evolcore 0.0.19 → 0.0.21

package/dist/core/auth/agent-delegation.js

@@ -8,6 +8,9 @@ export class AgentDelegationRegistry {
     activeHashBySession = new Map();
     approvedCommands = new Map();
     issue(input) {
+        if (input.executionIdentity && !isValidFullAccessExecutionIdentity(input.executionIdentity)) {
+            throw new Error('invalid fullaccess task execution identity');
+        }
         this.revokeSession(input.sessionId);
         const token = crypto.randomBytes(32).toString('base64url');
         const tokenHash = hashDelegationToken(token);
@@ -134,7 +137,7 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
     if (!validation.ok)
         return validation;
     const grant = validation.grant;
-    if (grant.selfAid !== input.aid) {
+    if (grant.selfAid !== input.aid && !hasTrustedFullAccessDelegation(grant)) {
         return { ok: false, code: 'INVALID_DELEGATION', reason: 'Delegation self agent does not match sender' };
     }
     if (grant.messageId && grant.messageId !== input.messageId) {
@@ -157,6 +160,7 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
         conversationId: channelId,
         processOwners: [],
         fromControlChannel: false,
+        ...trustedExecutionIdentityInput(grant),
     });
     const subject = { ...builtSubject, peerKey: grant.peerKey };
     const decision = authorizeOperation({
@@ -180,6 +184,32 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
     }
     return { ok: true, grant };
 }
+/** Build the only AuthGateway input shape accepted for a task-held fullaccess claim. */
+export function trustedExecutionIdentityInput(grant) {
+    return grant.executionIdentity && isValidFullAccessExecutionIdentity(grant.executionIdentity)
+        ? {
+            trustedProcessRole: 'fullaccess-run',
+            trustedFullAccessAuthorization: grant.executionIdentity,
+        }
+        : {};
+}
+export function hasTrustedFullAccessDelegation(grant) {
+    return !!grant.executionIdentity && isValidFullAccessExecutionIdentity(grant.executionIdentity);
+}
+function isValidFullAccessExecutionIdentity(identity) {
+    if (identity.permissionMode !== 'fullaccess'
+        || identity.processRole !== 'fullaccess-run'
+        || identity.dataScope !== 'daemon')
+        return false;
+    if (identity.source === 'fullaccess-command') {
+        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0;
+    }
+    return identity.source === 'trigger'
+        && typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
+        && typeof identity.triggerId === 'string' && identity.triggerId.length > 0
+        && typeof identity.runId === 'string' && identity.runId.length > 0
+        && typeof identity.attemptId === 'string' && identity.attemptId.length > 0;
+}
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }

package/dist/core/auth/auth-gateway.js

@@ -8,6 +8,11 @@ import { resolveRuntimePermissionMode } from '../role/runtime-policy.js';
 export function isCrossAgentTriggerOperationAllowed(input) {
     return input.control || input.daemonOwner === true || input.taskAgentAid === input.targetAgentAid;
 }
+/** A delegated identity may authorize ordinary work, but it is not a human approval for persistent host execution. */
+export function canApprovePersistentFullAccessTrigger(input) {
+    return input.daemonOwner
+        && (input.source === 'direct-user' || input.source === 'management-channel');
+}
 export function buildAuthSubject(input) {
     const chatType = input.chatType === 'group' ? 'group' : 'private';
     const actorId = input.actorId;
@@ -22,17 +27,31 @@ export function buildAuthSubject(input) {
         peerType: input.peerType,
     });
     const processOwners = input.processOwners ?? [];
+    const fullAccessAuthorization = input.trustedFullAccessAuthorization;
+    const isFullAccessRun = input.trustedProcessRole === 'fullaccess-run'
+        && fullAccessAuthorization?.permissionMode === 'fullaccess'
+        && fullAccessAuthorization.processRole === 'fullaccess-run'
+        && fullAccessAuthorization.dataScope === 'daemon';
     const isDaemonService = input.trustedProcessRole === 'daemon-service';
-    const isDaemonOwner = !isDaemonService && isProcessOwner({
+    const isDaemonOwner = !isDaemonService && !isFullAccessRun && isProcessOwner({
         actor: roleDetail.actor,
         processOwners,
     });
     const suppliedRole = input.identity?.role && input.identity.role !== 'none' ? input.identity.role : undefined;
     const role = suppliedRole ?? roleDetail.effectiveRole ?? 'none';
-    const processRole = isDaemonService ? 'daemon-service' : isDaemonOwner ? 'daemon-owner' : 'none';
+    const processRole = isFullAccessRun
+        ? 'fullaccess-run'
+        : isDaemonService ? 'daemon-service' : isDaemonOwner ? 'daemon-owner' : 'none';
+    const dataScope = processRole === 'fullaccess-run'
+        || processRole === 'daemon-service'
+        || processRole === 'daemon-owner'
+        ? 'daemon'
+        : role === 'owner' || role === 'admin' ? 'agent' : 'relation';
     return {
         selfAid: input.selfAid,
+        agentName: input.agentName,
         actorId,
+        principalId: roleDetail.actor.principalId,
         requestId: input.requestId,
         sessionId: input.sessionId,
         channel: input.channel,
@@ -44,6 +63,8 @@ export function buildAuthSubject(input) {
         role,
         relationRole: role,
         processRole,
+        dataScope,
+        authorizedBy: isFullAccessRun ? fullAccessAuthorization.authorizedBy : undefined,
         roleSource: roleDetail.source,
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
@@ -51,8 +72,12 @@ export function buildAuthSubject(input) {
         allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
-        permissionMode: input.permissionMode
-            ?? resolveRuntimePermissionMode({ selfAid: input.selfAid, role }).effectiveValue,
+        canApprovePersistentFullAccess: input.canApprovePersistentFullAccess
+            ?? (isDaemonOwner && !isDaemonService),
+        permissionMode: isFullAccessRun
+            ? 'fullaccess'
+            : input.permissionMode
+                ?? resolveRuntimePermissionMode({ selfAid: input.selfAid, role }).effectiveValue,
     };
 }
 function isProcessOwner(input) {
@@ -97,6 +122,7 @@ export function authorizeOperation(params) {
         peerKey: params.subject.peerKey,
         role: params.subject.role,
         processRole: params.subject.processRole,
+        dataScope: params.subject.dataScope,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         allowExplicitRelationTarget: params.allowExplicitRelationTarget,
@@ -162,6 +188,7 @@ function auditDecision(params, decision) {
         requestId: params.auditMetadata?.requestId ?? params.subject.requestId,
         sessionId: params.auditMetadata?.sessionId ?? params.subject.sessionId,
         agentAid: params.auditMetadata?.agentAid ?? params.subject.selfAid,
+        agentName: params.auditMetadata?.agentName ?? params.subject.agentName ?? params.subject.selfAid,
         permissionMode: params.auditMetadata?.permissionMode
             ?? (decision.allow ? decision.permissionMode ?? params.subject.permissionMode : params.subject.permissionMode),
         toolName: params.auditMetadata?.toolName,
@@ -178,6 +205,8 @@ function auditDecision(params, decision) {
         channelId: params.subject.channelId,
         role: decision.allow ? decision.role : params.subject.role,
         processRole: params.subject.processRole,
+        dataScope: params.subject.dataScope,
+        authorizedBy: params.subject.authorizedBy,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         decision: decision.allow ? 'allow' : 'deny',

package/dist/core/auth/authorization-audit.js

@@ -3,12 +3,14 @@ import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
 import { buildAuthorizationEventKey } from '../audit/event-key.js';
+import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
         event.decision === 'deny' ||
         (event.decision === 'allow' && event.dangerous) ||
         (event.source === 'agent-tool' && event.operation.startsWith('config.')) ||
         event.operation === 'codex.approval' ||
+        event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
         event.operation === 'cli.exec.raw';
     if (!shouldAudit)
@@ -16,6 +18,77 @@ export function auditCommandAuthorization(event) {
     const auditRecord = buildAuditRecord(event);
     logAuditEvent(auditRecord);
 }
+export function auditFullAccessEvent(input) {
+    const configurationEvent = input.event === 'fullaccess.trigger.configured'
+        || input.event === 'fullaccess.trigger.deescalated';
+    const executionEvent = input.event === 'fullaccess.execution.started'
+        || input.event === 'fullaccess.execution.ended'
+        || input.event === 'fullaccess.trigger.execution.started'
+        || input.event === 'fullaccess.trigger.execution.ended';
+    // The scheduler triggers a run, but the executing subject is the task-bound
+    // fullaccess identity. Keep the original owner/configuration provenance in
+    // a separate field rather than reporting the model task as a human owner.
+    const processRole = input.processRole
+        ?? (executionEvent ? 'fullaccess-run' : input.source === 'trigger' ? 'daemon-service' : 'none');
+    const actorRole = processRole === 'daemon-owner' ? 'daemon-owner' : processRole;
+    const runnerProfileActive = executionEvent && input.executionState !== 'blocked';
+    const completedEvent = input.event.endsWith('.ended') || configurationEvent;
+    auditCommandAuthorization({
+        ts: Date.now(),
+        callId: input.attemptId ?? input.runId ?? input.taskId ?? input.messageId,
+        correlationId: input.runId ?? input.taskId,
+        source: input.source === 'trigger' ? 'agent-tool' : 'slash',
+        operation: input.event,
+        // CommandScope has no separate daemon value; process is the closest
+        // existing scope for daemon-owner authorization and keeps audit records
+        // compatible with the established command-audit schema.
+        scope: 'process',
+        dangerous: true,
+        decision: input.decision ?? 'allow',
+        executed: input.executed ?? completedEvent,
+        executionState: input.executionState
+            ?? (input.decision === 'deny' ? 'blocked' : completedEvent ? 'completed' : 'authorized'),
+        decisionSource: input.decision === 'deny'
+            ? 'policy'
+            : configurationEvent
+                ? processRole === 'daemon-owner' ? 'daemon-owner' : 'policy'
+                : processRole === 'fullaccess-run'
+                    ? 'fullaccess-run'
+                    : input.source === 'trigger'
+                        ? 'trigger-definition'
+                        : 'daemon-owner',
+        actorId: input.actorId,
+        processRole,
+        dataScope: input.dataScope ?? (executionEvent ? 'daemon' : undefined),
+        authorizedBy: input.authorizedBy,
+        isDaemonOwner: processRole === 'daemon-owner',
+        agentAid: input.agentAid,
+        agentName: input.agentName,
+        sessionId: input.sessionId,
+        taskId: input.taskId,
+        messageId: input.messageId,
+        permissionMode: 'fullaccess',
+        role: actorRole,
+        reason: input.reason ?? input.result ?? input.event,
+        durationMs: input.durationMs,
+        argsSummary: {
+            source: input.source,
+            triggerId: input.triggerId,
+            runId: input.runId,
+            attemptId: input.attemptId,
+            baseagent: input.baseagent,
+            model: input.model,
+            dataScope: input.dataScope ?? (executionEvent ? 'daemon' : undefined),
+            authorizedBy: input.authorizedBy,
+            ...(runnerProfileActive ? {
+                sandbox: 'off',
+                approval: 'bypassed',
+                applicationPolicy: 'bypassed',
+            } : {}),
+            result: input.result,
+        },
+    });
+}
 /**
  * Record a tool-level preflight denial (e.g. protected-path block) in the
  * structured command-audit log. This covers interactive sessions whose
@@ -37,11 +110,15 @@ export function auditToolPreflightDenial(input) {
         toolName: input.toolName,
         policyCode: input.policyCode,
         protectionClass: input.protectionClass ?? protectionClassForPolicy(input.policyCode),
-        matchedPath: input.matchedPath ?? extractAuditPath(input.summary),
+        // Path provenance must come from the policy parser. Do not infer it from
+        // localized summaries: words such as `daemon.json` or `.lock` may only be
+        // regex/string literals in an otherwise harmless diagnostic command.
+        matchedPath: input.matchedPath,
         reason: input.reason,
         argsSummary: input.summary ? { summary: input.summary } : undefined,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         channel: input.channel,
         actorId: input.actorId,
@@ -73,6 +150,7 @@ export function auditCodexApprovalDecision(input) {
         correlationId: input.correlationId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         toolName: input.toolName,
         approvalMethod: input.method,
@@ -81,7 +159,40 @@ export function auditCodexApprovalDecision(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: { method: input.method },
+        argsSummary: {
+            method: input.method,
+            ...(input.parseFailure ? { parseFailure: input.parseFailure } : {}),
+        },
+    });
+}
+/**
+ * Record a runtime permission decision outside a Codex app-server approval.
+ * The shared command-audit stream distinguishes policy, human, and
+ * infrastructure denials without parsing localized log text.
+ */
+export function auditPermissionDecision(input) {
+    auditCommandAuthorization({
+        ts: Date.now(),
+        callId: input.requestId,
+        correlationId: input.requestId,
+        requestId: input.requestId,
+        sessionId: input.sessionId,
+        agentAid: input.agentAid,
+        agentName: input.agentName,
+        permissionMode: input.permissionMode,
+        toolName: input.toolName,
+        policyCode: input.policyCode,
+        decisionSource: input.decisionSource,
+        source: 'agent-tool',
+        operation: 'permission.runtime',
+        scope: 'filesystem',
+        dangerous: false,
+        role: input.role ?? 'unknown',
+        taskId: input.taskId,
+        decision: 'deny',
+        executed: false,
+        executionState: 'blocked',
+        reason: input.reason,
     });
 }
 /** Record a fail-closed infrastructure condition before a tool can execute. */
@@ -101,6 +212,7 @@ export function auditToolInfrastructureFailure(input) {
         requestId: input.callId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         toolName: input.toolName,
         policyCode: input.policyCode,
@@ -137,7 +249,8 @@ function buildAuditRecord(event) {
         requestId: event.requestId,
         sessionId: event.sessionId,
         agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
-        permissionMode: event.permissionMode,
+        agentName: resolveAgentName(event),
+        permissionMode: normalizeAuditPermissionMode(event.permissionMode),
         toolName: event.toolName,
         approvalMethod: event.approvalMethod,
         policyCode: event.policyCode ?? event.code,
@@ -158,6 +271,8 @@ function buildAuditRecord(event) {
         channelId: redactIdentifier(event.channelId),
         role: event.role,
         processRole: event.processRole,
+        dataScope: event.dataScope,
+        authorizedBy: redactIdentifier(event.authorizedBy),
         isDaemonOwner: event.isDaemonOwner,
         fromControlChannel: event.fromControlChannel,
         taskId: event.taskId,
@@ -174,6 +289,26 @@ function buildAuditRecord(event) {
         exitCode: event.exitCode,
     };
 }
+function resolveAgentName(event) {
+    const displayName = typeof event.agentName === 'string' ? event.agentName.trim() : '';
+    if (displayName && !isUnknownAgentLabel(displayName))
+        return displayName;
+    const aid = typeof event.agentAid === 'string' ? event.agentAid.trim() : '';
+    if (aid && aid !== 'unknown')
+        return aid;
+    const selfAid = typeof event.selfAid === 'string' ? event.selfAid.trim() : '';
+    if (selfAid && selfAid !== 'unknown')
+        return selfAid;
+    return aid === 'unknown' || selfAid === 'unknown' ? 'unknown' : undefined;
+}
+function isUnknownAgentLabel(value) {
+    return value === 'unknown' || value === '<unknown>' || value === '<none>' || value === 'undefined' || value === 'null';
+}
+function normalizeAuditPermissionMode(value) {
+    if (!value || value === 'unknown')
+        return value;
+    return normalizeExecutionPermissionMode(value);
+}
 function redactIdentifier(value) {
     if (!value)
         return undefined;
@@ -209,6 +344,7 @@ function logAuditEvent(record) {
         record.correlationId ? `correlation=${record.correlationId}` : null,
         record.eventKey ? `eventKey=${record.eventKey}` : null,
         record.sessionId ? `session=${record.sessionId}` : null,
+        record.agentName ? `agentName=${JSON.stringify(record.agentName)}` : null,
         record.agentAid ? `agent=${record.agentAid}` : null,
         record.permissionMode ? `permissionMode=${record.permissionMode}` : null,
         record.toolName ? `tool=${record.toolName}` : null,
@@ -293,6 +429,21 @@ function summarizeAuthorizationArgs(operation, args) {
     for (const [key, value] of Object.entries(args)) {
         if (value === undefined)
             continue;
+        if (key === 'parseFailure' && value && typeof value === 'object' && !Array.isArray(value)) {
+            const diagnostic = value;
+            const issue = typeof diagnostic.issue === 'string' ? diagnostic.issue : undefined;
+            const offset = typeof diagnostic.offset === 'number' && Number.isFinite(diagnostic.offset)
+                ? Math.max(0, Math.floor(diagnostic.offset)) : undefined;
+            const tokenIndex = typeof diagnostic.tokenIndex === 'number' && Number.isFinite(diagnostic.tokenIndex)
+                ? Math.max(0, Math.floor(diagnostic.tokenIndex)) : undefined;
+            const dialect = typeof diagnostic.dialect === 'string' ? diagnostic.dialect : undefined;
+            const inputLength = typeof diagnostic.inputLength === 'number' && Number.isFinite(diagnostic.inputLength)
+                ? Math.max(0, Math.floor(diagnostic.inputLength)) : undefined;
+            if (issue && offset !== undefined && tokenIndex !== undefined && dialect && inputLength !== undefined) {
+                summary.parseFailure = { issue, offset, tokenIndex, dialect, inputLength };
+            }
+            continue;
+        }
         if (/^(?:self|peer|peerKey|target|targetId|session|sessionId|channelId)$/i.test(key)) {
             summary[key] = typeof value === 'string' ? redactIdentifier(value) : '[redacted]';
             continue;
@@ -341,7 +492,7 @@ function protectionClassForPolicy(policyCode) {
         return 'L';
     return undefined;
 }
-function extractAuditPath(summary) {
+function extractAuditPath_UNUSED(summary) {
     if (!summary)
         return undefined;
     const match = summary.match(/(?:^|\s)(\/[^\s'"`;]+|[A-Za-z]:[\\/][^\s'"`;]+|(?:src|ecagent|ecweb|scripts|tests?)\/[^\s'"`;]+)/);

package/dist/core/auth/operation-authorizer.js

@@ -95,6 +95,20 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
         return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
     }
+    // A fullaccess task is deliberately a daemon-scoped runtime identity. It
+    // still has to name a known operation and pass structural command parsing,
+    // but relation/Agent role rules, source lists, and daemon-owner gates are
+    // not meaningful limits for code already approved for host-level execution.
+    if (ctx.processRole === 'fullaccess-run' && ctx.dataScope === 'daemon') {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'fullaccess-run',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'fullaccess-run-daemon-scope',
+        };
+    }
     if (ctx.chatType === 'group'
         && (resolvedConfigCommand ? isResolvedConfigMutation(resolvedConfigCommand) : isConfigMutationOperation(operation))
         && intent.scope !== 'relation') {
@@ -175,7 +189,31 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (roleDef.allowAccess === false) {
         return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Role ${role} is not allowed to access commands`, operation, intent.scope, opMeta.dangerous);
     }
-    const matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    let matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    // Agent self-service contact add deliberately reuses the same low-trust
+    // relation boundary as ec.msg.send. Older per-Agent role files may still
+    // contain the historical contact.* deny without an explicit contact.add
+    // entry; preserve their safe current-peer/private-only send capability while
+    // allowing this new request workflow. An explicit contact.add rule wins.
+    if (operation === 'contact.add'
+        && !Object.prototype.hasOwnProperty.call(roleDef.commandPermissions || {}, 'contact.add')) {
+        const sendPermission = roleDef.commandPermissions?.['ec.msg.send'];
+        if (sendPermission?.allow) {
+            matchResult = {
+                permission: {
+                    ...sendPermission,
+                    scopes: ['relation'],
+                    constraints: {
+                        ...(sendPermission.constraints ?? {}),
+                        ownPeerOnly: true,
+                        privateOnly: true,
+                    },
+                },
+                matchedRule: 'ec.msg.send',
+                rank: 1000,
+            };
+        }
+    }
     if (!matchResult) {
         return denyDecision(ctx, 'NO_PERMISSION', `Role ${role} has no permission for ${operation}`, operation, intent.scope, opMeta.dangerous);
     }
@@ -274,6 +312,8 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
         const targetAgentAid = stringArg(args.targetAgentAid) ?? stringArg(args.self);
         return !!taskAgentAid && !!targetAgentAid && taskAgentAid !== targetAgentAid;
     }
+    if (operation.startsWith('role.') && ctx.fromControlChannel)
+        return true;
     return false;
 }
 function hasDaemonOwnerRole(ctx) {

package/dist/core/auth/operation-catalog.js

@@ -55,7 +55,7 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     sources: ['agent-tool'],
 }));
 const MSG_READ_OPERATIONS = [
-    ['ec.msg.history', 'Read message history for an AUN private relation'],
+    ['ec.msg.history', 'Read message history for a controlled private relation'],
     ['ec.msg.online', 'Read online status for an AUN private relation'],
 ].map(([id, description]) => ({
     id,
@@ -476,6 +476,14 @@ const OPERATIONS = [
         description: 'Read the Agent contact block list',
         sources: ['agent-tool'],
     },
+    {
+        id: 'contact.add',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['relation'],
+        description: 'Request adding the current private relation as an Agent contact',
+        sources: ['agent-tool'],
+    },
     {
         id: 'contact.block',
         category: 'write-agent',

package/dist/core/bootstrap-messages.js

@@ -70,11 +70,11 @@ export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
         return false;
     if (entry.context?.sessionId === sessionId)
         return true;
-    return outbox.replace(aid, {
+    return outbox.replaceIfRouteMatches(aid, entry, {
         ...entry,
         context: {
             ...(entry.context ?? {}),
             sessionId,
         },
-    });
+    }) === 'replaced';
 }

package/dist/core/bootstrap-service.js

@@ -2,10 +2,10 @@ import fs from 'fs';
 import path from 'path';
 import { randomBytes } from 'crypto';
 import { kitsTemplatesDir, agentMdPath } from '../paths.js';
-import { resolveAgentDisplayName } from '../aun/aid/agentmd.js';
+import { buildInitialAgentMd, resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { logger } from '../utils/logger.js';
 import { loadAgent, saveAgent } from '../config-store.js';
-import { normalizeAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
+import { resolveAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
 import { renderTemplate } from '../eck/manifest-engine.js';
 import { activeBaseagent } from './model/config-scope.js';
 import { buildEnvelope } from './message/message-utils.js';
@@ -123,12 +123,18 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        const config = normalizeAgentLifecycle(loadedConfig);
-        if (config.lifecycle === 'active') {
+        const lifecycle = resolveAgentLifecycle(loadedConfig);
+        if (lifecycle === 'active') {
             this.inFlight.delete(key);
             return false;
         }
-        const starting = config.lifecycle === 'created';
+        if (lifecycle !== 'created' && lifecycle !== 'bootstrapping') {
+            this.inFlight.delete(key);
+            logger.warn(`[Bootstrap] Refusing invalid lifecycle for ${aid}: ${String(loadedConfig.lifecycle)}`);
+            return false;
+        }
+        const config = { ...loadedConfig, lifecycle };
+        const starting = lifecycle === 'created';
         const channelType = ctx.channelType || this.channelTypeFromKey(ctx.channelKey);
         const configuredRecipient = this.resolveConfiguredRecipient(config, ctx.channelKey, channelType);
         const recipientId = ctx.recipientId || configuredRecipient;
@@ -140,35 +146,14 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        // The bootstrap prompt is deliberately a private message to the configured
-        // owner. An inbound owner message may have arrived from a group, in which
-        // case ctx.channelId is the group AID and must not be paired with the
-        // private delivery route below (that would call message.send(to=group)).
-        // A configured AUN recipient may itself be a group AID. Ask the channel's
-        // authoritative group endpoint before choosing the transport; never infer
-        // group/private semantics from the AID string or from the inbound venue.
-        let isGroupRecipient = false;
-        try {
-            isGroupRecipient = channelType === 'aun'
-                ? (await ctx.adapter.isGroup?.(recipientId)) === true
-                : false;
-        }
-        catch (error) {
-            // Group/private routing is security-sensitive. If the authoritative
-            // probe fails, do not guess a route, and release the single-flight key
-            // so a later connection or retry can recover.
-            this.inFlight.delete(key);
-            logger.warn(`[Bootstrap] Failed to resolve recipient type for ${aid}: ${error instanceof Error ? error.message : String(error)}`);
-            return false;
-        }
-        const delivery = isGroupRecipient === true
-            ? { chatType: 'group', groupId: recipientId }
-            : { chatType: 'private' };
-        const channelId = delivery.chatType === 'group'
-            ? delivery.groupId
-            : channelType === 'aun'
-                ? recipientId
-                : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // Bootstrap is initiated by connection/owner binding, not by a reply to
+        // an existing group message. `owners[]` contains personal Owner AIDs, so
+        // the first prompt must always use the private message route. Inbound
+        // group context must never change this initial delivery target.
+        const delivery = { chatType: 'private' };
+        const channelId = channelType === 'aun'
+            ? recipientId
+            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;
@@ -234,14 +219,14 @@ export class BootstrapService {
         const loadedConfig = loadAgent(aid) || agent?.config;
         if (!loadedConfig)
             return { ok: false, error: `Agent "${aid}" not found` };
-        const lifecycle = normalizeAgentLifecycle(loadedConfig).lifecycle;
+        const lifecycle = resolveAgentLifecycle(loadedConfig);
         if (lifecycle === 'active')
             return { ok: true, aid, transitioned: false };
         if (lifecycle !== 'bootstrapping') {
             return {
                 ok: false,
                 code: 'INVALID_LIFECYCLE',
-                error: `Agent "${aid}" is ${lifecycle}; only a bootstrapping agent can become ready`,
+                error: `Agent "${aid}" is ${lifecycle ?? `invalid (${String(loadedConfig.lifecycle)})`}; only a bootstrapping agent can become ready`,
             };
         }
         this.setLifecycle(agent, aid, 'active');
@@ -253,7 +238,7 @@ export class BootstrapService {
         const agent = this.agentRegistry.get(aid);
         const loadedConfig = loadAgent(aid) || agent?.config;
         return loadedConfig
-            ? normalizeAgentLifecycle(loadedConfig).lifecycle
+            ? resolveAgentLifecycle(loadedConfig)
             : null;
     }
     setLifecycle(agent, aid, lifecycle) {
@@ -307,7 +292,11 @@ export class BootstrapService {
         if (typeof adapter.uploadAgentMd !== 'function')
             return;
         const existing = fs.existsSync(agentMdPath(aid)) ? fs.readFileSync(agentMdPath(aid), 'utf-8') : '';
-        const content = existing.trim() || `---\naid: "${aid}"\nname: "${fallbackName}"\ntype: "codeagent"\nversion: "1.0.0"\ndescription: ""\ntags:\n  - evolcore\n  - ai-agent\n---\n`;
+        const content = existing.trim() || buildInitialAgentMd({
+            aid,
+            name: fallbackName,
+            type: 'codeagent',
+        });
         try {
             await adapter.uploadAgentMd(content);
             logger.info(`[Bootstrap] Published agent.md for ${aid}`);

package/dist/core/causation/aun-association.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../../paths.js';
-import { atomicReadJson, atomicWriteJson } from '../../utils/atomic-write.js';
+import { atomicReadJson, stableWriteJson } from '../../utils/atomic-write.js';
 import { cloneCausation, normalizeCausation } from './context.js';
 const DEFAULT_TTL_MS = 30 * 60 * 1000;
 const associations = new Map();
@@ -44,9 +44,12 @@ function ensureLoaded() {
 }
 function persist() {
     try {
-        // Keep the protected mount target present even when there are no pending
-        // associations. Removing it races with Bubblewrap's H-class projection.
-        atomicWriteJson(associationFile(), [...associations].map(([messageId, association]) => ({
+        // Keep the protected mount target's inode stable. Bubblewrap binds this
+        // H-class file by pathname while constructing its namespace; an atomic
+        // rename can otherwise replace the inode during bind/remount and make
+        // sandbox initialization fail. Causation state is best-effort and small,
+        // so an in-place write is preferable to changing the protected inode.
+        stableWriteJson(associationFile(), [...associations].map(([messageId, association]) => ({
             messageId,
             ...association,
         })));