keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/queries/witness-inquisitor.js

@@ -7,23 +7,36 @@
  * is an explicitly selected remote attester. Resolve/sign just before sending,
  * using accepted endpoint evidence. One worker owns the unsigned request Deck
  * and current network attempt; there is no retained signed retry backlog.
+ *
+ * With a relay (an edge runtime) every query is addressed and sent to the relay,
+ * which is the attester: it answers from its own store through its Respondant
+ * and Poster into the edge's mailbox, which it hosts. No query goes to a witness
+ * or controller, whatever `src` or `wits` the request names.
  */
 import { concatBytes } from "cesr-ts";
 import { call, resource } from "effection";
 import { Deck } from "../../core/deck.js";
-import { ValidationError } from "../../core/errors.js";
 import { consoleLogger } from "../../core/logger.js";
 import { Roles } from "../../core/roles.js";
 import { Schemes } from "../../core/schemes.js";
 import { introduce } from "../delivery/introducing.js";
+import { relayEndpoint, relayRefusal } from "../delivery/relaying.js";
 import { PROTOCOL_TOCK_MS } from "../runtime/doing.js";
 import { waitOnClock } from "../runtime/workflow-contract.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
+import { isRequestableHttpUrl } from "../transport/http-client.js";
 import { HTTPMessenger } from "../transport/http-messenger.js";
+import { messengerUrl } from "../transport/messengering.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
 import { TransportError } from "../transport/transport-error.js";
 /** First eligible role used by KERIpy WitnessInquisitor before random endpoint selection. */
 const QUERY_ROLE_PRIORITY = [Roles.controller, Roles.agent, Roles.witness];
+/**
+ * Delivery passes an ordinary request may rotate with a ready signer but no reachable attester before it is dropped:
+ * about five minutes at the protocol tock. Any remote party can cause such requests (every unverified reply signed by
+ * an unknown prefix yields a `query` cue), so without a bound they would rotate in the queue forever.
+ */
+export const UNADDRESSED_QUERY_PASS_LIMIT = 9_600;
 /**
  * Copy only the owned query-body level without erasing its route/payload relationship.
  *
@@ -41,6 +54,22 @@ function copyQuery(instruction) {
             return { route: instruction.route, q: { ...instruction.q } };
     }
 }
+/**
+ * Identity of one unsigned request for duplicate detection: every field that changes what is signed or where it goes.
+ *
+ * @param request Queued or candidate request; query filters are strings and string-valued seal SADs.
+ * @returns A canonical string equal for two requests exactly when they would produce the same query.
+ */
+function requestKey(request) {
+    return JSON.stringify([
+        request.route,
+        request.pre,
+        request.signer ?? null,
+        request.src ?? null,
+        request.wits ?? null,
+        request.q,
+    ]);
+}
 /**
  * Return the sole local habitat when exactly one exists.
  *
@@ -56,12 +85,47 @@ function soleHab(hby) {
     const first = habitats.next();
     return first.done || !habitats.next().done ? null : first.value;
 }
+/**
+ * The attesters an ordinary (non-relay) query for `pre` may go to: the AIDs of the first role among controller,
+ * agent and witness that has any accepted endpoint for the subject. Mailbox providers are not query attesters.
+ *
+ * @param hab Local habitat whose accepted-state store is read.
+ * @param pre Subject AID whose accepted endpoint roles are consulted.
+ * @returns Eligible attester AIDs, or an empty array for an unknown subject or a subject with no such endpoint.
+ */
+function queryAttesters(hab, pre) {
+    if (!hab.db.getKever(pre))
+        return [];
+    const ends = hab.endsFor(pre);
+    for (const role of QUERY_ROLE_PRIORITY) {
+        const eids = Object.keys(ends[role] ?? {});
+        if (eids.length > 0)
+            return eids;
+    }
+    return [];
+}
+/**
+ * The location a query can be sent to, preferring HTTPS, then HTTP, then TCP. An accepted location comes from a remote
+ * `/loc/scheme` reply, so one the HTTP client refuses by construction (embedded credentials) is no location: sending
+ * to it would throw a refusal that is not a send outcome.
+ *
+ * @param urls Accepted locations of one endpoint, by scheme.
+ * @returns The preferred usable location, or null when none is usable.
+ */
+function preferredLocation(urls) {
+    for (const url of [urls[Schemes.https], urls[Schemes.http]])
+        if (url && isRequestableHttpUrl(url))
+            return url;
+    // A TCP location without a valid port is refused by the TCP messenger; it is no location here.
+    const tcp = urls[Schemes.tcp];
+    return tcp && messengerUrl({ tcp }) ? tcp : null;
+}
 /**
  * Resolve the actual transport URL for one query destination AID.
  *
  * An explicit witness uses its own location records. Ordinary queries use only
  * the selected controller, agent or witness endpoint; mailbox providers are not
- * query attesters. Missing/unsupported locations do not promote another endpoint.
+ * query attesters. Missing, unsupported or unusable locations do not promote another endpoint.
  *
  * @param hab Local habitat used to construct/sign this output; stores remain borrowed.
  * @param queriedPre Subject AID whose state is requested.
@@ -70,18 +134,27 @@ function soleHab(hby) {
  * @returns Preferred endpoint URL, or null if no permitted route exists.
  */
 function resolveQueryDestinationUrl(hab, queriedPre, destination, { explicitWitness = false, } = {}) {
-    if (explicitWitness) {
-        const urls = hab.fetchUrls(destination);
-        return urls[Schemes.https] ?? urls[Schemes.http] ?? urls[Schemes.tcp] ?? null;
-    }
+    if (explicitWitness)
+        return preferredLocation(hab.fetchUrls(destination));
     const ends = hab.endsFor(queriedPre);
     for (const role of [Roles.controller, Roles.agent, Roles.witness]) {
         const urls = ends[role]?.[destination];
         if (urls)
-            return urls[Schemes.https] ?? urls[Schemes.http] ?? urls[Schemes.tcp] ?? null;
+            return preferredLocation(urls);
     }
     return null;
 }
+/**
+ * The attesters of an ordinary query for `pre` that can be sent to now: those {@link queryAttesters} selects that also
+ * have an accepted location.
+ *
+ * @param hab Local habitat whose accepted-state store is read.
+ * @param pre Subject AID whose accepted endpoint roles and locations are consulted.
+ * @returns Addressable attester AIDs of the first eligible role; empty when none can be reached now.
+ */
+export function addressableAttesters(hab, pre) {
+    return queryAttesters(hab, pre).filter((aid) => resolveQueryDestinationUrl(hab, pre, aid) !== null);
+}
 /**
  * KERIpy-shaped query sender, independent from semantic query completion.
  *
@@ -109,9 +182,10 @@ export class WitnessInquisitor {
      * @param protocol Borrowed same-database processor for incoming query replies.
      * @param http Borrowed HTTP implementation selected by composition.
      * @param clock Borrowed clock for transport deadlines; times are milliseconds.
+     * @param relay The agent every query goes to; null selects attesters from accepted endpoint roles.
      * @param hab Optional default local signer; null requires an unambiguous sole habitat.
      */
-    constructor(hby, protocol, http, clock, hab = null) {
+    constructor(hby, protocol, http, clock, relay, hab = null) {
         /** Borrowed local signers and accepted-state stores. */
         Object.defineProperty(this, "hby", {
             enumerable: true,
@@ -182,12 +256,20 @@ export class WitnessInquisitor {
             writable: true,
             value: void 0
         });
+        /** The agent every query is addressed and sent to (an edge); null selects ordinary attesters. */
+        Object.defineProperty(this, "relay", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         if (protocol.kvy.db !== hby.db)
             throw new RangeError("Query protocol must use the same database");
         this.hby = hby;
         this.protocol = protocol;
         this.http = http;
         this.clock = clock;
+        this.relay = relay;
         this.hab = hab;
     }
     /**
@@ -198,6 +280,17 @@ export class WitnessInquisitor {
     configure({ hab = null } = {}) {
         this.hab = hab;
     }
+    /** The explicitly configured default signer, or null when the sole local habitat is used. */
+    get defaultSigner() {
+        return this.hab?.pre ?? null;
+    }
+    /** Whether a queued request names `signer` as its explicit signer. */
+    hasRequestsSignedBy(signer) {
+        for (const request of this.requests)
+            if (request.signer === signer)
+                return true;
+        return false;
+    }
     /** Deferred instructions and active sends are this sender's only pending work. */
     hasPendingWork() {
         return !this.requests.empty || this.hasPendingDelivery;
@@ -215,6 +308,7 @@ export class WitnessInquisitor {
             ...request,
             ...copyQuery(request),
             wits: request.wits ? [...request.wits] : undefined,
+            unaddressedPasses: 0,
         });
     }
     /**
@@ -232,6 +326,27 @@ export class WitnessInquisitor {
         const selected = { ...request, signer: request.signer ?? hab?.pre };
         this.enqueue(selected);
     }
+    /**
+     * Admit a routed query cue unless an identical request is already queued: same subject, route, filters, signer,
+     * attester and witness overrides, with the signer resolved as {@link enqueueCue} resolves it. A relaying host's cue
+     * router uses this, so the queries of the many edges it serves about one subject leave one request queued; a request
+     * already taken for delivery is no longer queued, so a later cue queues the next one.
+     *
+     * @param cue Typed query cue; missing route/subject produces no request.
+     * @param hab Optional local signer hint when the cue has no explicit signer.
+     */
+    enqueueCueOnce(cue, hab) {
+        if (this.closed)
+            throw new Error("Query sender is closed");
+        if (!cue.route || !cue.pre)
+            return;
+        const { kin: _, ...request } = cue;
+        const key = requestKey({ ...request, signer: request.signer ?? hab?.pre });
+        for (const queued of this.requests)
+            if (requestKey(queued) === key)
+                return;
+        this.enqueueCue(cue, hab);
+    }
     /** Include actual query I/O in convergence; pending instructions have their own queue. */
     get hasPendingDelivery() {
         return this.delivering;
@@ -282,7 +397,16 @@ export class WitnessInquisitor {
                 const packet = self.prepareRequest(request);
                 self.requests.pull();
                 if (!packet) {
-                    self.requests.append(request);
+                    // A signer that cannot sign yet, or a relay not yet usable, is local state that waits; a ready signer with no
+                    // reachable attester counts toward the bound.
+                    if (!self.relay && self.configuredHab(request.signer)?.canSign())
+                        request.unaddressedPasses++;
+                    if (request.unaddressedPasses >= UNADDRESSED_QUERY_PASS_LIMIT) {
+                        consoleLogger.warn(`Dropping ${request.route} query for ${request.pre}: no reachable attester after ${request.unaddressedPasses} passes.`);
+                    }
+                    else {
+                        self.requests.append(request);
+                    }
                     continue;
                 }
                 active.signal.throwIfAborted();
@@ -369,51 +493,73 @@ export class WitnessInquisitor {
      * Resolve/sign one selected query and introduction immediately before its attempt.
      *
      * @param request Deferred unsigned request; nested query values must remain immutable.
-     * @returns Prepared packet, or null when signer/attester evidence is unresolved.
-     * @throws A selected attester with no endpoint URL throws; source removal remains with the caller.
+     * The attester is chosen at random among the eligible ones (the explicit `src`, the `wits` overrides, or the first
+     * eligible endpoint role) that have an accepted location. An attester without one is never promoted to another
+     * role; when none of the eligible attesters can be reached the request is unresolved, like a signer that cannot sign
+     * yet, so no endpoint condition ends the delivery loop or fails a caller's pass.
+     *
+     * @param request Deferred unsigned request; nested query values must remain immutable.
+     * @returns Prepared packet, or null when signer/attester evidence is unresolved, no eligible attester has an
+     *   accepted location, or the signer cannot sign yet.
      */
     prepareRequest(request) {
         const hab = this.configuredHab(request.signer);
-        if (!hab)
+        // A signer that cannot sign yet leaves the request unresolved: it goes to the tail, and the next pass tries again.
+        if (!hab || !hab.canSign())
             return null;
-        const attesters = request.src ? [] : this.attestersFor(request.pre, { signer: hab.pre, wits: request.wits });
-        const destination = request.src ?? attesters[Math.floor(Math.random() * attesters.length)];
-        if (!destination)
-            return null;
-        const url = resolveQueryDestinationUrl(hab, request.pre, destination, {
-            explicitWitness: request.wits?.includes(destination) ?? false,
+        if (this.relay)
+            return this.prepareRelayRequest(hab, request, this.relay);
+        const eligible = request.src
+            ? [request.src]
+            : this.attestersFor(request.pre, { signer: hab.pre, wits: request.wits });
+        const reachable = eligible.flatMap((destination) => {
+            const url = resolveQueryDestinationUrl(hab, request.pre, destination, {
+                explicitWitness: request.wits?.includes(destination) ?? false,
+            });
+            // A TCP location on a host without a TCP dialer cannot be sent to: it is unreachable, not a fault.
+            return url && (this.http.tcp || !url.startsWith("tcp:")) ? [{ destination, url }] : [];
         });
-        if (!url)
-            throw new ValidationError(`No endpoint URL found for query destination ${destination}.`);
+        const selected = reachable[Math.floor(Math.random() * reachable.length)];
+        if (!selected)
+            return null;
+        const { destination, url } = selected;
         const message = hab.query(request.pre, destination, copyQuery(request));
         const intro = introduce(hab, destination);
         return { url, body: concatBytes(intro, message), destination };
     }
     /**
-     * Return the first eligible role’s attester IDs; preparation chooses one randomly.
+     * Address one query to the relay and sign it for the relay's location. The relay must have an accepted location
+     * and the signer must have authorized it as mailbox (where the answer is stored); until then the request stays
+     * unresolved and is tried again on a later pass, as for a signer that cannot sign yet.
+     *
+     * @param hab Local signing habitat.
+     * @param request Deferred unsigned request; its `src` and `wits` are not consulted.
+     * @param relay The configured relay agent, which is the attester.
+     * @returns Prepared packet for the relay, or null while {@link relayRefusal} refuses the relay for this signer.
+     */
+    prepareRelayRequest(hab, request, relay) {
+        if (relayRefusal(this.hby, relay, hab.pre))
+            return null;
+        const endpoint = relayEndpoint(this.hby, relay);
+        const message = hab.query(request.pre, relay.aid, copyQuery(request));
+        return { url: endpoint.url, body: concatBytes(introduce(hab, relay.aid), message), destination: relay.aid };
+    }
+    /**
+     * Return the first eligible role’s attester IDs; preparation chooses one randomly. With a relay, the relay is the
+     * only attester.
      *
      * @param pre Subject AID whose accepted endpoint roles are consulted.
      * @param options Optional local signer AID and remote witness/attester overrides; neither selects a transport implementation.
      * @returns Eligible attester AIDs, or an empty array for an unknown subject or unresolved signer/role.
      */
     attestersFor(pre, { signer, wits } = {}) {
+        if (this.relay)
+            return [this.relay.aid];
         if (wits && wits.length > 0) {
             // Explicit watcher/witness overrides outrank endpoint-role lookup.
             return [...wits];
         }
         const hab = this.configuredHab(signer);
-        if (!hab || !this.hby.db.getKever(pre))
-            return [];
-        const ends = hab.endsFor(pre);
-        for (const role of QUERY_ROLE_PRIORITY) {
-            const roleEnds = ends[role];
-            if (!roleEnds) {
-                continue;
-            }
-            const eids = Object.keys(roleEnds);
-            if (eids.length > 0)
-                return eids;
-        }
-        return [];
+        return hab ? queryAttesters(hab, pre) : [];
     }
 }

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -8,7 +8,6 @@ import { DatabaseNotOpenError } from "../../core/errors.js";
 import { Kevery } from "../../core/kel/eventing.js";
 import { Kramer } from "../../core/mailbox/kraming.js";
 import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../../core/mailbox/mailbox-topics.js";
-import { Roles } from "../../core/roles.js";
 import { Revery } from "../../core/routing.js";
 import { openOwner } from "../../db/core/store-owner.js";
 import { Mailboxer } from "../../db/mailbox/mailboxing.js";
@@ -20,12 +19,12 @@ import { Authenticator } from "../bootstrap/authenticating.js";
 import { loadOobiHandlers, Oobiery, oobiTerminalState } from "../bootstrap/oobiery.js";
 import { publishPendingTel } from "../credentials/tel-publishing.js";
 import { Poster } from "../delivery/forwarding.js";
+import { relayEndpoint, relayOnlyHttpClient } from "../delivery/relaying.js";
 import { ReplyStreams } from "../delivery/reply-streams.js";
 import { Respondant } from "../delivery/respondant.js";
 import { Exchanger, RouteRefuser } from "../exchanges/exchanging.js";
 import { loadChallengeHandlers } from "../identity/challenging.js";
 import { Anchorer, loadDelegationHandlers } from "../identity/delegating.js";
-import { SignerNotHeldError } from "../identity/keeping.js";
 import { loadIpexHandlers } from "../ipex/ipexing.js";
 import { ForwardHandler } from "../mailbox/forward-handler.js";
 import { KEL_PUBLISHER_PACING, KelPublisher, kelPublisherDo } from "../mailbox/kel-publisher.js";
@@ -47,7 +46,6 @@ import { cueDo } from "./cue-runtime.js";
 import { doEveryOnWrite, PROTOCOL_PACING } from "./doing.js";
 import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
 import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
-import { SignerConditions } from "./signer-conditions.js";
 import { signalerChangeSink } from "./workflow-contract.js";
 import { observeUntil } from "./workflow-contract.js";
 /**
@@ -67,12 +65,18 @@ import { observeUntil } from "./workflow-contract.js";
  * @throws Dependency mismatch/acquisition errors propagate after owned resource cleanup.
  */
 export function* createAgentRuntime(hby, http, clock, options = {}) {
+    // An edge reaches only its relay: every component below, and `runtime.http`, gets the guarded client.
+    if (options.relay)
+        http = relayOnlyHttpClient(http, hby, options.relay);
     const injectedSignaler = options.signaler ?? options.notifier?.signaler;
     if ((options.notifier && options.notifier.signator !== hby.signator)
         || (options.noter && options.notifier && options.noter !== options.notifier.noter)
         || (options.signaler && options.notifier && options.signaler !== options.notifier.signaler)) {
         throw new RangeError("AgentRuntime notification services require its exact Signator, Noter and Signaler");
     }
+    if (options.relaying && !options.mailboxer && !options.enableMailboxStore) {
+        throw new RangeError("Relaying requires a mailbox store for /fwd intake");
+    }
     const mailboxer = options.mailboxer
         ?? (options.enableMailboxStore ? (yield* openRuntimeMailboxer(hby)) : null);
     const ownsMailboxer = options.mailboxer === undefined && mailboxer !== null;
@@ -131,7 +135,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     const kramer = options.kram ? new Kramer(hby.db, { config: options.kram, cues: protocolCues, now }) : undefined;
     const kvy = new Kevery(hby.db, { cues: protocolCues, rvy: revery, messagePolicy: options.messagePolicy, kramer });
     const exc = new Exchanger(hby, { cues: protocolCues, now });
-    const registry = acdc ? new RegistryObserver(hby.db, acdc.store) : null;
+    const registry = acdc ? new RegistryObserver(hby.db, acdc.store, protocolCues) : null;
     // Every runtime with a v2 registry store owns the per-identifier DH and Unblind owners: one dispatch path.
     const ipex = registry
         ? yield* resource(function* (provide) {
@@ -146,11 +150,11 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         })
         : null;
     const replies = new QueryReplies(cues);
-    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined);
+    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined, options.relaying === true);
     const reactor = new Reactor(protocol);
     loadChallengeHandlers(hby.db, exc);
     loadDelegationHandlers(hby, exc, notifier);
-    loadOobiHandlers(hby, exc, notifier);
+    loadOobiHandlers(hby, exc, notifier, options.relaying === true);
     const mux = loadMultisigHandlers(hby, exc, { notifier, registry: protocol.registry, messageKevery: protocol.kvy });
     loadIpexHandlers(hby, exc, {
         notifier,
@@ -158,8 +162,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         grantWalk: options.grantWalk,
     });
     // Construction adopts stored copies an earlier handler-less Exchanger left unescrowed.
+    const changes = options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined);
     const registryRoot = options.registryRoots !== "refuse" && acdc
-        ? new RegistryRoot(hby, acdc, notifier, options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined))
+        ? new RegistryRoot(hby, acdc, notifier, changes)
         : null;
     if (registryRoot)
         exc.addHandler(registryRoot);
@@ -175,7 +180,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const postman = yield* resource(function* (provide) {
-        const postman = new Poster(hby, mailboxer, protocol, http, clock);
+        const postman = new Poster(hby, mailboxer, protocol, http, clock, options.relay ?? null);
         try {
             yield* provide(postman);
         }
@@ -185,7 +190,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     });
     const respondant = new Respondant(hby, postman);
     if (mailboxer) {
-        exc.addHandler(new ForwardHandler(mailboxDirector));
+        exc.addHandler(new ForwardHandler(mailboxDirector, reactor, options.relaying ? postman : null));
     }
     for (const route of exc.routes.keys()) {
         if (route === ForwardHandler.resource) {
@@ -206,20 +211,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         changes: signaler ? signalerChangeSink(signaler) : undefined,
         retry: options.kelPublishRetry,
     });
-    const signerConditions = new SignerConditions();
-    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {
-        signerConditions,
-        onPolled: (pre, mailbox) => kelPublisher.prompt(pre, mailbox),
-        onUnauthorized: (pre, mailbox) => kelPublisher.repair(pre, mailbox),
-        timeouts: options.mailboxPolling,
-    });
-    // A mailbox role accepted from a reply (a group member's approved add, an OOBI) is acted on at the next tock.
-    revery.onEndRole = (cid, role) => {
-        if (role !== Roles.mailbox)
-            return;
-        kelPublisher.prompt(cid);
-        mailboxPoller.prompt(cid);
-    };
+    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, options.relay ?? null, { polls: kelPublisher.polls, timeouts: options.mailboxPolling });
     for (const topic of [
         DELEGATE_MAILBOX_TOPIC,
         CREDENTIAL_MAILBOX_TOPIC,
@@ -230,7 +222,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         mailboxDirector.registerTopic(topic);
     }
     const querying = yield* resource(function* (provide) {
-        const inquisitor = new WitnessInquisitor(hby, protocol, http, clock);
+        const inquisitor = new WitnessInquisitor(hby, protocol, http, clock, options.relay ?? null);
         try {
             yield* provide(inquisitor);
         }
@@ -239,17 +231,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const delegating = new Anchorer(hby, postman, querying, protocol, http, clock);
-    // Group receipting reaches TCP-only witnesses as `WitnessReceiptor` does, as KERIpy's Counselor does.
-    const groupReceiptor = new Receiptor(hby, protocol, http, clock);
-    const counselor = new Counselor(hby, {
-        receipt: (pre, options) => groupReceiptor.receipt(pre, { ...options, allowTcp: true }),
-        get: (pre, options) => groupReceiptor.get(pre, options),
-    }, clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, {
-        rotated: (cue) => {
-            kelPublisher.rotated.push(cue);
-            owned?.rootReplicator?.prompt(cue.pre);
-        },
-    }, options.counselorReceiptRetry, groupEventForwarding(hby, postman));
+    // Only a runtime with operations owners and a registry root has a root replicator to drain this deck.
+    const groupChanges = registryRoot && ipex ? new Deck() : undefined;
+    const counselor = new Counselor(hby, new Receiptor(hby, protocol, http, clock), clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, kelPublisher.rotated, groupChanges, options.counselorReceiptRetry, groupEventForwarding(hby, postman));
     const owned = acdc && ipex
         ? composeOwners({
             hby,
@@ -264,21 +248,26 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
             registryRoot,
             mux,
             counselor,
+            groupChanges,
             retry: options.operationRetry,
             queryResendMs: options.issuanceQueryResendMs,
             changes: signaler ? signalerChangeSink(signaler) : undefined,
         }, options.operationStores)
         : null;
-    const oobiery = new Oobiery(hby, protocol, revery, http, cues);
+    const oobiery = new Oobiery(hby, protocol, revery, http, cues, options.relay ? { relay: options.relay, postman, clock } : null);
     oobiery.registerReplyRoutes(revery.rtr);
+    if (options.relay && !relayEndpoint(hby, options.relay))
+        oobiery.resolve(options.relay.oobi);
     const authenticator = new Authenticator(hby, http);
     return {
         hby,
         mailboxer,
+        relaying: options.relaying === true,
         noter,
         notifier,
         signaler,
         cues,
+        changes: changes ?? null,
         reactor,
         protocol,
         replies,
@@ -296,7 +285,6 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         delegating,
         counselor,
         kelPublisher,
-        signerConditions,
         ownerPacing: options.ownerPacing ?? OWNER_PACING,
         publisherPacing: options.publisherPacing ?? KEL_PUBLISHER_PACING,
         protocolPacing: options.protocolPacing ?? PROTOCOL_PACING,
@@ -618,6 +606,11 @@ export { runtimeTurn } from "./runtime-turn.js";
  * delegation and ordinary query sending. The finalizer halts children in reverse
  * order; store ownership remains with the composition scope.
  *
+ * Each loop is a plain spawned fixed-tock doer. A loop that signs for a local habitat reads `Hab.canSign()` on its
+ * tock and skips a habitat that cannot sign yet (a store opened without its signer); a later `Manager.hold` lets
+ * that habitat act on the next tock. A `SignerNotHeldError` that still escapes a loop is a fault: the loop ends
+ * and the failure ends this operation.
+ *
  * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
  * @param options Optional default query/cue signer, remote pollMailbox switch
  * (default true) and command-owned queryCues Deck. Wire queryCues before starting
@@ -628,28 +621,25 @@ export function* runAgentRuntime(runtime, options = {}) {
     runtime.querying.configure({ hab: options.hab });
     const pacing = runtime.protocolPacing;
     const telReceiptor = runtime.vdr ? new Receiptor(runtime.hby, runtime.protocol, runtime.http, runtime.clock) : null;
-    // A loop that needs a signer the host released waits for it; it never ends the runtime (see `surviving`).
-    const alive = (loop, make) => spawn(() => surviving(runtime, loop, make));
-    const stopHoldWatch = runtime.hby.mgr.onHold(() => runtime.signerConditions.held());
     const tasks = [
-        yield* alive("querying", () => runtime.querying.deliverDo(pacing.tockMs)),
-        yield* alive("postman", () => runtime.postman.deliverDo(pacing.tockMs)),
+        yield* spawn(() => runtime.querying.deliverDo(pacing.tockMs)),
+        yield* spawn(() => runtime.postman.deliverDo(pacing.tockMs)),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* alive("tel-publication", () => doEveryOnWrite(runtime.clock, pacing, {
+                yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, {
                     get writeActivity() {
                         return runtime.hby.db.writeActivity + runtime.vdr.publication.reger.writeActivity;
                     },
                 }, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
-        yield* alive("cues", () => cueDo(runtime, options, pacing)),
-        yield* alive("escrows", () => runtime.protocol.escrowDo(runtime.clock, pacing)),
-        yield* alive("oobi", () => runtime.oobiery.oobiDo(runtime.clock, pacing)),
-        yield* alive("authentication", () => runtime.authenticator.authDo(runtime.clock, pacing)),
+        yield* spawn(() => cueDo(runtime, options, pacing)),
+        yield* spawn(() => runtime.protocol.escrowDo(runtime.clock, pacing)),
+        yield* spawn(() => runtime.oobiery.oobiDo(runtime.clock, pacing)),
+        yield* spawn(() => runtime.authenticator.authDo(runtime.clock, pacing)),
         ...(runtime.signaler
             ? [
-                yield* alive("signals", () => runtime.signaler.signalDo(runtime.clock, pacing)),
+                yield* spawn(() => runtime.signaler.signalDo(runtime.clock, pacing)),
             ]
             : []),
         ...(options.pollMailbox ?? true
@@ -659,12 +649,12 @@ export function* runAgentRuntime(runtime, options = {}) {
                 }),
             ]
             : []),
-        yield* alive("delegation", () => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.delegating.processAllOnce())),
-        yield* alive("counselor", () => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.counselor.processOnce(), () => runtime.counselor.holdsForwards)),
-        yield* alive("kel-publisher", () => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
+        yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.delegating.processAllOnce())),
+        yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.counselor.processOnce(), () => runtime.counselor.holdsForwards)),
+        yield* spawn(() => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
         ...(runtime.operations && runtime.ipex
             ? [
-                yield* alive("operation-owners", () => operationOwnersDo({
+                yield* spawn(() => operationOwnersDo({
                     operations: runtime.operations,
                     rootReplicator: runtime.rootReplicator,
                     ipex: runtime.ipex,
@@ -677,29 +667,8 @@ export function* runAgentRuntime(runtime, options = {}) {
         return yield* suspend();
     }
     finally {
-        stopHoldWatch();
         for (const task of tasks.reverse()) {
             yield* task.halt();
         }
     }
 }
-/** How long a loop waits for a held signer before trying again, in milliseconds. */
-const SIGNER_RETRY_MS = 1_000;
-/**
- * Run a background loop so that a signer the host released does not end the runtime: the loop's
- * `SignerNotHeldError` is recorded in `runtime.signerConditions`, the loop waits for a signer to be held (or a
- * second) and starts again. Every other failure still ends it.
- */
-function* surviving(runtime, loop, make) {
-    while (true) {
-        try {
-            return yield* make();
-        }
-        catch (error) {
-            if (!(error instanceof SignerNotHeldError))
-                throw error;
-            runtime.signerConditions.report(`runtime:${loop}`, error.pub, runtime.clock.now());
-            yield* runtime.signerConditions.waitForHold(runtime.clock, SIGNER_RETRY_MS);
-        }
-    }
-}