keri-ts 2.1.0 → 2.2.0

package/esm/keri/npm/src/app/multisig/proposing.js

@@ -0,0 +1,122 @@
+import { ValidationError } from "../../core/errors.js";
+import { revokeCredential, } from "../credentials/credential-revoking.js";
+import { createCredential, inceptCredentialRegistry, } from "../credentials/credential-workflows.js";
+import { groupSigningMembers, localGroupMember, uniqueMembers } from "./group-members.js";
+import { MULTISIG_ICP_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_ROT_ROUTE } from "./grouping.js";
+import { remoteGroupMembers } from "./multisig-messaging.js";
+import { approveAcdcV2Registry, commitAcceptedGroupMembers, publishAcdcV2Registry, publishProposal, } from "./multisig-workflows.js";
+/** Propose a new group: create this member's inception and publish it. */
+export function* proposeGroupInception(deps, member, alias, { smids, rmids = smids, ...args }, inputs) {
+    // Publishing needs a route to every other member. Refuse before the group habitat exists, so a call that could
+    // not be sent leaves nothing behind and the same alias can be used again.
+    for (const other of remoteGroupMembers(deps.hby, member, uniqueMembers([...smids, ...rmids]))) {
+        if (!deps.postman.canReach(member.pre, other)) {
+            throw new ValidationError(`Group member ${other} cannot be reached: no end role is known for it. Resolve its OOBI first.`);
+        }
+    }
+    const created = deps.hby.makeGroupHab(alias, member, [...smids], [...rmids], undefined, args);
+    const event = { pre: created.hab.pre, sn: created.serder.sn ?? 0, said: created.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(deps.hby, deps.protocol, deps.postman, member, uniqueMembers([...smids, ...rmids]), {
+        route: MULTISIG_ICP_ROUTE,
+        attrs: { smids: [...smids], rmids: [...rmids], ...(args.delpre ? { delegator: args.delpre } : {}) },
+    }, created.message);
+    return { ...sent, route: MULTISIG_ICP_ROUTE, group: created.hab.pre, event, smids, rmids };
+}
+/** Propose a group rotation, including member add or remove through new `smids` / `rmids`. */
+export function* proposeGroupRotation(deps, group, { smids: newSmids, rmids: newRmids, ...args } = {}, inputs) {
+    const { hby } = deps;
+    const rotated = hby.rotateGroupHab(group.name, newSmids && [...newSmids], newRmids && [...newRmids], args);
+    const smids = newSmids?.length ? newSmids : groupSigningMembers(hby, rotated.hab.pre);
+    const rmids = newRmids?.length ? newRmids : smids;
+    const event = { pre: rotated.hab.pre, sn: rotated.serder.sn, said: rotated.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(hby, deps.protocol, deps.postman, localGroupMember(hby, rotated.hab.pre), uniqueMembers([...smids, ...rmids]), { route: MULTISIG_ROT_ROUTE, attrs: { gid: rotated.hab.pre, smids: [...smids], rmids: [...rmids] } }, rotated.message);
+    return { ...sent, route: MULTISIG_ROT_ROUTE, group: rotated.hab.pre, event, smids, rmids };
+}
+/** Propose a group interaction event carrying `data`. */
+export function* proposeGroupInteraction(deps, group, data, inputs, version) {
+    const { hby } = deps;
+    const created = hby.interactGroupHab(group.name, undefined, { data, version });
+    const smids = groupSigningMembers(hby, created.hab.pre);
+    const event = { pre: created.hab.pre, sn: created.serder.sn, said: created.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(hby, deps.protocol, deps.postman, localGroupMember(hby, created.hab.pre), smids, { route: MULTISIG_IXN_ROUTE, attrs: { gid: created.hab.pre, smids } }, created.message);
+    return { ...sent, route: MULTISIG_IXN_ROUTE, group: created.hab.pre, event, smids, rmids: [] };
+}
+/**
+ * Commit the members a proposed rotation named, once the rotation is accepted and
+ * is the group's latest establishment event. Idempotent; false until then, so a
+ * proposed newcomer is never adopted early. Other event kinds commit nothing.
+ *
+ * @throws ValidationError when the event is not an accepted event body held locally.
+ */
+export function settleProposedRotation(deps, result) {
+    if (result.route !== MULTISIG_ROT_ROUTE)
+        return false;
+    const serder = deps.hby.db.getEvtSerder(result.event.pre, result.event.said);
+    if (!serder)
+        throw new ValidationError(`No rotation ${result.event.said} is held for ${result.event.pre}.`);
+    return commitAcceptedGroupMembers(deps.hby, serder, result.smids, result.rmids);
+}
+/**
+ * Propose an ACDC v2 registry event (`rip` or `bup`): author the group anchor
+ * that seals it, process this member's own contribution, hand the anchor to the
+ * Counselor and publish the proposal. The proposer's contribution is also its
+ * approval. Returns without waiting; the anchor's progress is
+ * `counselor.status(result.event)`. A `bup` needs its `opening`.
+ *
+ * @throws ValidationError for a group that is not joined and accepted, or a TEL event the group cannot propose.
+ */
+export function* proposeRegistryEvent(deps, group, event, opening, inputs) {
+    const { hby } = deps;
+    const approval = yield* approveAcdcV2Registry(hby, deps.protocol, group, event, { opening, resume: true });
+    const anchorSaid = approval[0].sad?.a?.anc;
+    const anchor = anchorSaid ? hby.db.getEvtSerder(group.pre, anchorSaid) : null;
+    if (!anchor || anchor.sn === null)
+        throw new ValidationError("Registry proposal lost its group anchor.");
+    const anchorRef = { pre: group.pre, sn: anchor.sn, said: anchor.said };
+    deps.counselor.start(anchorRef, inputs);
+    const sent = yield* publishAcdcV2Registry(hby, deps.postman, group, approval);
+    const regid = event.ilk === "rip" ? event.said : event.regid;
+    const accepted = deps.registryStore?.seqEvent(regid, Number(BigInt(`0x${event.sad.n}`)))?.said === event.said;
+    return {
+        route: approval[0].route,
+        said: approval[0].said,
+        embedded: event.said,
+        group: group.pre,
+        accepted,
+        ...sent,
+        event: anchorRef,
+    };
+}
+function proposedGroup(result, what) {
+    if (!result.group)
+        throw new ValidationError(`${what} must be proposed by a local group.`);
+    return result;
+}
+/**
+ * Propose a group's legacy credential registry (`vcp`): author the anchoring group event,
+ * process this member's contribution, hand the anchor to the Counselor and publish the
+ * proposal. Returns without waiting; the anchor's progress is `counselor.status(result.group.event)`
+ * and the registry's is `waitForTelEvent`.
+ *
+ * @throws ValidationError when `group` is not a local group or the registry name is taken.
+ */
+export function* proposeCredentialRegistry(deps, group, options, inputs) {
+    const result = proposedGroup(yield* inceptCredentialRegistry(deps.rgy, deps.input, deps.postman, group, options), "A group registry");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}
+/** Propose a group credential issuance (`iss`) the way {@link proposeCredentialRegistry} proposes a registry. */
+export function* proposeCredentialIssue(deps, options, inputs) {
+    const result = proposedGroup(yield* createCredential(deps.rgy, deps.input, deps.postman, options), "A group credential");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}
+/** Propose a group credential revocation (`rev`) the way {@link proposeCredentialRegistry} proposes a registry. */
+export function* proposeCredentialRevocation(deps, options, inputs) {
+    const result = proposedGroup(yield* revokeCredential(deps.rgy, deps.input, deps.postman, options), "A group revocation");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}

package/esm/keri/npm/src/app/notifications/signaling.js

@@ -11,7 +11,8 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 };
 var _Signal_raw, _Signal_pad, _Signal_ckey;
 import { MtrDex, Salter } from "cesr-ts";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { systemClock } from "../runtime/runtime-clock.js";
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
 function randomNonce() {
@@ -162,11 +163,10 @@ export class Signaler {
         this.closed = true;
         this.clear();
     }
-    *signalDo() {
-        while (true) {
+    *signalDo(clock = systemClock, pacing = PROTOCOL_PACING) {
+        return yield* doEvery(clock, pacing.tockMs, function* () {
             this.processOnce();
-            yield* runtimeTurn();
-        }
+        }.bind(this));
     }
 }
 Object.defineProperty(Signaler, "SignalTimeoutMs", {

package/esm/keri/npm/src/app/protocol/parsering.js

@@ -144,7 +144,7 @@ function* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAi
         }
     }
     if (serder.ilk === "qry" && !["logs", "ksn", "mbx", "tels", "tsn"].includes(serder.route ?? "")
-        && qvy?.resource !== serder.route) {
+        && !(qvy?.claims ? qvy.claims(serder) : qvy?.resource === serder.route)) {
         return { envelope, decision: { kind: "drop", reason: "missingProcessor" } };
     }
     const result = kevery.kramer?.intake(envelope);
@@ -487,6 +487,31 @@ export function copyAuxiliaryQuery(envelope) {
     copied.tsgs.splice(0, copied.tsgs.length, ...normalized.tsgs);
     return copied;
 }
+/**
+ * Serialize an auxiliary query without nested evidence so a later process can rebuild it: its own frame with
+ * every attachment group (plus `children`, nested evidence already encoded as counted frames), then the
+ * normalized proof KRAM may have completed from earlier inputs.
+ */
+export function auxiliaryQueryWire(envelope, children = []) {
+    const version = envelope.gvrsn ?? envelope.serder.gvrsn ?? envelope.serder.pvrsn;
+    const frame = concatBytes(Counter.makeGVC(version), envelope.serder.raw, Counter.enclose({
+        code: "AttachmentGroup",
+        version,
+        qb64: concatBytes(...envelope.attachmentGroups.map(group => group.raw), ...children),
+    }));
+    const proof = serializeMessage(envelope.serder, { tsgs: envelope.tsgs, gvrsn: version, genusify: true });
+    const size = new Uint8Array(4);
+    new DataView(size.buffer).setUint32(0, frame.length);
+    return concatBytes(size, frame, proof);
+}
+/** Rebuild the envelope {@link auxiliaryQueryWire} serialized. */
+export function restoreAuxiliaryQuery(wire, local = false) {
+    const length = new DataView(wire.buffer, wire.byteOffset, 4).getUint32(0);
+    const restored = envelopeFromFrame(parseBytes(wire.slice(4, 4 + length))[0], local);
+    const normalized = envelopeFromFrame(parseBytes(wire.slice(4 + length))[0]);
+    restored.tsgs.splice(0, restored.tsgs.length, ...normalized.tsgs);
+    return restored;
+}
 /** Normalize the actual query endorsements for ingress and per-request authorization. */
 export function queryEnvelopeFromDispatch(envelope) {
     const lastSsg = envelope.ssgs.at(-1);

package/esm/keri/npm/src/app/protocol/protocol-processing.js

@@ -6,8 +6,14 @@ import { consoleLogger } from "../../core/logger.js";
 import { BasicReplyRouteHandler, Revery } from "../../core/routing.js";
 import { Exchanger } from "../exchanges/exchanging.js";
 import { QueryReplies } from "../queries/query-replies.js";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { systemClock } from "../runtime/runtime-clock.js";
+import { waitOnClock } from "../runtime/workflow-contract.js";
 import { dispatchEnvelope, envelopeFromFrame, queryEnvelopeFromDispatch, } from "./parsering.js";
+/**
+ * Wait after every escrow pass, as KERIpy's Doist cycle (`tock` 0.03125 s, app/directing.py) paces its `escrowDo`,
+ * which runs one full pass per cycle. A pass is never skipped or shortened; this is the time others get between passes.
+ */
+export const ESCROW_TOCK_MS = 31.25;
 /**
  * Identify a refusal of one already-extracted message, which must not end its stream.
  *
@@ -255,10 +261,10 @@ export class ProtocolProcessor {
      * - mirrors the dedicated `escrowDo` loop rather than folding escrow
      *   processing into parser ingress
      */
-    *escrowDo() {
+    *escrowDo(clock = systemClock) {
         while (true) {
             yield* this.processEscrowsOnce();
-            yield* runtimeTurn();
+            yield* waitOnClock(clock, ESCROW_TOCK_MS);
         }
     }
 }

package/esm/keri/npm/src/app/queries/query-workflows.js

@@ -0,0 +1,98 @@
+import { call, race, sleep, spawn } from "effection";
+import { ValidationError } from "../../core/errors.js";
+import { isLocalGroupHab } from "../multisig/group-members.js";
+import { AnchorQuerier, KeyStateNoticer } from "./querying.js";
+/** One elapsed deadline covers query sending and independently received evidence. */
+export const QUERY_TIMEOUT_MS = 10_000;
+/** Reject group habs: a query must be signed by one member, not by a group needing more signatures. */
+export function requireQueryRequester(hby, hab) {
+    if (isLocalGroupHab(hby, hab)) {
+        throw new ValidationError("Query --alias must select a member requester, not a group requiring additional signatures.");
+    }
+}
+/** Durable anchor status (`scope: "durable"`): the accepted KEL of `prefix` already holds the exact seal. */
+export function anchorQueryStatus(deps, prefix, anchor) {
+    return deps.hby.db.fetchLastSealingEventByEventSeal(prefix, anchor)
+        ? { state: "completed", scope: "durable" }
+        : { state: "active", phase: "awaitingEvidence", scope: "durable" };
+}
+/** Start a key-state query in the caller's scope. */
+export function* beginKeyStateQuery(deps, target) {
+    requireQueryRequester(deps.hby, target.hab);
+    const workflow = new KeyStateNoticer(deps.hby.db, deps.querying, target.prefix, deps.cues, {
+        signer: target.hab.pre,
+    });
+    return yield* startQuery(deps, target.prefix, workflow);
+}
+/** Start an anchor query in the caller's scope. */
+export function* beginAnchorQuery(deps, target) {
+    requireQueryRequester(deps.hby, target.hab);
+    const workflow = new AnchorQuerier(deps.hby.db, deps.querying, target.prefix, target.anchor, {
+        signer: target.hab.pre,
+    });
+    return yield* startQuery(deps, target.prefix, workflow);
+}
+/**
+ * Query current key state for `prefix` and wait for accepted evidence.
+ *
+ * @returns `settled` (status `completed`), or `timed-out`; a timeout is not permission to treat
+ * stale local state as success. Workflow failures propagate.
+ */
+export function* queryKeyState(deps, target, options = {}) {
+    return yield* beginThenWait(beginKeyStateQuery(deps, target), options);
+}
+/** Query for an accepted KEL event holding the exact seal `target.anchor`; see {@link queryKeyState}. */
+export function* queryAnchor(deps, target, options = {}) {
+    return yield* beginThenWait(beginAnchorQuery(deps, target), options);
+}
+/** Spawn the workflow in the caller's scope. */
+function* startQuery(deps, prefix, workflow) {
+    let completed = false;
+    const status = () => completed
+        ? { state: "completed", scope: "process" }
+        : { state: "active", phase: "awaitingEvidence", scope: "process" };
+    const observing = yield* spawn(function* () {
+        yield* workflow.queryDo();
+        completed = true;
+    });
+    deps.changes?.push({ kind: "query", id: prefix });
+    return {
+        prefix,
+        status,
+        *wait(options = {}) {
+            const outcome = yield* waitForQuery(observing, status, options.timeoutMs ?? QUERY_TIMEOUT_MS);
+            if (outcome.outcome === "settled")
+                deps.changes?.push({ kind: "query", id: prefix });
+            return outcome;
+        },
+        halt: () => observing.halt(),
+    };
+}
+/**
+ * Observe completion within the window without transferring task ownership.
+ * The race cancels only its observation when the timer wins; the run's `halt`
+ * joins the original task.
+ */
+function* waitForQuery(observing, status, timeoutMs) {
+    const done = yield* race([
+        call(function* () {
+            yield* observing;
+            return true;
+        }),
+        call(function* () {
+            yield* sleep(timeoutMs);
+            return false;
+        }),
+    ]);
+    return done ? { outcome: "settled", status: status() } : { outcome: "timed-out", status: status(), timeoutMs };
+}
+/** begin + wait, halting the run on every exit path. */
+function* beginThenWait(begin, options) {
+    const run = yield* begin;
+    try {
+        return yield* run.wait(options);
+    }
+    finally {
+        yield* run.halt();
+    }
+}

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -1,15 +1,14 @@
 import { WireParseError } from "cesr-ts";
 import { call, resource, spawn, suspend } from "effection";
-import { Dhke } from "../../acdc/dhking.js";
 import { RegistryObserver } from "../../acdc/observing.js";
 import { createRegery as createAcdcRegery } from "../../acdc/registraring.js";
 import { RegistryRoot } from "../../acdc/salting.js";
-import { Unblind } from "../../acdc/unblinding.js";
 import { Deck } from "../../core/deck.js";
-import { DatabaseNotOpenError, ValidationError } from "../../core/errors.js";
+import { DatabaseNotOpenError } from "../../core/errors.js";
 import { Kevery } from "../../core/kel/eventing.js";
 import { Kramer } from "../../core/mailbox/kraming.js";
 import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../../core/mailbox/mailbox-topics.js";
+import { Roles } from "../../core/roles.js";
 import { Revery } from "../../core/routing.js";
 import { openOwner } from "../../db/core/store-owner.js";
 import { Mailboxer } from "../../db/mailbox/mailboxing.js";
@@ -28,10 +27,12 @@ import { loadChallengeHandlers } from "../identity/challenging.js";
 import { Anchorer, loadDelegationHandlers } from "../identity/delegating.js";
 import { loadIpexHandlers } from "../ipex/ipexing.js";
 import { ForwardHandler } from "../mailbox/forward-handler.js";
+import { KEL_PUBLISHER_PACING, KelPublisher, kelPublisherDo } from "../mailbox/kel-publisher.js";
 import { MailboxDirector } from "../mailbox/mailbox-director.js";
-import { MailboxPoller } from "../mailbox/mailbox-poller.js";
+import { MAILBOX_POLLER_PACING, MailboxPoller, } from "../mailbox/mailbox-poller.js";
 import { mailboxerOptionsForHabery } from "../mailbox/mailboxing.js";
 import { mailboxTopicForRoute } from "../mailbox/topic-routing.js";
+import { Counselor } from "../multisig/counseling.js";
 import { loadMultisigHandlers } from "../multisig/grouping.js";
 import { noterOptionsForHabery, Notifier } from "../notifications/notifying.js";
 import { Signaler } from "../notifications/signaling.js";
@@ -41,7 +42,11 @@ import { QueryReplies } from "../queries/query-replies.js";
 import { WitnessInquisitor } from "../queries/witness-inquisitor.js";
 import { Receiptor } from "../witness/receipting.js";
 import { cueDo } from "./cue-runtime.js";
-import { runtimeTurn } from "./runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "./doing.js";
+import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
+import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
+import { signalerChangeSink } from "./workflow-contract.js";
+import { observeUntil } from "./workflow-contract.js";
 /**
  * Create the shared runtime composition root used by CLI commands and
  * `tufa agent`.
@@ -59,15 +64,6 @@ import { runtimeTurn } from "./runtime-turn.js";
  * @throws Dependency mismatch/acquisition errors propagate after owned resource cleanup.
  */
 export function* createAgentRuntime(hby, http, clock, options = {}) {
-    const selected = options.ipexAuxiliary;
-    if (selected) {
-        if (options.kram?.enabled !== true) {
-            throw new ValidationError("IPEX auxiliary runtime requires explicitly enabled KRAM");
-        }
-        if (!selected.hab.pre || hby.habs.get(selected.hab.pre) !== selected.hab) {
-            throw new ValidationError("IPEX auxiliary runtime requires its actual local habitat");
-        }
-    }
     const injectedSignaler = options.signaler ?? options.notifier?.signaler;
     if ((options.notifier && options.notifier.signator !== hby.signator)
         || (options.noter && options.notifier && options.noter !== options.notifier.noter)
@@ -102,8 +98,6 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     const acdc = options.acdc ?? (!hby.readonly ? (yield* openAcdcRegeryForHabery(hby)) : null);
     const ownsAcdcRegery = options.acdc === undefined && acdc !== null;
     const acdcRegery = acdc;
-    if (selected && !acdc)
-        throw new ValidationError("IPEX auxiliary runtime requires a v2 registry");
     // Acquire after stores, before processors/consumers: reverse teardown joins consumers, clears cues, closes stores.
     const cues = yield* resource(function* (provide) {
         const owned = new Deck();
@@ -135,25 +129,21 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     const kvy = new Kevery(hby.db, { cues: protocolCues, rvy: revery, messagePolicy: options.messagePolicy, kramer });
     const exc = new Exchanger(hby, { cues: protocolCues, now });
     const registry = acdc ? new RegistryObserver(hby.db, acdc.store) : null;
-    const ipexAuxiliary = selected && registry
+    // Every runtime with a v2 registry store owns the per-identifier DH and Unblind owners: one dispatch path.
+    const ipex = registry
         ? yield* resource(function* (provide) {
-            const auxiliary = selected.kind === "dhke"
-                ? { kind: "dhke", owner: new Dhke({ hab: selected.hab, exc, registryStore: registry.store, rvy: revery, now }) }
-                : {
-                    kind: "unblind",
-                    owner: new Unblind({ hab: selected.hab, exc, registry, states: selected.states, rvy: revery, now }),
-                };
+            const owners = new IpexAuxiliaries(exc, registry, revery, now, options.kram?.enabled === true);
             try {
-                revery.rtr.addRoute(auxiliary.kind === "dhke" ? Dhke.Route : Unblind.Route, auxiliary.owner);
-                yield* provide(auxiliary);
+                owners.registerReplyRoutes(revery.rtr);
+                yield* provide(owners);
             }
             finally {
-                auxiliary.owner.close();
+                owners.close();
             }
         })
         : null;
     const replies = new QueryReplies(cues);
-    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipexAuxiliary?.owner);
+    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined);
     const reactor = new Reactor(protocol);
     loadChallengeHandlers(hby.db, exc);
     loadDelegationHandlers(hby, exc, notifier);
@@ -165,7 +155,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         grantWalk: options.grantWalk,
     });
     // Construction adopts stored copies an earlier handler-less Exchanger left unescrowed.
-    const registryRoot = options.registryRoots !== "refuse" && acdc ? new RegistryRoot(hby, acdc, notifier) : null;
+    const registryRoot = options.registryRoots !== "refuse" && acdc
+        ? new RegistryRoot(hby, acdc, notifier, options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined))
+        : null;
     if (registryRoot)
         exc.addHandler(registryRoot);
     const mailboxDirector = yield* resource(function* (provide) {
@@ -204,7 +196,25 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     // Copies ride the credential topic; the refuser adds no mailbox topic of its own.
     if (options.registryRoots === "refuse")
         exc.addHandler(new RouteRefuser(RegistryRoot.Route));
-    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {});
+    const kelPublisher = new KelPublisher({
+        hby,
+        http,
+        clock,
+        changes: signaler ? signalerChangeSink(signaler) : undefined,
+        retry: options.kelPublishRetry,
+    });
+    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {
+        onPolled: (pre, mailbox) => kelPublisher.prompt(pre, mailbox),
+        onUnauthorized: (pre, mailbox) => kelPublisher.repair(pre, mailbox),
+        timeouts: options.mailboxPolling,
+    });
+    // A mailbox role accepted from a reply (a group member's approved add, an OOBI) is acted on at the next tock.
+    revery.onEndRole = (cid, role) => {
+        if (role !== Roles.mailbox)
+            return;
+        kelPublisher.prompt(cid);
+        mailboxPoller.prompt(cid);
+    };
     for (const topic of [
         DELEGATE_MAILBOX_TOPIC,
         CREDENTIAL_MAILBOX_TOPIC,
@@ -224,6 +234,36 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const delegating = new Anchorer(hby, postman, querying, protocol, http, clock);
+    // Group receipting reaches TCP-only witnesses as `WitnessReceiptor` does, as KERIpy's Counselor does.
+    const groupReceiptor = new Receiptor(hby, protocol, http, clock);
+    const counselor = new Counselor(hby, {
+        receipt: (pre, options) => groupReceiptor.receipt(pre, { ...options, allowTcp: true }),
+        get: (pre, options) => groupReceiptor.get(pre, options),
+    }, clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, {
+        rotated: (cue) => {
+            kelPublisher.rotated.push(cue);
+            owned?.rootReplicator?.prompt(cue.pre);
+        },
+    }, options.counselorReceiptRetry);
+    const owned = acdc && ipex
+        ? composeOwners({
+            hby,
+            acdc,
+            exc,
+            protocol,
+            reactor,
+            postman,
+            receiptor: new Receiptor(hby, protocol, http, clock),
+            ipex,
+            clock,
+            registryRoot,
+            mux,
+            counselor,
+            retry: options.operationRetry,
+            queryResendMs: options.issuanceQueryResendMs,
+            changes: signaler ? signalerChangeSink(signaler) : undefined,
+        }, options.operationStores)
+        : null;
     const oobiery = new Oobiery(hby, protocol, revery, http, cues);
     oobiery.registerReplyRoutes(revery.rtr);
     const authenticator = new Authenticator(hby, http);
@@ -239,7 +279,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         replies,
         exc,
         mux,
-        ipexAuxiliary,
+        ipex,
+        operations: owned?.operations ?? null,
+        rootReplicator: owned?.rootReplicator ?? null,
         oobiery,
         authenticator,
         mailboxDirector,
@@ -247,6 +289,12 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         mailboxPoller,
         postman,
         delegating,
+        counselor,
+        kelPublisher,
+        ownerPacing: options.ownerPacing ?? OWNER_PACING,
+        publisherPacing: options.publisherPacing ?? KEL_PUBLISHER_PACING,
+        protocolPacing: options.protocolPacing ?? PROTOCOL_PACING,
+        pollerPacing: options.pollerPacing ?? MAILBOX_POLLER_PACING,
         querying,
         replyStreams,
         vdr,
@@ -264,7 +312,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
             const failures = [];
             const cleanup = [
                 function* () {
-                    ipexAuxiliary?.owner.close();
+                    ipex?.close();
                 },
                 function* () {
                     yield* querying.close();
@@ -485,6 +533,7 @@ export function runtimePendingState(runtime) {
         delegationPending: runtime.hby.db.dpwe.cnt() > 0
             || runtime.hby.db.dune.cnt() > 0
             || runtime.hby.db.dpub.cnt() > 0,
+        groupPending: runtime.hby.db.gpse.cnt() > 0 || runtime.hby.db.gdee.cnt() > 0 || runtime.hby.db.gpwe.cnt() > 0,
         queriesPending: runtime.querying.hasPendingWork(),
         deliveriesPending: runtime.querying.hasPendingDelivery || runtime.postman.hasPending,
     };
@@ -506,6 +555,9 @@ export function runtimeHasPendingWork(runtime) {
 }
 /**
  * Return true once OOBI acceptance and its ingress/query dependencies settle.
+ * This is a whole-runtime drain predicate: any unrelated pending cue, query,
+ * delegation or OOBI keeps it false. A command or request that asked for one
+ * OOBI must wait with `waitForOobi` (`app/bootstrap/oobi-resolving.ts`) instead.
  * Background receipt delivery is not remote acknowledgement of OOBI acceptance;
  * static OOBI servers may refuse unsolicited posts. Runtime close still joins I/O.
  *
@@ -536,14 +588,10 @@ export function* runAgentRuntimeUntil(runtime, done, options) {
     if (done())
         return;
     const { timeoutMs, ...workerOptions } = options;
-    const deadline = Date.now() + timeoutMs;
     const worker = yield* spawn(() => runAgentRuntime(runtime, workerOptions));
     try {
-        while (!done()) {
-            if (Date.now() >= deadline)
-                throw new Error(`Runtime did not converge within ${timeoutMs}ms.`);
-            yield* runtimeTurn();
-        }
+        if (!(yield* observeUntil(done, { timeoutMs })))
+            throw new Error(`Runtime did not converge within ${timeoutMs}ms.`);
     }
     finally {
         yield* worker.halt();
@@ -572,52 +620,55 @@ export { runtimeTurn } from "./runtime-turn.js";
  */
 export function* runAgentRuntime(runtime, options = {}) {
     runtime.querying.configure({ hab: options.hab });
+    const pacing = runtime.protocolPacing;
     const telReceiptor = runtime.vdr ? new Receiptor(runtime.hby, runtime.protocol, runtime.http, runtime.clock) : null;
     const tasks = [
         yield* spawn(() => runtime.querying.deliverDo()),
         yield* spawn(() => runtime.postman.deliverDo()),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* spawn(function* () {
-                    while (true) {
-                        yield* publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock);
-                        yield* runtimeTurn();
-                    }
-                }),
+                yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
         yield* spawn(function* () {
-            yield* cueDo(runtime, options);
+            yield* cueDo(runtime, options, pacing);
         }),
         yield* spawn(function* () {
-            yield* runtime.protocol.escrowDo();
+            yield* runtime.protocol.escrowDo(runtime.clock);
         }),
         yield* spawn(function* () {
-            yield* runtime.oobiery.oobiDo();
+            yield* runtime.oobiery.oobiDo(runtime.clock, pacing);
         }),
         yield* spawn(function* () {
-            yield* runtime.authenticator.authDo();
+            yield* runtime.authenticator.authDo(runtime.clock, pacing);
         }),
         ...(runtime.signaler
             ? [
                 yield* spawn(function* () {
-                    yield* runtime.signaler.signalDo();
+                    yield* runtime.signaler.signalDo(runtime.clock, pacing);
                 }),
             ]
             : []),
         ...(options.pollMailbox ?? true
             ? [
                 yield* spawn(function* () {
-                    yield* runtime.mailboxPoller.pollDo((batch) => settleMailboxPollBatch(runtime, batch));
+                    yield* runtime.mailboxPoller.pollDo((batch) => settleMailboxPollBatch(runtime, batch), runtime.pollerPacing);
                 }),
             ]
             : []),
-        yield* spawn(function* () {
-            while (true) {
-                yield* runtime.delegating.processAllOnce();
-                yield* runtimeTurn();
-            }
-        }),
+        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
+        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
+        yield* spawn(() => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
+        ...(runtime.operations && runtime.ipex
+            ? [
+                yield* spawn(() => operationOwnersDo({
+                    operations: runtime.operations,
+                    rootReplicator: runtime.rootReplicator,
+                    ipex: runtime.ipex,
+                    clock: runtime.clock,
+                }, runtime.ownerPacing)),
+            ]
+            : []),
     ];
     try {
         return yield* suspend();

package/esm/keri/npm/src/app/runtime/cue-runtime.js

@@ -1,4 +1,4 @@
-import { runtimeTurn } from "./runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "./doing.js";
 /**
  * Use an explicitly selected or sole local habitat; never guess among hosted identities.
  *
@@ -53,9 +53,6 @@ export function* processCuesOnce(runtime, { hab, queryCues } = {}) {
  * @param runtime Borrowed composed runtime containing the actual cue consumers.
  * @param options Explicit signer and optional command-owned query cue destination.
  */
-export function* cueDo(runtime, options = {}) {
-    while (true) {
-        yield* processCuesOnce(runtime, options);
-        yield* runtimeTurn();
-    }
+export function* cueDo(runtime, options = {}, pacing = PROTOCOL_PACING) {
+    return yield* doEvery(runtime.clock, pacing.tockMs, () => processCuesOnce(runtime, options));
 }