byollm 0.1.0-alpha.7 → 0.1.0-alpha.71

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.7`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.71`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@alpha`, or `npm install byollm@alpha`.
 >
@@ -11,14 +11,116 @@
 > npm assigns `latest` on a first publish and won't let it be removed, so a
 > bare install resolves here too. This notice is the only guard — deliberately
 > not an npm deprecation, which would read as *abandoned* rather than *early*.
-> Ask for `@alpha` explicitly so your lockfile records that you meant to.
+> Ask for `@alpha` explicitly so your lockfile records that you meant to.>
+> **`alpha.15` is a breaking wire change, and it breaks daemons and relays —
+> not app authors.** If you call `app.enqueue(...)` and read results, nothing
+> in your code changes. If you run a daemon or an upstream, every package must
+> move together: a mixed pair refuses on both sides, because both ends parse
+> `.strict()`.
+>
+> What moved, all of it reconciling the frozen `byollm_009` with its code:
+> `JobStub` gains `site` (the site's identity key id) and loses
+> `audienceAllow`; `ResultRequest` gains `leaseId`; `HeartbeatResponse` loses
+> `leases`, which nothing read; `WireErrorCode` gains `not-ready`,
+> `clock-skew` and `forbidden`, and `403` is `forbidden` rather than
+> `unauthorized`. `RESULT_PROVENANCE` is superseded by
+> `PROVENANCE_NAMES_DEVICE`. See `byollm_009` Amendment A.>
+> **`alpha.16` is a breaking wire change — daemons and relays again, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together: both ends parse `.strict()`, so a mixed pair
+> refuses.
+>
+> What moved, all of it Tier 2 of `cloud_008`: `model`, `backendClass` and
+> `durationMs` come off `ResultRequest` and are sealed **inside** the result
+> envelope as `SealedOutcome = { outcome, ran }` — so a daemon can no longer
+> declare a model it did not sign, and a relay carries neither.
+> `HeartbeatResponse` loses `leases` (nothing read it) and now reports real
+> cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
+> for 403, leaving `unauthorized` at exactly 401. The relay gained a
+> site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
+> `stub.audience`, and remembers a refusal.>
+> **`alpha.17` is additive** — no wire change. It exports `ReleaseReason`,
+> which `RoutingStore.releaseLeases` names and the package did not export, so
+> the interface was unimplementable outside this repo.>
+> **`alpha.18` is a breaking wire change — daemons and relays, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together.
+>
+> The **bearer token is gone**: off `PairPollResponse`, off the runner row,
+> off the daemon's pairings file, out of the adapter's schema. It was minted,
+> hashed and stored on two disks and never sent, looked up or compared —
+> `REQUESTS_SIGNED_NOT_BEARER` was enforced by signatures the whole time. If
+> you run the Supabase adapter, apply
+> `20260819000000_drop_runner_token.sql`; `byollm_approve_pairing` now takes
+> one argument. A pairings file written by an older daemon still loads.
+>
+> `model`, `backendClass` and `durationMs` moved **inside** the sealed result
+> (`SealedOutcome = { outcome, ran }`), so a daemon cannot declare a model it
+> did not sign and a relay carries none of them. Writing a `RoutingStore`?
+> `releaseLeases` takes an optional `reason` and `complete` requires
+> `leaseId`, and **an implementation that ignores either still typechecks** —
+> run the store contract tests.>
+> **`alpha.19` is additive on the wire and a behaviour change in every
+> store.** `ResultResponse` gains an optional `duplicate`. Nothing is removed,
+> so an older daemon keeps working — but the *order* two rules are checked in
+> has changed, and a `RoutingStore` implementation must change with it.
+>
+> `complete` now checks **terminal state before holder**, scoped to the device
+> that finished the job: a replay from that device is answered `duplicate:
+> true` with a 2xx, and anyone else gets exactly the refusal they would get
+> for a job that is not terminal. Previously `RESULT_IDEMPOTENT` held only
+> because the lease is nulled on success, so the holder check tripped first —
+> deleting the idempotency branch failed no test. Run the store contract
+> tests; the compiler cannot see this.
 >
 > **`alpha.3` is a breaking change.** A config naming `openai-http` with a
-> remote base URL and an offer scope wider than `self` is narrowed to `self`
+> remote base URL and an offer scope wider than `private` is narrowed to `private`
 > until you acknowledge the spend and set a daily ceiling:
 > `byollm offer <backend> public --cap <cents>`. Local base URLs are
 > unaffected. `byollm backends` shows the cost class per route.
 
+<!-- release-note 0.1.0-alpha.21 -->
+> [!NOTE]
+> **`0.1.0-alpha.20` is not a complete release — do not pin it.** Four
+> packages published and `@byollm/server` did not: a Sigstore
+> transparency-log 409 on its provenance attestation. The workflow's
+> "already published" guard correctly refuses to resume a partial publish,
+> so `0.1.0-alpha.71` is that release, whole.
+>
+> If you run the Supabase adapter, `alpha.21` needs
+> `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
+> ordering without the column it stores the grant in.
+
+<!-- release-note 0.1.0-alpha.40 -->
+**`byollm install` — stop keeping a terminal open.** The daemon can now run
+under your computer's own supervisor and restart itself if it stops: a launchd
+agent on macOS, a `systemd --user` unit on Linux, a logon task on Windows. All
+user-level — no root, no system directories, and `byollm uninstall` takes it
+away. `byollm status` gained a line saying whether it is actually supervised
+right now, including the state that matters most: installed but not running,
+which looks fine from an app's dashboard and serves nothing.
+
+If you are running via `npx`, install properly first (`npm install -g
+byollm@alpha`) — `install` refuses to supervise a copy in npx's cache, because
+npm deletes that directory and the service would fail at some later boot.
+
+<!-- release-note 0.1.0-alpha.41 -->
+**`onNoRunner` takes a string.** Your fallback answer is your own value, not
+wire data, and handing back a whole result record for it was ceremony — the
+README's own example got the shape wrong, which is how this was found.
+
+```ts
+const { outcome, fallback } = await job.result({
+  onNoRunner: () => runOnHostedModel(transcript),
+});
+```
+
+Whatever you return, `result()` labels it `fallback: true` — the stamp is
+applied by the wait, not taken from you, so an answer that did not run on
+somebody's device cannot be reported as though it did (`FALLBACK_LABELED`).
+Both delivery channels do it, polling and Supabase Realtime. Records still
+work; they just get labelled too.
+
 # `byollm`
 
 What end users run. Connects **outbound** to an app you trust, claims only the
@@ -79,12 +181,48 @@ password and never accepts a pasted secret.
 }
 ```
 
-A job's `kind` selects a route **you defined**. A job can never name a model, a
-URL, a path or a flag — there is no field on the wire for any of them.
+A job's `kind` selects a route **you defined**, and a job can never name a
+model, a URL, a path or a flag — there is no field on the wire for any of
+them. It cannot name one of your services either: a site declares what it
+*needs*, you decide which of your services answers that need, and the job
+carries the site's word for the need rather than yours for the answer.
+
+`byollm services` shows what is configured, what is healthy, what each one
+answers, and which is your own default. A service that is down is never
+advertised, so you never get work you cannot run.
+
+## Keep it running
+
+By default `byollm connect` and `byollm run` hold a terminal — close the
+window and the device stops serving. Nothing breaks (your pairings live in
+`~/.byollm/pairings.json` and survive), but the device goes quiet without
+telling anyone, and if it is on a team's roster, the first person to notice is
+a teammate whose job did not run.
+
+```bash
+byollm install     # keep running in the background, and restart if it stops
+byollm status      # says whether it is actually supervised right now
+byollm uninstall
+```
+
+It installs at the user level on every platform — a launchd `LaunchAgent` on
+macOS, a `systemd --user` unit on Linux, a logon task on Windows. No root, no
+system directories: it runs as you, it stops when you say so, and you can read
+every file it wrote. Output goes to `~/.byollm/service.log` on all three.
+
+Two things worth knowing:
 
-`byollm backends` shows what is configured, what is healthy, and what is
-therefore advertised. A backend that is down is never advertised, so you never
-get work you cannot run.
+- **Install `byollm` properly first.** `byollm install` refuses to supervise a
+  copy running from `npx`'s cache, because npm deletes that directory without
+  warning and the service would stop working at some later boot with nothing
+  to show for it. `npm install -g byollm@alpha` first.
+- **On Linux, `systemd --user` stops when you log out** unless lingering is
+  enabled. `byollm install` prints the one command for that rather than
+  running it — it changes something outside your session, so it is your call.
+
+`byollm status` reports three states, not two: running under supervision,
+*installed but not running* (the one that looks fine from an app's dashboard
+and serves nothing), and not installed at all.
 
 ## The trust surface
 
@@ -92,32 +230,69 @@ The meter is the product, and it gets the same care as the loop.
 
 ```bash
 byollm status         # what's connected, what's running, what you've done for others
+byollm sites          # which sites this device serves, and which are waiting on you
+byollm approve <site> # say yes to a site that asked
 byollm log            # every prompt that has ever run here
 byollm log --full     # the whole text, not the first line
 byollm pause          # stop claiming work
 byollm resume
 ```
 
+### A site cannot add itself
+
+Pairing is with an *app* — a hub, a relay, your own server — and one pairing
+can cover several sites. Which sites arrives on the heartbeat, from the same
+party that routes the work.
+
+So a site that turns up after pairing **waits**. It is listed by
+`byollm sites` with its fingerprint, nothing is claimed for it, and it starts
+being served the moment you run `byollm approve <site>`. Compare the
+fingerprint against what the site itself shows you before you do.
+
+The reason is narrow and worth stating: the daemon pins each site's keys so
+that the party routing a job cannot choose which key signed it. If that party
+could also *add* a site, it could generate a keypair, announce it, sign its
+own work with it, and every pin check downstream would pass — because the
+list they check against is the thing it wrote. Approving is the one step it
+cannot perform for you.
+
+A key that moves under a site you already approved is refused rather than
+replaced, for the life of the pairing — including when the site leaves the
+list and comes back. Rotation is an explicit path, not a silent swap.
+
 Every prompt is appended to `~/.byollm/ingress.log` **before** it executes, so
-a job that wedges the machine still leaves a record of what it was. The file is
+a job that wedges the computer still leaves a record of what it was. The file is
 JSONL, `0600`, and yours to read, grep and delete.
 
-## Lending your machine to other people
+## Lending your computer to other people
 
 Off by default. A fresh daemon runs your work and nobody else's.
 
 ```bash
-byollm allow https://your-app.com alice   # asks you to confirm, in plain words
-byollm allow --list                       # everyone who can use this machine
-byollm offer openai public --cap 250      # share a paid backend, with a ceiling
-byollm disallow https://your-app.com alice
+byollm offer qwen team --cap 250          # share a service with your team
+byollm offer qwen private                 # back to your work only
 ```
 
-The allowlist is **yours**, checked locally, keyed by `(app, user)`. An app
-saying "this runner is allowed" is not enough — your daemon decides. Community
-jobs are additionally rate-limited, capped daily, given a tighter resource
-budget, and their prompts are reduced to hashes after 7 days so you are not
-holding strangers' content indefinitely.
+Who "your team" is lives in the dashboard, not on this machine. Add somebody
+to your roster there and their next job can run here; remove them and their
+next claim fails, including work already queued.
+
+`byollm allow` and `byollm disallow` are gone. A device no longer keeps its own
+list of who may use it — that list had to be kept in step with the roster by
+hand, and two lists that must agree are one list and a bug waiting. Both
+commands leave a tombstone pointing at where the decision lives now.
+
+What replaced it is stronger than a list. Every teammate's job arrives carrying
+a **grant**: short-lived, single-use, signed by the control plane your device
+pinned when it paired, naming the site, the person, the job and the service to
+run. Your daemon checks that signature itself before it runs anything, so an
+app saying "this runner is allowed" is still not enough — and neither is a
+relay saying it. Jobs from other people are additionally rate-limited, capped
+daily, given a tighter resource budget, and their prompts are reduced to hashes
+after 7 days so you are not holding anybody else's content indefinitely.
+
+`public` is not a scope. It was one until 2026-08-26, and `byollm offer <service>
+public` now refuses by name rather than silently doing something else.
 
 **Your subscription-backed models are never part of this.** `claude-cli` is
 locked to your own work — a protocol rule, not a setting you can change.

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-3E2PGDHL.js";
+} from "./chunk-YJ3OSRLT.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));