reploid 0.0.0-stage → 0.1.1

package/packages/reploid/src/transport/tool-offer-channel.js

@@ -0,0 +1,137 @@
+import { hashJson } from '../artifacts/signatures.js';
+
+export const TOOL_OFFER_MESSAGE = 'reploid:tool-offer';
+export const TOOL_OFFER_ACK = 'reploid:tool-offer-ack';
+const copy = value => JSON.parse(JSON.stringify(value));
+const assert = (ok, message) => { if (!ok) throw new Error(message); };
+const bytes = value => new TextEncoder().encode(value);
+const digest = hashJson;
+const hashPattern = /^sha256:[a-f0-9]{64}$/;
+const identifier = value => typeof value === 'string' && /^[a-zA-Z0-9:._-]{1,180}$/.test(value);
+
+/** Bounded, explicitly retried delivery. Acknowledgement means retained preview, never evaluation or adoption.
+ * The host supplies a durable store and serialization lock. The connection remains borrowed.
+ */
+export function createToolOfferChannel({ peerId, roomId, policy, ports }) {
+  policy = Object.freeze(copy(policy));
+  assert(identifier(peerId) && identifier(roomId), 'Explicit peer and room identities are required');
+  for (const key of ['maxBytes', 'maxRecords', 'maxPending', 'ttlMs', 'maxAttempts']) {
+    assert(Number.isSafeInteger(policy[key]) && policy[key] > 0, 'Invalid transfer limit: ' + key);
+  }
+  let closed = false, pending = 0;
+  const now = ports.now || Date.now;
+  const load = async () => (await ports.load()) || { schema: 'reploid.tool-transfers/v1', inbox: [], outbox: [] };
+  const commit = async state => {
+    assert(!closed, 'Candidate channel is closed');
+    await ports.save(copy(state)); ports.onChange?.(copy(state));
+  };
+  const transact = operation => {
+    assert(!closed, 'Candidate channel is closed');
+    assert(pending < policy.maxPending, 'Candidate channel is busy');
+    pending++;
+    return Promise.resolve().then(() => ports.lock(async () => {
+      assert(!closed, 'Candidate channel is closed'); return operation(await load());
+    })).finally(() => pending--);
+  };
+  const validate = async (remote, envelope) => {
+    assert(envelope && Object.keys(envelope).sort().join(',') === 'bytes,createdAt,expiresAt,offerHash,recipient,roomId,schema,sender,targetContract,targetId,text,transferId', 'Malformed transfer');
+    assert(envelope.schema === 'reploid.tool-transfer/v1' && envelope.roomId === roomId
+      && envelope.sender === remote && envelope.recipient === peerId && remote !== peerId
+      && identifier(remote) && identifier(envelope.transferId) && identifier(envelope.targetId), 'Transfer identity mismatch');
+    assert(Number.isSafeInteger(envelope.createdAt) && Number.isSafeInteger(envelope.expiresAt)
+      && envelope.createdAt <= now() && envelope.expiresAt > now()
+      && envelope.expiresAt - envelope.createdAt > 0 && envelope.expiresAt - envelope.createdAt <= policy.ttlMs, 'Transfer expired or invalid lifetime');
+    assert(typeof envelope.text === 'string' && envelope.bytes === bytes(envelope.text).byteLength
+      && envelope.bytes <= policy.maxBytes && hashPattern.test(envelope.targetContract), 'Transfer size or contract is invalid');
+    assert(envelope.offerHash === await digest(envelope.text), 'Transfer content hash does not match');
+    return digest(envelope);
+  };
+  const acknowledge = async record => {
+    assert(!closed, 'Candidate channel is closed');
+    return ports.send(record.sender, TOOL_OFFER_ACK, {
+    schema: 'reploid.tool-transfer-ack/v1', roomId, sender: peerId, recipient: record.sender,
+    transferId: record.transferId, envelopeHash: record.envelopeHash, status: record.status,
+    reason: record.reason || ''
+    });
+  };
+  const dispatch = async (state, record) => {
+    assert(record.envelope.sender === peerId && record.envelope.expiresAt > now(), 'Transfer expired or belongs to another sender');
+    assert(record.attempts < policy.maxAttempts, 'Transfer retry limit reached');
+    assert(await ports.authorize({ action: 'offer.send', envelope: copy(record.envelope) }) === true, 'Host denied candidate sending');
+    record.attempts++; record.status = 'sending'; record.error = null;
+    await commit(state);
+    assert(!closed, 'Candidate channel is closed');
+    try { assert(await ports.send(record.envelope.recipient, TOOL_OFFER_MESSAGE, copy(record.envelope)) === true, 'Peer connection is unavailable'); }
+    catch (error) { record.status = 'interrupted'; record.error = String(error.message || error); await commit(state); }
+    return copy(record);
+  };
+  return Object.freeze({
+    async list() { return copy(await load()); },
+    async send({ recipient, targetId, targetContract, text }) {
+      assert(identifier(recipient) && recipient !== peerId && identifier(targetId) && hashPattern.test(targetContract), 'Invalid candidate destination or contract');
+      assert(typeof text === 'string' && bytes(text).byteLength <= policy.maxBytes, 'Candidate exceeds peer transfer allowance');
+      const createdAt = now();
+      const envelope = { schema: 'reploid.tool-transfer/v1', transferId: crypto.randomUUID(), sender: peerId, recipient, roomId,
+        createdAt, expiresAt: createdAt + policy.ttlMs, bytes: bytes(text).byteLength, targetId, targetContract, text, offerHash: await digest(text) };
+      const envelopeHash = await digest(envelope);
+      return transact(async state => {
+        assert(state.inbox.length + state.outbox.length < policy.maxRecords, 'Candidate transfer history is full');
+        const record = { envelope, envelopeHash, attempts: 0, status: 'sending', error: null };
+        state.outbox.push(record); return dispatch(state, record);
+      });
+    },
+    retry(transferId) {
+      return transact(async state => {
+        const record = state.outbox.find(item => item.envelope.transferId === transferId);
+        assert(record && ['sending', 'interrupted'].includes(record.status), 'Transfer cannot be retried');
+        return dispatch(state, record);
+      });
+    },
+    async receive(remote, type, payload) {
+      // Snapshot untrusted data before any await. Do not let transport callbacks mutate an in-flight validation.
+      const message = copy(payload);
+      return transact(async state => {
+        if (type === TOOL_OFFER_ACK) {
+          const record = state.outbox.find(item => item.envelope.transferId === message.transferId);
+          assert(record && message.schema === 'reploid.tool-transfer-ack/v1' && message.roomId === roomId
+            && remote === record.envelope.recipient && message.sender === remote && message.recipient === peerId
+            && message.envelopeHash === record.envelopeHash && ['received', 'refused'].includes(message.status)
+            && typeof message.reason === 'string' && message.reason.length <= 256, 'Invalid candidate acknowledgement');
+          if (['received', 'refused'].includes(record.status)) {
+            assert(record.status === message.status, 'Conflicting candidate acknowledgement'); return;
+          }
+          record.status = message.status; record.reason = message.reason; record.acknowledgedAt = now();
+          await commit(state); return;
+        }
+        assert(type === TOOL_OFFER_MESSAGE, 'Unsupported candidate message');
+        const envelopeHash = await validate(remote, message);
+        const existing = state.inbox.find(item => item.sender === remote && item.transferId === message.transferId);
+        if (existing) {
+          assert(existing.envelopeHash === envelopeHash, 'Conflicting candidate redelivery');
+          await acknowledge(existing); return;
+        }
+        const record = { transferId: message.transferId, sender: remote, recipient: peerId, roomId, envelopeHash,
+          receivedAt: now(), status: 'refused', reason: '', envelope: null };
+        if (state.inbox.length + state.outbox.length >= policy.maxRecords) {
+          record.reason = 'Candidate transfer history is full'; await acknowledge(record); return;
+        }
+        try {
+          assert(await ports.authorize({ action: 'offer.receive', envelope: copy(message) }) === true, 'Recipient is not accepting candidates');
+          await ports.validateOffer(copy(message));
+          assert(await ports.authorize({ action: 'offer.receive', envelope: copy(message) }) === true, 'Recipient is not accepting candidates');
+          record.status = 'received'; record.envelope = message;
+        } catch (error) { record.reason = String(error.message || error).slice(0, 256); }
+        state.inbox.push(record); await commit(state);
+        await acknowledge(record);
+      });
+    },
+    dismiss(transferId) {
+      return transact(async state => {
+        const record = state.inbox.find(item => item.transferId === transferId);
+        assert(record && record.status === 'received', 'Received candidate not found');
+        record.dismissed = true; await commit(state);
+      });
+    },
+    close() { closed = true; }
+  });
+}

package/server/browser-roots.js

@@ -0,0 +1,42 @@
+/**
+ * Source roots of the served browser tree. Each root holds files at their served
+ * paths, so a served path such as /config/chat-models.json resolves to the one root
+ * that contains it. Dependency-free: native delivery and the hosted backend use it.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const REPOSITORY_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+/** Agent substrate, code both surfaces load, and the Poolday product. */
+export const BROWSER_ROOTS = Object.freeze(['self', 'shared', 'apps/poolday']);
+
+const toPosix = value => String(value).split(path.sep).join('/');
+
+/** The root that contains a repository-relative path, or null. */
+export function rootOf(sourcePath, roots = BROWSER_ROOTS) {
+  const normalized = toPosix(sourcePath).replace(/^\.\//, '');
+  return [...roots].sort((a, b) => b.length - a.length)
+    .find(root => normalized.startsWith(root + '/')) || null;
+}
+
+/** The served path of a repository-relative source path, or null outside the roots. */
+export function servedPathOf(sourcePath, roots = BROWSER_ROOTS) {
+  const normalized = toPosix(sourcePath).replace(/^\.\//, '');
+  const root = rootOf(normalized, roots);
+  return root ? normalized.slice(root.length + 1) : null;
+}
+
+/**
+ * Absolute path of the source that serves a path or origin-relative URL. A path no
+ * root holds resolves inside the first root, so reading it fails as a missing file.
+ */
+export function resolveServedFile(servedPath, { repoRoot = REPOSITORY_ROOT, roots = BROWSER_ROOTS } = {}) {
+  const served = String(servedPath).replace(/[?#].*$/, '').replace(/^\/+/, '');
+  if (!served || served.split('/').some(part => part === '..' || part === '.')) throw new Error(`Invalid served path: ${servedPath}`);
+  for (const root of roots) {
+    const candidate = path.join(repoRoot, root, served);
+    if (existsSync(candidate)) return candidate;
+  }
+  return path.join(repoRoot, roots[0], served);
+}

package/server/browser-web-worker.js

@@ -0,0 +1,94 @@
+/** Operator-owned unsigned-in search profile. Only Google receives browser cookies;
+ * result documents use the existing public, DNS-guarded, cookie-free reader. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createPublicWebWorker } from './public-web-worker.js';
+
+const GOOGLE = 'https://www.google.com';
+const MARKER = '.reploid-search-profile';
+
+export async function openBrowserWebWorker({ profileDirectory, launch, pageFetch } = {}) {
+  if (!path.isAbsolute(profileDirectory || '')) throw new Error('Browser search needs an absolute dedicated profile directory');
+  await fs.mkdir(profileDirectory, { recursive: true, mode: 0o700 });
+  const entries = await fs.readdir(profileDirectory);
+  if (entries.length && !entries.includes(MARKER)) throw new Error('Refusing a browser profile not created for Reploid search');
+  await fs.writeFile(path.join(profileDirectory, MARKER), 'Dedicated Reploid public search profile; do not sign in.\n', { mode: 0o600 });
+  if (!launch) {
+    const { chromium } = await import('playwright').catch(() => { throw new Error('Browser search requires Playwright and Chrome; see docs/native-participant.md'); });
+    launch = chromium.launchPersistentContext.bind(chromium);
+  }
+  const context = await launch(profileDirectory, { channel: 'chrome', headless: false, serviceWorkers: 'block' });
+  const worker = createBrowserWebWorker({ context, pageFetch });
+  return Object.freeze({ ...worker, async close() { await worker.close(); await context.close(); } });
+}
+
+export function createBrowserWebWorker({ context, pageFetch }) {
+  let closed = false, active = null, verificationPage = null;
+  context.on?.('close', () => { closed = true; active?.controller.abort(new Error('Contributor browser closed')); });
+  const searchResults = async ({ query, maxResults, signal }) => {
+    signal?.throwIfAborted();
+    if (closed) throw new Error('Browser search is closed');
+    if (active) throw new Error('Browser search is busy');
+    const controller = new AbortController();
+    const forward = () => controller.abort(signal.reason);
+    signal?.addEventListener('abort', forward, { once: true });
+    const job = { controller, settled: null }; active = job;
+    job.settled = (async () => {
+      const page = await context.newPage();
+      const stop = () => { void page.close().catch(() => {}); };
+      controller.signal.addEventListener('abort', stop, { once: true });
+      try {
+        controller.signal.throwIfAborted();
+        // Search never follows result links in the browser. Block unrelated subresources.
+        await page.route('**/*', route => {
+          const url = new URL(route.request().url());
+          const allowed = url.protocol === 'https:' && /(^|\.)(google\.com|gstatic\.com|googleusercontent\.com)$/.test(url.hostname);
+          return allowed ? route.continue() : route.abort();
+        });
+        const url = new URL('/search', GOOGLE); url.searchParams.set('q', query);
+        await page.goto(url.href, { waitUntil: 'domcontentloaded', timeout: 8000 });
+        if (new URL(page.url()).pathname.startsWith('/sorry')) {
+          const operatorPage = context.pages().find(tab => tab !== page);
+          verificationPage = operatorPage;
+          await operatorPage?.goto(page.url(), { waitUntil: 'domcontentloaded', timeout: 4000 }).catch(() => {});
+          throw new Error('Google needs human verification in the contributor browser');
+        }
+        await page.locator('a:has(h3)').first().waitFor({ state: 'visible', timeout: 4000 });
+        const rows = await page.locator('a:has(h3)').evaluateAll((anchors, limit) => anchors.filter(a => a.getClientRects().length).slice(0, limit).map(a => ({
+          url: a.href, title: a.querySelector('h3').innerText,
+          excerpt: (a.closest('div.MjjYud')?.innerText || a.innerText).slice(0, 1500)
+        })), maxResults);
+        const settled = await Promise.allSettled(rows.map(async row => {
+          let target = new URL(row.url);
+          if (target.origin === GOOGLE && ['/goto', '/url'].includes(target.pathname)) {
+            // Resolve only the search engine hop with its own session; never forward cookies to a result.
+            const response = await context.request.get(target.href, { maxRedirects: 0, timeout: 4000 });
+            try {
+              if (![301, 302, 303, 307, 308].includes(response.status()) || !response.headers().location) return null;
+              target = new URL(response.headers().location, target);
+            } finally { await response.dispose(); }
+          }
+          if (!['https:', 'http:'].includes(target.protocol) || target.username || target.password || /(^|\.)google\.com$/.test(target.hostname)) return null;
+          return { ...row, url: target.href };
+        }));
+        controller.signal.throwIfAborted();
+        const failed = settled.find(result => result.status === 'rejected');
+        if (failed) throw failed.reason;
+        const results = settled.map(result => result.value).filter(Boolean);
+        if (!results.length) throw new Error('Browser search returned no usable public results');
+        return results;
+      } finally {
+        controller.signal.removeEventListener('abort', stop);
+        await page.close().catch(() => {});
+      }
+    })();
+    try { return await job.settled; }
+    finally { signal?.removeEventListener('abort', forward); if (active === job) active = null; }
+  };
+  const worker = createPublicWebWorker({ service: 'google-browser', searchResults, pageFetch });
+  return Object.freeze({ ...worker,
+    isAvailable: () => !closed && (!verificationPage || verificationPage.isClosed() || !new URL(verificationPage.url()).pathname.startsWith('/sorry')),
+    extract(args, owner) { if (closed) return Promise.reject(new Error('Browser search is closed')); return worker.extract(args, owner); },
+    async close() { closed = true; active?.controller.abort(new Error('Browser search closed')); await active?.settled.catch(() => {}); }
+  });
+}

package/server/chat-completions.js

@@ -0,0 +1,45 @@
+/** Text Chat Completions protocol over the existing authenticated HTTP requester. */
+import policy from '../apps/poolday/config/partition-policy.json' with { type: 'json' };
+import { createTextRequester, fail, object, freeze } from './text-requester.js';
+
+export function parseTextChatCompletion(body) {
+  if (!object(body)) throw fail(400, 'A JSON object is required');
+  for (const key of Object.keys(body)) if (!['model', 'messages', 'stream'].includes(key)) throw fail(400, `Unsupported parameter: ${key}`, key);
+  if (typeof body.model !== 'string' || !body.model.trim() || body.model.length > 256) throw fail(400, 'A bounded model id is required', 'model');
+  if (body.stream !== undefined && typeof body.stream !== 'boolean') throw fail(400, 'stream must be boolean', 'stream');
+  if (!Array.isArray(body.messages) || !body.messages.length || body.messages.length > 128) throw fail(400, 'Require 1–128 text messages', 'messages');
+  let characters = 0;
+  const messages = body.messages.map((message, index) => {
+    const param = `messages[${index}]`;
+    if (!object(message) || Object.keys(message).some(key => !['role', 'content'].includes(key))
+      || !['system', 'user', 'assistant'].includes(message.role) || typeof message.content !== 'string') {
+      throw fail(400, 'Only system/user/assistant string-content messages are supported', param);
+    }
+    characters += message.content.length;
+    if (characters > policy.inputLimits.maxInputCharacters) throw fail(413, 'Input text limit exceeded', 'messages');
+    return { role: message.role, content: message.content };
+  });
+  return freeze({ model: body.model, messages, stream: body.stream === true });
+}
+
+
+export function createChatCompletions(options) {
+  return createTextRequester(options, { path: '/v1/chat/completions', idPrefix: 'chatcmpl-', parse: parseTextChatCompletion,
+    output({ id, created, model, input, write, end, json }) {
+      let started = false;
+      const chunk = (delta, finishReason = null, usage = undefined) => write(`data: ${JSON.stringify({ id, object: 'chat.completion.chunk', created, model, ...(usage ? { usage } : {}),
+        choices: [{ index: 0, delta, logprobs: null, finish_reason: finishReason }] })}\n\n`);
+      return {
+        delta(text) { chunk({ ...(started ? {} : { role: 'assistant' }), content: text }); started = true; },
+        complete(content, finishReason, _reason, measured) {
+          const usage = measured ? { prompt_tokens: measured.inputTokens, completion_tokens: measured.outputTokens,
+            total_tokens: measured.inputTokens + measured.outputTokens } : undefined;
+          if (input.stream) { chunk({}, finishReason, usage); end('data: [DONE]\n\n'); }
+          else json({ id, object: 'chat.completion', created, model, ...(usage ? { usage } : {}),
+            choices: [{ index: 0, message: { role: 'assistant', content, refusal: null }, logprobs: null, finish_reason: finishReason }] });
+        },
+        error(error) { end(`data: ${JSON.stringify({ error })}\n\n`); }
+      };
+    }
+  });
+}

package/server/fleet/browser-bridge.js

@@ -0,0 +1,145 @@
+import http from 'node:http';
+import https from 'node:https';
+import { timingSafeEqual } from 'node:crypto';
+
+const assert = (ok, message) => { if (!ok) throw Error(message); };
+
+function normalizeBasePath(basePath = '') {
+  const clean = String(basePath || '').replace(/\/+$/, '');
+  assert(clean === '' || (/^\/[A-Za-z0-9/_-]+$/.test(clean) && !clean.includes('//')
+    && !clean.split('/').some(part => part === '.' || part === '..')), 'Clean browser bridge path prefix required');
+  return clean;
+}
+
+/** Explicitly paired access to an owner-operated native requester over loopback or TLS/bound-tunnel HTTPS.
+ * The pairing secret authorizes delegation to this host's enrolled private pool;
+ * it never exposes the signing identity, room credential, file paths or raw config. */
+export function createFleetBrowserBridgeHandler({ host, token, origins, basePath = '', maxBodyBytes = 262144, maxConcurrent = 8, maxSeenAttempts = 10000 }) {
+  assert(typeof token === 'string' && token.length >= 32, 'Strong pairing secret required');
+  assert(Array.isArray(origins) && origins.length && origins.every(origin => new URL(origin).origin === origin), 'Exact allowed browser origins required');
+  assert(Number.isSafeInteger(maxSeenAttempts) && maxSeenAttempts >= maxConcurrent, 'Positive replay window required');
+  const prefix = normalizeBasePath(basePath);
+  const pending = new Map(), seen = new Set();
+  const authenticate = request => {
+    const received = Buffer.from(request.headers.authorization || ''), expected = Buffer.from(`Bearer ${token}`);
+    return received.length === expected.length && timingSafeEqual(received, expected);
+  };
+  const handle = async (request, response) => {
+    let attemptId = null;
+    try {
+      assert(origins.includes(request.headers.origin), 'Browser origin is not paired');
+      response.setHeader('Access-Control-Allow-Origin', request.headers.origin);
+      response.setHeader('Vary', 'Origin');
+      response.setHeader('Cache-Control', 'no-store');
+      response.setHeader('X-Content-Type-Options', 'nosniff');
+      response.setHeader('Access-Control-Allow-Headers', 'authorization, content-type');
+      response.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+      response.setHeader('Access-Control-Allow-Private-Network', 'true');
+      if (request.method === 'OPTIONS') { response.writeHead(204); response.end(); return; }
+      assert(request.method === 'POST' && authenticate(request), 'Pair this browser with the native host first');
+      const pathname = new URL(request.url || '/', 'http://127.0.0.1').pathname;
+      assert(!prefix || pathname.startsWith(prefix + '/'), 'Unknown browser bridge operation');
+      const routePath = prefix ? pathname.slice(prefix.length) : pathname;
+      let length = 0; const chunks = [];
+      for await (const chunk of request) { length += chunk.length; assert(length <= maxBodyBytes, 'Request exceeds browser bridge limit'); chunks.push(chunk); }
+      const body = JSON.parse(Buffer.concat(chunks));
+      if (routePath === '/state') {
+        response.setHeader('Content-Type', 'application/json'); response.end(JSON.stringify(await host.browserState())); return;
+      }
+      if (routePath === '/receipt') {
+        assert(typeof body.id === 'string' && body.id.length < 512, 'Receipt identity required');
+        response.setHeader('Content-Type', 'application/json'); response.end(JSON.stringify(await host.receipt(body.id))); return;
+      }
+      if (routePath === '/accounts') {
+        response.setHeader('Content-Type', 'application/json'); response.end(JSON.stringify(await host.balances())); return;
+      }
+      if (routePath === '/cancel') {
+        assert(pending.has(body.attemptId), 'No active bridge request');
+        host.cancel(body.attemptId); response.setHeader('Content-Type', 'application/json'); response.end(JSON.stringify({ status: 'stopping' })); return;
+      }
+      if (routePath === '/recover') {
+        assert(typeof host.recover === 'function', 'Recovery is not configured on this host');
+        assert(typeof body.reservationId === 'string' && body.reservationId.length > 0 && body.reservationId.length < 512
+          && Array.isArray(body.messages) && body.messages.length > 0
+          && body.messages.every(row => ['user', 'assistant', 'system'].includes(row.role) && typeof row.content === 'string'),
+        'Bound reservation and original messages required');
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify(await host.recover({
+          reservationId: body.reservationId,
+          messages: body.messages,
+          ...(typeof body.providerId === 'string' && body.providerId.length <= 256 ? { providerId: body.providerId } : {})
+        })));
+        return;
+      }
+      assert(routePath === '/generate', 'Unknown browser bridge operation');
+      assert(typeof body.attemptId === 'string' && body.attemptId.length <= 128 && typeof body.threadId === 'string'
+        && body.threadId.length <= 128 && Array.isArray(body.messages) && body.messages.length > 0
+        && body.messages.every(row => ['user', 'assistant', 'system'].includes(row.role) && typeof row.content === 'string'), 'Invalid conversation request');
+      assert(pending.size < maxConcurrent && !seen.has(body.attemptId), 'Request already used or bridge limit reached');
+      while (seen.size >= maxSeenAttempts) {
+        const oldest = [...seen].find(id => !pending.has(id));
+        assert(oldest !== undefined, 'Request already used or bridge limit reached');
+        seen.delete(oldest);
+      }
+      attemptId = body.attemptId; seen.add(attemptId); pending.set(attemptId, Promise.resolve());
+      const state = await host.browserState();
+      const model = state.models.find(row => row.id === body.model?.id && row.identity === body.model?.identity);
+      assert(model && ['ready', 'busy'].includes(model.availability), 'No private computer is ready for this model');
+      assert(body.poolIdentity === state.poolIdentity, 'Private computer enrollment changed; reconnect before sending');
+      // Never accept a browser-supplied route, source, adapter, generation policy or provider.
+      response.writeHead(200, { 'Content-Type': 'application/x-ndjson; charset=utf-8', 'X-Accel-Buffering': 'no' });
+      const emit = event => { if (!response.destroyed) response.write(JSON.stringify(event) + '\n'); };
+      response.on('close', () => { if (pending.has(attemptId)) host.cancel(attemptId); });
+      let lastAdmission = null;
+      const operation = host.generate(
+        { threadId: body.threadId, attemptId, model: { id: model.id, identity: model.identity }, messages: body.messages },
+        delta => emit({ delta }),
+        disclosure => {
+          const route = disclosure.route;
+          emit({ status: 'executing', execution: { provider: 'peer', placement: route ? 'ordered-layer-partition' : 'peer-whole-request',
+            ...(route ? { identity: { schema: 'reploid.partition-attempt/v2', route, requesterId: state.requester.participantId, threadId: body.threadId, attemptId } }
+              : { peerId: disclosure.recipientIdentity }),
+            ...(lastAdmission ? { admission: lastAdmission } : {}),
+            serviceCredit: { status: 'pending', id: `service:${state.requester.participantId}:${route ? attemptId : disclosure.requestId}` } } });
+        },
+        admission => {
+          lastAdmission = admission;
+          if (admission?.status === 'queued') emit({ status: 'queued', execution: { admission } });
+        }
+      );
+      pending.set(attemptId, operation);
+      try { emit({ result: await operation }); }
+      catch (error) { emit({ error: error.message, serviceCredit: error.serviceCredit || null, ...(error.disconnect ? { disconnect: error.disconnect } : {}) }); }
+      finally { pending.delete(attemptId); response.end(); }
+    } catch (error) {
+      if (attemptId) pending.delete(attemptId);
+      if (!response.headersSent) response.writeHead(400, { 'Content-Type': 'application/json' });
+      response.end(JSON.stringify({ error: error.message }));
+    }
+  };
+  return {
+    prefix,
+    handle,
+    async close() {
+      for (const id of pending.keys()) host.cancel(id);
+      await Promise.allSettled([...pending.values()]);
+    }
+  };
+}
+
+export async function startFleetBrowserBridge({ host, token, origins, listenHost = '127.0.0.1', port = 0, tls = null, basePath = '', maxBodyBytes = 262144, maxConcurrent = 8, maxSeenAttempts = 10000 }) {
+  const loopback = ['127.0.0.1', '::1', 'localhost'].includes(listenHost);
+  assert(loopback || Boolean(tls?.key && tls?.cert), 'Non-loopback browser bridge requires TLS');
+  const bridge = createFleetBrowserBridgeHandler({ host, token, origins, basePath, maxBodyBytes, maxConcurrent, maxSeenAttempts });
+  const server = tls ? https.createServer(tls, bridge.handle) : http.createServer(bridge.handle);
+  server.requestTimeout = 30000;
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, listenHost, resolve); });
+  const hostText = listenHost.includes(':') ? `[${listenHost}]` : listenHost;
+  return {
+    url: `${tls ? 'https' : 'http'}://${hostText}:${server.address().port}${bridge.prefix}`,
+    async close() {
+      await bridge.close();
+      await new Promise(resolve => { server.close(resolve); server.closeAllConnections(); });
+    }
+  };
+}

package/server/fleet/contract.js

@@ -0,0 +1,42 @@
+import { canonicalize } from '../../packages/reploid/src/artifacts/canonical-json.js';
+import { participantIdFor, normalizeParticipantPublicKey } from '../../packages/reploid/src/artifacts/participant-proofs.js';
+
+export const assert = (condition, message) => { if (!condition) throw Error(message); };
+export const integer = value => Number.isSafeInteger(value) && value >= 0;
+export const digest = value => typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
+export const text = value => typeof value === 'string' && value.length > 0 && value.length <= 256;
+export const same = (a, b) => canonicalize(a) === canonicalize(b);
+
+/** Enrollment comes from the operator, never from a remote advertisement. */
+export async function enrollComputers(computers) {
+  assert(Array.isArray(computers) && computers.length > 0 && computers.length <= 256, 'Explicit fleet enrollment required');
+  const byPeer = new Map(), byId = new Map();
+  for (const source of computers) {
+    const computer = structuredClone(source);
+    assert(text(computer.id) && text(computer.name) && text(computer.ownerId) && !byId.has(computer.id)
+      && Array.isArray(computer.providers) && computer.providers.length > 0, 'Invalid computer enrollment');
+    byId.set(computer.id, computer);
+    for (const provider of computer.providers) {
+      const publicJwk = normalizeParticipantPublicKey(provider.publicJwk);
+      assert(publicJwk && !Object.hasOwn(provider.publicJwk, 'd'), 'Only public enrollment keys are admitted');
+      const participantId = await participantIdFor(publicJwk);
+      assert(provider.participantId === participantId && !byPeer.has(participantId), 'Provider key must belong to exactly one enrolled computer');
+      byPeer.set(participantId, { computerId: computer.id, ownerId: computer.ownerId, publicJwk });
+    }
+  }
+  return { byId, byPeer };
+}
+
+export function creditPolicy(source) {
+  const policy = structuredClone(source);
+  assert(policy?.schema === 'reploid.service-credit-policy/v1' && policy.unit === 'noncash-service-credit'
+    && text(policy.version) && integer(policy.creditsPerOutputToken) && policy.creditsPerOutputToken > 0
+    && integer(policy.maxDebt) && integer(policy.maxOutputTokens) && policy.maxOutputTokens > 0
+    && integer(policy.maxPendingPerComputer) && policy.maxPendingPerComputer > 0
+    && integer(policy.maxClockSkewMs) && integer(policy.maxRequestMs) && policy.maxRequestMs > 0
+    && typeof policy.allowSameOwner === 'boolean'
+    && (policy.wholeModelTerminalCharge === undefined || policy.wholeModelTerminalCharge === 0),
+  'Explicit non-cash credit policy required');
+  assert(Number.isSafeInteger(policy.maxOutputTokens * policy.creditsPerOutputToken + policy.maxDebt), 'Credit policy exceeds integer precision');
+  return Object.freeze(policy);
+}

package/server/fleet/credit-evidence.js

@@ -0,0 +1,103 @@
+import { verifyGenerationTerminal } from '../../packages/reploid/src/artifacts/generation-terminal.js';
+import { verifyReceipt } from '../../packages/reploid/src/artifacts/receipt.js';
+import { verifyStageReceipt, verifyOutputAcknowledgment, attemptRouteHash, outputChainGenesis } from '../../packages/reploid/src/mesh/partitions/partition-attempt-evidence.js';
+import { canonicalRouteAttemptBinding } from '../../packages/reploid/src/mesh/partitions/partition-contract.js';
+import { normalizeParticipantPublicKey } from '../../packages/reploid/src/artifacts/participant-proofs.js';
+import { assert, same, integer } from './contract.js';
+
+/** Reuse execution signatures; the credit service never treats a completed counter as evidence. */
+export async function verifyCreditEvidence(request, evidence, enrollment, now, skew, { unadmitted = [] } = {}) {
+  const within = at => Number.isFinite(at) && at >= request.createdAt - skew
+    && at <= Math.min(now, request.deadline) + skew;
+  if (request.mode === 'whole-model') {
+    if (evidence?.schema === 'reploid.generation-terminal/v1') {
+      const provider = request.providers[0]?.participantId;
+      assert(request.providers.length === 1 && await verifyGenerationTerminal(evidence, {
+        requestId: request.executionId, provider, consumer: request.consumer, model: request.model.id,
+        modelIdentity: request.model.identity, adapterIdentities: request.model.adapterIdentities,
+        inputDigest: request.inputDigest
+      }) && same(normalizeParticipantPublicKey(evidence.publicJwk), enrollment.byPeer.get(provider)?.publicJwk)
+        && evidence.timestamp >= request.createdAt - skew && evidence.timestamp <= now + skew,
+      'Terminal cleanup does not match the accepted request');
+      // Cleanup is not a token meter. A fixed terminal charge must have been
+      // accepted separately; missing terms leave this execution pending.
+      return { outputTokens: null, terminalStatus: evidence.status, fixedCharge: request.terminalCharge ?? null, outputIdentity: null,
+        workIds: [`whole:${provider}:${request.consumer}:request:${request.executionId}`] };
+    }
+    const receipt = structuredClone(evidence);
+    assert(request.providers.length === 1 && receipt.version === 2 && receipt.status === 'completed'
+      && receipt.cleanup === 'settled' && receipt.provider === request.providers[0].participantId
+      && receipt.consumer === request.consumer && receipt.jobHash === `request:${request.executionId}`
+      && receipt.model === request.model.id && receipt.modelIdentity === request.model.identity
+      && same(receipt.adapterIdentities, request.model.adapterIdentities) && receipt.inputDigest === request.inputDigest
+      && within(receipt.timestamp) && integer(receipt.outputTokens) && receipt.outputTokens <= request.maxOutputTokens,
+    'Completed receipt does not match the accepted request');
+    assert(same(normalizeParticipantPublicKey(receipt.providerKey), enrollment.byPeer.get(receipt.provider).publicJwk)
+      && same(normalizeParticipantPublicKey(receipt.consumerKey), enrollment.byPeer.get(receipt.consumer).publicJwk), 'Receipt enrollment changed');
+    const verified = await verifyReceipt(receipt);
+    assert(verified.providerValid && verified.consumerValid, 'Countersigned completed receipt required');
+    return { outputTokens: receipt.outputTokens, outputIdentity: receipt.outputDigest, workIds: [`whole:${receipt.provider}:${receipt.consumer}:${receipt.jobHash}`] };
+  }
+  const proof = await verifyPartitionComponents(request, evidence, enrollment, now, skew);
+  const { receipts, acknowledgment, acknowledgedReceipt } = proof;
+  assert(acknowledgment, 'Matching requester acknowledgment required');
+  const workIds = [];
+  for (let index = 0; index < request.providers.length; index++) {
+    const receipt = receipts.find(row => row.partitionIndex === index), provider = request.providers[index];
+    if (!receipt && unadmitted.includes(index) && acknowledgment.count === 0) continue;
+    assert(receipt && ['settled', 'failed'].includes(receipt.status) && receipt.timing.closedAt !== null
+      && receipt.steps >= acknowledgment.count, 'Settled stage receipt does not match the acknowledged work');
+    workIds.push(`stage:${receipt.participantId}:${receipt.reservationId}:${receipt.attemptId}:${index}`);
+  }
+  if (acknowledgment.count > 0) {
+    const final = acknowledgedReceipt ?? receipts.find(row => row.partitionIndex === request.providers.length - 1);
+    assert(final?.output?.count === acknowledgment.count && final.output.chain === acknowledgment.chain,
+      'Final output differs from requester acknowledgment');
+  }
+  return { outputTokens: acknowledgment.count, outputIdentity: acknowledgment.chain, workIds };
+}
+
+/** Validate independently submitted pieces before retaining them. A signed failure is a closing
+ * receipt only when it carries closedAt; executing receipts never establish cleanup. */
+export async function verifyPartitionComponents(request, evidence, enrollment, now, skew) {
+  assert(request.mode === 'partition' && evidence && same(canonicalRouteAttemptBinding(evidence.identity), request.route),
+    'Partition route differs from accepted route');
+  const routeHash = await attemptRouteHash(evidence.identity);
+  const signedTime = value => Number.isFinite(Date.parse(value)) && Date.parse(value) >= request.createdAt - skew
+    && Date.parse(value) <= now + skew;
+  const executionTime = value => signedTime(value) && Date.parse(value) <= request.deadline + skew;
+  const checkReceipt = async receipt => {
+    const provider = request.providers[receipt?.partitionIndex];
+    assert(provider, 'Unknown receipt stage');
+    const checked = await verifyStageReceipt(receipt, { publicJwk: enrollment.byPeer.get(provider.participantId).publicJwk });
+    assert(checked.ok && receipt.participantId === provider.participantId && receipt.reservationId === request.id
+      && receipt.attemptId === request.executionId && receipt.routeHash === routeHash && receipt.steps <= request.maxOutputTokens
+      && signedTime(receipt.signedAt) && executionTime(receipt.timing.reservedAt)
+      && (receipt.steps === 0 || executionTime(receipt.timing.firstStepAt) && executionTime(receipt.timing.lastStepAt))
+      && (receipt.status === 'executing' ? receipt.timing.closedAt === null : signedTime(receipt.timing.closedAt)),
+    'Stage receipt does not match the admitted work');
+    assert(receipt.partitionIndex === request.providers.length - 1 ? receipt.output !== null : receipt.output === null,
+      'Only the final stage commits outputs');
+    return structuredClone(receipt);
+  };
+  assert(Array.isArray(evidence.receipts) && evidence.receipts.length <= request.providers.length, 'Bounded stage receipts required');
+  const receipts = await Promise.all(evidence.receipts.map(checkReceipt));
+  assert(new Set(receipts.map(row => row.partitionIndex)).size === receipts.length, 'Duplicate stage receipt');
+  const acknowledgment = evidence.acknowledgment ?? evidence.acknowledged?.acknowledgment ?? null;
+  const acknowledgedReceipt = evidence.acknowledgedReceipt ?? evidence.acknowledged?.receipt ?? null;
+  if (acknowledgment) {
+    const ack = await verifyOutputAcknowledgment(acknowledgment, { publicJwk: enrollment.byPeer.get(request.consumer).publicJwk });
+    assert(ack.ok && acknowledgment.requesterId === request.consumer && acknowledgment.reservationId === request.id
+      && acknowledgment.attemptId === request.executionId && acknowledgment.routeHash === routeHash
+      && signedTime(acknowledgment.signedAt) && acknowledgment.count <= request.maxOutputTokens, 'Matching requester acknowledgment required');
+    if (acknowledgment.count === 0) assert(acknowledgment.chain === await outputChainGenesis({ reservationId: request.id, routeHash }),
+      'Zero acknowledgment must bind the genesis chain');
+    if (acknowledgedReceipt) {
+      await checkReceipt(acknowledgedReceipt);
+      assert(acknowledgedReceipt.partitionIndex === request.providers.length - 1
+        && acknowledgedReceipt.output.count === acknowledgment.count && acknowledgedReceipt.output.chain === acknowledgment.chain,
+      'Acknowledged output prefix differs');
+    }
+  } else assert(!acknowledgedReceipt, 'Output prefix needs its acknowledgment');
+  return { identity: request.route, receipts, acknowledgment, acknowledgedReceipt };
+}