borgmcp-server 0.1.7 → 0.1.9

package/src/cli.ts

@@ -1,9 +1,11 @@
 import type { ServerService } from "./service.js";
+import { RuntimeUpdateFailure } from "./runtime-operator.js";
 
 export interface CliIo {
   readonly stdout: (message: string) => void;
   readonly stderr: (message: string) => void;
   readonly readSecret?: (prompt: string) => Promise<string>;
+  readonly isTTY?: boolean;
 }
 
 const usage = `Usage: borg-mcp-server <command> [options]
@@ -11,6 +13,9 @@ const usage = `Usage: borg-mcp-server <command> [options]
 Commands:
   setup [--reinitialize]  Prepare an offline server installation
   start    Start the server process
+  status [--json]  Report exact local runtime evidence
+  update [--json]  Verify and activate the latest server artifact
+  invite   Create a single-use invitation in an interactive terminal.
   client-rotate <client-id>  Rotate one client credential offline
   client-revoke <client-id>  Revoke one client and its credentials offline
   client-grant <client-id> <cube-id> <read|write|manage>  Set one offline cube grant
@@ -58,11 +63,109 @@ export async function runCli(
         return 1;
       }
       const result = await service.setup({ reinitialize: extraArgs[0] === "--reinitialize" });
-      io.stdout(`Server setup complete.\nRecovery credential (shown once; keep offline): ${result.recoveryCredential}\nOwner enrollment invitation (single-use, shown once; enroll the owner client): ${result.initialInvitation}\nSetup created no cube.\nNext: start the server with \`borg-mcp-server start\`.`);
+      const artifactIdentity = result.artifact === undefined
+        ? "borgmcp-server@unavailable"
+        : `borgmcp-server@${result.artifact.version}`;
+      const artifact = result.artifact === undefined
+        ? "Artifact: unavailable"
+        : `Artifact: ${artifactIdentity} (${result.artifact.integrity})`;
+      if (io.isTTY === false) {
+        io.stdout(JSON.stringify({
+          status: "prepared",
+          artifact: artifactIdentity,
+          build_identity: result.artifact?.sourceSha ?? null,
+          owner_access: "prepared",
+          process: "stopped",
+        }));
+        return 0;
+      }
+      if ("existing" in result) {
+        io.stdout([
+          "Local server is already prepared.",
+          artifact,
+          `Build identity: ${result.artifact?.sourceSha ?? "unavailable"}`,
+          "Data and identity: unchanged",
+          "No server process started.",
+          "Next: borg-mcp-server start",
+        ].join("\n"));
+        return 0;
+      }
+      io.stdout([
+        "Local server setup completed.",
+        artifact,
+        "Local owner access: prepared.",
+        "No server process started.",
+        "Next: start the server, then run borg assimilate.",
+      ].join("\n"));
       return 0;
     case "start":
       await service.start(extraArgs);
       return 0;
+    case "status": {
+      if (extraArgs.length > 1 || (extraArgs.length === 1 && extraArgs[0] !== "--json") ||
+          service.status === undefined) return invalidArguments(io);
+      const status = await service.status();
+      if (extraArgs[0] === "--json" || io.isTTY === false) {
+        io.stdout(JSON.stringify({
+          status: status.status,
+          artifact: status.artifact === null
+            ? null
+            : `borgmcp-server@${status.artifact.version}`,
+          artifact_integrity: status.artifact?.integrity ?? null,
+          build_identity: status.buildIdentity,
+          endpoint: status.endpoint,
+          mode: status.mode,
+          data_identity: status.dataIdentity,
+        }));
+      } else {
+        io.stdout(renderRuntimeStatus(status));
+      }
+      return 0;
+    }
+    case "update": {
+      if (extraArgs.length > 1 || (extraArgs.length === 1 && extraArgs[0] !== "--json") ||
+          service.update === undefined) return invalidArguments(io);
+      let result: Awaited<ReturnType<NonNullable<ServerService["update"]>>>;
+      try {
+        result = await service.update();
+      } catch (error) {
+        if (!(error instanceof RuntimeUpdateFailure)) throw error;
+        renderUpdateFailure(error, io, extraArgs[0] === "--json" || io.isTTY === false);
+        return 1;
+      }
+      if (extraArgs[0] === "--json" || io.isTTY === false) {
+        io.stdout(JSON.stringify({
+          status: result.outcome,
+          artifact: `borgmcp-server@${result.artifact.version}`,
+          artifact_integrity: result.artifact.integrity,
+          build_identity: result.runningIdentity?.source_sha ?? result.artifact.sourceSha,
+          mode: result.outcome === "updated" ? "managed" : "stopped",
+          data_identity: result.dataIdentity,
+        }));
+      } else if (result.outcome === "updated") {
+        io.stdout([
+          `Verifying borgmcp-server@${result.artifact.version}...`,
+          "Artifact verified and activated.",
+          "Restarting the verified local server...",
+          `Local server is running.`,
+          `Artifact: borgmcp-server@${result.artifact.version} (${result.artifact.integrity})`,
+          `Build identity: ${result.runningIdentity?.source_sha ?? "unavailable"}`,
+          "Data and identity: preserved",
+          "Next: borg-mcp-server status",
+        ].join("\n"));
+      } else {
+        io.stdout([
+          `Verifying borgmcp-server@${result.artifact.version}...`,
+          "Artifact verified and activated.",
+          "No server process started.",
+          `Artifact: borgmcp-server@${result.artifact.version} (${result.artifact.integrity})`,
+          `Build identity: ${result.artifact.sourceSha ?? "unavailable"}`,
+          "Data and identity: preserved",
+          "Next: borg-mcp-server start",
+        ].join("\n"));
+      }
+      return 0;
+    }
     case "client-rotate":
       if (extraArgs.length !== 1 || service.rotateClient === undefined) return invalidArguments(io);
       io.stdout(`Client credential rotated (shown once): ${await service.rotateClient(extraArgs[0]!)}`);
@@ -115,6 +218,16 @@ export async function runCli(
       }
       return 0;
     }
+    case "invite": {
+      if (extraArgs.length !== 0 || service.invite === undefined) return invalidArguments(io);
+      if (io.isTTY !== true) {
+        io.stderr("Invitation creation requires an interactive terminal.");
+        return 1;
+      }
+      const invitation = await service.invite();
+      io.stdout(`Invitation (single-use; shown once): ${invitation}\nShare it only with the intended recipient.`);
+      return 0;
+    }
     case "help":
     case "--help":
     case "-h":
@@ -127,6 +240,63 @@ export async function runCli(
   }
 }
 
+function renderUpdateFailure(failure: RuntimeUpdateFailure, io: CliIo, machine: boolean): void {
+  const state = failure.code === "ARTIFACT_VERIFICATION_FAILED"
+    ? "verification_failed"
+    : failure.recovery === "restored"
+      ? "restored"
+      : failure.recovery === "stopped"
+        ? "stopped"
+        : "recovery_failed";
+  if (machine) {
+    io.stdout(JSON.stringify({
+      status: "failed",
+      error_code: failure.code,
+      recovery: state,
+      data_identity: "preserved",
+    }));
+    return;
+  }
+  if (failure.code === "ARTIFACT_VERIFICATION_FAILED") {
+    io.stderr([
+      "Update stopped: artifact verification failed.",
+      "No activation occurred.",
+      "The last verified runtime remains available.",
+      "Next: borg-mcp-server status",
+    ].join("\n"));
+    return;
+  }
+  io.stderr([
+    "Update stopped: activation did not complete.",
+    failure.recovery === "restored"
+      ? "The last verified runtime was restored."
+      : failure.recovery === "stopped"
+        ? "The server stopped safely."
+        : "Recovery did not complete; inspect server status.",
+    "Data and identity: preserved",
+    "Next: borg-mcp-server status",
+  ].join("\n"));
+}
+
+function renderRuntimeStatus(status: Awaited<ReturnType<NonNullable<ServerService["status"]>>>): string {
+  const heading = status.status === "running"
+    ? status.buildIdentity === null
+      ? "Local server is reachable, but its running build identity is unavailable."
+      : "Local server is running."
+    : "Local server is stopped.";
+  const artifact = status.artifact === null
+    ? "Artifact: unavailable"
+    : `Artifact: borgmcp-server@${status.artifact.version} (${status.artifact.integrity})`;
+  return [
+    heading,
+    artifact,
+    `Build identity: ${status.buildIdentity ?? "unavailable"}`,
+    `Endpoint: ${status.endpoint ?? "unavailable"}`,
+    `Mode: ${status.mode}`,
+    `Data and identity: ${status.dataIdentity}`,
+  ].join("\n");
+}
+
 function parseClientInviteArguments(
   args: readonly string[],
 ): { readonly cubeSelector?: string; readonly access?: "read" | "write" | "manage" } | undefined {

package/src/coordination-api.ts

@@ -21,7 +21,10 @@ import {
 import type { CredentialAuthority } from "./credentials.js";
 import {
   CursorExpiredError,
+  AttachDroneEvictedError,
+  AttachSessionExpiredError,
   AttachSessionRejectedError,
+  AttachSessionRevokedError,
   AccessDeniedError,
   CreateCubeConflictError,
   DefaultRoleRequiredError,
@@ -132,6 +135,15 @@ export class CoordinationApi {
             ? failure(426, error.code, "Unsupported protocol version.", requestId)
             : failure(400, "INVALID_INPUT", "Invalid protocol request.", requestId);
         }
+        if (error instanceof AttachDroneEvictedError) {
+          return failure(410, ErrorCode.DRONE_EVICTED, error.message, requestId);
+        }
+        if (error instanceof AttachSessionExpiredError) {
+          return failure(401, ErrorCode.AUTH_EXPIRED, error.message, requestId);
+        }
+        if (error instanceof AttachSessionRevokedError) {
+          return failure(401, ErrorCode.SESSION_REVOKED, error.message, requestId);
+        }
         if (error instanceof AttachSessionRejectedError) {
           return failure(401, ErrorCode.SESSION_REJECTED, error.message, requestId);
         }

package/src/credentials.ts

@@ -43,6 +43,9 @@ export interface CubeInvitationResult extends InvitationCubeScope {
 
 export type SeatAttachResponse = SeatAttachRecord;
 
+export const DRONE_SESSION_TTL_MS = 86_400_000;
+export const DRONE_SESSION_RENEWAL_WINDOW_MS = DRONE_SESSION_TTL_MS / 2;
+
 export class CredentialDigester {
   readonly #key: Buffer;
 
@@ -124,6 +127,22 @@ export class LiveCredentialRegistry {
     }
   }
 
+  renew(identity: string, expiresInMs: number): void {
+    const sessions = this.#sessions.get(identity);
+    if (sessions === undefined) return;
+    for (const controller of [...sessions]) {
+      const timer = this.#timers.get(controller);
+      if (timer !== undefined) clearTimeout(timer);
+      if (expiresInMs <= 0) {
+        this.#expire(controller);
+        continue;
+      }
+      const renewedTimer = setTimeout(() => this.#expire(controller), expiresInMs);
+      renewedTimer.unref();
+      this.#timers.set(controller, renewedTimer);
+    }
+  }
+
   activeSessionCount(clientId: string): number {
     return this.#sessions.get(clientId)?.size ?? 0;
   }
@@ -191,6 +210,13 @@ export class CredentialAuthority {
     return this.#createInvitation("client", ttlMs);
   }
 
+  createInvitationForOwnerCredential(clientCredential: string, ttlMs: number): string | null {
+    const principal = this.authenticate(`Bearer ${clientCredential}`);
+    if (principal?.kind !== "client" ||
+        !this.#store.clientHasServerCapability(principal.id, "create_cube")) return null;
+    return this.#createInvitation("client", ttlMs);
+  }
+
   createCubeInvitation(
     recoveryCredential: string,
     cubeSelector: { readonly kind: "id" | "name"; readonly value: string },
@@ -287,7 +313,7 @@ export class CredentialAuthority {
 
   authenticateStatus(
     authorization: string | undefined,
-  ): Principal | "missing" | "invalid" | "revoked" | "evicted" {
+  ): Principal | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" {
     if (authorization === undefined) return "missing";
     const secret = bearerSecret(authorization);
     const clientDigest = safeDigest(this.#digester, secret, "client");
@@ -304,9 +330,9 @@ export class CredentialAuthority {
     }
     if (droneValid) {
       if (drone!.evictedAt !== null) return "evicted";
-      if (drone!.revokedAt != null || drone!.expiresAt <= this.#clock().toISOString()) {
-        return "revoked";
-      }
+      if (drone!.revokedAt != null) return "revoked";
+      if (drone!.takenOver) return "rejected";
+      if (drone!.expiresAt <= this.#clock().toISOString()) return "expired";
       return droneSessionPrincipal({
         id: drone!.sessionId,
         clientId: drone!.clientId,
@@ -326,6 +352,7 @@ export class CredentialAuthority {
       readonly priorDroneId?: string;
     },
   ): SeatAttachResponse {
+    const now = this.#clock();
     const record = store.attachSeat({
       cubeId: request.cubeId,
       roleId: request.roleId,
@@ -334,8 +361,12 @@ export class CredentialAuthority {
       sessionId: randomUUID(),
       credentialId: randomUUID(),
       credentialDigest: this.#digester.digest(request.sessionCredential, "drone-session"),
-      expiresAt: new Date(this.#clock().getTime() + 86_400_000).toISOString(),
+      expiresAt: new Date(now.getTime() + DRONE_SESSION_TTL_MS).toISOString(),
+      renewIfExpiresAtOrBefore: new Date(
+        now.getTime() + DRONE_SESSION_RENEWAL_WINDOW_MS,
+      ).toISOString(),
     });
+    this.#registry.renew(record.sessionId, new Date(record.expiresAt).getTime() - now.getTime());
     if (record.result === "created") {
       this.#debugLogger.emit({
         event: "credential",

package/src/debug-log.ts

@@ -3,6 +3,7 @@ import type { Principal } from "./principal.js";
 export type DebugRoute =
   | "health"
   | "protocol"
+  | "runtime"
   | "enrollment_exchange"
   | "client_attach"
   | "cubes"
@@ -21,7 +22,7 @@ export type DebugRoute =
 export type DebugEvent =
   | { readonly event: "startup"; readonly bindMode: "loopback" | "lan"; readonly port: number; readonly dataDirectory: "configured" | "tls_only" }
   | { readonly event: "lifecycle"; readonly action: "listening" | "stopped" }
-  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
+  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
   | { readonly event: "activity_append"; readonly cubeId: string; readonly entryId: string; readonly principal: Principal; readonly droneId: string | null; readonly visibility: "broadcast" | "direct"; readonly recipientDroneIds: readonly string[] }
   | { readonly event: "cursor_replay"; readonly mode: "page" | "sse"; readonly cubeId: string; readonly cursorId: string | null; readonly returnedCount: number; readonly behindBy: number; readonly truncated: boolean }
   | { readonly event: "ack_write"; readonly cubeId: string; readonly entryId: string; readonly kind: "ack" | "claim"; readonly principal: Principal }
@@ -158,8 +159,8 @@ function enumValue<const T extends string>(value: unknown, allowed: readonly T[]
 }
 
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-const DEBUG_ROUTES: readonly DebugRoute[] = ["health", "protocol", "enrollment_exchange", "client_attach", "cubes", "cube", "cube_roles", "cube_role", "cube_role_section_patch", "cube_taxonomy_patch", "cube_drones", "cube_logs", "cube_acks", "cube_decisions", "cube_stream", "unknown"];
+const DEBUG_ROUTES: readonly DebugRoute[] = ["health", "protocol", "runtime", "enrollment_exchange", "client_attach", "cubes", "cube", "cube_roles", "cube_role", "cube_role_section_patch", "cube_taxonomy_patch", "cube_drones", "cube_logs", "cube_acks", "cube_decisions", "cube_stream", "unknown"];
 const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OTHER"] as const;
-const AUTH_RESULTS = ["not_required", "missing", "invalid", "revoked", "evicted", "accepted"] as const;
+const AUTH_RESULTS = ["not_required", "missing", "invalid", "expired", "revoked", "evicted", "rejected", "accepted"] as const;
 const AUTHZ_RESULTS = ["not_checked", "accepted", "denied_or_not_found"] as const;
 const CREDENTIAL_ACTIONS = ["invitation_created", "enrollment_accepted", "enrollment_rejected", "session_created", "session_revoked", "client_rotated", "client_revoked"] as const;

package/src/https-server.ts

@@ -17,6 +17,7 @@ import { resolveBindOptions, type BindOptionsInput } from "./network-policy.js";
 import type { CoordinationRequest, CoordinationResponse } from "./coordination-api.js";
 import type { Principal } from "./principal.js";
 import { disabledDebugLogger, type DebugLogger, type DebugRoute } from "./debug-log.js";
+import { RUNTIME_INFO_PATH, type RuntimeBuildIdentity } from "./runtime-identity.js";
 
 export interface ServiceLimits {
   readonly maxConnections: number;
@@ -39,7 +40,7 @@ export interface ServiceLimits {
 
 export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxConnections: 100,
-  maxConnectionsPerAddress: 25,
+  maxConnectionsPerAddress: 30,
   maxRequestsPerWindow: 120,
   maxRequestsPerAddressWindow: 600,
   maxRequestsGlobalWindow: 5_000,
@@ -48,7 +49,7 @@ export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxStreamsPerCredential: 8,
   maxHeaderBytes: 16_384,
   maxRequestBodyBytes: 65_536,
-  maxRequestsPerSocket: 100,
+  maxRequestsPerSocket: 0,
   requestTimeoutMs: 15_000,
   tlsHandshakeTimeoutMs: 10_000,
   headersTimeoutMs: 10_000,
@@ -63,9 +64,10 @@ export interface RequestHandlerContext {
   readonly authorizeCoordination?: (
     authorization: string | undefined,
     signal: AbortSignal,
-  ) => Promise<Principal | "missing" | "invalid" | "revoked" | "evicted">;
+  ) => Promise<Principal | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected">;
   readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
   readonly debugLogger: DebugLogger;
+  readonly runtimeIdentity?: RuntimeBuildIdentity;
 }
 
 export interface HttpsServerOptions {
@@ -80,8 +82,10 @@ export interface HttpsServerOptions {
   readonly handleCoordination?: RequestHandlerContext["handleCoordination"];
   readonly limits?: ServiceLimits;
   readonly debugLogger?: DebugLogger;
+  readonly runtimeIdentity?: RuntimeBuildIdentity;
   readonly testHooks?: {
     readonly identifyRemoteAddress?: (socket: Socket) => string;
+    readonly identifyConnectionAddress?: (socket: Socket) => string;
   };
 }
 
@@ -100,6 +104,15 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
   validateLimits(limits);
   validateTlsCertificate(options.tls.cert, bind.host, bind.mode, options.tls.ca);
   const handlerContext = createRequestHandlerContext(options);
+  const identifyRemoteAddress = options.testHooks?.identifyRemoteAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const identifyConnectionAddress = options.testHooks?.identifyConnectionAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const addressConnectionLimiter = new AddressConnectionLimiter(
+    limits.maxConnectionsPerAddress,
+    limits.maxConnections,
+    identifyConnectionAddress,
+  );
 
   const server = createServer(
     {
@@ -112,11 +125,19 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
       headersTimeout: limits.headersTimeoutMs,
       keepAliveTimeout: limits.keepAliveTimeoutMs,
     },
-    createRequestListener(handlerContext, limits, options.testHooks?.identifyRemoteAddress),
+    createRequestListener(
+      handlerContext,
+      limits,
+      identifyRemoteAddress,
+      (socket) => addressConnectionLimiter.isRejected(socket),
+    ),
   );
 
-  const acceptedSockets = applyServerLimits(server, limits);
-  server.on("secureConnection", (socket) => socket.disableRenegotiation());
+  const acceptedSockets = applyServerLimits(server, limits, addressConnectionLimiter);
+  server.on("secureConnection", (socket) => {
+    socket.disableRenegotiation();
+    addressConnectionLimiter.admit(socket);
+  });
   server.on("tlsClientError", (_error, socket) => {
     handlerContext.debugLogger.emit({ event: "transport_rejection", reason: "tls_client_error" });
     socket.destroy();
@@ -165,6 +186,7 @@ export function createRequestHandlerContext(
     ...(options.handleCoordination === undefined
       ? {}
       : { handleCoordination: options.handleCoordination }),
+    ...(options.runtimeIdentity === undefined ? {} : { runtimeIdentity: options.runtimeIdentity }),
     debugLogger: options.debugLogger ?? disabledDebugLogger,
   });
 }
@@ -173,6 +195,7 @@ function createRequestListener(
   context: RequestHandlerContext,
   limits: ServiceLimits,
   identifyRemoteAddress: (socket: Socket) => string = (socket) => socket.remoteAddress ?? "unknown",
+  isConnectionRejected: (socket: Socket) => boolean = () => false,
 ): (request: IncomingMessage, response: ServerResponse) => void {
   const admissionLimiter = new PreAuthAdmissionLimiter(limits);
   const credentialRateLimiter = new RequestRateLimiter(limits, limits.maxRequestsPerWindow);
@@ -204,6 +227,11 @@ function createRequestListener(
     };
     response.once("finish", emitDebug);
     response.once("close", emitDebug);
+    if (isConnectionRejected(request.socket)) {
+      request.resume();
+      sendRateLimited(response, 1);
+      return;
+    }
     const controller = new AbortController();
     response.once("close", () => controller.abort());
     let timer: NodeJS.Timeout | undefined;
@@ -318,7 +346,7 @@ async function handleRequest(
     return;
   }
 
-  if (isCoordinationPath(path) && context.handleCoordination !== undefined) {
+  if (isAuthenticatedPath(path) && context.authorizeCoordination !== undefined) {
     let decoded: unknown;
     if (requestBody.length === 0) {
       decoded = undefined;
@@ -330,12 +358,7 @@ async function handleRequest(
       }
     }
     const authorization = request.headers.authorization;
-    const authorizeCoordination = context.authorizeCoordination;
-    if (authorizeCoordination === undefined) {
-      sendJson(response, 500, protocolError("INTERNAL_ERROR", "Coordination authentication is unavailable."), true);
-      return;
-    }
-    const authentication = await authorizeCoordination(authorization, signal);
+    const authentication = await context.authorizeCoordination(authorization, signal);
     trace.authentication = typeof authentication === "string" ? authentication : "accepted";
     if (signal.aborted) return;
     if (typeof authentication === "string") {
@@ -343,16 +366,32 @@ async function handleRequest(
         sendJson(response, 410, protocolError(ErrorCode.DRONE_EVICTED, "Authentication failed."));
         return;
       }
-      const code = authentication === "revoked"
-        ? "SESSION_REVOKED"
+      const code = authentication === "expired"
+        ? ErrorCode.AUTH_EXPIRED
+        : authentication === "revoked" ? ErrorCode.SESSION_REVOKED
+        : authentication === "rejected" ? ErrorCode.SESSION_REJECTED
         : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
       sendJson(response, 401, protocolError(code, "Authentication failed."));
       return;
     }
     trace.principal = authentication;
-    const clientIdentity = `client:${authentication.kind === "drone-session"
-      ? authentication.clientId
-      : authentication.id}`;
+    if (path === RUNTIME_INFO_PATH) {
+      if (request.method !== "GET" || requestBody.length !== 0) {
+        sendEmpty(response, request.method === "GET" ? 400 : 405, true);
+        return;
+      }
+      if (context.runtimeIdentity === undefined) {
+        sendEmpty(response, 404);
+        return;
+      }
+      sendJson(response, 200, context.runtimeIdentity);
+      return;
+    }
+    if (context.handleCoordination === undefined) {
+      sendJson(response, 500, protocolError("INTERNAL_ERROR", "Coordination handling is unavailable."), true);
+      return;
+    }
+    const clientIdentity = credentialRateLimitIdentity(authentication, request.method, path);
     const credentialRetry = credentialRateLimiter.consume(clientIdentity);
     if (credentialRetry !== null) return sendRateLimited(response, credentialRetry);
     const query = parseCoordinationQuery(request.url, path);
@@ -393,7 +432,7 @@ async function handleRequest(
 interface RequestTrace {
   readonly route: DebugRoute;
   readonly method: string;
-  authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted";
+  authentication: "not_required" | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" | "accepted";
   principal?: Principal;
 }
 
@@ -407,6 +446,7 @@ function debugRoute(rawUrl: string | undefined): DebugRoute {
   if (path === null) return "unknown";
   if (path === HEALTH_PATH) return "health";
   if (path === PROTOCOL_INFO_PATH) return "protocol";
+  if (path === RUNTIME_INFO_PATH) return "runtime";
   if (path === ENROLLMENT_EXCHANGE_PATH) return "enrollment_exchange";
   if (path === ATTACH_PATH) return "client_attach";
   if (path === "/api/cubes") return "cubes";
@@ -592,7 +632,28 @@ function isCoordinationPath(path: string | null): path is string {
     path?.startsWith("/api/cubes/") === true;
 }
 
-function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Socket> {
+function isAuthenticatedPath(path: string | null): path is string {
+  return path === RUNTIME_INFO_PATH || isCoordinationPath(path);
+}
+
+function credentialRateLimitIdentity(
+  principal: Principal,
+  method: string | undefined,
+  path: string,
+): string {
+  const routineRead = (method === "GET" && !path.endsWith("/stream")) ||
+    (method === "PUT" && (path.endsWith("/logs") || path.endsWith("/decisions")));
+  if (principal.kind === "drone-session" && routineRead) {
+    return `drone-session:${principal.id}`;
+  }
+  return `client:${principal.kind === "drone-session" ? principal.clientId : principal.id}`;
+}
+
+function applyServerLimits(
+  server: HttpsServer,
+  limits: ServiceLimits,
+  addressConnectionLimiter: AddressConnectionLimiter,
+): Set<Socket> {
   server.maxConnections = limits.maxConnections;
   server.maxRequestsPerSocket = limits.maxRequestsPerSocket;
   server.requestTimeout = limits.requestTimeoutMs;
@@ -602,27 +663,63 @@ function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Sock
     Math.min(limits.handlerTimeoutMs * 2, 2_147_483_647),
     (socket) => socket.destroy(),
   );
-  const addressConnections = new ConcurrentQuota(limits.maxConnectionsPerAddress);
   const acceptedSockets = new Set<Socket>();
   server.on("connection", (socket) => {
     const tracked = socket as Socket;
     acceptedSockets.add(tracked);
     tracked.once("close", () => acceptedSockets.delete(tracked));
-    const identity = tracked.remoteAddress ?? "unknown";
-    const release = addressConnections.acquire(identity);
+    addressConnectionLimiter.admitRaw(tracked);
+  });
+  return acceptedSockets;
+}
+
+class AddressConnectionLimiter {
+  readonly #rawConnections: ConcurrentQuota;
+  readonly #connections: ConcurrentQuota;
+  readonly #rejected = new WeakSet<Socket>();
+  readonly #identifyRemoteAddress: (socket: Socket) => string;
+
+  constructor(
+    limit: number,
+    globalLimit: number,
+    identifyRemoteAddress: (socket: Socket) => string,
+  ) {
+    // Keep exactly one per-address raw socket available beyond normal secure
+    // admission so it can receive a controlled HTTP 429 after TLS. All later
+    // raw sockets are rejected before they can consume the global pool.
+    this.#rawConnections = new ConcurrentQuota(Math.min(limit + 1, globalLimit));
+    this.#connections = new ConcurrentQuota(limit);
+    this.#identifyRemoteAddress = identifyRemoteAddress;
+  }
+
+  admitRaw(socket: Socket): void {
+    const release = this.#rawConnections.acquire(this.#identifyRemoteAddress(socket));
     if (release === null) {
       socket.destroy();
       return;
     }
     socket.once("close", release);
-  });
-  return acceptedSockets;
+  }
+
+  admit(socket: Socket): void {
+    const release = this.#connections.acquire(this.#identifyRemoteAddress(socket));
+    if (release === null) {
+      this.#rejected.add(socket);
+      return;
+    }
+    socket.once("close", release);
+  }
+
+  isRejected(socket: Socket): boolean {
+    return this.#rejected.has(socket);
+  }
 }
 
 function validateLimits(limits: ServiceLimits): void {
   for (const [name, value] of Object.entries(limits)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new Error(`${name} must be a positive safe integer.`);
+    if (!Number.isSafeInteger(value) || value < 0 || (value === 0 && name !== "maxRequestsPerSocket")) {
+      const range = name === "maxRequestsPerSocket" ? "non-negative" : "positive";
+      throw new Error(`${name} must be a ${range} safe integer.`);
     }
   }
   if (limits.headersTimeoutMs > limits.requestTimeoutMs) {