drupal-mcp-connector 2.13.0 → 2.14.0

package/src/lib/relay/edge.js

@@ -1,8 +1,8 @@
 /**
- * Relay northbound edge (#232, #242, #244, #247, #250, #253, #256) — DEV-294
- * AC4, DEV-122 isolation, DEV-124 tenant routing, DEV-123 actor mapping,
- * DEV-125 policy digest and W&L-operated bundle promotion, DEV-126
- * attributable usage, quotas, and abuse signals.
+ * Relay northbound edge (#232, #242, #244, #247, #250, #253, #256) — the
+ * hosted-edge slice (#232), tenant isolation (#242), tenant routing (#244),
+ * actor mapping (#247), policy digest (#250) and W&L-operated bundle
+ * promotion (#253), attributable usage, quotas, and abuse signals (#256).
  *
  * Terminates northbound MCP over the OAuth resource server and fans requests
  * down outbound tenant-agent channels. The edge proposes; the tenant-side
@@ -23,7 +23,7 @@
  *     `agentId`; channel records may bind `sites`. A second unscoped agent
  *     or overlapping site claim is denied at hello. Fan-down selects the
  *     unique bound agent from server-owned grants. Single unscoped agent
- *     remains the DEV-294 compatibility path.
+ *     remains the #232 single-agent compatibility path.
  *   - Stateless MCP 2026-07-28 northbound: sessionful traffic is refused and
  *     no `Mcp-Session-Id` crosses in either direction.
  *   - Revocation is per-request with no grace window, for both credential
@@ -33,15 +33,40 @@
  *     the validated principal; with `auth.quotas` a tenant or principal
  *     without a row, an exhausted window, or a locked principal is refused
  *     with zero frames. `GET /usage` serves one tenant partition only.
+ *   - Independent evidence is optional and fail-closed. With
+ *     `auth.evidenceAnchor` a settled receipt is reconciled by stable
+ *     identifiers and submitted to an Ed25519 notary whose key the edge
+ *     never holds. `GET /assessor` serves one tenant-scoped, data-minimized
+ *     export bound to the live policy digest. Omit to keep the prior path
+ *     (404 on /assessor).
+ *   - Optional `auth.approvalRequiredTools` issues a one-use approval
+ *     before fan-down for named tools. Omit keeps the prior path.
+ *   - `offboardTenant` exports, then destroys, one grant-resolved tenant.
+ *     Omit to keep the prior path. Laboratory offboard, not hosted admission.
  */
 
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { readFileSync, statSync } from "node:fs";
+import { readFileSync, statSync, writeFileSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import { createServer as createNetServer } from "node:net";
 import { createServer as createTlsServer } from "node:tls";
+import { createAnchorClient } from "../anchor.js";
+import { createMemoryApproval } from "../contracts/approval.js";
 import { createLocalRelay } from "../contracts/relay.js";
+import { digestPayload } from "../contracts/types.js";
+import {
+  ABSENT,
+  approvalId,
+  createEvidenceLedger,
+  createExecutionChain,
+  delegationId,
+  digestExecution,
+  exportAssessor,
+  identityId,
+  normalizeEvidenceAnchor,
+  obligationId,
+} from "../evidence.js";
 import {
   createInboundHttpsAuth,
   formatWwwAuthenticate,
@@ -74,7 +99,7 @@ import {
 export const EDGE_MCP_PROTOCOL = "2026-07-28";
 
 /**
- * Revocation bound restated from the DEV-293 lab for both credential kinds.
+ * Revocation bound restated from the outbound-relay lab for both credential kinds.
  * The next request after revoke is denied; an in-flight request may finish.
  */
 export const EDGE_REVOCATION_BOUND = Object.freeze({
@@ -122,7 +147,7 @@ const SHARED_SCOPES = new Set(["tenant", "config"]);
 
 /**
  * Normalize a channel-record `sites` list. Empty / missing means unscoped
- * (legal only as the sole connected agent — the DEV-294 compatibility path).
+ * (legal only as the sole connected agent — the #232 compatibility path).
  *
  * @param {unknown} sites
  * @returns {string[]}
@@ -228,7 +253,7 @@ export function selectTenantSession({
  * Resolve tenant and target from server-owned grants. Caller `tenant` is a
  * confirming hint inside the grant, never authority. When `tenantGrants` is
  * omitted, tenant is derived from the unique agent covering the site grant
- * (DEV-122 / DEV-294 compatibility).
+ * (#242 / #232 compatibility).
  *
  * @param {object} params
  * @param {object|null} params.identity
@@ -306,7 +331,37 @@ function callerTenantHint(args = {}) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
-const CALLER_HINT_KEYS = Object.freeze(["tenant", "actor", "delegator", "policy", "digest"]);
+const CALLER_HINT_KEYS = Object.freeze([
+  "tenant", "actor", "delegator", "policy", "digest", "approvalId",
+]);
+
+function callerApprovalHint(args = {}) {
+  const value = new Map(Object.entries(args ?? {})).get("approvalId");
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+/**
+ * Optional tool names that require a one-use edge approval before fan-down.
+ * Omit / comment-only keeps the prior path. Anything else unreadable is
+ * invalid and refuses startup.
+ *
+ * @param {unknown} raw
+ * @returns {string[]|{invalid: true, reason: string}}
+ */
+export function normalizeApprovalRequiredTools(raw) {
+  if (raw === null || raw === undefined) return [];
+  if (Array.isArray(raw)) {
+    return [...new Set(
+      raw.map((name) => (typeof name === "string" ? name.trim() : ""))
+        .filter((name) => name && !name.startsWith("_")),
+    )];
+  }
+  if (typeof raw === "object") {
+    const entries = Object.entries(raw).filter(([key]) => key && !key.startsWith("_"));
+    if (!entries.length) return [];
+  }
+  return { invalid: true, reason: "approvalRequiredTools" };
+}
 
 function stripCallerHints(body) {
   const args = body?.params?.arguments;
@@ -385,11 +440,15 @@ export function fanDownHeaders(headers = {}) {
  *
  * @param {object} options
  * @param {string} options.filePath
- * @returns {{lookup: (token: string) => {agentId: string, revoked: boolean, sites: string[]|null}|null}}
+ * @returns {{
+ *   lookup: (token: string) => {agentId: string, revoked: boolean, sites: string[]|null}|null,
+ *   destroy: (agentId: string) => {ok: boolean, reason?: string},
+ * }}
  */
 export function createChannelCredentialStore({
   filePath,
   readFile = readFileSync,
+  writeFile = writeFileSync,
   stat = statSync,
 } = {}) {
   let cache = { mtimeMs: Number.NaN, agents: [], denyAll: true };
@@ -440,6 +499,47 @@ export function createChannelCredentialStore({
       }
       return null;
     },
+
+    /**
+     * Overwrite-then-remove one agent. The digest is replaced before the
+     * row is deleted so a leftover file cannot still match the token.
+     *
+     * @param {string} agentId
+     * @returns {{ok: true}|{ok: false, reason: string}}
+     */
+    destroy(agentId) {
+      const id = typeof agentId === "string" ? agentId.trim() : "";
+      if (!filePath) {
+        return { ok: false, reason: "unreadable" };
+      }
+      if (!id || id.startsWith("_")) {
+        return { ok: false, reason: "missing_agent" };
+      }
+      let raw;
+      try {
+        raw = JSON.parse(readFile(filePath, "utf8"));
+      } catch {
+        return { ok: false, reason: "unreadable" };
+      }
+      if (!raw.agents || typeof raw.agents !== "object" || Array.isArray(raw.agents)) {
+        return { ok: false, reason: "unreadable" };
+      }
+      const entry = raw.agents[id];
+      if (!entry || typeof entry !== "object") {
+        return { ok: false, reason: "missing_agent" };
+      }
+      try {
+        raw.agents[id] = { ...entry, tokenSha256: "0".repeat(64), revoked: true };
+        writeFile(filePath, JSON.stringify(raw));
+        delete raw.agents[id];
+        writeFile(filePath, JSON.stringify(raw));
+      } catch {
+        return { ok: false, reason: "unreadable" };
+      }
+      cache = { mtimeMs: Number.NaN, agents: [], denyAll: true };
+      load();
+      return { ok: true };
+    },
   };
 }
 
@@ -528,6 +628,20 @@ function byteLength(value) {
  * @param {?object} [options.usage] Optional usage ledger (usage.js). When
  *   present, every decision and receipt is recorded and `GET /usage` serves
  *   the caller's tenant partition. Omit to record nothing (404 on /usage).
+ * @param {object|null} [options.evidenceAnchor] Optional `auth.evidenceAnchor`
+ *   (`url` + pinned `publicKey`, or a test `submit`). When present, every
+ *   decision/receipt is reconciled and submitted to the notary; `GET /assessor`
+ *   serves the caller's tenant pack. A table the edge cannot pin refuses
+ *   startup. Omit to keep the prior path (404 on /assessor).
+ * @param {?object} [options.evidence] Optional evidence ledger (evidence.js).
+ *   Injected by tests; created automatically when `evidenceAnchor` is set.
+ * @param {string[]|null} [options.approvalRequiredTools] Optional
+ *   `auth.approvalRequiredTools`. Named tools receive a one-use
+ *   `require_approval` challenge before fan-down. Omit keeps the prior path.
+ *   An unreadable table refuses startup.
+ * @param {?object} [options.approvals] Optional approval ledger
+ *   (`createMemoryApproval`). Injected by tests; created automatically when
+ *   the tool list is non-empty.
  * @param {() => number} [options.now] Clock for quotas and cost signals.
  * @param {?object} [options.rateLimiter] Optional rate limiter (rate-limit.js).
  * @param {number} [options.fanDownTimeoutMs]
@@ -553,6 +667,10 @@ export async function startEdge({
   allowHttpLoopback = false,
   quotas = null,
   usage = null,
+  evidenceAnchor = null,
+  evidence = null,
+  approvalRequiredTools = null,
+  approvals = null,
   now = () => Date.now(),
   rateLimiter = null,
   fanDownTimeoutMs = DEFAULT_FAN_DOWN_TIMEOUT_MS,
@@ -603,6 +721,62 @@ export async function startEdge({
       + "(see createUsageLedger in usage.js), or be omitted.",
     );
   }
+  const anchorCfg = normalizeEvidenceAnchor(evidenceAnchor);
+  if (anchorCfg?.invalid) {
+    throw new EdgeStartupError(
+      `Relay edge refuses to start: auth.evidenceAnchor is not readable at "${anchorCfg.reason}". `
+      + "An evidence anchor the edge cannot pin is not independently verifiable; "
+      + "fix the row or remove the table.",
+    );
+  }
+  let evidenceLedger = evidence === null || evidence === undefined ? null : evidence;
+  if (evidenceLedger !== null && (
+    typeof evidenceLedger !== "object"
+    || typeof evidenceLedger.record !== "function"
+    || typeof evidenceLedger.query !== "function"
+  )) {
+    throw new EdgeStartupError(
+      "Relay edge evidence ledger must expose record() and query() "
+      + "(see createEvidenceLedger in evidence.js), or be omitted.",
+    );
+  }
+  let anchorClient = null;
+  if (anchorCfg) {
+    try {
+      anchorClient = createAnchorClient(anchorCfg);
+    } catch {
+      throw new EdgeStartupError(
+        "Relay edge refuses to start: auth.evidenceAnchor.publicKey is not a pinned Ed25519 key.",
+      );
+    }
+    evidenceLedger = evidenceLedger ?? createEvidenceLedger();
+  } else if (evidenceLedger) {
+    throw new EdgeStartupError(
+      "Relay edge refuses to start with an evidence ledger and no auth.evidenceAnchor. "
+      + "Unanchored evidence is not independently verifiable; omit both to keep the prior path.",
+    );
+  }
+  const requiredTools = normalizeApprovalRequiredTools(approvalRequiredTools);
+  if (requiredTools?.invalid) {
+    throw new EdgeStartupError(
+      `Relay edge refuses to start: auth.approvalRequiredTools is not readable at "${requiredTools.reason}". `
+      + "A gate the edge cannot name authorizes nobody; fix the list or remove it.",
+    );
+  }
+  const approvalRequired = new Set(requiredTools);
+  if (approvals !== null && approvals !== undefined && (
+    typeof approvals !== "object"
+    || typeof approvals.issue !== "function"
+    || typeof approvals.consume !== "function"
+  )) {
+    throw new EdgeStartupError(
+      "Relay edge approvals ledger must expose issue() and consume() "
+      + "(see createMemoryApproval), or be omitted.",
+    );
+  }
+  const approvalLedger = approvalRequired.size
+    ? (approvals ?? createMemoryApproval())
+    : null;
 
   /**
    * Record without ever changing the verdict: a metering failure is logged
@@ -617,6 +791,60 @@ export async function startEdge({
       return null;
     }
   }
+
+  /**
+   * Reconcile and (when the notary answers) independently anchor.
+   *
+   * @param {object} fields
+   * @returns {Promise<object|null>}
+   */
+  async function rememberNow(fields) {
+    if (!evidenceLedger) return null;
+    const decisionId = fields.decisionId || randomUUID();
+    const receiptId = fields.receiptId || decisionId;
+    const built = createExecutionChain({
+      tenant: fields.tenant,
+      identityId: identityId({
+        iss: auth.issuer,
+        sub: fields.sub,
+        clientId: fields.clientId,
+      }),
+      delegationId: delegationId(fields.delegator),
+      decisionId,
+      obligationId: obligationId(fields.obligations),
+      approvalId: approvalId(fields.approvalId),
+      localExecutionId: fields.requestId || ABSENT.localExecution,
+      targetRevision: fields.targetRevision,
+      receiptId,
+      policyDigest: fields.policyDigest,
+      outcome: fields.outcome,
+      requestId: fields.requestId,
+      receiptDecisionId: decisionId,
+      receiptTenant: fields.tenant,
+    });
+    const digest = digestExecution(built);
+    let inclusion = null;
+    if (anchorClient) {
+      const result = await anchorClient.submit(digest);
+      inclusion = result.ok ? result.inclusion : null;
+    }
+    return evidenceLedger.record(built, inclusion, anchorClient?.publicPin ?? null);
+  }
+
+  /**
+   * Fire-and-forget remember. Failures never change a northbound verdict.
+   *
+   * @param {object} fields
+   * @returns {void}
+   */
+  function remember(fields) {
+    void rememberNow(fields).catch(() => {
+      console.error("[drupal-mcp-edge] evidence record failed; the decision stands.");
+    });
+  }
+
+  /** clientId → { tenant, at }. Former principals see `offboarded`, not never-existed. */
+  const tombstones = new Map();
   if (typeof channelCredentials?.lookup !== "function") {
     throw new EdgeStartupError(
       "Relay edge requires an agent channel credential store; without one no "
@@ -777,7 +1005,7 @@ export async function startEdge({
       if (ABUSE_SIGNAL_ERRORS.has(error) && !SHARED_SCOPES.has(scope)) {
         quotaGate.noteDenial(principalKey);
       }
-      meter({
+      const denied = meter({
         phase: "decision",
         decision: "deny",
         reason: error,
@@ -792,6 +1020,17 @@ export async function startEdge({
         units: 1,
         bytesIn,
       });
+      remember({
+        tenant: usageTenant,
+        sub: identity.sub,
+        clientId: identity.clientId,
+        delegator: null,
+        decisionId: denied?.decisionId ?? null,
+        receiptId: denied?.decisionId ?? null,
+        requestId: null,
+        policyDigest,
+        outcome: "denied",
+      });
       jsonResponse(
         res,
         status,
@@ -800,6 +1039,11 @@ export async function startEdge({
       );
     }
 
+    if (tombstones.has(identity.clientId)) {
+      refuse(403, "offboarded");
+      return;
+    }
+
     // Entitlement at the seam, before anything about the tenant is revealed:
     // an unlisted client learns nothing, not even whether an agent exists.
     const granted = resolveGrantedSites(identity, catalog, grantTable);
@@ -898,6 +1142,61 @@ export async function startEdge({
       return;
     }
 
+    const callerApproval = callerApprovalHint(args);
+    let consumedApprovalId = null;
+    if (approvalLedger && isCall && toolName && approvalRequired.has(toolName)) {
+      const manifest = {
+        digest: digestPayload({
+          tool: toolName,
+          tenant: selected.tenant,
+          policyDigest: policyDigest || "",
+        }),
+      };
+      if (!callerApproval) {
+        const issued = approvalLedger.issue(manifest, principalKey);
+        // Usage stays allow/deny (#256). A challenge is not dispatched, so
+        // it meters as deny; evidence still records outcome require_approval.
+        const challenged = meter({
+          phase: "decision",
+          decision: "deny",
+          reason: "require_approval",
+          requestId: null,
+          tenant: selected.tenant,
+          principal,
+          principalKey,
+          method: body?.method ?? null,
+          tool: toolName,
+          policyDigest,
+          units: 1,
+          bytesIn,
+        });
+        remember({
+          tenant: selected.tenant,
+          sub: identity.sub,
+          clientId: identity.clientId,
+          delegator: mapped.delegator,
+          decisionId: challenged?.decisionId ?? null,
+          receiptId: challenged?.decisionId ?? null,
+          requestId: null,
+          policyDigest,
+          approvalId: issued.approvalId,
+          outcome: "require_approval",
+        });
+        jsonResponse(res, 403, {
+          error: "require_approval",
+          approvalId: issued.approvalId,
+        });
+        return;
+      }
+      try {
+        approvalLedger.consume(callerApproval, manifest.digest, principalKey);
+        consumedApprovalId = callerApproval;
+      } catch {
+        refuse(403, "not_entitled");
+        return;
+      }
+    }
+
     const id = randomUUID();
     const waited = broker.track(id, { owner: selected.session.agentId });
     const routedIdentity = identityWithGrant(identity, {
@@ -947,7 +1246,7 @@ export async function startEdge({
     });
 
     function receipt(fields) {
-      meter({
+      const usageRow = meter({
         phase: "receipt",
         requestId: id,
         decisionId: decisionRecord?.decisionId ?? null,
@@ -956,6 +1255,19 @@ export async function startEdge({
         durationMs: Math.max(0, now() - startedAt),
         ...fields,
       });
+      remember({
+        tenant: selected.tenant,
+        sub: identity.sub,
+        clientId: identity.clientId,
+        delegator: mapped.delegator,
+        decisionId: decisionRecord?.decisionId ?? null,
+        receiptId: usageRow?.receiptId ?? null,
+        requestId: id,
+        targetRevision: fields.revisionId || fields.targetRevision,
+        policyDigest,
+        approvalId: consumedApprovalId,
+        outcome: fields.outcome,
+      });
     }
 
     let result;
@@ -995,7 +1307,16 @@ export async function startEdge({
       return;
     }
     res.end(result.body ?? "");
-    receipt({ outcome: status >= 500 ? "failed" : "ok", reason: null, status, bytesOut });
+    const revision = typeof result.revisionId === "string" && result.revisionId.trim()
+      ? result.revisionId.trim()
+      : undefined;
+    receipt({
+      outcome: status >= 500 ? "failed" : "ok",
+      reason: null,
+      status,
+      bytesOut,
+      ...(revision ? { revisionId: revision } : {}),
+    });
   }
 
   /**
@@ -1036,6 +1357,10 @@ export async function startEdge({
       res.writeHead(auth.status, auth.headers).end(auth.body);
       return;
     }
+    if (tombstones.has(auth.identity.clientId)) {
+      jsonResponse(res, 403, { error: "offboarded" });
+      return;
+    }
     try {
       const query = new URL(String(req.url || "/usage"), "http://edge.invalid").searchParams;
       const read = readUsage({
@@ -1064,6 +1389,85 @@ export async function startEdge({
     }
   }
 
+  /**
+   * `GET /assessor` — the caller's own tenant pack (#261). Authenticated
+   * on the same resource server as `/mcp`; the tenant comes from
+   * `auth.tenantGrants`. Controls cite the live policy digest and
+   * independently anchored evidence ids; they never write `passed`.
+   * 404 without an evidence ledger.
+   */
+  async function serveAssessor(req, res) {
+    if (!evidenceLedger) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    if (req.method !== "GET") {
+      res.writeHead(405, { Allow: "GET" }).end("Method Not Allowed");
+      return;
+    }
+    if (rateLimiter) {
+      const verdict = rateLimiter.check(req.socket?.remoteAddress || "unknown");
+      if (!verdict.allowed) {
+        res.writeHead(429, { "Retry-After": String(verdict.retryAfterSec) }).end("Too Many Requests");
+        return;
+      }
+    }
+    let authResult;
+    try {
+      authResult = await inbound.authenticate(req);
+    } catch {
+      res.writeHead(401, {
+        "WWW-Authenticate": formatWwwAuthenticate({
+          error: "invalid_token",
+          errorDescription: "Token validation failed",
+        }),
+      }).end("Unauthorized");
+      return;
+    }
+    if (!authResult.ok) {
+      res.writeHead(authResult.status, authResult.headers).end(authResult.body);
+      return;
+    }
+    if (tombstones.has(authResult.identity.clientId)) {
+      jsonResponse(res, 403, { error: "offboarded" });
+      return;
+    }
+    try {
+      const query = new URL(String(req.url || "/assessor"), "http://edge.invalid").searchParams;
+      const bound = resolvePolicy({ identity: authResult.identity, policies: policyTable });
+      const digest = bound.policy ?? null;
+      let attested = false;
+      if (digest) {
+        for (const session of sessions.values()) {
+          if (session.attestedDigests?.has(digest)) {
+            attested = true;
+            break;
+          }
+        }
+      }
+      const pack = exportAssessor({
+        identity: authResult.identity,
+        tenantGrants: tenantGrantTable,
+        tenant: query.get("tenant"),
+        ledger: evidenceLedger,
+        policyDigest: digest,
+        attested,
+      });
+      if (!pack.ok) {
+        jsonResponse(res, 403, { error: "not_entitled" });
+        return;
+      }
+      jsonResponse(res, 200, pack);
+    } catch {
+      console.error("[drupal-mcp-edge] assessor export failed.");
+      if (res.headersSent) {
+        res.destroy();
+        return;
+      }
+      res.writeHead(500).end("Internal Server Error");
+    }
+  }
+
   const requestHandler = createMcpRequestHandler({
     authenticate: (req) => inbound.authenticate(req),
     protectedResource: inbound.protectedResource,
@@ -1081,10 +1485,15 @@ export async function startEdge({
   });
 
   function northbound(req, res) {
-    if (String(req.url || "").split("?")[0] === "/usage") {
+    const path = String(req.url || "").split("?")[0];
+    if (path === "/usage") {
       void serveUsage(req, res);
       return;
     }
+    if (path === "/assessor") {
+      void serveAssessor(req, res);
+      return;
+    }
     void requestHandler(req, res);
   }
   const northServer = hasTls
@@ -1106,6 +1515,140 @@ export async function startEdge({
     });
   }
 
+  /**
+   * Destroy one grant-resolved tenant after a fail-closed export probe.
+   * Revoke and destroy rows are anchored only after teardown succeeds.
+   * Laboratory offboard, not hosted admission.
+   *
+   * @param {object} params
+   * @param {string} [params.tenant] Confirming hint only. Authority is the
+   *   unique grant. A hint that does not match, or more than one grant,
+   *   is `not_entitled`.
+   * @param {{clientId: string, sub?: string, jti?: string}} params.identity
+   * @returns {Promise<{ok: true, export: object}|{ok: true, already: true}|{ok: false, reason: string}>}
+   */
+  async function offboardTenant({ tenant, identity } = {}) {
+    const clientId = typeof identity?.clientId === "string" ? identity.clientId.trim() : "";
+    if (!clientId) {
+      return { ok: false, reason: "not_entitled" };
+    }
+    if (tombstones.has(clientId)) {
+      return { ok: true, already: true };
+    }
+    if (!evidenceLedger || !anchorClient) {
+      return { ok: false, reason: "export_unavailable" };
+    }
+    const granted = tenantGrantTable
+      ? grantIds(new Map(Object.entries(tenantGrantTable)).get(clientId))
+      : [];
+    if (granted.length !== 1) {
+      return { ok: false, reason: "not_entitled" };
+    }
+    const tenantId = granted[0];
+    const hint = typeof tenant === "string" ? tenant.trim() : "";
+    if (hint && hint !== tenantId) {
+      return { ok: false, reason: "not_entitled" };
+    }
+
+    const bound = resolvePolicy({ identity, policies: policyTable });
+    const digest = bound.policy ?? null;
+    let attested = false;
+    if (digest) {
+      for (const session of sessions.values()) {
+        if (session.attestedDigests?.has(digest)) {
+          attested = true;
+          break;
+        }
+      }
+    }
+
+    try {
+      const probe = exportAssessor({
+        identity,
+        tenantGrants: tenantGrantTable,
+        tenant: tenantId,
+        ledger: evidenceLedger,
+        policyDigest: digest,
+        attested,
+      });
+      if (!probe?.ok) {
+        return { ok: false, reason: "export_unavailable" };
+      }
+    } catch {
+      return { ok: false, reason: "export_unavailable" };
+    }
+
+    if (identity.jti && typeof inbound.revoke === "function") {
+      const revoked = inbound.revoke(identity.jti);
+      if (!revoked?.ok) {
+        return { ok: false, reason: "destroy_failed" };
+      }
+    }
+
+    if (typeof channelCredentials.destroy !== "function") {
+      return { ok: false, reason: "destroy_failed" };
+    }
+    const destroyed = channelCredentials.destroy(tenantId);
+    if (!destroyed.ok && destroyed.reason !== "missing_agent") {
+      return { ok: false, reason: destroyed.reason || "destroy_failed" };
+    }
+
+    const session = sessions.get(tenantId);
+    if (session) {
+      broker.rejectByOwner(tenantId, new Error("Tenant offboarded."));
+      session.socket.destroy();
+      sessions.delete(tenantId);
+    }
+    if (typeof approvalLedger?.purge === "function") {
+      approvalLedger.purge();
+    }
+
+    try {
+      await rememberNow({
+        tenant: tenantId,
+        sub: identity.sub,
+        clientId,
+        decisionId: randomUUID(),
+        requestId: null,
+        policyDigest: digest,
+        outcome: "revoked",
+      });
+      await rememberNow({
+        tenant: tenantId,
+        sub: identity.sub,
+        clientId,
+        decisionId: randomUUID(),
+        requestId: null,
+        policyDigest: digest,
+        outcome: "destroyed",
+      });
+    } catch {
+      return { ok: false, reason: "export_unavailable" };
+    }
+
+    let snapshot;
+    try {
+      snapshot = exportAssessor({
+        identity,
+        tenantGrants: tenantGrantTable,
+        tenant: tenantId,
+        ledger: evidenceLedger,
+        policyDigest: digest,
+        attested,
+      });
+    } catch {
+      return { ok: false, reason: "export_unavailable" };
+    }
+    if (!snapshot?.ok) {
+      return { ok: false, reason: "export_unavailable" };
+    }
+
+    if (tenantGrantTable) delete tenantGrantTable[clientId];
+    delete grantTable[clientId];
+    tombstones.set(clientId, { tenant: tenantId, at: now() });
+    return { ok: true, export: snapshot };
+  }
+
   const scheme = hasTls ? "https" : "http";
   let closed = false;
   return {
@@ -1113,6 +1656,7 @@ export async function startEdge({
     port: northAddr.port,
     agentPort: channelAddr.port,
     resourceMetadataUrl: inbound.resourceMetadataUrl,
+    offboardTenant,
     get hasAgent() {
       return sessions.size > 0;
     },