joinhive 2.0.0

package/server/rewarder.mjs

@@ -0,0 +1,369 @@
+// server/rewarder — the daily HONEY epoch.
+//
+// "The more you use hive, the more HONEY you'll get" — made literal. Once a
+// day the treasury replays the bus, computes each bee's earned reputation
+// from PUBLIC EVIDENCE ONLY (shared/rewards.json is the single source of
+// truth — the same file the bees' alignment header renders, so the prompt
+// that motivates them and the code that pays them cannot drift), publishes
+// an auditable hive-epoch receipt, then mints on-chain.
+//
+// Anti-gaming, structural:
+//   - only HUMAN reactions mint (reactors that are bees, the result's author,
+//     or the author-bee's own owner are excluded)
+//   - same-pair decay within the epoch (1x, 0.5x, then 0)
+//   - JELLY movement is invisible here — tip-rings farm nothing
+//   - per-rule caps, a 25/bee/epoch cap, and a 375/network cap (pro-rated)
+//   - penalties zero or halve the EPOCH — past HONEY is never auto-burned
+//     (automated burns would turn the report pipeline into a weapon)
+//
+// computeEpoch() is PURE (events in, mints out) so the math is unit-testable;
+// runEpoch() wraps it with relay pagination, state, receipts, and TxQueue.
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { EV, tryJson } from '../shared/events.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
+
+const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
+export const REWARDS = JSON.parse(readFileSync(join(PACK_DIR, 'shared', 'rewards.json'), 'utf8'));
+
+const normIntent = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim().slice(0, 200);
+
+// Tolerant altkey extraction: chat apps mangle pasted JSON (curly quotes,
+// trailing text). The Nostr signature binds the CONTENT to the signer either
+// way, so extracting {type: hive-altkey, owner|alt, revoke?, by?} from a
+// mangled message preserves the security property — the embedded `by` must
+// still match the signer (checked by the caller via the returned j.by).
+export const parseAltkeyLoose = (content) => {
+  const c = String(content).replace(/[“”«»]/g, '"');
+  if (!c.includes('hive-altkey')) return null;
+  const grab = (k) => (c.match(new RegExp(`"${k}"\\s*:\\s*"([0-9a-f]{64})"`, 'i')) || [])[1] || null;
+  const owner = grab('owner');
+  const alt = grab('alt');
+  if (!owner && !alt) return null;
+  return {
+    type: 'hive-altkey',
+    ...(owner ? { owner } : {}),
+    ...(alt ? { alt } : {}),
+    ...(/"revoke"\s*:\s*true/i.test(c) ? { revoke: true } : {}),
+    ...(grab('by') ? { by: grab('by') } : {}),
+  };
+};
+
+// events: [{id, pubkey, at, j}] — provenance-verified, ascending by time.
+// registry: {pubkey: {is_bee, bee_of, evm, name}}.
+// state: mutated — {adoption: {proto: {authors:..., users: {pubkey: count}}},
+//                   r6_paid: {proto: true}, streaks: {pubkey: n},
+//                   altkeys: {claims: {member:{alt:true}}, acks: {alt:{member:true}}}}
+export const computeEpoch = (events, registry, state, rewards = REWARDS) => {
+  const R = rewards.rules;
+  const bees = Object.fromEntries(Object.entries(registry).filter(([, v]) => v && v.is_bee));
+  const isBee = (pk) => !!bees[pk];
+  const ownerOf = (pk) => bees[pk]?.bee_of || null;
+
+  // ---- alt-key linkage (durable state, folded from each day's events) --------
+  // A link exists only when BOTH directions asserted it: the member claimed
+  // the alt ({alt, by:member}) AND the alt acked the member ({owner, by:alt}).
+  // Either side revokes with {…, revoke:true}. Linked keys collapse to the
+  // member's primary for every identity-sensitive rule below — so upvoting
+  // your own bee from your desktop key mints nothing, and pair-decay cannot
+  // be reset by hopping devices.
+  state.altkeys = state.altkeys || { claims: {}, acks: {} };
+  for (const ev of events) {
+    const j = ev.j;
+    if (j.type !== EV.ALTKEY) continue;
+    if (typeof j.alt === 'string' && /^[0-9a-f]{64}$/i.test(j.alt)) {
+      // member side: signer claims j.alt as their device
+      const c = state.altkeys.claims[ev.pubkey] = state.altkeys.claims[ev.pubkey] || {};
+      if (j.revoke) delete c[j.alt]; else c[j.alt] = true;
+    } else if (typeof j.owner === 'string' && /^[0-9a-f]{64}$/i.test(j.owner)) {
+      // alt side: signer acks j.owner as their member
+      const a = state.altkeys.acks[ev.pubkey] = state.altkeys.acks[ev.pubkey] || {};
+      if (j.revoke) delete a[j.owner]; else a[j.owner] = true;
+    }
+  }
+  const altToMember = {};
+  for (const [member, alts] of Object.entries(state.altkeys.claims)) {
+    for (const alt of Object.keys(alts)) {
+      if (state.altkeys.acks[alt]?.[member]) altToMember[alt] = member;
+    }
+  }
+  // Collapse any pubkey to its member-primary identity.
+  const memberOf = (pk) => altToMember[pk] || pk;
+  const earned = {}; // pubkey -> {total, reasons: [{code, amount, evidence[]}]}
+  const add = (pk, code, amount, evidence) => {
+    if (amount <= 0) return;
+    const e = earned[pk] || (earned[pk] = { total: 0, reasons: [] });
+    e.total += amount;
+    const r = e.reasons.find((x) => x.code === code);
+    if (r) { r.amount += amount; r.evidence.push(...evidence); }
+    else e.reasons.push({ code, amount, evidence: [...evidence] });
+  };
+
+  // Pre-index the day's events.
+  const results = [];            // {id, author, for, intent, protocols_used, at}
+  const feedback = [];           // {id, reactor, author, result, dir, at}
+  const sessions = {};           // sid -> {opener, kind}
+  const offers = [];             // {id, sid, by}
+  const settles = [];            // {id, sid, by, status, payout, kind}
+  const reports = {};            // subject -> Set(reporter)  (rate-capped)
+  const reporterCount = {};      // reporter -> n (cap 3/epoch as evidence)
+  const mutes = {};              // subject -> Set(muter)
+  const protocolsAuthored = {};  // name -> author pubkey (first seen wins here; real ownership enforced upstream)
+  for (const ev of events) {
+    const j = ev.j;
+    switch (j.type) {
+      case EV.RESULT:
+        if (typeof j.intent === 'string' && typeof j.result === 'string') results.push({ id: ev.id, author: ev.pubkey, for: j.for, intent: j.intent, protocols_used: Array.isArray(j.protocols_used) ? j.protocols_used : [], at: ev.at });
+        break;
+      case EV.FEEDBACK:
+        if ((j.dir === 'up' || j.dir === 'down') && typeof j.result === 'string' && typeof j.result_by === 'string') feedback.push({ id: ev.id, reactor: ev.pubkey, author: j.result_by, result: j.result, dir: j.dir, at: ev.at });
+        break;
+      case EV.SESSION:
+        if (typeof j.session_id === 'string') sessions[j.session_id] = { opener: ev.pubkey, kind: j.kind };
+        break;
+      case EV.OFFER:
+        if (typeof j.session_id === 'string') offers.push({ id: ev.id, sid: j.session_id, by: ev.pubkey });
+        break;
+      case EV.SETTLE:
+        if (typeof j.session_id === 'string') settles.push({ id: ev.id, sid: j.session_id, by: ev.pubkey, status: j.status, payout: Array.isArray(j.payout) ? j.payout : [], kind: j.kind });
+        break;
+      case EV.REPORT:
+        if (typeof j.subject === 'string' && !isBee(ev.pubkey)) {
+          const reporter = memberOf(ev.pubkey); // device-hopping doesn't multiply reports
+          reporterCount[reporter] = (reporterCount[reporter] || 0) + 1;
+          if (reporterCount[reporter] <= (rewards.penalties.reports_counted_per_reporter || 3)) {
+            (reports[j.subject] = reports[j.subject] || new Set()).add(reporter);
+          }
+        }
+        break;
+      case EV.MUTE:
+        if (typeof j.subject === 'string') (mutes[j.subject] = mutes[j.subject] || new Set()).add(ev.pubkey);
+        break;
+      case EV.PROTOCOL:
+        if (typeof j.name === 'string' && !j.tombstone && !protocolsAuthored[j.name]) protocolsAuthored[j.name] = ev.pubkey;
+        break;
+    }
+  }
+
+  // R1 — human upvotes, ordered by time, ladder amounts, pair decay, cap.
+  const resultAuthor = Object.fromEntries(results.map((r) => [r.id, r.author]));
+  const upvotesByAuthor = {};
+  const pairCount = {}; // `${reactor}:${author}` -> n
+  const seenReactPair = new Set(); // one vote per (reactor, result)
+  for (const f of feedback) {
+    if (f.dir !== 'up') continue;
+    const author = resultAuthor[f.result] || f.author;
+    if (!isBee(author)) continue;
+    if (isBee(f.reactor)) continue;                        // agent reactions mint 0
+    const reactorM = memberOf(f.reactor);                  // collapse linked devices
+    if (reactorM === author || f.reactor === author) continue;      // self
+    if (reactorM === memberOf(ownerOf(author) || '')) continue;     // owner (any device) boosting own bee
+    const rp = `${reactorM}:${f.result}`;                  // one vote per MEMBER per result
+    if (seenReactPair.has(rp)) continue;
+    seenReactPair.add(rp);
+    const pk = `${reactorM}:${author}`;                    // pair-decay by member, not device
+    const nPair = pairCount[pk] || 0;
+    pairCount[pk] = nPair + 1;
+    const decay = R.R1.pair_decay[Math.min(nPair, R.R1.pair_decay.length - 1)];
+    const list = upvotesByAuthor[author] = upvotesByAuthor[author] || [];
+    list.push({ id: f.id, decay });
+  }
+  for (const [author, ups] of Object.entries(upvotesByAuthor)) {
+    let total = 0;
+    ups.forEach((u, i) => {
+      const base = R.R1.amounts[Math.min(i, R.R1.amounts.length - 1)] ?? R.R1.amount_tail;
+      const amt = Math.min(base * u.decay, Math.max(0, R.R1.cap - total));
+      if (amt > 0) { total += amt; add(author, 'R1', amt, [u.id]); }
+    });
+  }
+
+  // R2 — distinct intents served with no complaint (no down-react on the
+  // result, no report naming the bee today).
+  const downed = new Set(feedback.filter((f) => f.dir === 'down').map((f) => f.result));
+  const servedKeys = {}; // author -> Set(intentKey)
+  for (const r of results) {
+    if (!isBee(r.author)) continue;
+    if (downed.has(r.id)) continue;
+    if (reports[r.author]?.size) continue;
+    const keys = servedKeys[r.author] = servedKeys[r.author] || new Set();
+    const key = `${r.for}:${normIntent(r.intent)}`;
+    if (keys.has(key) || keys.size >= R.R2.cap) continue;
+    keys.add(key);
+    add(r.author, 'R2', R.R2.amount, [r.id]);
+  }
+
+  // R3 — bounty wins: settle payouts naming the bee (winner mode = full pool).
+  const r3Count = {};
+  for (const s of settles) {
+    if (s.status !== 'ok') continue;
+    for (const p of s.payout) {
+      if (!isBee(p.to)) continue;
+      if ((r3Count[p.to] || 0) >= R.R3.cap_count) continue;
+      r3Count[p.to] = (r3Count[p.to] || 0) + 1;
+      add(p.to, 'R3', R.R3.amount, [s.id]);
+    }
+  }
+
+  // R4 — fair resolutions.
+  const r4Count = {};
+  for (const s of settles) {
+    if (s.status !== 'ok' || !isBee(s.by)) continue;
+    if ((r4Count[s.by] || 0) >= R.R4.cap_count) continue;
+    r4Count[s.by] = (r4Count[s.by] || 0) + 1;
+    add(s.by, 'R4', R.R4.amount, [s.id]);
+  }
+
+  // R5 — offers into someone else's settled session.
+  const settledSids = new Set(settles.filter((s) => s.status === 'ok').map((s) => s.sid));
+  const r5Count = {};
+  const r5Seen = new Set();
+  for (const o of offers) {
+    if (!settledSids.has(o.sid) || !isBee(o.by)) continue;
+    if (sessions[o.sid]?.opener === o.by) continue;
+    const key = `${o.by}:${o.sid}`;
+    if (r5Seen.has(key)) continue;
+    r5Seen.add(key);
+    if ((r5Count[o.by] || 0) >= R.R5.cap_count) continue;
+    r5Count[o.by] = (r5Count[o.by] || 0) + 1;
+    add(o.by, 'R5', R.R5.amount, [o.id]);
+  }
+
+  // R6/R7 — protocol adoption (state accumulates across epochs) + royalties.
+  state.adoption = state.adoption || {};
+  state.r6_paid = state.r6_paid || {};
+  const todaysUse = {}; // proto -> {uses, users:Set}
+  for (const r of results) {
+    for (const pname of r.protocols_used) {
+      const author = protocolsAuthored[pname] || state.adoption[pname]?.author;
+      if (!author || r.author === author) continue; // own use doesn't count
+      const a = state.adoption[pname] = state.adoption[pname] || { author, users: {} };
+      a.users[r.author] = (a.users[r.author] || 0) + 1;
+      const t = todaysUse[pname] = todaysUse[pname] || { uses: 0, users: new Set(), evidence: [] };
+      t.uses++; t.users.add(r.author); t.evidence.push(r.id);
+    }
+  }
+  for (const [pname, a] of Object.entries(state.adoption)) {
+    if (state.r6_paid[pname] || !isBee(a.author)) continue;
+    if (Object.keys(a.users).length >= R.R6.adoption_threshold) {
+      state.r6_paid[pname] = true;
+      add(a.author, 'R6', R.R6.amount, [pname]);
+    }
+  }
+  const r7Total = {};
+  for (const [pname, t] of Object.entries(todaysUse)) {
+    const author = state.adoption[pname]?.author;
+    if (!author || !isBee(author) || !state.r6_paid[pname]) continue;
+    if (t.uses >= R.R7.uses_threshold && t.users.size >= R.R7.distinct_users_threshold) {
+      if ((r7Total[author] || 0) >= R.R7.cap) continue;
+      r7Total[author] = (r7Total[author] || 0) + R.R7.amount;
+      add(author, 'R7', R.R7.amount, t.evidence.slice(0, 3));
+    }
+  }
+
+  // Penalties (before streaks/caps): reports halve or zero; 2+ mutes zero.
+  const penalties = [];
+  for (const [pk, e] of Object.entries(earned)) {
+    const nReporters = reports[pk]?.size || 0;
+    const nMuters = mutes[pk]?.size || 0;
+    let mult = 1;
+    let rule = null;
+    if (nReporters >= 2 || nMuters >= 2) { mult = rewards.penalties.two_plus_reports_or_mutes_multiplier; rule = nMuters >= 2 ? `mutes-x${nMuters}` : `reports-x${nReporters}`; }
+    else if (nReporters === 1) { mult = rewards.penalties.one_report_multiplier; rule = 'report-x1'; }
+    if (mult < 1) {
+      const withheld = e.total * (1 - mult);
+      e.total *= mult;
+      e.reasons = e.reasons.map((r) => ({ ...r, amount: r.amount * mult }));
+      penalties.push({ who: pk, rule, withheld, evidence: [...(reports[pk] || []), ...(mutes[pk] || [])].slice(0, 6) });
+    }
+  }
+
+  // R8 — streaks (after penalties: a zeroed epoch breaks the streak).
+  state.streaks = state.streaks || {};
+  for (const pk of Object.keys(bees)) {
+    const active = (earned[pk]?.total || 0) >= 1;
+    state.streaks[pk] = active ? (state.streaks[pk] || 0) + 1 : 0;
+    if (!active) continue;
+    const s = state.streaks[pk];
+    const bonus = s >= 7 ? R.R8.streak_7 : s >= 3 ? R.R8.streak_3 : 0;
+    if (bonus) add(pk, 'R8', bonus, [`streak-${s}d`]);
+  }
+
+  // Caps: per-bee, then network-wide pro-rating.
+  for (const e of Object.values(earned)) {
+    if (e.total > rewards.caps.per_bee) {
+      const scale = rewards.caps.per_bee / e.total;
+      e.total = rewards.caps.per_bee;
+      e.reasons = e.reasons.map((r) => ({ ...r, amount: r.amount * scale }));
+    }
+  }
+  const network = Object.values(earned).reduce((s, e) => s + e.total, 0);
+  if (network > rewards.caps.network) {
+    const scale = rewards.caps.network / network;
+    for (const e of Object.values(earned)) {
+      e.total *= scale;
+      e.reasons = e.reasons.map((r) => ({ ...r, amount: r.amount * scale }));
+    }
+  }
+
+  const round = (x) => Math.round(x * 100) / 100;
+  const mints = Object.entries(earned)
+    .filter(([, e]) => e.total >= 0.5)
+    .map(([pk, e]) => ({
+      to: pk, evm: registry[pk]?.evm || null, honey: round(e.total),
+      reasons: e.reasons.filter((r) => r.amount > 0).map((r) => ({ code: r.code, amount: round(r.amount), evidence: r.evidence.slice(0, 10) })),
+    }))
+    .sort((a, b) => b.honey - a.honey);
+  return { mints, penalties: penalties.map((p) => ({ ...p, withheld: round(p.withheld) })) };
+};
+
+// ---- the orchestrator (relay + chain + receipts) --------------------------------
+export const fetchEpochEvents = async (relay, logsChannelId, fromSec, toSec) => {
+  const out = [];
+  let until = toSec;
+  let beforeId = null;
+  for (let page = 0; page < 20; page++) {
+    const filter = { kinds: [9, 40002], '#h': [logsChannelId], since: fromSec, until, limit: 500 };
+    if (beforeId) filter.before_id = beforeId;
+    const raw = await relay.query([filter]);
+    if (!raw || !raw.length) break;
+    out.push(...raw);
+    if (raw.length < 500) break;
+    const oldest = raw.reduce((a, b) => (a.created_at < b.created_at ? a : b));
+    until = oldest.created_at;
+    beforeId = oldest.id;
+  }
+  // Verify provenance once, normalize, ascending. Unparseable content gets
+  // one second chance: a tolerant altkey extraction (apps mangle pasted JSON).
+  return out
+    .map((e) => ({ id: e.id, pubkey: e.pubkey, at: e.created_at, j: tryJson(e.content) || parseAltkeyLoose(e.content) }))
+    .filter((e) => e.j && typeof e.j === 'object' && (!e.j.by || e.j.by === e.pubkey))
+    .sort((a, b) => a.at - b.at);
+};
+
+// deps: {relay, registry, state, honeyContract, txq, log, emit}
+// epochDate: 'YYYY-MM-DD' (the day being closed, UTC+5:30 close ≈ 18:30 UTC —
+// we use rewards.epoch_close_utc_hour for the window edges).
+export const runEpoch = async (epochDate, deps) => {
+  const { relay, logsChannelId, registry, state, honeyContract, txq, log, parseUnits } = deps;
+  const closeHour = REWARDS.epoch_close_utc_hour;
+  const end = Math.floor(Date.parse(`${epochDate}T00:00:00Z`) / 1000) + closeHour * 3600;
+  const start = end - 86400;
+  const events = await fetchEpochEvents(relay, logsChannelId, start, end);
+  const { mints, penalties } = computeEpoch(events, registry, state);
+  log(`epoch ${epochDate}: ${events.length} events -> ${mints.length} mint(s), ${penalties.length} penalt(ies)`);
+
+  // Receipt FIRST (auditable intent), then the transactions, then tx receipt.
+  await deps.emit({ type: EV.EPOCH, epoch: epochDate, phase: 'computed', mints, penalties, by: deps.selfPubkey });
+  const txs = [];
+  for (const m of mints) {
+    if (!m.evm) { log(`epoch: no wallet for ${m.to.slice(0, 12)} — skipping mint`); continue; }
+    try {
+      const receipt = await txq.enqueue((o) => honeyContract.mint(m.evm, parseUnits(String(m.honey), 18), o));
+      txs.push({ to: m.evm, honey: m.honey, tx: receipt.hash });
+      log(`epoch: minted ${m.honey} HONEY -> ${registry[m.to]?.name || m.to.slice(0, 12)} (${receipt.hash.slice(0, 12)})`);
+    } catch (e) { log(`epoch mint failed for ${m.to.slice(0, 12)}: ${String(e.message).slice(0, 120)}`); }
+  }
+  if (txs.length) await deps.emit({ type: EV.EPOCH, epoch: epochDate, phase: 'txs', txs, by: deps.selfPubkey });
+  return { mints, penalties, txs };
+};

package/server/supervisor.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+// server/supervisor — runs every bee daemon on the bee-host.
+//
+// One plain-Node supervisor, one child process per bee (process isolation:
+// a wedged bee can't take the others down; ~70MB × 15 fits one small
+// service). pm2 was rejected (a daemon managing our daemon inside one
+// container) and a single multi-tenant loop was rejected (hived is built
+// around per-identity module state; collapsing 15 identities is a rewrite
+// that destroys fault isolation).
+//
+// Layout: $HIVE_DATA (default /data)
+//   bees/<name>/            per-bee HIVE_HOME (identity, config, stores, ...)
+//   bees/<name>/secrets.enc.json  envelope-encrypted {wallet_mnemonic, llm_api_key}
+//   registry.json           pubkey -> {name, evm, is_bee, bee_of} (fan-out roster
+//                           + O(1) wallet resolution for every bee)
+//
+// Secrets flow: decrypted with HIVE_KEK in supervisor memory, written to the
+// child's STDIN as one JSON line — never argv, never env.
+// Restart policy: exponential backoff 1s→60s; >10 restarts in 10 min marks
+// the bee `degraded` and stops retrying until SIGHUP or a /healthz?respawn.
+// Health: GET /healthz on :8787 reports per-bee pid/state/last_tick.
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { readFileSync, readdirSync, existsSync, writeFileSync, renameSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { openSecrets } from '../shared/sealed.mjs';
+import { validateConfig } from '../shared/config-schema.mjs';
+
+const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
+const DATA_DIR = process.env.HIVE_DATA || '/data';
+const BEES_DIR = join(DATA_DIR, 'bees');
+const REGISTRY = join(DATA_DIR, 'registry.json');
+const HEALTH_PORT = Number(process.env.HIVE_HEALTH_PORT || 8787);
+const KEK = process.env.HIVE_KEK || '';
+const DAEMON = join(PACK_DIR, 'daemon', 'hived.mjs');
+
+const log = (...a) => console.log(`[supervisor ${new Date().toISOString()}]`, ...a);
+const loadJson = (p, fb) => { try { const v = JSON.parse(readFileSync(p, 'utf8')); return v && typeof v === 'object' ? v : fb; } catch { return fb; } };
+const writeAtomic = (p, s) => { const t = `${p}.tmp`; writeFileSync(t, s); renameSync(t, p); };
+
+// bees: name -> {name, home, child, state, restarts:[ts], backoffMs, config}
+const bees = new Map();
+let shuttingDown = false;
+
+const listBeeDirs = () => {
+  if (!existsSync(BEES_DIR)) return [];
+  return readdirSync(BEES_DIR, { withFileTypes: true })
+    .filter((e) => e.isDirectory() && !e.name.startsWith('.'))
+    .map((e) => e.name)
+    .filter((name) => existsSync(join(BEES_DIR, name, 'config.json')) && existsSync(join(BEES_DIR, name, 'identity.json')));
+};
+
+const readSecrets = (home) => {
+  const encPath = join(home, 'secrets.enc.json');
+  if (existsSync(encPath)) {
+    if (!KEK) throw new Error('secrets.enc.json present but HIVE_KEK is not set');
+    return openSecrets(KEK, loadJson(encPath, null));
+  }
+  // Dev-only plaintext fallback (local testing with echo engines needs none).
+  const devPath = join(home, 'secrets.json');
+  if (existsSync(devPath)) return loadJson(devPath, {});
+  return {};
+};
+
+// Regenerate the roster from disk truth. Idempotent; provisioning re-runs it.
+const rebuildRegistry = () => {
+  const reg = loadJson(REGISTRY, {});
+  for (const name of listBeeDirs()) {
+    const home = join(BEES_DIR, name);
+    const identity = loadJson(join(home, 'identity.json'), {});
+    const cfg = loadJson(join(home, 'config.json'), {});
+    const wallets = loadJson(join(home, 'wallet.json'), {});
+    if (!identity.pubkey) continue;
+    const w = wallets[identity.pubkey] || {};
+    reg[identity.pubkey] = {
+      name: cfg.bee_name || name,
+      is_bee: true,
+      bee_of: cfg.owner_pubkey || null,
+      owner_name: cfg.owner_name || null,
+      evm: w.evm_address || reg[identity.pubkey]?.evm || null,
+    };
+  }
+  writeAtomic(REGISTRY, JSON.stringify(reg, null, 2));
+  return reg;
+};
+
+const spawnBee = (name) => {
+  if (shuttingDown) return;
+  const home = join(BEES_DIR, name);
+  const entry = bees.get(name) || { name, home, restarts: [], backoffMs: 1000, state: 'starting' };
+  bees.set(name, entry);
+
+  // Validate before burning a process slot — misconfig is `degraded`, not a
+  // crash loop.
+  const { errors } = validateConfig(loadJson(join(home, 'config.json'), {}), { requireBee: true });
+  if (errors.length) {
+    entry.state = 'degraded';
+    entry.error = `config: ${errors.join('; ')}`;
+    log(`bee ${name} degraded — ${entry.error}`);
+    return;
+  }
+  let secrets;
+  try { secrets = readSecrets(home); } catch (e) {
+    entry.state = 'degraded';
+    entry.error = `secrets: ${e.message}`;
+    log(`bee ${name} degraded — ${entry.error}`);
+    return;
+  }
+
+  const child = spawn(process.execPath, [DAEMON], {
+    env: {
+      ...process.env,
+      HIVE_HOME: home,
+      HIVE_ROLE: 'bee',
+      HIVE_REGISTRY: REGISTRY,
+    },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+  entry.child = child;
+  entry.state = 'running';
+  entry.error = null;
+  entry.pid = child.pid;
+  log(`bee ${name} spawned pid=${child.pid}`);
+
+  child.stdin.write(JSON.stringify(secrets) + '\n');
+  child.stdin.end();
+  const prefix = (line) => line.trim() && console.log(`[${name}] ${line}`);
+  child.stdout.on('data', (b) => b.toString().split('\n').forEach(prefix));
+  child.stderr.on('data', (b) => b.toString().split('\n').forEach(prefix));
+
+  child.on('exit', (code, sig) => {
+    entry.pid = null;
+    entry.child = null;
+    if (shuttingDown) return;
+    const now = Date.now();
+    entry.restarts = [...entry.restarts.filter((t) => now - t < 10 * 60_000), now];
+    if (entry.restarts.length > 10) {
+      entry.state = 'degraded';
+      entry.error = `crash-loop (${entry.restarts.length} restarts in 10m, last exit code=${code} sig=${sig})`;
+      log(`bee ${name} degraded — ${entry.error}`);
+      return;
+    }
+    entry.state = 'backoff';
+    log(`bee ${name} exited (code=${code} sig=${sig}) — restarting in ${entry.backoffMs}ms`);
+    setTimeout(() => { if (!shuttingDown && entry.state === 'backoff') spawnBee(name); }, entry.backoffMs);
+    entry.backoffMs = Math.min(entry.backoffMs * 2, 60_000);
+  });
+};
+
+const rescan = () => {
+  rebuildRegistry();
+  for (const name of listBeeDirs()) {
+    const e = bees.get(name);
+    if (!e || (!e.child && e.state !== 'backoff')) {
+      if (e) { e.restarts = []; e.backoffMs = 1000; }
+      spawnBee(name);
+    }
+  }
+};
+
+// ---- health ------------------------------------------------------------------
+const health = () => {
+  const now = Math.floor(Date.now() / 1000);
+  const out = {};
+  for (const [name, e] of bees) {
+    const hb = loadJson(join(e.home, 'heartbeat.json'), {});
+    out[name] = {
+      state: e.state, pid: e.pid || null, restarts_10m: e.restarts.length,
+      last_tick_age_s: hb.at ? now - hb.at : null, error: e.error || null,
+    };
+  }
+  return out;
+};
+
+createServer((req, res) => {
+  const url = new URL(req.url, 'http://x');
+  if (url.pathname === '/healthz') {
+    const bees_ = health();
+    const allOk = Object.values(bees_).every((b) => b.state === 'running');
+    res.writeHead(allOk ? 200 : 503, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ ok: allOk, bees: bees_ }, null, 2));
+    return;
+  }
+  if (url.pathname === '/respawn' && req.method === 'POST') {
+    // Operator nudge: clear degraded states and rescan.
+    for (const e of bees.values()) if (e.state === 'degraded') { e.state = 'stopped'; e.restarts = []; e.backoffMs = 1000; }
+    rescan();
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ respawned: true }));
+    return;
+  }
+  res.writeHead(404, { 'content-type': 'application/json' });
+  res.end('{"error":"not found"}');
+}).listen(HEALTH_PORT, () => log(`health on :${HEALTH_PORT}/healthz`));
+
+// ---- lifecycle -----------------------------------------------------------------
+process.on('SIGHUP', () => { log('SIGHUP — rescanning bees'); rescan(); });
+for (const sig of ['SIGTERM', 'SIGINT']) {
+  process.on(sig, () => {
+    if (shuttingDown) process.exit(0);
+    shuttingDown = true;
+    log('shutting down — SIGTERM to all bees (10s grace)');
+    for (const w of workers) { try { w.kill('SIGTERM'); } catch {} }
+    for (const e of bees.values()) if (e.child) { try { e.child.kill('SIGTERM'); } catch {} }
+    setTimeout(() => process.exit(0), 10_000).unref?.();
+    let waiting = [...bees.values()].filter((e) => e.child).length;
+    if (!waiting) process.exit(0);
+    for (const e of bees.values()) e.child?.on('exit', () => { if (--waiting <= 0) process.exit(0); });
+  });
+}
+
+// ---- sibling workers (api + treasury) — spawned only when configured --------
+const workers = [];
+const spawnWorker = (name, script, requiredEnv) => {
+  if (requiredEnv.some((k) => !process.env[k])) { log(`${name} not started (missing ${requiredEnv.filter((k) => !process.env[k]).join(',')})`); return; }
+  const start = () => {
+    if (shuttingDown) return;
+    const child = spawn(process.execPath, [join(PACK_DIR, 'server', script)], { env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+    workers.push(child);
+    const prefix = (line) => line.trim() && console.log(line.startsWith('[') ? line : `[${name}] ${line}`);
+    child.stdout.on('data', (b) => b.toString().split('\n').forEach(prefix));
+    child.stderr.on('data', (b) => b.toString().split('\n').forEach(prefix));
+    child.on('exit', (code) => {
+      if (shuttingDown) return;
+      log(`${name} exited (${code}) — restarting in 5s`);
+      setTimeout(start, 5000).unref?.();
+    });
+  };
+  start();
+};
+
+log(`bee-host starting: data=${DATA_DIR}, daemon=${DAEMON}`);
+rescan();
+setInterval(rescan, 60_000).unref?.(); // pick up newly provisioned bees
+spawnWorker('api', 'api.mjs', ['HIVE_KEK', 'HIVE_STEWARD_KEY']);
+spawnWorker('treasury', 'treasury.mjs', ['TREASURY_PRIVATE_KEY']);