-    async loadStateFile(now) {
+    async loadStateFile(_now) {
         let body;
         try {
             body = await this.readPrivateFile(this.stateFilePath, GATEWAY_MAX_STATE_FILE_BYTES);
@@ -4668,23 +4130,15 @@ export class GatewayStore {
         catch {
             throw new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state is not valid JSON.");
         }
-        parsed = migratePreUnconfirmedCounters(parsed);
-        parsed = migratePreSuccessionJournal(parsed);
-        parsed = migratePrePairGraph(parsed);
-        parsed = migratePreProgressWatches(parsed);
-        parsed = migratePreCompatibilityAttestations(parsed);
-        parsed = migratePreCodexEndpointRefreshJournal(parsed);
-        parsed = migratePreCodexOrphanRemovalJournal(parsed);
-        parsed = migrateLegacyHopCounts(parsed);
-        parsed = migrateLegacyCompatibilityCertifications(parsed);
-        parsed = migrateV14ProgressWatchState(parsed, now.toISOString());
         if (!isPersistedState(parsed)) {
             throw new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state failed strict schema validation.");
         }
         if (parsed.routes.some((route) => !this.config.allowedHosts.includes(route.binding.hostId)) ||
             parsed.connectors.some((connector) => !this.config.allowedHosts.includes(connector.hostId)) ||
             parsed.routes.length > this.config.limits.maxRoutes ||
-            parsed.connectors.length > this.config.allowedHosts.length * 2 ||
+            parsed.connectors.length >
+                this.config.allowedHosts.length * gatewayProviders.length ||
+            parsed.consentEdges.length > this.config.limits.maxConsentEdges ||
             parsed.rateBuckets.length > this.config.limits.maxRoutes ||
             parsed.progressWatches.length >
                 (this.config.limits.maxWatches ?? PROGRESS_WATCH_DEFAULT_CAPACITY) ||