borgmcp 5.5.0 → 5.7.0

package/dist/representative-listener.js

@@ -0,0 +1,293 @@
+/** Supervised body-free wake channel; independent of the lazy MCP tools lease. */
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { borgConfigRoot } from './private-root.js';
+import { acquireStreamLease, readOwnershipSnapshot, STREAM_OWNER_STALE_MS } from './stream-owner.js';
+import { representativeOwnerDeps } from './representative-owner.js';
+import { createListenerInbox } from './representative-listener-store.js';
+import { streamOnce, streamReconnectDelay } from './log-stream.js';
+import { resolveRepresentativeContext } from './representative-cmd.js';
+import { DroneEvictedError, CubeDeletedError } from './drone-lifecycle.js';
+import { BorgServerTrustError, BorgServerUnreachableError } from './server-errors.js';
+import { isTransportFailure } from './seat-probe.js';
+import { readBorgServerTrustIdentity } from './server-trust.js';
+import { RepresentativeError, verifyLiveBinding } from './representative-core.js';
+import { bindingFingerprint } from './representative-store.js';
+function listenerOwnerDeps(binding) {
+    const authority = createHash('sha256').update(JSON.stringify([binding.origin, binding.trustIdentity])).digest('hex');
+    return { ...representativeOwnerDeps(binding), locksDir: join(borgConfigRoot(), 'representative-listener-locks', authority) };
+}
+export async function representativeListenerStatus(binding) {
+    const ownership = await readOwnershipSnapshot(binding.cubeId, binding.representativeDroneId, listenerOwnerDeps(binding));
+    let alive = false;
+    if (ownership.pid) {
+        try {
+            process.kill(ownership.pid, 0);
+            alive = true;
+        }
+        catch (error) {
+            alive = error.code === 'EPERM';
+        }
+    }
+    return { ...ownership, running: alive && (ownership.ageMs ?? Infinity) <= STREAM_OWNER_STALE_MS,
+        ...await createListenerInbox(binding).snapshot() };
+}
+function codeOf(error) {
+    if (error instanceof DroneEvictedError)
+        return 'DRONE_EVICTED';
+    if (error instanceof CubeDeletedError)
+        return 'CUBE_DELETED';
+    if (error instanceof BorgServerTrustError)
+        return 'TRUST_CHANGED';
+    return typeof error?.code === 'string' ? error.code : 'LISTENER_ERROR';
+}
+function terminalReason(error) {
+    const code = codeOf(error);
+    if (code === 'DRONE_EVICTED' || code === 'CUBE_DELETED' || code === 'SEAT_UNAVAILABLE')
+        return 'evicted';
+    if (code === 'BINDING_MISMATCH' || code === 'COORDINATOR_UNAVAILABLE')
+        return 'rebound';
+    if (code.includes('TRUST'))
+        return 'trust-changed';
+    if (['SESSION_REVOKED', 'SESSION_REJECTED', 'CREDENTIAL_REJECTED'].includes(code))
+        return 'revoked';
+    return undefined;
+}
+export async function runListener(command, deps, options = {}) {
+    const emit = async (event) => {
+        deps.stdout(JSON.stringify(event) + '\n');
+        // The command exits after its final event; wait for the pipe to flush.
+        await new Promise((resolve, reject) => process.stdout.write('', error => error ? reject(error) : resolve()));
+    };
+    let lease = null;
+    let timer;
+    let started = false, reason, active;
+    const abort = new AbortController();
+    let pending = Promise.resolve();
+    const serial = (fn) => {
+        const result = pending.then(fn);
+        pending = result.catch(() => { });
+        return result;
+    };
+    const stop = (why) => { reason ??= why; abort.abort(); };
+    const signal = () => stop('signal');
+    let outputBroken = false;
+    const outputError = () => { outputBroken = true; reason = 'fatal'; abort.abort(); };
+    process.stdout.on('error', outputError);
+    const exitCode = () => reason === 'signal' ? 0 : reason === 'fatal' ? 1 : 4;
+    try {
+        let worktree = command.worktree ?? deps.cwd();
+        try {
+            worktree = realpathSync(worktree);
+        }
+        catch { /* resolve refuses missing bindings */ }
+        worktree = deps.findProjectRoot(worktree);
+        const ctx = await resolveRepresentativeContext(worktree, deps);
+        // Only this server step maps transport failures to SERVER_UNREACHABLE; typed
+        // rejections keep their binding codes and storage keeps STORAGE_REFUSED.
+        await verifyLiveBinding(ctx).catch((error) => {
+            throw isTransportFailure(error) && !(error instanceof BorgServerUnreachableError)
+                ? new BorgServerUnreachableError('Borg server unreachable during startup verification', { cause: error }) : error;
+        });
+        const binding = ctx.binding;
+        active = (await deps.hydrateSeat(worktree));
+        const ownerDeps = listenerOwnerDeps(binding);
+        lease = await acquireStreamLease(binding.cubeId, binding.representativeDroneId, STREAM_OWNER_STALE_MS, ownerDeps);
+        if (!lease) {
+            const owner = await readOwnershipSnapshot(binding.cubeId, binding.representativeDroneId, ownerDeps);
+            await emit({ event: 'refused', code: 'REPRESENTATIVE_LISTENER_OWNED', exit_code: 3,
+                owner_pid: owner.pid ?? null, owner_started_at: owner.startedAt ?? null });
+            return 3;
+        }
+        const guard = async () => {
+            if (abort.signal.aborted)
+                throw new Error('listener stopped');
+            const current = await deps.store.getBinding(worktree);
+            if (!current || JSON.stringify([current.origin, current.trustIdentity, current.cubeId, current.representativeDroneId, current.coordinatorDroneId, current.boundAt]) !==
+                JSON.stringify([binding.origin, binding.trustIdentity, binding.cubeId, binding.representativeDroneId, binding.coordinatorDroneId, binding.boundAt])) {
+                stop('rebound');
+                throw new RepresentativeError('BINDING_MISMATCH', 'Representative binding changed');
+            }
+            const saved = await deps.hydrateSeat(worktree);
+            if (!saved) {
+                stop('revoked');
+                throw new RepresentativeError('SEAT_UNAVAILABLE', 'Representative seat unavailable');
+            }
+            if (saved.serverTrustIdentity !== binding.trustIdentity) {
+                stop('trust-changed');
+                throw new BorgServerTrustError('Representative trust changed');
+            }
+            if (saved.cubeId !== binding.cubeId || saved.droneId !== binding.representativeDroneId || saved.apiUrl !== binding.origin) {
+                stop('rebound');
+                throw new RepresentativeError('BINDING_MISMATCH', 'Representative seat changed');
+            }
+            // Recheck authority trust while the stream stays open, not only on reconnect.
+            // Controlled transports may omit trust loading; production never does.
+            if (!options.streamDeps?.fetchImpl || options.streamDeps.loadTrust) {
+                try {
+                    // Read fresh: the loader's local-authority cache never observes a change.
+                    const identity = options.streamDeps?.loadTrust
+                        ? (await options.streamDeps.loadTrust(binding.origin)).identity
+                        : await readBorgServerTrustIdentity(binding.origin);
+                    if (identity !== binding.trustIdentity)
+                        throw new BorgServerTrustError('Representative authority trust changed');
+                }
+                catch (error) {
+                    stop('trust-changed');
+                    throw error;
+                }
+            }
+            const observed = await readOwnershipSnapshot(binding.cubeId, binding.representativeDroneId, ownerDeps);
+            if (observed.processNonce !== lease.record.processNonce) {
+                stop('lease-lost');
+                throw new Error('Listener ownership lost');
+            }
+        };
+        const inbox = createListenerInbox(binding, guard);
+        await inbox.snapshot(); // refuse unsafe persisted paths before emitting listening
+        process.once('SIGTERM', signal);
+        process.once('SIGINT', signal);
+        timer = setInterval(() => {
+            void serial(async () => { await guard(); if (!await lease.refresh())
+                stop('lease-lost'); }).catch(error => { if (!reason)
+                stop(terminalReason(error) ?? 'lease-lost'); });
+        }, options.heartbeatIntervalMs ?? 20_000);
+        let attempt = 0;
+        let consumerFailure;
+        let pendingGap;
+        // Failures of the listener's own guard, storage and output are fatal; every
+        // other non-terminal stream failure is transport and reconnects, as in the
+        // ordinary stream loop (pinned HTTPS surfaces raw errno/string codes).
+        const local = (fn) => async (...args) => {
+            try {
+                return await fn(...args);
+            }
+            catch (error) {
+                consumerFailure ??= error;
+                throw error;
+            }
+        };
+        while (!reason) {
+            const resumed = await inbox.cursor();
+            try {
+                consumerFailure = undefined;
+                await local(() => serial(guard))();
+                await streamOnce(active, resumed?.id ?? null, () => { }, {
+                    ...options.streamDeps, getCursor: local(async () => inbox.cursor()), abortSignal: abort.signal,
+                    consumer: {
+                        catchupCursor: await local(() => inbox.dedupeCursor())(),
+                        beforeEvent: local(() => serial(guard)),
+                        clearCursor: local(() => serial(async () => {
+                            const previous = await inbox.snapshot();
+                            await inbox.clearCursor();
+                            if (started)
+                                await emit({ event: 'gap', after: previous.watermark, reason: 'cursor-expired' });
+                            else
+                                pendingGap = previous.watermark;
+                        })),
+                        connected: local(() => serial(async () => {
+                            await guard();
+                            if (!started) {
+                                await emit({ event: 'listening', cube_id: binding.cubeId, drone_id: binding.representativeDroneId,
+                                    binding_fingerprint: bindingFingerprint(binding), ...await inbox.snapshot() });
+                                started = true;
+                                if (pendingGap !== undefined)
+                                    await emit({ event: 'gap', after: pendingGap, reason: 'cursor-expired' });
+                                if (command.replayAfter) {
+                                    const replay = await inbox.replay(command.replayAfter);
+                                    if (replay.missing)
+                                        await emit({ event: 'gap', after: command.replayAfter, reason: 'replay-checkpoint-missing' });
+                                    for (const hint of replay.hints) {
+                                        await guard();
+                                        await emit(hint);
+                                    }
+                                }
+                            }
+                            else
+                                await emit({ event: 'connected', resumed_from: resumed?.id ?? null });
+                        })),
+                        log: local((event, catchupCursor) => serial(async () => {
+                            await guard();
+                            const hint = await inbox.append({ ...event.data, id: event.id }, catchupCursor);
+                            if (hint) {
+                                await guard();
+                                await emit(hint);
+                            }
+                        })),
+                    },
+                });
+                attempt = 0;
+            }
+            catch (error) {
+                if (reason) {
+                    if (!started)
+                        throw error;
+                    break;
+                }
+                if (consumerFailure)
+                    throw consumerFailure;
+                const terminal = terminalReason(error);
+                if (terminal) {
+                    if (!started)
+                        throw error;
+                    stop(terminal);
+                    break;
+                }
+                deps.stderr(`Representative listener: ${error instanceof Error ? error.message : 'stream disconnected'}\n`);
+            }
+            if (reason)
+                break;
+            const delay = Math.round((options.reconnectDelay ?? streamReconnectDelay)(attempt++));
+            if (started)
+                await emit({ event: 'reconnecting', attempt, delay_ms: delay });
+            await new Promise(resolve => {
+                const done = () => { clearTimeout(timeout); abort.signal.removeEventListener('abort', done); resolve(); };
+                const timeout = setTimeout(done, delay);
+                abort.signal.addEventListener('abort', done, { once: true });
+                if (abort.signal.aborted)
+                    done();
+            });
+        }
+        return exitCode();
+    }
+    catch (error) {
+        deps.stderr(`Representative listener refused: ${error instanceof Error ? error.message : String(error)}\n`);
+        if (!started && (error instanceof RepresentativeError || terminalReason(error))) {
+            await emit({ event: 'refused', code: typeof error?.code === 'string' ? error.code : 'BACKEND_ERROR', exit_code: 2 });
+            return 2;
+        }
+        if (started)
+            reason = 'fatal';
+        else if (!outputBroken)
+            await emit({ event: 'refused', code: error instanceof BorgServerUnreachableError
+                    ? 'REPRESENTATIVE_LISTENER_SERVER_UNREACHABLE' : 'REPRESENTATIVE_LISTENER_STORAGE_REFUSED', exit_code: 1 });
+        return 1;
+    }
+    finally {
+        if (timer)
+            clearInterval(timer);
+        process.removeListener('SIGTERM', signal);
+        process.removeListener('SIGINT', signal);
+        await pending;
+        let releaseFailed = false;
+        try {
+            await lease?.release();
+        }
+        catch (error) {
+            releaseFailed = true;
+            reason = 'fatal';
+            deps.stderr(`Listener lease release failed: ${String(error)}\n`);
+        }
+        if (started && reason && !outputBroken) {
+            try {
+                await emit({ event: 'stopped', reason, exit_code: exitCode() });
+            }
+            catch { /* stdout failure is fatal to the host */ }
+        }
+        process.stdout.removeListener('error', outputError);
+        if (releaseFailed || outputBroken)
+            return 1;
+    }
+}
+//# sourceMappingURL=representative-listener.js.map

package/dist/representative-listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"representative-listener.js","sourceRoot":"","sources":["../src/representative-listener.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAoB,MAAM,mBAAmB,CAAC;AACvH,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAA8B,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAA8B,MAAM,2BAA2B,CAAC;AAU3F,SAAS,iBAAiB,CAAC,OAA8B;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrH,OAAO,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,+BAA+B,EAAE,SAAS,CAAC,EAAE,CAAC;AAC/H,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAA8B;IAC/E,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QACrD,OAAO,KAAK,EAAE,CAAC;YAAC,KAAK,GAAI,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,qBAAqB;QAC7F,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,iBAAiB;QAAE,OAAO,eAAe,CAAC;IAC/D,IAAI,KAAK,YAAY,gBAAgB;QAAE,OAAO,cAAc,CAAC;IAC7D,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,eAAe,CAAC;IAClE,OAAO,OAAQ,KAAa,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC3F,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACzG,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,SAAS,CAAC;IACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAoD,EAAE,IAA2B,EAAE,UAA2B,EAAE;IAEhH,MAAM,IAAI,GAAG,KAAK,EAAE,KAAc,EAAE,EAAE;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1C,uEAAuE;QACvE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC,CAAC;IACF,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,KAAiD,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,EAAE,MAA8B,EAAE,MAAkB,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,OAAO,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAI,EAAoB,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACnF,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAe,EAAE,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,WAAW,GAAG,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;QAC3F,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpD,MAAM,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;gBAC/E,CAAC,CAAC,IAAI,0BAA0B,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtH,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC;QAClH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;YACpG,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,SAAS,EAAE,CAAC;gBAChF,SAAS,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC/J,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACxJ,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;YAAC,CAAC;YACtH,IAAI,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;gBAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAAC,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;YACnJ,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,qBAAqB,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1H,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACpG,CAAC;YACD,8EAA8E;YAC9E,uEAAuE;YACvE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC;oBACH,0EAA0E;oBAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS;wBAC5C,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;wBAC/D,CAAC,CAAC,MAAM,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtD,IAAI,QAAQ,KAAK,OAAO,CAAC,aAAa;wBAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;gBACnH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBAAC,MAAM,KAAK,CAAC;gBAAC,CAAC;YACzD,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;YACvG,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAAC,CAAC;QAC/H,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,0DAA0D;QAClF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChE,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YACvB,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAM,CAAC,OAAO,EAAE;gBAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7K,CAAC,EAAE,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,eAAwB,CAAC;QAC7B,IAAI,UAAqC,CAAC;QAC1C,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,KAAK,GAAG,CAAyB,EAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,IAAO,EAAc,EAAE;YACzG,IAAI,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,eAAe,KAAK,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QAC7F,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,eAAe,GAAG,SAAS,CAAC;gBAC5B,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;oBACtD,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM;oBAC9F,QAAQ,EAAE;wBACR,aAAa,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,EAAE;wBACxD,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACvC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;4BACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;4BAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;4BACnE,IAAI,OAAO;gCAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;;gCAC1F,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC;wBACvC,CAAC,CAAC,CAAC;wBACH,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;4BACvC,MAAM,KAAK,EAAE,CAAC;4BACd,IAAI,CAAC,OAAO,EAAE,CAAC;gCACb,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,qBAAqB;oCAC/F,mBAAmB,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gCACjF,OAAO,GAAG,IAAI,CAAC;gCACf,IAAI,UAAU,KAAK,SAAS;oCAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gCACxG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oCACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oCACvD,IAAI,MAAM,CAAC,OAAO;wCAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;oCAClH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wCAAC,MAAM,KAAK,EAAE,CAAC;wCAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oCAAC,CAAC;gCACvE,CAAC;4BACH,CAAC;;gCAAM,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;wBAC/E,CAAC,CAAC,CAAC;wBACH,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;4BACrD,MAAM,KAAK,EAAE,CAAC;4BACd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;4BAChF,IAAI,IAAI,EAAE,CAAC;gCAAC,MAAM,KAAK,EAAE,CAAC;gCAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;4BAAC,CAAC;wBAChD,CAAC,CAAC,CAAC;qBACJ;iBACF,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,MAAM,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC;oBAAC,MAAM;gBAAC,CAAC;gBACjD,IAAI,eAAe;oBAAE,MAAM,eAAe,CAAC;gBAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC;YAC9G,CAAC;YACD,IAAI,MAAM;gBAAE,MAAM;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtF,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;gBAChC,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtG,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,EAAE,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5G,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,YAAY,mBAAmB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAQ,KAAa,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,GAAG,OAAO,CAAC;aACzB,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,YAAY,0BAA0B;oBACtG,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,CAAC;QACd,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YAAC,MAAM,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,aAAa,GAAG,IAAI,CAAC;YAAC,MAAM,GAAG,OAAO,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC3J,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,aAAa,IAAI,YAAY;YAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/representative-mcp.d.ts

@@ -2,8 +2,9 @@
  * Restricted stdio MCP facade for the human representative.
  *
  * A Borg server speaks pinned-TLS HTTPS, not MCP, so a generic MCP host reaches
- * it through this local stdio process. The surface is four tools: status, send
- * (to the ONE bound Coordinator), read (that Coordinator's replies) and ack.
+ * it through this local stdio process. The surface is five tools: status, send
+ * (to the ONE bound Coordinator), read (that Coordinator's replies), deliver
+ * (the host's durable delivery checkpoint) and ack.
  * There is deliberately no log/broadcast/dispatch, roster-management, grant,
  * evict, release, regen or server-lifecycle tool, and no dispatcher escape hatch.
  *
@@ -12,11 +13,17 @@
  */
 import type { Readable, Writable } from 'node:stream';
 import { type RepresentativeContext } from './representative-core.js';
-export declare const REPRESENTATIVE_TOOL_NAMES: readonly ["borg_representative-status", "borg_representative-send", "borg_representative-read", "borg_representative-ack"];
+export declare const REPRESENTATIVE_TOOL_NAMES: readonly ["borg_representative-status", "borg_representative-send", "borg_representative-read", "borg_representative-deliver", "borg_representative-ack"];
 export declare const REPRESENTATIVE_INSTRUCTIONS: string;
 export interface ServeRepresentativeOptions {
     /** Resolved on every call; a throw fails that call closed. */
     context: () => Promise<RepresentativeContext>;
+    /**
+     * The binding generation this process started with. Every call except status
+     * refuses with BINDING_MISMATCH, before any lease, ledger, checkpoint, cursor
+     * or network activity, once the saved binding's fingerprint differs.
+     */
+    pinnedFingerprint?: string;
     version: string;
     stdin?: Readable;
     stdout?: Writable;

package/dist/representative-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"representative-mcp.d.ts","sourceRoot":"","sources":["../src/representative-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAItD,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAIlC,eAAO,MAAM,yBAAyB,4HAK5B,CAAC;AAEX,eAAO,MAAM,2BAA2B,QAMV,CAAC;AA4F/B,MAAM,WAAW,0BAA0B;IACzC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA4DhE"}
+{"version":3,"file":"representative-mcp.d.ts","sourceRoot":"","sources":["../src/representative-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAItD,OAAO,EAUL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAKlC,eAAO,MAAM,yBAAyB,2JAM5B,CAAC;AAEX,eAAO,MAAM,2BAA2B,QAMV,CAAC;AA8G/B,MAAM,WAAW,0BAA0B;IACzC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAwEhE"}

package/dist/representative-mcp.js

@@ -2,8 +2,9 @@
  * Restricted stdio MCP facade for the human representative.
  *
  * A Borg server speaks pinned-TLS HTTPS, not MCP, so a generic MCP host reaches
- * it through this local stdio process. The surface is four tools: status, send
- * (to the ONE bound Coordinator), read (that Coordinator's replies) and ack.
+ * it through this local stdio process. The surface is five tools: status, send
+ * (to the ONE bound Coordinator), read (that Coordinator's replies), deliver
+ * (the host's durable delivery checkpoint) and ack.
  * There is deliberately no log/broadcast/dispatch, roster-management, grant,
  * evict, release, regen or server-lifecycle tool, and no dispatcher escape hatch.
  *
@@ -14,13 +15,15 @@ import { ErrorCode } from 'borgmcp-shared/protocol';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { REPRESENTATIVE_DELIVERY_NOTE, REPRESENTATIVE_MESSAGE_LIMIT_BYTES, RepresentativeError, ackRepresentativeReply, readRepresentativeReplies, representativeStatus, sendRepresentativeMessage, } from './representative-core.js';
-import { RepresentativeStoreError } from './representative-store.js';
+import { REPRESENTATIVE_DELIVERY_NOTE, REPRESENTATIVE_MESSAGE_LIMIT_BYTES, RepresentativeError, ackRepresentativeReply, deliverRepresentativeReplies, readRepresentativeReplies, serializeRepresentativeResult, representativeStatus, sendRepresentativeMessage, } from './representative-core.js';
+import { RepresentativeStoreError, bindingFingerprint } from './representative-store.js';
+import { createDeliveryStore } from './representative-delivery-store.js';
 import { createRepresentativeOwner } from './representative-owner.js';
 export const REPRESENTATIVE_TOOL_NAMES = [
     'borg_representative-status',
     'borg_representative-send',
     'borg_representative-read',
+    'borg_representative-deliver',
     'borg_representative-ack',
 ];
 export const REPRESENTATIVE_INSTRUCTIONS = 'You are connected as the human representative of one Borg cube: an automated delegate that relays the ' +
@@ -64,28 +67,45 @@ const TOOLS = [
     },
     {
         name: 'borg_representative-read',
-        description: 'Read unread replies from the bound Coordinator addressed to this representative. Replies arrive only when this tool ' +
-            'is called; there is no background wake. Each call DRAINS the whole fetched unread page for this drone — returned ' +
-            'replies and ignored entries alike (other drones\' entries are counted, never returned) — so they will not appear ' +
-            'unread again: persist the result, then route each reply by in_reply_to to its conversation or hold it for the human. If the host stops before persisting, the reply ' +
-            'is no longer in the unread view.',
+        description: 'Read the bound Coordinator\'s replies addressed to this representative that come after your delivered checkpoint, ' +
+            'oldest first. Reading changes nothing: the same replies return on every call until you call ' +
+            'borg_representative-deliver. Persist each reply durably, route it by in_reply_to or hold it for the human, then ' +
+            'deliver through the last one you persisted. At most `limit` replies and `max_bytes` of serialized result; a reply ' +
+            'larger than max_bytes is returned whole and alone with oversize:true, and the result never exceeds ' +
+            'max(max_bytes, 16384) bytes (oversize citations reduced to ids, documents_reduced:true). has_more means more ' +
+            'replies follow the window; an empty page never has has_more. ' +
+            'Stop routing if binding_fingerprint differs from the value you persisted at binding time.',
         inputSchema: {
             type: 'object',
             properties: {
                 include_broadcast: { type: 'boolean', description: 'Also return the Coordinator\'s cube-wide broadcasts (marked as such).' },
-                limit: {
-                    type: 'integer', minimum: 1, maximum: 200,
-                    description: 'Page-size hint, not a hard cap: a large unread backlog may return (and drain) more entries.',
+                limit: { type: 'integer', minimum: 1, maximum: 50, description: 'Hard cap on returned replies. Default 10.' },
+                max_bytes: {
+                    type: 'integer', minimum: 4096, maximum: 60000,
+                    description: 'Hard cap on the serialized result size in bytes. Default 32768.',
                 },
             },
             additionalProperties: false,
         },
     },
+    {
+        name: 'borg_representative-deliver',
+        description: 'Record that every reply up to and including `through` is durably persisted by the host. Only this call moves the ' +
+            'read window. `through` must be a reply borg_representative-read returned; the same or an older id is a no-op ' +
+            '(advanced:false). Call it only after durable persistence: a delivered reply is not returned again. It does not ' +
+            'notify the Coordinator; that is borg_representative-ack.',
+        inputSchema: {
+            type: 'object',
+            properties: { through: { type: 'string', description: 'entry_id of the last reply you persisted.' } },
+            required: ['through'],
+            additionalProperties: false,
+        },
+    },
     {
         name: 'borg_representative-ack',
         description: 'Signal to the Coordinator that one of its direct replies (entry_id from borg_representative-read) was received. ' +
-            'It is only that signal: it does not make delivery reliable, does not move or restore the unread cursor, and is ' +
-            'not needed for reading.',
+            'It is only that signal: it is not delivery, does not move the read window (that is borg_representative-deliver), ' +
+            'and is not needed for reading.',
         inputSchema: {
             type: 'object',
             properties: { entry_id: { type: 'string' } },
@@ -108,7 +128,7 @@ function errorBody(error) {
     };
 }
 const toolResult = (body, isError = false) => ({
-    content: [{ type: 'text', text: JSON.stringify(body, null, 2) }],
+    content: [{ type: 'text', text: serializeRepresentativeResult(body) }],
     ...(isError ? { isError: true } : {}),
 });
 export async function serveRepresentativeMcp(options) {
@@ -123,17 +143,24 @@ export async function serveRepresentativeMcp(options) {
                 throw new RepresentativeError(ErrorCode.INVALID_INPUT, `Unknown tool ${JSON.stringify(name)}; this connection exposes only the representative tools.`);
             }
             const ctx = await options.context();
+            const pinned = options.pinnedFingerprint ? { pinned_binding_fingerprint: options.pinnedFingerprint } : {};
             if (name === 'borg_representative-status') {
-                return toolResult({ ...await representativeStatus(ctx), ownership: await owner.snapshot(ctx.binding) });
+                return toolResult({ ...await representativeStatus(ctx), ...pinned, ownership: await owner.snapshot(ctx.binding) });
+            }
+            if (options.pinnedFingerprint && bindingFingerprint(ctx.binding) !== options.pinnedFingerprint) {
+                throw new RepresentativeError('BINDING_MISMATCH', 'The operator rebound this connection (a new binding generation) while it was running. Restart the MCP server to use the new binding.');
             }
+            // An untrustworthy delivery checkpoint stops every effect, not only read
+            // and deliver, so the refusal reaches the human. Read-only; status stays.
+            await createDeliveryStore(ctx.binding).load();
             await owner.ensure(ctx.binding);
             // Recheck at each network boundary, not just at tool dispatch: a process
             // may have paused or lost its lease while awaiting live verification.
             const backend = ctx.backend;
-            const guarded = { ...ctx, backend: Object.fromEntries(['whoami', 'roster', 'append', 'readUnread', 'readEntry', 'ack'].map((key) => [key, async (...args) => {
+            const guarded = { ...ctx, guard: () => owner.ensure(ctx.binding), backend: Object.fromEntries(['whoami', 'roster', 'append', 'readAfter', 'unreadCursor', 'readEntry', 'ack'].map((key) => [key, async (...args) => {
                         await owner.ensure(ctx.binding);
-                        if (key === 'readUnread')
-                            args[1] = () => owner.ensure(ctx.binding);
+                        if (key === 'readAfter')
+                            args[2] = () => owner.ensure(ctx.binding);
                         const result = await backend[key].apply(backend, args);
                         await owner.ensure(ctx.binding);
                         return result;
@@ -145,6 +172,8 @@ export async function serveRepresentativeMcp(options) {
                 }
                 case 'borg_representative-read':
                     return toolResult(await readRepresentativeReplies(guarded, args));
+                case 'borg_representative-deliver':
+                    return toolResult(await deliverRepresentativeReplies(guarded, args));
                 default:
                     return toolResult(await ackRepresentativeReply(guarded, args));
             }

package/dist/representative-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"representative-mcp.js","sourceRoot":"","sources":["../src/representative-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,4BAA4B;IAC5B,0BAA0B;IAC1B,0BAA0B;IAC1B,yBAAyB;CACjB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GACtC,wGAAwG;IACxG,mHAAmH;IACnH,2GAA2G;IAC3G,iHAAiH;IACjH,2EAA2E;IAC3E,4BAA4B,CAAC;AAE/B,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0HAA0H;YAC1H,gHAAgH;QAClH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,wHAAwH;YACxH,oHAAoH;YACpH,wGAAwG;YACxG,6GAA6G;QAC/G,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;gBACnE,aAAa,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;oBACzC,WAAW,EACT,6GAA6G;wBAC7G,qCAAqC;iBACxC;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,kCAAkC,SAAS,EAAE;gBAC5G,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gGAAgG;iBAC9G;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,CAAC;YAC9C,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sHAAsH;YACtH,mHAAmH;YACnH,mHAAmH;YACnH,sKAAsK;YACtK,kCAAkC;QACpC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,uEAAuE,EAAE;gBAC5H,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG;oBACzC,WAAW,EAAE,6FAA6F;iBAC3G;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kHAAkH;YAClH,iHAAiH;YACjH,yBAAyB;QAC3B,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC5C,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,oBAAoB,EAAE,KAAK;SAC5B;KACF;CACO,CAAC;AAEX,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;YACvD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAClE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACzE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtC,CAAC,CAAC;AAYH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC/D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAC3E,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9G,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,CAAE,yBAA+C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACzJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;gBAC1C,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBACrK,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAChC,IAAI,GAAG,KAAK,YAAY;4BAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBACpE,MAAM,MAAM,GAAG,MAAO,OAAO,CAAC,GAA2B,CAA8C,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;wBAC7H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAChC,OAAO,MAAM,CAAC;oBAChB,CAAC,CAAC,CAAC,CAA8B,EAAE,CAAC;YACpC,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,0BAA0B,CAAC,CAAC,CAAC;oBAChC,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5D,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;gBACxD,CAAC;gBACD,KAAK,0BAA0B;oBAC7B,OAAO,UAAU,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpE;oBACE,OAAO,UAAU,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAmB,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC;QAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,QAAQ,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACzF,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC"}
+{"version":3,"file":"representative-mcp.js","sourceRoot":"","sources":["../src/representative-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,yBAAyB,EACzB,6BAA6B,EAC7B,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,4BAA4B;IAC5B,0BAA0B;IAC1B,0BAA0B;IAC1B,6BAA6B;IAC7B,yBAAyB;CACjB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GACtC,wGAAwG;IACxG,mHAAmH;IACnH,2GAA2G;IAC3G,iHAAiH;IACjH,2EAA2E;IAC3E,4BAA4B,CAAC;AAE/B,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0HAA0H;YAC1H,gHAAgH;QAClH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,wHAAwH;YACxH,oHAAoH;YACpH,wGAAwG;YACxG,6GAA6G;QAC/G,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;gBACnE,aAAa,EAAE;oBACb,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;oBACzC,WAAW,EACT,6GAA6G;wBAC7G,qCAAqC;iBACxC;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,kCAAkC,SAAS,EAAE;gBAC5G,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gGAAgG;iBAC9G;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,CAAC;YAC9C,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,oHAAoH;YACpH,8FAA8F;YAC9F,kHAAkH;YAClH,oHAAoH;YACpH,qGAAqG;YACrG,+GAA+G;YAC/G,+DAA+D;YAC/D,2FAA2F;QAC7F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,uEAAuE,EAAE;gBAC5H,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE;gBAC7G,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;oBAC9C,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,mHAAmH;YACnH,+GAA+G;YAC/G,iHAAiH;YACjH,0DAA0D;QAC5D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE,EAAE;YACrG,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kHAAkH;YAClH,mHAAmH;YACnH,gCAAgC;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC5C,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,oBAAoB,EAAE,KAAK;SAC5B;KACF;CACO,CAAC;AAEX,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;YACvD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAClE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtC,CAAC,CAAC;AAkBH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAC/D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAC3E,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9G,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,CAAE,yBAA+C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACzJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;gBAC1C,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC/F,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,sIAAsI,CACvI,CAAC;YACJ,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;wBAC5N,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAChC,IAAI,GAAG,KAAK,WAAW;4BAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBACnE,MAAM,MAAM,GAAG,MAAO,OAAO,CAAC,GAA2B,CAA8C,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;wBAC7H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAChC,OAAO,MAAM,CAAC;oBAChB,CAAC,CAAC,CAAC,CAA8B,EAAE,CAAC;YACpC,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,0BAA0B,CAAC,CAAC,CAAC;oBAChC,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5D,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;gBACxD,CAAC;gBACD,KAAK,0BAA0B;oBAC7B,OAAO,UAAU,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpE,KAAK,6BAA6B;oBAChC,OAAO,UAAU,CAAC,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvE;oBACE,OAAO,UAAU,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAmB,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC;QAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,QAAQ,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACzF,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC"}

package/dist/representative-store.d.ts

@@ -11,6 +11,13 @@
  * holds message text (only a payload digest).
  */
 export declare function isRepresentativeUuid(value: unknown): value is string;
+/**
+ * Host fence for one binding generation: hex SHA-256 of the canonical JSON array
+ * [origin, trustIdentity, cubeId, representativeDroneId, coordinatorDroneId,
+ * boundAt]. It changes on every rebind (boundAt) and trust change, and carries
+ * no path or credential.
+ */
+export declare function bindingFingerprint(binding: RepresentativeBinding): string;
 export interface RepresentativeBinding {
     /** Canonical worktree holding the dedicated representative seat. */
     worktree: string;

package/dist/representative-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"representative-store.d.ts","sourceRoot":"","sources":["../src/representative-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAGD,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAEpF;AAED,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,0BAA0B,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;gBAAxB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAI/D;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACvE,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAChD,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,EAAE,KAAK,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAoED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAgB,yBAAyB,CAAC,SAAS,GAAE,MAAkC,GAAG,mBAAmB,CAgD5G"}
+{"version":3,"file":"representative-store.d.ts","sourceRoot":"","sources":["../src/representative-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAKzE;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAEpF;AAED,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,0BAA0B,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;gBAAxB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAI/D;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACvE,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAChD,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,EAAE,KAAK,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAoED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAgB,yBAAyB,CAAC,SAAS,GAAE,MAAkC,GAAG,mBAAmB,CAkD5G"}

package/dist/representative-store.js

@@ -11,6 +11,7 @@
  * holds message text (only a payload digest).
  */
 import { decodeUuid } from 'borgmcp-shared/protocol';
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { borgConfigRoot } from './private-root.js';
 import { shellEscape } from './shell-escape.js';
@@ -25,6 +26,18 @@ export function isRepresentativeUuid(value) {
     }
 }
 const SETTLED_REQUEST_LIMIT = 200;
+/**
+ * Host fence for one binding generation: hex SHA-256 of the canonical JSON array
+ * [origin, trustIdentity, cubeId, representativeDroneId, coordinatorDroneId,
+ * boundAt]. It changes on every rebind (boundAt) and trust change, and carries
+ * no path or credential.
+ */
+export function bindingFingerprint(binding) {
+    return createHash('sha256').update(JSON.stringify([
+        binding.origin, binding.trustIdentity, binding.cubeId,
+        binding.representativeDroneId, binding.coordinatorDroneId, binding.boundAt,
+    ])).digest('hex');
+}
 export function representativeRecoveryCommand(binding) {
     return `cd ${shellEscape(binding.worktree)} && borg representative prepare --coordinator ${shellEscape(binding.coordinatorLabel)} --role ${shellEscape(binding.representativeRoleName)} --rebind`;
 }
@@ -128,7 +141,9 @@ export function createRepresentativeStore(storePath = representativeStorePath())
                 throw new Error('Refusing to save an invalid representative binding');
             }
             const existing = txn.data.bindings[binding.worktree];
-            if (existing && sameSelection(existing, binding))
+            // An explicit rebind always starts a new generation (new boundAt, so a new
+            // binding_fingerprint), even for the same selection.
+            if (existing && sameSelection(existing, binding) && !options.rebind)
                 return 'unchanged';
             if (existing && !options.rebind) {
                 throw new RepresentativeStoreError('BINDING_CONFLICT', `This worktree is already bound to Coordinator ${existing.coordinatorLabel} in cube ${existing.cubeName}. ` +
@@ -137,7 +152,7 @@ export function createRepresentativeStore(storePath = representativeStorePath())
             txn.data.bindings[binding.worktree] = binding;
             // A different selection invalidates the old ledger: its post ids belong to
             // another cube/Coordinator conversation.
-            if (existing)
+            if (existing && !sameSelection(existing, binding))
                 delete txn.data.requests[binding.worktree];
             await txn.commit();
             return existing ? 'rebound' : 'created';