sealbridge 0.2.2 → 0.3.0

package/dist/packages/runtime/dist/session.js

@@ -1,27 +1,38 @@
 // SPDX-License-Identifier: Apache-2.0
+import { IdempotencyStore, runtimeIdempotencyAction, unwrapIdempotency, validateIdempotencyKey } from './idempotency-store.js';
+import { RecipientDeliveryCoordinator } from './delivery-status.js';
+import { setDeliveryStatusReaderFactory } from './delivery-status-router.js';
+import { PENDING_NEXT_STEP, pendingErrorCode } from './requester-pending-store.js';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { consumeDailyTask } from './daily-limit.js';
 import { existsSync, openSync, closeSync, fstatSync, fchmodSync, appendFileSync, constants, fsyncSync, readFileSync, } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
-import { createContract, createCapability, createSignedAgentCard, createInviteToken, parseAndVerifyInviteToken, isInviteTarget, validateRelayEndpointUrl, signPayload, verifySigned, verifyEnvelope, verifyContract, verifyApproval, validateManifest, validateOutput, verifyCapabilityChain, capabilityIssuerControls, findDiscoveredAgentCard, discoverAgentCards, schemaNarrows, digest, openEnvelope, resolveDid, createRevocationNotice, verifyRevocationNotice, RevocationRegistry, signEnvelope, DEFAULT_CLOCK_SKEW_MS, OPEN_POLICY_FIELDS, } from '../../core/dist/index.js';
+import { createContract, createCapability, createSignedAgentCard, createInviteToken, parseAndVerifyInviteToken, isInviteTarget, validateRelayEndpointUrl, signPayload, verifySigned, verifyEnvelope, verifyContract, verifyApproval, validateManifest, validateOutput, verifyCapabilityChain, capabilityIssuerControls, findDiscoveredAgentCard, discoverAgentCards, schemaNarrows, digest, openEnvelope, resolveDid, createRevocationNotice, verifyRevocationNotice, RevocationRegistry, signEnvelope, DEFAULT_CLOCK_SKEW_MS, assertConnectionsOptions, isConnectionEvent, } from '../../core/dist/index.js';
 import { parseJsonl, verifyAudit } from '../../ledger/dist/index.js';
-import { HttpRelayClient, waitForRelayRetry, relayDiagnostic, relayDeadline } from '../../relay/dist/index.js';
+import { HttpRelayClient, waitForRelayRetry, relayDiagnostic, relayDeadline, validateRelayAuthRecoveryOptions } from '../../relay/dist/index.js';
 import { InteractiveCliApprovalProvider, ProposalRejectedError, evaluateContractAcceptance, } from './approval-providers.js';
 import { OwnerGateway } from './gateway.js';
 import { MCPProxy } from './mcp.js';
 import { VerificationEngine, createDelivery } from './verifier.js';
 import { asJson, receiveRelay, acknowledgeRelay, PeerRejectedError, SessionWire } from './session-audit.js';
 import { SessionTimeouts, validateSessionTimeouts, resolveSessionTimeouts } from './session-timeouts.js';
+import { WorkerTrustStore, workerIntakePath, PENDING_MESSAGE } from './worker-trust-store.js';
+import { LiveProtocol } from './protocol-release.js';
+import { HeldRequestReview } from './held-request-review.js';
+import { ConnectionRouter } from './connection-router.js';
+import { connectionIdFor } from './connection-service.js';
+import { openConnectionFrame } from './connection-transport.js';
 import { TaskJournal } from './task-journal.js';
+import { GatewayDeliveryService } from './outbox.js';
+import { deliveryError, receiptFileId } from './delivery-records.js';
 const policy = { requiredGates: [], autoApprove: [] };
 /** Daemon workers stay finite unless the owner raises the cap. */
 export const DEFAULT_MAX_CONCURRENT_TASKS = 8;
 function acceptanceFrom(options) {
     return {
         allowedRequesterDids: options.allowedRequesterDids,
-        allowAnyRequester: options.allowAnyRequester,
         maxInputTokens: options.maxInputTokens,
         maxOutputTokens: options.maxOutputTokens,
         maxToolInvocations: options.maxToolInvocations,
@@ -55,6 +66,12 @@ function validateAcceptance(acceptance) {
     if (acceptance.allowedRequesterDids?.some((did) => typeof did !== 'string' || did.trim() === ''))
         throw new Error('INVALID_REQUESTER_DID');
 }
+function deliveryPins(relay) {
+    return {
+        ...(relay.getDeliveryStatusPin ? { getDeliveryStatusPin: (id) => relay.getDeliveryStatusPin(id) } : {}),
+        ...(relay.restoreDeliveryStatusPin ? { restoreDeliveryStatusPin: (id, did) => relay.restoreDeliveryStatusPin(id, did) } : {}),
+    };
+}
 function transport(relay, owner, security) {
     const client = typeof relay === 'string'
         ? new HttpRelayClient(relay.replace(/\/$/, ''), owner, security)
@@ -62,9 +79,12 @@ function transport(relay, owner, security) {
     client.setRecipientKey?.(owner);
     const bound = client.withRecipient?.(owner) ?? client;
     return {
+        ...deliveryPins(bound),
         get connectionStatus() { return bound.connectionStatus; },
         send: (envelope) => relayDeadline(Promise.resolve(bound.send(envelope)), security?.requestTimeoutMs ?? 45_000),
         receive: async (did, waitMs, signal, filter) => {
+            if (bound.managesRequestDeadlines)
+                return bound.receive(did, waitMs, signal, filter);
             const controller = new AbortController();
             const readSignal = AbortSignal.any([controller.signal, ...(signal ? [signal] : [])]);
             try {
@@ -75,8 +95,10 @@ function transport(relay, owner, security) {
                 throw error;
             }
         },
-        ...(bound.acknowledgeDelivery ? { acknowledgeDelivery: (did, id) => relayDeadline(Promise.resolve(bound.acknowledgeDelivery(did, id)), security?.requestTimeoutMs ?? 45_000) } : {}),
-        ...(bound.deliveryStatus ? { deliveryStatus: (envelope, signal) => relayDeadline(Promise.resolve(bound.deliveryStatus(envelope, signal)), security?.requestTimeoutMs ?? 45_000, signal) } : {}),
+        ...(bound.acknowledgeDelivery ? { acknowledgeDelivery: (did, id, signal) => bound.managesRequestDeadlines ? bound.acknowledgeDelivery(did, id, signal) :
+                relayDeadline(Promise.resolve(bound.acknowledgeDelivery(did, id, signal)), security?.requestTimeoutMs ?? 45_000, signal) } : {}),
+        ...(bound.deliveryStatus ? { deliveryStatus: (envelope, signal) => bound.managesRequestDeadlines
+                ? bound.deliveryStatus(envelope, signal) : relayDeadline(Promise.resolve(bound.deliveryStatus(envelope, signal)), security?.requestTimeoutMs ?? 45_000, signal) } : {}),
         ...(bound.register ? { register: (card) => bound.register(card) } : {}),
         ...(bound.discover ? { discover: () => relayDeadline(Promise.resolve(bound.discover()), security?.requestTimeoutMs ?? 45_000) } : {}),
     };
@@ -135,9 +157,10 @@ class TaskMailbox {
 }
 function mailboxRelay(relay, mailbox) {
     return {
+        ...deliveryPins(relay),
         send: (envelope) => relay.send(envelope),
         ...(relay.deliveryStatus ? { deliveryStatus: (envelope, signal) => relay.deliveryStatus(envelope, signal) } : {}),
-        ...(relay.acknowledgeDelivery ? { acknowledgeDelivery: (did, id) => relay.acknowledgeDelivery(did, id) } : {}),
+        ...(relay.acknowledgeDelivery ? { acknowledgeDelivery: (did, id, signal) => relay.acknowledgeDelivery(did, id, signal) } : {}),
         receive: (_recipientDid, _waitMs, signal) => mailbox.take(signal),
     };
 }
@@ -217,6 +240,23 @@ class RecipientInbox {
     readAbort;
     started = false;
     error;
+    connections;
+    delivery;
+    setDelivery(service, url, active) {
+        this.delivery = { service, url, active };
+        this.readAbort?.abort();
+        this.wake?.();
+        this.wake = undefined;
+        if (active && !this.started) {
+            this.started = true;
+            registerRequesterInbox(this.did, this);
+            void this.pump();
+        }
+    }
+    statusIds() {
+        return this.delivery && (this.delivery.active || this.mailboxes.size > 0) ? this.delivery.service.statusRouter.ids(this.delivery.url) : [];
+    }
+    setConnections(router) { this.connections = router; this.readAbort?.abort(); }
     constructor(relay, did) {
         this.relay = relay;
         this.did = did;
@@ -225,6 +265,10 @@ class RecipientInbox {
         return this.mailboxes.has(taskId);
     }
     deliverFromPeerRole(envelope) {
+        if (envelope.payload.eventType === 'DELIVERY_STATUS' && this.delivery) {
+            void this.delivery.service.statusRouter.route(envelope, this.relay).catch(e => this.delivery?.service.options.onError?.(e));
+            return true;
+        }
         const mailbox = this.mailboxes.get(envelope.payload.taskId);
         if (!mailbox)
             return false;
@@ -239,6 +283,8 @@ class RecipientInbox {
             return existing;
         const mailbox = new TaskMailbox();
         this.mailboxes.set(taskId, mailbox);
+        if (this.delivery || this.connections)
+            this.readAbort?.abort();
         registerRequesterInbox(this.did, this);
         this.wake?.();
         this.wake = undefined;
@@ -266,9 +312,9 @@ class RecipientInbox {
     }
     async pump() {
         for (;;) {
-            if (this.mailboxes.size === 0) {
+            if (this.mailboxes.size === 0 && this.statusIds().length === 0) {
                 await new Promise((resolve) => {
-                    if (this.mailboxes.size > 0) {
+                    if (this.mailboxes.size > 0 || this.statusIds().length > 0) {
                         resolve();
                         return;
                     }
@@ -279,9 +325,27 @@ class RecipientInbox {
             const controller = new AbortController();
             this.readAbort = controller;
             try {
-                const envelope = await receiveRelay(this.relay, this.did, controller.signal, {
-                    role: 'requester',
-                });
+                const statusIds = this.statusIds();
+                const readStatus = async () => statusIds.length ? await this.relay.receive(this.did, 0, controller.signal, { taskId: statusIds, lease: this.relay.acknowledgeDelivery !== undefined }) : undefined;
+                // Read the independent status namespace without a role filter so existing relays
+                // can forward it. Task reads retain bilateral role inference, including self-delegation.
+                const envelope = await readStatus() ?? await receiveRelay(this.relay, this.did, controller.signal, this.mailboxes.size === 0 ? { taskId: statusIds } : this.connections ? {
+                    taskId: [...this.mailboxes.keys(), ...this.connections.options.store.controlSnapshot()
+                            .filter(r => r.active).map(r => 'conn_' + r.offer.requestId)],
+                } : this.delivery ? { role: 'requester', taskId: [...this.mailboxes.keys()] } : { role: 'requester' }, undefined, readStatus);
+                if (envelope.payload.eventType === 'DELIVERY_STATUS' && this.delivery) {
+                    try {
+                        await this.delivery.service.statusRouter.route(envelope, this.relay);
+                    }
+                    catch (error) {
+                        this.delivery.service.options.onError?.(error);
+                    }
+                    continue;
+                }
+                if (isConnectionEvent(envelope.payload.eventType) && this.connections) {
+                    await this.connections.route(envelope);
+                    continue;
+                }
                 if (!this.mailboxes.has(envelope.payload.taskId) || this.isWorkerBoundFrame(envelope)) {
                     if (forwardToWorkerListener(this.did, envelope))
                         continue;
@@ -318,6 +382,9 @@ function recipientInbox(source, relay, did, relayUrl) {
     }
     return inbox;
 }
+setDeliveryStatusReaderFactory((service, relay, url, active) => {
+    recipientInbox(service, relay, service.owner.did, url.replace(/\/$/, '')).setDelivery(service, url, active);
+});
 /** Checks every backing list. Inbox notices and an owner-supplied registry both apply. */
 class CompositeRevocation {
     layers;
@@ -355,10 +422,18 @@ function asRevocationRegistry(list) {
 }
 export class WorkerNode {
     options;
+    deliveryService;
     relay;
     agentCard;
     approvalProvider;
     acceptance;
+    intakeStore;
+    connectionStore;
+    heldReview;
+    connections;
+    protocol;
+    acceptedPeers = new Map();
+    registered = false;
     completed = 0;
     activeTasks = 0;
     taskJournal;
@@ -379,7 +454,18 @@ export class WorkerNode {
     revocation;
     constructor(options) {
         this.options = options;
+        assertConnectionsOptions(options);
+        validateRelayAuthRecoveryOptions(options);
         validateSessionTimeouts(options);
+        this.protocol = new LiveProtocol(options);
+        this.intakeStore = options.intakeStore ?? new WorkerTrustStore(options.owner, {
+            path: options.identityOptions ? workerIntakePath(options.owner.did, options.identityOptions) : undefined,
+            fs: options.identityOptions?.fs, platform: options.identityOptions?.platform, now: options.now
+        });
+        this.connectionStore = options.connectionStore ?? (this.intakeStore instanceof WorkerTrustStore ? this.intakeStore : new WorkerTrustStore(options.owner, { now: options.now }));
+        if (this.connectionStore.ownerDid !== options.owner.did)
+            throw new Error('CONNECTION_OWNER_MISMATCH');
+        this.heldReview = options.heldReview ?? new HeldRequestReview(options.owner, { ...options.identityOptions, now: options.now });
         if (options.inviteTtlSeconds !== undefined && (!Number.isSafeInteger(options.inviteTtlSeconds) ||
             options.inviteTtlSeconds < 1 || options.inviteTtlSeconds > 2592000))
             throw new Error('INVALID_INVITE_TTL');
@@ -388,8 +474,6 @@ export class WorkerNode {
             this.taskJournal = new TaskJournal(persistencePath + '.tasks.jsonl', options.owner);
         if (options.dailyLimit && (!options.dailyLimit.path || !Number.isSafeInteger(options.dailyLimit.maxTasks) || options.dailyLimit.maxTasks < 1))
             throw new Error('INVALID_DAILY_LIMIT');
-        if (options.accessMode !== undefined && !['invite-only', 'open'].includes(options.accessMode))
-            throw new Error('INVALID_ACCESS_MODE');
         this.acceptance = acceptanceFrom(options);
         validateAcceptance(this.acceptance);
         this.revocation = options.revocation
@@ -401,34 +485,90 @@ export class WorkerNode {
             allowPrivateRelay: options.allowPrivateRelay,
             lookup: options.lookup,
             requestTimeoutMs: options.connectTimeoutMs,
+            maxAuthRecoveryAttempts: options.maxAuthRecoveryAttempts,
+            authRecoveryTimeoutMs: options.authRecoveryTimeoutMs,
         }));
+        this.deliveryService = (typeof options.relay === 'string' || options.relayUrl)
+            ? options.deliveryService ?? (typeof options.relay === 'string' || options.deliveryOptions
+                ? new GatewayDeliveryService(options.owner, { ...options.deliveryOptions,
+                    identityOptions: options.deliveryOptions?.identityOptions ?? options.identityOptions,
+                    now: options.deliveryOptions?.now ?? options.now, requestTimeoutMs: options.connectTimeoutMs,
+                    resolveTransport: options.deliveryOptions?.resolveTransport ?? ((url, owner) => transport(url, owner, options)),
+                    assertSendAllowed: async (context) => {
+                        this.assertPeer(context.peerOwnerDid, context.envelope.payload.taskId);
+                        await options.deliveryOptions?.assertSendAllowed?.(context);
+                    } }) : undefined) : undefined;
+        if (this.deliveryService && this.deliveryService.owner.did !== options.owner.did)
+            throw deliveryError('OUTBOX_STORE_INVALID');
+        if (this.deliveryService) {
+            this.deliveryService.recipientStatus = new RecipientDeliveryCoordinator(this.deliveryService, {
+                relayUrl: typeof options.relay === 'string' ? options.relay : options.relayUrl,
+                connectionState: peer => this.connectionStore.connectionState(peer),
+                onPublish: () => { void this.deliveryService.drainStatuses(); },
+            });
+            this.heldReview.store.setTransitionSink(this.deliveryService.recipientStatus.transition);
+            this.deliveryService.onMaintenance(() => {
+                this.deliveryService.recipientStatus.reconcile(this.heldReview.store.records());
+                if (this.heldReview.list().some(r => r.state === 'expired'))
+                    this.heldReview.expire();
+            });
+        }
+        if (!persistencePath && this.deliveryService) {
+            this.taskJournal = new TaskJournal(join(this.deliveryService.store.root, 'tasks.jsonl'), options.owner, this.deliveryService.store.limits.recordBytes, 'process');
+            this.deliveryService.onMaintenance(async (signal) => {
+                if (!existsSync(this.taskJournal.path))
+                    return;
+                const store = this.deliveryService.store, retained = new Set();
+                for await (const r of store.scan('receipts', signal))
+                    if (r.retainUntil > store.now())
+                        retained.add(r.taskId);
+                await this.taskJournal.compactInBackground(retained, change => store.transaction(change), signal);
+            });
+        }
         this.approvalProvider =
             options.approvalProvider ?? new InteractiveCliApprovalProvider(options.owner);
         const agentDid = options.agentDid ?? options.agentKey?.did ?? options.owner.did;
+        const now = this.protocol.now();
         this.agentCard = createSignedAgentCard({
-            name: options.name ?? options.adapter.name,
+            name: options.name ?? options.adapter.name, now,
             agentDid,
             relayEndpoint: typeof options.relay === 'string'
                 ? options.relay
                 : (options.relayUrl ?? 'http://in-memory.invalid'),
             skills: options.adapter.skills,
             ...(options.inviteTtlSeconds !== undefined ? {
-                expiresAt: new Date(Date.now() + options.inviteTtlSeconds * 1000).toISOString(),
+                expiresAt: new Date(now + options.inviteTtlSeconds * 1000).toISOString(),
             } : {}),
-            ...(options.accessMode ? { accessMode: options.accessMode } : {}),
-            ...(options.openPolicy !== undefined ? { openPolicy: options.openPolicy } : {}),
+            protocolVersions: this.protocol.receiveVersions(),
         }, options.owner, agentDid === options.owner.did ? undefined : options.agentKey);
+        this.connections = new ConnectionRouter({ owner: options.owner, agentCard: this.agentCard,
+            relayUrl: this.agentCard.payload.relayEndpoint, relay: this.relay, store: this.connectionStore,
+            review: this.heldReview, now: options.now, humanReview: options.connectionReview,
+            revocations: this.revocation, allowPrivateRelay: options.allowPrivateRelay,
+            assertPeer: did => { this.assertPeer(did); }, onConnectionEvent: options.onConnectionEvent });
     }
     invite(expiresInSeconds = this.options.inviteTtlSeconds ?? 86400) {
-        return createInviteToken({ agentCard: this.agentCard, expiresInSeconds }, this.options.owner);
+        return createInviteToken({ agentCard: this.agentCard, expiresInSeconds, issuedAt: new Date(this.protocol.now()).toISOString() }, this.options.owner);
     }
     async register() {
+        const protocolVersions = this.protocol.receiveVersions();
+        if (JSON.stringify(protocolVersions) !== JSON.stringify(this.agentCard.payload.protocolVersions) || Date.parse(this.agentCard.payload.expiresAt) <= this.protocol.now()) {
+            const now = this.protocol.now();
+            this.agentCard = createSignedAgentCard({ ...this.agentCard.payload, protocolVersions, now,
+                expiresAt: new Date(now + (this.options.inviteTtlSeconds ?? 86400) * 1000).toISOString() }, this.options.owner, this.options.agentKey);
+        }
+        this.connections.service.setAgentCard(this.agentCard);
         await this.relay.register?.(this.agentCard);
+        this.registered = true;
     }
     stop() {
+        this.stopDelivery();
         this.controller.abort('WORKER_STOPPED');
+        this.taskJournal?.close();
         this.listenerStatus('stopped');
     }
+    async startDelivery() { await this.deliveryService?.start(); }
+    stopDelivery() { this.deliveryService?.stop(); }
     /** Public registration is opt-in, including for PolicyAutoApprovalProvider. */
     publishes() {
         return this.options.publishToRegistry === true;
@@ -535,7 +675,7 @@ export class WorkerNode {
             if (!idleSignal.aborted) {
                 // A rejected one-shot task may be followed by another start on this node.
                 // Only a terminal listener failure shuts down the worker and all of its tasks.
-                if (error instanceof Error && 'code' in error && error.code === 'RELAY_TERMINAL') {
+                if (error instanceof Error && 'code' in error && ['RELAY_TERMINAL', 'RELAY_AUTH_RECOVERY_EXHAUSTED'].includes(String(error.code))) {
                     this.listenerStatus('unavailable', error);
                     for (const mailbox of this.mailboxes.values())
                         mailbox.close(error);
@@ -549,9 +689,23 @@ export class WorkerNode {
                 this.listenerStatus('stopped');
             unregister();
             await Promise.allSettled([...jobs]);
+            this.taskJournal?.close();
         }
         return this.lastResult;
     }
+    assertPeer(did, taskId) {
+        if (this.options.allowedPeerDids !== undefined && !this.options.allowedPeerDids.includes(did))
+            throw new Error('PEER_NOT_ALLOWED');
+        if ((this.intakeStore.level(did) === 'denied' || this.connectionStore.connectionState(did) === 'blocked') && (!taskId || this.acceptedPeers.get(taskId) !== did))
+            throw new Error('REQUEST_DENIED');
+        return this.options.checkPeer?.(did);
+    }
+    trust(did, protocolVersion) {
+        const contactTrust = this.assertPeer(did);
+        if (contactTrust === 'trusted' || this.connectionStore.hasExplicitLegacyGrant(did))
+            return 'trusted';
+        return protocolVersion === '0.2.0' && this.connectionStore.connectionState(did) === 'connected' ? 'limited' : 'unknown';
+    }
     async notifyOutcome(record, outcome = record.outcome) {
         const send = (recovery) => this.relay.send(signEnvelope({ taskId: record.taskId,
             recipientDid: record.requesterDid, seq: 0, eventType: 'ERROR',
@@ -573,25 +727,48 @@ export class WorkerNode {
             await send({ proposalDigest: record.proposalDigest, ...(outcome.result ? { result: outcome.result } : {}) });
         }
     }
+    saveTaskCheckpoint(record) {
+        if (!this.taskJournal)
+            return;
+        if (this.deliveryService && !this.options.inboxPath && !this.options.auditPath) {
+            this.deliveryService.store.transaction(() => { this.taskJournal.reload(); this.taskJournal.save(record); });
+        }
+        else
+            this.taskJournal.save(record);
+    }
     async reconcileTasks() {
         if (this.reconciled || !this.taskJournal)
             return;
-        this.taskJournal.load();
-        for (const saved of this.taskJournal.tasks.values()) {
+        if (this.deliveryService && !this.options.inboxPath && !this.options.auditPath)
+            this.deliveryService.store.transaction(() => this.taskJournal.reload());
+        else
+            this.taskJournal.load();
+        for (const saved of [...this.taskJournal.tasks.values()]) {
             let record = saved;
+            const pending = this.intakeStore.pendingTask(record.requesterDid, record.taskId, record.proposalDigest);
             if (record.phase !== 'terminal') {
                 const result = this.sealedTaskResult(record);
                 // Adapters expose executeTask only. Unknown execution/tool results cannot be retried safely.
-                record = { ...record, phase: 'terminal', outcome: result
+                record = { ...record, phase: 'terminal', outcome: pending ? { code: 'PENDING_OWNER_APPROVAL' } : result
                         ? { code: result.state === 'SETTLED' ? 'TASK_SETTLED' : 'TASK_CANCELLED', result }
                         : { code: 'TASK_INTERRUPTED' }, notificationPending: true };
-                this.taskJournal.save(record);
-                if (!result)
+                this.saveTaskCheckpoint(record);
+                if (!result && !pending)
                     this.options.onEvent?.('INTERRUPTED', record.taskId, { code: 'TASK_INTERRUPTED' });
             }
             if (record.notificationPending) {
+                try {
+                    this.assertPeer(record.requesterDid);
+                }
+                catch {
+                    continue;
+                }
+                if (pending) {
+                    record = { ...record, phase: 'terminal', outcome: { code: 'PENDING_OWNER_APPROVAL' } };
+                    this.saveTaskCheckpoint(record);
+                }
                 await this.notifyOutcome(record);
-                this.taskJournal.save({ ...record, notificationPending: false });
+                this.saveTaskCheckpoint({ ...record, notificationPending: false });
             }
         }
         this.reconciled = true;
@@ -620,6 +797,14 @@ export class WorkerNode {
         if (!this.taskJournal || envelope.payload.eventType !== 'PROPOSE' || envelope.payload.seq !== 0 ||
             !verifyEnvelope(envelope, this.options.owner.did))
             return false;
+        try {
+            this.assertPeer(envelope.payload.senderDid);
+        }
+        catch (error) {
+            this.reportRejection(envelope.payload.taskId, error);
+            await acknowledgeRelay(this.relay, envelope);
+            return true;
+        }
         let data;
         try {
             data = openEnvelope(envelope, this.options.owner, sessionDecryptOptions(this.options.allowUnencryptedEnvelopes));
@@ -632,7 +817,18 @@ export class WorkerNode {
             manifest.taskId !== envelope.payload.taskId || manifest.requester?.ownerDid !== envelope.payload.senderDid)
             return false;
         const proposalDigest = digest({ manifest, input: data.input });
+        if (this.deliveryService && !this.options.inboxPath && !this.options.auditPath)
+            this.deliveryService.store.transaction(() => this.taskJournal.reload());
         let record = this.taskJournal.tasks.get(manifest.taskId);
+        const exactReceipt = this.deliveryService?.store.read('receipts', envelope.payload.envelopeId);
+        const receipt = exactReceipt ?? this.deliveryService?.store.snapshot('receipts').find(r => r.taskId === manifest.taskId);
+        if (receipt && (receipt.senderDid !== envelope.payload.senderDid || exactReceipt && receipt.envelopeDigest !== digest(envelope) || receipt.taskId !== manifest.taskId))
+            throw deliveryError('DELIVERY_RECORD_CONFLICT');
+        if (!record && receipt) {
+            record = { version: 1, taskId: manifest.taskId, requesterDid: envelope.payload.senderDid,
+                envelopeId: envelope.payload.envelopeId, proposalDigest, phase: 'terminal', invocations: [], outcome: { code: 'TASK_INTERRUPTED' } };
+            this.saveTaskCheckpoint(record);
+        }
         // Older inboxes have intake evidence but no execution checkpoint. Never execute those tasks again.
         if (!record && this.options.inboxPath && existsSync(this.options.inboxPath)) {
             for (const line of readFileSync(this.options.inboxPath, 'utf8').split('\n')) {
@@ -767,24 +963,40 @@ export class WorkerNode {
             throw failure;
     }
     async runOnce(signal) {
-        await this.reconcileTasks();
-        const idleSignal = AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])]);
-        // One or more leading REVOKE envelopes are consumed before the task PROPOSE.
-        const first = await receiveRelay(this.relay, this.options.owner.did, idleSignal, {
-            role: 'worker',
-        });
-        if (await this.recoverProposal(first)) {
-            if (this.lastResult?.taskId === first.payload.taskId)
-                return this.lastResult;
-            throw new Error(this.taskJournal?.tasks.get(first.payload.taskId)?.outcome?.code ?? 'TASK_INTERRUPTED');
+        try {
+            await this.reconcileTasks();
+            const idleSignal = AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])]);
+            // One or more leading REVOKE envelopes are consumed before the task PROPOSE.
+            const first = await receiveRelay(this.relay, this.options.owner.did, idleSignal, {
+                role: 'worker',
+            });
+            if (await this.recoverProposal(first)) {
+                if (this.lastResult?.taskId === first.payload.taskId)
+                    return this.lastResult;
+                throw new Error(this.taskJournal?.tasks.get(first.payload.taskId)?.outcome?.code ?? 'TASK_INTERRUPTED');
+            }
+            return await this.executeTask(first, idleSignal, this.relay);
+        }
+        finally {
+            this.taskJournal?.close();
         }
-        return this.executeTask(first, idleSignal, this.relay);
+    }
+    async holdTask(first, manifest, input) {
+        const contentDigest = digest({ manifest, input });
+        this.connectionStore.consumeAdmission(manifest.requester.ownerDid, manifest.taskId);
+        const previous = this.heldReview.list().find(r => r.taskId === manifest.taskId && r.senderOwnerDid === manifest.requester.ownerDid);
+        const held = previous ?? this.heldReview.hold({ kind: 'task', senderOwnerDid: manifest.requester.ownerDid,
+            taskId: manifest.taskId, contentDigest, deadline: Date.parse(manifest.deadline), envelope: first });
+        if (held.contentDigest !== contentDigest)
+            throw new Error('INVALID_PROPOSAL');
+        return this.heldReview.inspect(held.id);
     }
     async executeTask(first, idleSignal, relay, earlyRejection) {
         if (!verifyEnvelope(first, this.options.owner.did) ||
             first.payload.eventType !== 'PROPOSE' ||
             first.payload.seq !== 0)
             throw new Error('INVALID_PROPOSAL_ENVELOPE');
+        this.assertPeer(first.payload.senderDid);
         // PROPOSE arrives before the session wire is constructed. Open it with the same rule,
         // and return an encrypted ERROR frame if pre-wire validation fails so the requester does not hang.
         let data;
@@ -795,10 +1007,15 @@ export class WorkerNode {
             if (!checkpoint || !this.taskJournal)
                 return;
             checkpoint = { ...checkpoint, ...patch };
-            this.taskJournal.save(checkpoint);
+            this.saveTaskCheckpoint(checkpoint);
         };
         const saveOutcome = (outcome) => {
             saveCheckpoint({ phase: 'terminal', outcome, notificationPending: true });
+            this.deliveryService?.store.receipt(first, Date.parse(m.deadline), 'terminal', outcome.code);
+        };
+        const acknowledgeProposal = async (signal) => {
+            this.deliveryService?.store.receipt(first, Date.parse(m.deadline), 'processed');
+            await acknowledgeRelay(relay, first, signal);
         };
         try {
             data = openEnvelope(first, this.options.owner, sessionDecryptOptions(this.options.allowUnencryptedEnvelopes));
@@ -810,9 +1027,11 @@ export class WorkerNode {
             if (!verifySigned(data.proposal, manifest.requester.ownerDid) ||
                 manifest.worker?.ownerDid !== this.options.owner.did ||
                 manifest.worker.agentDid !== this.agentCard.payload.agentDid ||
-                Date.parse(manifest.deadline) <= Date.now() ||
-                Date.parse(manifest.createdAt) > Date.now() + DEFAULT_CLOCK_SKEW_MS)
+                Date.parse(manifest.deadline) <= this.protocol.now() ||
+                Date.parse(manifest.createdAt) > this.protocol.now() + DEFAULT_CLOCK_SKEW_MS)
                 throw new Error('INVALID_PROPOSAL');
+            this.assertPeer(first.payload.senderDid);
+            validateManifest(manifest);
             m = manifest;
             auditPath = this.options.auditPath
                 ? this.completed++ === 0 && !existsSync(this.options.auditPath)
@@ -824,7 +1043,17 @@ export class WorkerNode {
                 checkpoint = { version: 1, taskId: m.taskId, requesterDid: m.requester.ownerDid,
                     envelopeId: first.payload.envelopeId, proposalDigest: digest({ manifest: m, input: data.input }),
                     phase: 'received', auditPath, invocations: [] };
-                this.taskJournal.save(checkpoint);
+                if (this.deliveryService) {
+                    this.deliveryService.store.transaction(() => {
+                        this.taskJournal.reload();
+                        if (this.taskJournal.tasks.has(m.taskId) || this.deliveryService.store.snapshot('receipts').some(r => r.taskId === m.taskId))
+                            throw deliveryError('DELIVERY_RECORD_CONFLICT');
+                        this.deliveryService.store.receiptLocked(first, Date.parse(m.deadline), 'persisted');
+                        this.taskJournal.save(checkpoint);
+                    });
+                }
+                else
+                    this.taskJournal.save(checkpoint);
             }
         }
         catch (e) {
@@ -845,7 +1074,11 @@ export class WorkerNode {
         }
         const timeouts = new SessionTimeouts(this.options, m.deadline, idleSignal);
         const activeSignal = timeouts.signal;
-        const wire = new SessionWire(relay, this.options.owner, m.requester.ownerDid, m.taskId, [m.requester.ownerDid, this.options.owner.did], activeSignal, auditPath, this.options.allowUnencryptedEnvelopes === true);
+        const wire = new SessionWire(relay, this.options.owner, m.requester.ownerDid, m.taskId, [m.requester.ownerDid, this.options.owner.did], activeSignal, auditPath, this.options.allowUnencryptedEnvelopes === true, true, this.deliveryService ? { service: this.deliveryService, context: {
+                messageId: receiptFileId(first.payload.envelopeId), peerOwnerDid: m.requester.ownerDid,
+                relayUrl: this.options.relayUrl ?? (typeof this.options.relay === 'string' ? this.options.relay : this.agentCard.payload.relayEndpoint),
+                deliveryDeadline: Date.parse(m.deadline),
+            } } : undefined);
         const cancelController = new AbortController();
         wire.earlyCancel = () => cancelController.abort('CANCELLED');
         let heartbeat;
@@ -868,27 +1101,29 @@ export class WorkerNode {
         let progressFailure;
         let wireFailureSent = false;
         try {
-            await wire.receiveEvent('PROPOSE', first);
             this.assertInviteActive(data);
-            if (this.options.accessMode === 'open') {
-                for (const field of OPEN_POLICY_FIELDS) {
-                    const limit = this.agentCard.payload.openPolicy?.[field];
-                    if (limit !== undefined && m.budget[field] > limit)
-                        throw diagnosticError('TASK_SCOPE_REJECTED', 'budget.' + field, limit, m.budget[field], 'Use a budget within the advertised policy.');
+            let peerDisplayName;
+            if (this.relay.discover) {
+                const cards = await this.relay.discover();
+                const sender = findDiscoveredAgentCard(cards, m.requester.agentDid, this.protocol.now());
+                if (sender?.payload.ownerDid === m.requester.ownerDid && sender.payload.relayEndpoint === this.agentCard.payload.relayEndpoint) {
+                    this.protocol.observe(sender, cards);
+                    peerDisplayName = sender.payload.name;
                 }
-                const skills = this.agentCard.payload.skills;
-                const selected = m.task.skillId ? skills.filter((skill) => skill.id === m.task.skillId) : skills;
-                if ((m.task.skillId && selected.length === 0) ||
-                    (m.task.taskType && !selected.some((skill) => skill.taskTypes?.includes(m.task.taskType))) ||
-                    (m.task.skillId && !m.task.taskType && selected.some((skill) => skill.taskTypes?.length)))
-                    throw diagnosticError('TASK_SCOPE_REJECTED', 'task.scope', skills, m.task, 'Select an advertised skill and task type, or omit both for direct delegation.');
             }
+            this.protocol.inbound(m.protocolVersion, m.requester.ownerDid, m.requester.agentDid);
+            const skills = this.agentCard.payload.skills;
+            const selected = m.task.skillId ? skills.filter(skill => skill.id === m.task.skillId) : skills;
+            if ((m.task.skillId && selected.length === 0) ||
+                (m.task.taskType && !selected.some(skill => skill.taskTypes?.includes(m.task.taskType))) ||
+                (m.task.skillId && !m.task.taskType && selected.some(skill => skill.taskTypes?.length)))
+                throw diagnosticError('TASK_SCOPE_REJECTED', 'task.scope', skills, m.task, 'Select an advertised skill and task type, or omit both for direct delegation.');
             const capabilityContext = {
                 rootDid: m.requester.ownerDid,
                 audience: this.options.owner.did,
                 taskId: m.taskId,
             };
-            if (!Array.isArray(data.capabilityChains))
+            if (!Array.isArray(data.capabilityChains) || data.capabilityChains.length > 32)
                 throw new Error('CAPABILITY_VIOLATION');
             for (const chain of data.capabilityChains)
                 verifyCapabilityChain(chain, capabilityContext);
@@ -910,8 +1145,86 @@ export class WorkerNode {
                 (!Number.isSafeInteger(data.peerIdleTimeoutMs) || data.peerIdleTimeoutMs < 1 ||
                     (this.options.heartbeatIntervalMs ?? 15_000) >= data.peerIdleTimeoutMs))
                 throw diagnosticError('INCOMPATIBLE_TIMEOUTS', 'peerIdleTimeoutMs', { greaterThan: this.options.heartbeatIntervalMs ?? 15_000 }, data.peerIdleTimeoutMs, 'Raise the requester idle timeout or shorten the worker heartbeat interval before accepting.');
+            // Validate capability scope before the admission queue or an owner prompt.
+            const scopedTools = new Set();
+            for (const chain of data.capabilityChains) {
+                const leaf = verifyCapabilityChain(chain, capabilityContext).payload;
+                const grant = m.permissions.grantedCapabilities.find(g => g.resource === leaf.resource &&
+                    leaf.allowedTools.every(t => g.allowedTools.includes(t)) && leaf.maxCalls <= g.maxInvocations &&
+                    Date.parse(leaf.expiresAt) <= Date.parse(g.expiresAt));
+                if (!grant || leaf.maxDepth > m.permissions.maxDelegationDepth || leaf.allowedTools.some(t => scopedTools.has(t) || !schemaNarrows(leaf.argConstraints[t], grant.argConstraints ?? { type: 'object' })))
+                    throw new Error('CAPABILITY_VIOLATION');
+                leaf.allowedTools.forEach(t => scopedTools.add(t));
+            }
+            if (this.options.requireConnection && (m.protocolVersion !== '0.2.0' || this.connectionStore.connectionState(m.requester.ownerDid) !== 'connected'))
+                throw new Error('CONNECTION_REQUIRED');
+            const proposalDigest = digest({ manifest: m, input: data.input });
+            if (data.connectionRequest) {
+                if (m.protocolVersion !== '0.2.0')
+                    throw new Error('INVALID_CONNECTION_REQUEST');
+                this.connections.service.validateRequest(data.connectionRequest);
+                const frame = openConnectionFrame(data.connectionRequest, this.options.owner);
+                if (frame.event.payload.type !== 'ConnectionRequest' || frame.event.payload.fromOwnerDid !== m.requester.ownerDid ||
+                    frame.event.payload.originProposalDigest !== proposalDigest)
+                    throw new Error('INVALID_CONNECTION_REQUEST');
+            }
+            const previouslyPending = this.intakeStore.pendingTask(m.requester.ownerDid, m.taskId, proposalDigest);
+            let inspection;
+            this.deliveryService?.recipientStatus.begin(first.payload.envelopeId);
+            // Persist the immutable ciphertext before any connection mutation or owner acknowledgement.
+            if (this.trust(m.requester.ownerDid, m.protocolVersion) !== 'trusted') {
+                inspection = await this.holdTask(first, m, data.input);
+                if (inspection.inspectionStatus !== 'complete' || m.protocolVersion === '0.1.0')
+                    this.intakeStore.enqueue(m, data.input);
+            }
+            // All identity, schema, scope, capability and host checks precede durable consent.
+            let inviteIneligible = false;
+            if (data.inviteToken) {
+                const invite = parseAndVerifyInviteToken(data.inviteToken, this.protocol.now(), { allowPrivateRelay: true });
+                const outcome = this.connectionStore.redeemTaskInvite(invite, { peerOwnerDid: m.requester.ownerDid,
+                    peerAgentDid: m.requester.agentDid, ...(peerDisplayName !== undefined ? { peerDisplayName } : {}),
+                    relayUrl: this.agentCard.payload.relayEndpoint }, connectionIdFor(this.options.owner.did, m.requester.ownerDid));
+                inviteIneligible = outcome === 'other' || outcome === 'inactive';
+                if (outcome === 'first')
+                    this.options.onConnectionEvent?.({ event: 'connected', peerOwnerDid: m.requester.ownerDid,
+                        peerAgentDid: m.requester.agentDid, connectionId: connectionIdFor(this.options.owner.did, m.requester.ownerDid),
+                        source: 'invite', connectedAt: this.protocol.now() });
+            }
+            if (data.connectionRequest)
+                await this.connections.consume(data.connectionRequest);
+            const peerTrust = inviteIneligible ? 'unknown' : this.trust(m.requester.ownerDid, m.protocolVersion);
+            this.deliveryService?.recipientStatus.admit(first, m, !previouslyPending && peerTrust === 'limited', !!inspection, inspection?.receivedAt);
+            this.deliveryService?.recipientStatus.end(first.payload.envelopeId);
+            if (previouslyPending && peerTrust === 'trusted')
+                throw new Error('PENDING_OWNER_APPROVAL');
+            if (peerTrust !== 'trusted') {
+                inspection ??= await this.holdTask(first, m, data.input);
+                if (previouslyPending || peerTrust === 'unknown' || this.intakeStore.pendingTask(m.requester.ownerDid, m.taskId, proposalDigest) ||
+                    inspection.inspectionStatus !== 'complete') {
+                    this.intakeStore.enqueue(m, data.input);
+                    if (this.connectionStore.connectionState(m.requester.ownerDid) === 'none') {
+                        const receivedAt = this.protocol.now();
+                        try {
+                            this.connectionStore.recordIncoming({ peerOwnerDid: m.requester.ownerDid, peerAgentDid: m.requester.agentDid,
+                                ...(peerDisplayName !== undefined ? { peerDisplayName } : {}),
+                                relayUrl: this.agentCard.payload.relayEndpoint, incoming: { requestId: m.taskId, requestDigest: proposalDigest,
+                                    receivedAt, expiresAt: receivedAt + 14 * 86400000 } });
+                        }
+                        catch (error) {
+                            if (!(error instanceof Error) || error.message !== 'CONNECTION_REQUEST_COOLDOWN')
+                                throw error;
+                        }
+                    }
+                    throw new Error('PENDING_OWNER_APPROVAL');
+                }
+            }
+            const contractProvider = peerTrust === 'limited' ? this.options.ownerApprovalProvider : this.approvalProvider;
+            if (!contractProvider || peerTrust === 'limited' && (contractProvider.kind === 'policy' ||
+                contractProvider === this.approvalProvider && contractProvider.kind !== 'human'))
+                throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
+            await wire.receiveEvent('PROPOSE', first);
             const contract = createContract(m, data.proposal, this.options.owner);
-            const approval = await abortable(this.approvalProvider.approve({
+            const approval = await abortable(contractProvider.approve({
                 taskId: m.taskId,
                 gate: 'contract_acceptance',
                 target: contract.contractDigest,
@@ -919,13 +1232,23 @@ export class WorkerNode {
                     manifest: m,
                     input: data.input,
                     capabilities: data.capabilityChains,
+                    ...(inspection ? { inspection } : {}),
                     from: first.payload.senderDid,
                 },
                 signal: activeSignal,
             }), activeSignal);
+            if (this.trust(m.requester.ownerDid, m.protocolVersion) === 'unknown')
+                throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
+            this.assertCapabilitiesActive(data.capabilityChains, capabilityContext);
+            this.assertPeer(m.requester.ownerDid);
+            if (peerTrust === 'trusted' && this.trust(m.requester.ownerDid, m.protocolVersion) !== 'trusted')
+                throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
             gateway = new OwnerGateway(this.options.owner, contract, policy, this.revocation);
             const accepted = gateway.accept(approval);
+            this.acceptedPeers.set(m.taskId, m.requester.ownerDid);
             saveCheckpoint({ phase: 'accepted' });
+            if (inspection?.inspectionStatus === 'complete')
+                this.deliveryService?.recipientStatus.observe(first.payload.envelopeId, 'opened');
             if (this.options.dailyLimit)
                 consumeDailyTask(this.options.dailyLimit.path, this.options.dailyLimit.maxTasks, m.taskId);
             if (this.options.inboxPath) {
@@ -951,7 +1274,7 @@ export class WorkerNode {
                 finally {
                     closeSync(fd);
                 }
-                await acknowledgeRelay(relay, first);
+                await acknowledgeProposal(activeSignal);
                 // Notification errors must not fail a persisted task.
                 try {
                     void Promise.resolve(this.options.onInboxRecord?.(record)).catch(() => undefined);
@@ -1008,6 +1331,7 @@ export class WorkerNode {
                     isActive: () => gateway.machine.state === 'IN_PROGRESS',
                 });
             });
+            this.assertPeer(m.requester.ownerDid, m.taskId);
             workspace = await mkdtemp(join(tmpdir(), 'acp-adapter-'));
             saveCheckpoint({ phase: 'running', workspace });
             let invocationCount = 0;
@@ -1100,6 +1424,7 @@ export class WorkerNode {
                     sandboxBoundary = boundary;
                 },
                 callTool: async (tool, args) => {
+                    this.assertPeer(m.requester.ownerDid, m.taskId);
                     executionSignal.throwIfAborted();
                     if (!args || typeof args !== 'object' || Array.isArray(args))
                         throw new Error('CAPABILITY_VIOLATION: arguments');
@@ -1126,9 +1451,12 @@ export class WorkerNode {
                     return result;
                 },
             };
+            this.assertPeer(m.requester.ownerDid, m.taskId);
+            this.assertCapabilitiesActive(data.capabilityChains, capabilityContext);
+            this.deliveryService?.recipientStatus.handoff(first, m);
             const output = await abortable(this.options.adapter.executeTask(context), executionSignal);
             if (!this.options.inboxPath)
-                await acknowledgeRelay(relay, first);
+                await acknowledgeProposal(executionSignal);
             // A task may return while a queued progress update is still waiting for its ACK.
             // Skip the drain once the task is already aborted, cancelled, or over budget.
             if (!executionSignal.aborted && !wire.cancelHandled) {
@@ -1194,11 +1522,19 @@ export class WorkerNode {
                 throw e;
             const diagnostic = preserveWorkspace ? { code: 'TASK_INTERRUPTED' } : rejectionBody(progressFailure ?? e);
             saveOutcome(diagnostic);
+            this.deliveryService?.recipientStatus.end(first.payload.envelopeId);
+            const refused = this.heldReview.list().find(r => r.taskId === m.taskId);
+            if (refused && diagnostic.code !== 'PENDING_OWNER_APPROVAL' && !preserveWorkspace)
+                this.heldReview.discard(refused.id);
             this.reportRejection(m.taskId, progressFailure ?? e);
             if (!wireFailureSent) {
                 wireFailureSent = true;
                 await wire.rawSend('ERROR', diagnostic)
-                    .then(() => saveCheckpoint({ notificationPending: false })).catch(() => { });
+                    .then(async () => {
+                    saveCheckpoint({ notificationPending: false });
+                    if (diagnostic.code === 'PENDING_OWNER_APPROVAL')
+                        await acknowledgeProposal();
+                }).catch(() => { });
             }
             // A quota abort already surfaces as EXECUTION_ABORTED. Keep that error.
             // A caught INVALID_PROGRESS still fails the session with the sticky error.
@@ -1208,10 +1544,15 @@ export class WorkerNode {
             throw e;
         }
         finally {
+            this.deliveryService?.recipientStatus.end(first.payload.envelopeId);
             heartbeatStopped = true;
             clearTimeout(heartbeat);
             timeouts.close();
             wire.close();
+            this.acceptedPeers.delete(m.taskId);
+            const completedHeld = this.heldReview.list().find(r => r.taskId === m.taskId);
+            if (completedHeld && gateway && ['SETTLED', 'CANCELLED'].includes(gateway.machine.state))
+                this.heldReview.discard(completedHeld.id, gateway.machine.state === 'SETTLED' ? 'completed' : 'closed');
             if (trackedTaskId)
                 this.liveChains.delete(trackedTaskId);
             gateway?.close();
@@ -1254,10 +1595,16 @@ export class WorkerNode {
     revocationAwareRelay(relay) {
         const receive = async (recipientDid, waitMs, signal, filter) => {
             for (;;) {
+                if (this.registered && JSON.stringify(this.protocol.receiveVersions()) !== JSON.stringify(this.agentCard.payload.protocolVersions))
+                    await this.register();
                 const forwarded = this.forwardedQueue.shift();
                 if (forwarded) {
                     if (this.consumeRevocation(forwarded))
                         continue;
+                    if (isConnectionEvent(forwarded.payload.eventType)) {
+                        await this.connections.route(forwarded);
+                        continue;
+                    }
                     return forwarded;
                 }
                 const envelope = await relay.receive(recipientDid, waitMs, signal, filter ?? { role: 'worker' });
@@ -1266,14 +1613,31 @@ export class WorkerNode {
                     if (afterWait) {
                         if (this.consumeRevocation(afterWait))
                             continue;
+                        if (isConnectionEvent(afterWait.payload.eventType)) {
+                            await this.connections.route(afterWait);
+                            continue;
+                        }
                         return afterWait;
                     }
                     return undefined;
                 }
+                if (envelope.payload.eventType === 'DELIVERY_STATUS' && this.deliveryService) {
+                    try {
+                        await this.deliveryService.statusRouter.route(envelope, relay);
+                    }
+                    catch (error) {
+                        this.deliveryService.options.onError?.(error);
+                    }
+                    continue;
+                }
                 if (this.consumeRevocation(envelope)) {
                     await acknowledgeRelay(relay, envelope);
                     continue;
                 }
+                if (isConnectionEvent(envelope.payload.eventType)) {
+                    await this.connections.route(envelope);
+                    continue;
+                }
                 if (this.isRequesterBoundFrame(envelope) &&
                     forwardToRequesterInbox(this.options.owner.did, envelope))
                     continue;
@@ -1281,9 +1645,13 @@ export class WorkerNode {
             }
         };
         return {
+            ...deliveryPins(relay),
             get connectionStatus() { return relay.connectionStatus; },
-            send: (envelope) => relay.send(envelope),
-            ...(relay.acknowledgeDelivery ? { acknowledgeDelivery: (did, id) => relay.acknowledgeDelivery(did, id) } : {}),
+            send: (envelope) => {
+                this.assertPeer(envelope.payload.recipientDid, envelope.payload.taskId);
+                return relay.send(envelope);
+            },
+            ...(relay.acknowledgeDelivery ? { acknowledgeDelivery: (did, id, signal) => relay.acknowledgeDelivery(did, id, AbortSignal.any([this.controller.signal, ...(signal ? [signal] : [])])) } : {}),
             receive,
             ...(relay.register ? { register: (card) => relay.register(card) } : {}),
             ...(relay.discover ? { discover: () => relay.discover() } : {}),
@@ -1353,27 +1721,21 @@ export class WorkerNode {
     }
     assertInviteActive(data) {
         const token = data.inviteToken;
-        if (typeof token !== 'string' || token.length === 0) {
-            if (this.options.accessMode !== 'open' &&
-                !this.options.allowedRequesterDids?.includes(data.proposal.payload.requester.ownerDid))
-                throw new Error('INVITE_REQUIRED');
-            return;
-        }
-        let invite;
-        try {
-            invite = parseAndVerifyInviteToken(token, Date.now(), { allowPrivateRelay: true });
-        }
-        catch (error) {
-            if (this.options.accessMode === 'open' && error instanceof Error && error.message === 'INVITE_EXPIRED')
-                return;
-            throw error;
-        }
+        if (token === undefined)
+            return false;
+        if (typeof token !== 'string' || !token)
+            throw new Error('INVALID_OR_EXPIRED_INVITE');
+        const invite = parseAndVerifyInviteToken(token, this.protocol.now(), { allowPrivateRelay: true, allowExpired: true });
         if (invite.ownerDid !== this.options.owner.did ||
             invite.agentDid !== this.agentCard.payload.agentDid ||
             invite.relayUrl !== this.agentCard.payload.relayEndpoint)
             throw new Error('INVITE_WORKER_MISMATCH');
         this.revocation.assertNotRevoked('invite', digest(invite));
         this.revocation.assertNotRevoked('invite', token);
+        if (Math.min(Date.parse(invite.expiresAt), Date.parse(invite.agentCard.payload.expiresAt)) <= this.protocol.now()) {
+            throw new Error('INVITE_EXPIRED');
+        }
+        return true;
     }
     /**
      * Before ACCEPT, every verified capability chain is checked against revocation
@@ -1552,11 +1914,19 @@ function rejectionBody(error) {
         return { code: safeError(error), detail: error.detail };
     if (error instanceof ProposalRejectedError)
         return { code: error.code, reason: error.reason };
+    if (safeError(error) === 'PENDING_OWNER_APPROVAL')
+        return { code: 'PENDING_OWNER_APPROVAL', reason: PENDING_MESSAGE };
     return { code: safeError(error) };
 }
 function safeError(e) {
     const s = String(e);
-    for (const code of ['INCOMPATIBLE_TIMEOUTS', 'CLAIM_LOST', 'DAILY_LIMIT_REACHED', 'DAILY_TASK_REPLAY', 'DAILY_LIMIT_CLOCK_ROLLBACK', 'DAILY_LIMIT_BUSY', 'DAILY_LIMIT_INVALID', 'UNENCRYPTED_ENVELOPE_REJECTED', 'INVITE_REQUIRED', 'INVITE_EXPIRED', 'INVITE_WORKER_MISMATCH', 'TASK_SCOPE_REJECTED'])
+    const exact = e instanceof Error ? e.message.split(':')[0] : '';
+    if (['OUTBOX_STORE_INVALID', 'OUTBOX_STORE_BUSY', 'OUTBOX_STORE_UNWRITABLE', 'OUTBOX_FULL',
+        'OUTBOX_DEADLINE_EXPIRED', 'DELIVERY_RECORD_CONFLICT'].includes(exact))
+        return exact;
+    if (/^(PROTOCOL_|CONNECTION_|INVALID_CONNECTION_|QUARANTINE_|INSPECTION_|ACCESS_MODE_REMOVED|INVITE_REFERENCE_UNAVAILABLE)/.test(exact))
+        return exact;
+    for (const code of ['PENDING_OWNER_APPROVAL', 'PEER_NOT_ALLOWED', 'REQUEST_DENIED', 'INTAKE_QUEUE_FULL', 'INTAKE_RATE_LIMITED', 'INTAKE_STORE_INVALID', 'INTAKE_STORE_BUSY', 'INTAKE_STORE_UNWRITABLE', 'APPROVAL_CHANNEL_UNAVAILABLE', 'CONTACT_REVOKED', 'CONTACT_NOT_ALLOWED', 'INCOMPATIBLE_TIMEOUTS', 'CLAIM_LOST', 'DAILY_LIMIT_REACHED', 'DAILY_TASK_REPLAY', 'DAILY_LIMIT_CLOCK_ROLLBACK', 'DAILY_LIMIT_BUSY', 'DAILY_LIMIT_INVALID', 'UNENCRYPTED_ENVELOPE_REJECTED', 'INVITE_REQUIRED', 'INVITE_EXPIRED', 'INVITE_WORKER_MISMATCH', 'TASK_SCOPE_REJECTED'])
         if (s === 'Error: ' + code || s.startsWith('Error: ' + code + ':'))
             return code;
     if (s.includes('TOKEN_REVOKED'))
@@ -1583,6 +1953,14 @@ async function abortable(promise, signal) {
         signal.removeEventListener('abort', listener);
     }
 }
+function freezeApprovalAction(value) {
+    if (value && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freezeApprovalAction(child);
+        Object.freeze(value);
+    }
+    return value;
+}
 /** Completion failure preserves local verification without claiming a sealed checkpoint. */
 export class IncompleteSettlementError extends Error {
     incompleteReceipt;
@@ -1640,13 +2018,71 @@ export async function deliverRevocation(options) {
 }
 export class RequesterClient {
     options;
+    idempotency;
+    keyedStore() {
+        return this.idempotency ??= new IdempotencyStore(this.options.owner, {
+            ...this.options.identityOptions, now: this.options.now, ...this.options.idempotencyOptions,
+        });
+    }
+    keyedAction(options) {
+        const allowed = ['idempotencyKey', 'idempotencyOperation', 'idempotencyChildIndex', 'workerRef', 'pendingId', 'pendingRelayUrl',
+            'renegotiateProtocol', 'beforePropose', 'beforeTransmit', 'to', 'discover', 'relay', 'title', 'description', 'input',
+            'outputSchema', 'budget', 'manifest', 'auditPath', 'signal', 'capabilities', 'capabilityChains', 'minimumIsolationLevel',
+            'onProgress', 'workers', 'mode', 'quorumSize', 'completionTimeoutMs', 'timeoutMs', 'executionTimeoutMs', 'taskTimeoutMs',
+            'waitTimeoutMs', 'connectTimeoutMs', 'transportIdleTimeoutMs', 'heartbeatIntervalMs'];
+        if (Object.keys(options).some(k => !allowed.includes(k)))
+            throw new Error('INVALID_IDEMPOTENCY_ARGUMENT');
+        const timeouts = resolveSessionTimeouts(this.options, options);
+        const normalized = { ...options, ...timeouts, relay: ('relay' in options ? options.relay : undefined) ?? this.options.relay,
+            outputSchema: options.outputSchema ?? {}, capabilities: options.capabilities ?? [],
+            minimumIsolationLevel: options.minimumIsolationLevel ?? 'subprocess_restricted',
+            budget: { costBearer: 'worker_byok', maxInputTokens: 50000, maxOutputTokens: 10000,
+                maxToolInvocations: 10, maxWallClockSeconds: timeouts.executionTimeoutMs !== undefined
+                    ? Math.floor(timeouts.executionTimeoutMs / 1000) : 60, onOverrun: 'hard_stop', ...options.budget },
+            taskTimeoutMs: timeouts.taskTimeoutMs ?? timeouts.timeoutMs ?? 600_000, timeoutMs: undefined,
+            waitTimeoutMs: timeouts.waitTimeoutMs ?? 600_000, connectTimeoutMs: timeouts.connectTimeoutMs ?? 45_000,
+            transportIdleTimeoutMs: timeouts.transportIdleTimeoutMs ?? 90_000, heartbeatIntervalMs: timeouts.heartbeatIntervalMs ?? 15_000,
+            ...('workers' in options ? { workers: structuredClone(options.workers),
+                completionTimeoutMs: options.completionTimeoutMs ?? 45_000,
+                ...(options.mode === 'quorum' ? { quorumSize: options.quorumSize ?? Math.floor(options.workers.length / 2) + 1 } : {}) } : {}),
+        };
+        return runtimeIdempotencyAction(normalized);
+    }
+    deliveryService;
+    deliveryStarted = false;
     approvalProvider;
+    protocol;
     constructor(options) {
         this.options = options;
+        assertConnectionsOptions(options);
+        this.protocol = new LiveProtocol(options);
+        validateRelayAuthRecoveryOptions(options);
         validateSessionTimeouts(options);
         this.approvalProvider =
             options.approvalProvider ?? new InteractiveCliApprovalProvider(options.owner);
+        this.deliveryService = options.deliveryService;
+        if (this.deliveryService && this.deliveryService.owner.did !== options.owner.did)
+            throw deliveryError('OUTBOX_STORE_INVALID');
+        if (!this.deliveryService && (typeof options.relay === 'string' || options.deliveryOptions))
+            this.deliveryService = this.createDelivery();
+    }
+    createDelivery() {
+        return new GatewayDeliveryService(this.options.owner, { ...this.options.deliveryOptions,
+            identityOptions: this.options.deliveryOptions?.identityOptions ?? this.options.identityOptions,
+            now: this.options.deliveryOptions?.now ?? this.options.now, requestTimeoutMs: this.options.connectTimeoutMs,
+            resolveTransport: this.options.deliveryOptions?.resolveTransport ?? ((url, owner) => transport(url, owner, this.options)),
+            assertSendAllowed: async (context) => {
+                const store = this.options.connectionStore ?? new WorkerTrustStore(this.options.owner, {
+                    path: workerIntakePath(this.options.owner.did, this.options.identityOptions),
+                    fs: this.options.identityOptions?.fs, platform: this.options.identityOptions?.platform, now: this.options.now
+                });
+                if (store.connectionState(context.peerOwnerDid) === 'blocked')
+                    throw new Error('REQUEST_DENIED');
+                await this.options.deliveryOptions?.assertSendAllowed?.(context);
+            } });
     }
+    async startDelivery() { this.deliveryStarted = true; await this.deliveryService?.start(); }
+    stopDelivery() { this.deliveryStarted = false; this.deliveryService?.stop(); }
     /**
      * Send an encrypted REVOKE for an invite or capability to a worker inbox.
      * `to` is a worker DID or an acp-invite token. The notice is signed by this client.
@@ -1679,6 +2115,28 @@ export class RequesterClient {
         });
     }
     async delegate(options, hooks) {
+        if (options.idempotencyKey !== undefined && !options.idempotencyOperation) {
+            validateIdempotencyKey(options.idempotencyKey);
+            options = { ...options, input: structuredClone(options.input),
+                outputSchema: options.outputSchema && structuredClone(options.outputSchema),
+                budget: options.budget && structuredClone(options.budget),
+                capabilities: options.capabilities && structuredClone(options.capabilities) };
+            options = { ...options, manifest: options.manifest && structuredClone(options.manifest),
+                discover: options.discover && structuredClone(options.discover),
+                capabilityChains: options.capabilityChains && structuredClone(options.capabilityChains) };
+            const action = this.keyedAction(options);
+            return unwrapIdempotency(await this.keyedStore().run('acp_delegate_task', options.idempotencyKey, action, async (operation) => ({ isError: false, value: await this.delegate({ ...options,
+                    idempotencyKey: undefined, idempotencyOperation: operation }, hooks) })));
+        }
+        assertConnectionsOptions(this.options);
+        // Retain the reviewed values even if the caller changes its objects while awaiting consent.
+        if (options.beforePropose)
+            options = { ...options,
+                input: structuredClone(options.input), manifest: options.manifest && structuredClone(options.manifest),
+                budget: options.budget && structuredClone(options.budget),
+                outputSchema: options.outputSchema && structuredClone(options.outputSchema),
+                capabilities: options.capabilities && structuredClone(options.capabilities),
+            };
         const timeoutOptions = resolveSessionTimeouts(this.options, options);
         validateSessionTimeouts(timeoutOptions);
         if (timeoutOptions.executionTimeoutMs !== undefined && timeoutOptions.executionTimeoutMs < 1000)
@@ -1689,6 +2147,9 @@ export class RequesterClient {
                 allowPrivateRelay: this.options.allowPrivateRelay,
             })
             : undefined;
+        assertConnectionsOptions(options);
+        if (options.workerRef && !invite)
+            throw new Error('INVITE_REFERENCE_UNAVAILABLE');
         const relayOption = options.relay ?? this.options.relay ?? invite?.relayUrl;
         if (!relayOption)
             throw new Error('RELAY_REQUIRED');
@@ -1702,24 +2163,30 @@ export class RequesterClient {
             allowPrivateRelay: this.options.allowPrivateRelay,
             lookup: this.options.lookup,
             requestTimeoutMs: timeoutOptions.connectTimeoutMs,
+            maxAuthRecoveryAttempts: this.options.maxAuthRecoveryAttempts,
+            authRecoveryTimeoutMs: this.options.authRecoveryTimeoutMs,
         }), owner = this.options.owner, inbox = typeof relayOption === 'string'
-            ? recipientInbox(this, relay, owner.did, relayOption.replace(/\/$/, ''))
-            : recipientInbox(relayOption, relay, owner.did);
+            ? recipientInbox(this.deliveryService ?? this, relay, owner.did, relayOption.replace(/\/$/, ''))
+            : recipientInbox(this.deliveryService ?? relayOption, relay, owner.did, this.deliveryService ? options.pendingRelayUrl ?? this.options.pendingRelayUrl : undefined);
         const rawCards = !invite && relay.discover ? await relay.discover() : [];
         if (!Array.isArray(rawCards))
             throw new Error('INVALID_AGENT_CARD');
         if (invite && options.discover)
             throw new Error('CONFLICTING_DISCOVERY_TARGET');
         const card = options.discover
-            ? discoverAgentCards(rawCards, { ...options.discover, accessMode: 'open',
+            ? discoverAgentCards(rawCards, { ...options.discover,
                 ...(options.to ? { did: options.to } : {}) })[0]
             : findDiscoveredAgentCard(rawCards, options.to);
         if (options.discover && !card)
-            throw new Error('OPEN_WORKER_NOT_FOUND');
+            throw new Error('WORKER_NOT_FOUND');
         const peer = invite?.ownerDid ?? card?.payload.ownerDid ?? options.to;
+        const protocolVersion = this.protocol.outbound(invite?.agentCard ?? card, options.renegotiateProtocol ? undefined : options.manifest?.protocolVersion, peer, invite?.agentDid ?? card?.payload.agentDid ?? peer);
+        if (options.manifest && options.renegotiateProtocol)
+            options = { ...options, manifest: { ...options.manifest, protocolVersion } };
         const manifest = options.manifest ??
             buildTaskManifest({
                 ...options,
+                protocolVersion,
                 taskTimeoutMs: timeoutOptions.taskTimeoutMs ?? timeoutOptions.timeoutMs,
                 budget: { ...options.budget, ...(timeoutOptions.executionTimeoutMs !== undefined
                         ? { maxWallClockSeconds: options.budget?.maxWallClockSeconds ?? Math.floor(timeoutOptions.executionTimeoutMs / 1000) } : {}) },
@@ -1730,14 +2197,6 @@ export class RequesterClient {
                 taskType: options.discover?.taskType ?? (card?.payload.skills.length === 1 &&
                     card.payload.skills[0].taskTypes?.length === 1 ? card.payload.skills[0].taskTypes[0] : undefined),
             });
-        // Cap only implicit defaults; explicit budgets remain subject to worker admission.
-        if (!options.manifest && card?.payload.accessMode === 'open') {
-            for (const field of OPEN_POLICY_FIELDS) {
-                const limit = card.payload.openPolicy?.[field];
-                if (limit !== undefined && options.budget?.[field] === undefined)
-                    manifest.budget[field] = Math.min(manifest.budget[field], limit);
-            }
-        }
         if (options.manifest && timeoutOptions.executionTimeoutMs !== undefined &&
             manifest.budget.maxWallClockSeconds * 1000 > timeoutOptions.executionTimeoutMs)
             throw new Error('INCOMPATIBLE_TIMEOUTS: manifest budget exceeds executionTimeoutMs');
@@ -1759,13 +2218,70 @@ export class RequesterClient {
         }
         if (!validateOutput(manifest.io.inputSchema, options.input))
             throw new Error('INPUT_SCHEMA');
+        if (!this.deliveryService && typeof relayOption === 'string') {
+            this.deliveryService = this.createDelivery();
+            if (this.deliveryStarted)
+                await this.deliveryService.start();
+        }
+        await this.deliveryService?.prepare(options.signal);
+        this.deliveryService?.store.checkAvailable();
+        const operation = options.idempotencyOperation, childIndex = options.idempotencyChildIndex ?? 0;
+        const stableRelayUrl = typeof relayOption === 'string' ? relayOption : options.pendingRelayUrl ?? this.options.pendingRelayUrl;
+        const approvalRelay = typeof relayOption === 'string' ? relayOption
+            : 'url' in relayOption && typeof relayOption.url === 'string' ? relayOption.url : 'injected transport';
+        const approvalTargetDigest = digest({ manifest, description: manifest.task.description, input: options.input,
+            relay: approvalRelay, fanOut: operation?.children ?? 1 });
+        if (operation)
+            await operation.prepare({ childIndex, manifest, input: options.input, relayUrl: stableRelayUrl ?? approvalRelay,
+                peerOwnerDid: peer, peerAgentDid: manifest.worker.agentDid, approvalTargetDigest });
+        if (options.beforePropose) {
+            const approvalSignal = AbortSignal.any([
+                AbortSignal.timeout(Math.max(0, Date.parse(manifest.deadline) - Date.now())),
+                ...(options.signal ? [options.signal] : []),
+            ]);
+            try {
+                const evidence = await abortable(options.beforePropose({
+                    manifest: freezeApprovalAction(manifest), input: freezeApprovalAction(options.input),
+                    relay: typeof relayOption === 'string' ? relayOption
+                        : 'url' in relayOption && typeof relayOption.url === 'string' ? relayOption.url : 'injected transport',
+                    signal: approvalSignal,
+                }), approvalSignal);
+                approvalSignal.throwIfAborted();
+                await operation?.authorize(childIndex, evidence);
+            }
+            catch (error) {
+                if (approvalSignal.aborted)
+                    throw new Error(options.signal?.aborted ? 'APPROVAL_ABORTED' : 'APPROVAL_TIMEOUT');
+                throw error;
+            }
+            if (invite)
+                parseAndVerifyInviteToken(options.to, Date.now(), {
+                    allowPrivateRelay: this.options.allowPrivateRelay,
+                });
+            if (Date.parse(manifest.deadline) <= Date.now())
+                throw new Error('APPROVAL_TIMEOUT');
+        }
+        if (operation && !options.beforePropose)
+            await operation.authorize(childIndex, {
+                targetDigest: approvalTargetDigest, approvedAt: (this.options.now ?? Date.now)(), policy: 'configured-auto',
+            });
+        await operation?.sending();
+        const wireDelivery = this.deliveryService && stableRelayUrl ? {
+            service: this.deliveryService, context: { messageId: '00000000-0000-4000-8000-000000000000',
+                peerOwnerDid: peer, relayUrl: stableRelayUrl, deliveryDeadline: Date.parse(manifest.deadline),
+                message: { taskId: manifest.taskId, peerAgentDid: manifest.worker.agentDid,
+                    protocolVersion: manifest.protocolVersion,
+                    ...(operation ? { operationId: operation.operationId } : {}) } },
+        } : undefined;
         const auditPath = options.auditPath ?? this.options.auditPath;
         freshAudit(auditPath);
         const bridge = new AbortController();
+        if (this.deliveryService && stableRelayUrl)
+            inbox.setDelivery(this.deliveryService, stableRelayUrl, this.deliveryStarted || this.deliveryService.statusRouter.active);
         const mailbox = inbox.attach(manifest.taskId);
         const timeouts = new SessionTimeouts(timeoutOptions, manifest.deadline, bridge.signal);
         const signal = timeouts.signal;
-        const wire = new SessionWire(mailboxRelay(relay, mailbox), owner, peer, manifest.taskId, [owner.did, peer], signal, auditPath, this.options.allowUnencryptedEnvelopes === true);
+        const wire = new SessionWire(mailboxRelay(relay, mailbox), owner, peer, manifest.taskId, [owner.did, peer], signal, auditPath, this.options.allowUnencryptedEnvelopes === true, false, wireDelivery);
         if (onProgress) {
             wire.onProgress = async (progress, envelope) => {
                 await onProgress(progress, {
@@ -1799,6 +2315,8 @@ export class RequesterClient {
                 .catch(() => undefined);
         };
         const onUserAbort = () => {
+            if (wireDelivery)
+                wireDelivery.service.closeMessage(wireDelivery.context.messageId, 'CANCELLED');
             const state = gateway?.machine.state;
             if (state === 'IN_PROGRESS')
                 startCancel();
@@ -1827,12 +2345,46 @@ export class RequesterClient {
                     const leaf = createCapability({ ...root.payload, audience: peer, maxDepth: 0 }, owner, root);
                     return [root, leaf];
                 });
+            let connectionRequest;
+            let connectionRouter;
+            if (this.options.connectionReview && protocolVersion === '0.2.0') {
+                const relayUrl = invite?.relayUrl ?? card?.payload.relayEndpoint ?? this.options.pendingRelayUrl;
+                if (!relayUrl)
+                    throw new Error('RELAY_REQUIRED');
+                const store = this.options.connectionStore ?? new WorkerTrustStore(owner, { path: this.options.identityOptions
+                        ? workerIntakePath(owner.did, this.options.identityOptions) : undefined, now: this.options.now });
+                if (store.ownerDid !== owner.did)
+                    throw new Error('CONNECTION_OWNER_MISMATCH');
+                if (store.connectionState(peer) !== 'connected') {
+                    connectionRouter = new ConnectionRouter({ owner, relay, relayUrl, store,
+                        agentCard: createSignedAgentCard({ name: 'Sealbridge requester', agentDid: owner.did,
+                            relayEndpoint: relayUrl, skills: [], protocolVersions: this.protocol.receiveVersions() }, owner),
+                        review: new HeldRequestReview(owner, { ...this.options.identityOptions, now: this.options.now }),
+                        humanReview: this.options.connectionReview, now: this.options.now, allowPrivateRelay: this.options.allowPrivateRelay,
+                        onConnectionEvent: this.options.onConnectionEvent });
+                    try {
+                        const request = await connectionRouter.service.request({ toOwnerDid: peer,
+                            ...(invite ? { inviteToken: options.to } : card ? { peerAgentCard: card } : {}), originProposalDigest: digest({ manifest, input: options.input }), deferDelivery: true });
+                        connectionRequest = store.controlSnapshot().find(r => r.offer.requestId === request.requestId)?.outbox[0]?.envelope;
+                    }
+                    catch (error) {
+                        if (!(error instanceof Error) || error.message !== 'APPROVAL_REJECTED')
+                            throw error;
+                    }
+                }
+            }
+            if (connectionRouter)
+                inbox.setConnections(connectionRouter);
+            // Recheck the live phase immediately before transmission; owner review may cross a boundary.
+            this.protocol.outbound(invite?.agentCard ?? card, manifest.protocolVersion, peer, manifest.worker.agentDid);
+            options.beforeTransmit?.();
             await wire.sendEvent('PROPOSE', {
                 proposal: signPayload(manifest, owner),
                 input: options.input,
                 capabilityChains,
                 peerIdleTimeoutMs: timeoutOptions.transportIdleTimeoutMs ?? 90_000,
                 ...(invite ? { inviteToken: options.to } : {}),
+                ...(connectionRequest ? { connectionRequest } : {}),
             });
             const accept = (await wire.receiveEvent('ACCEPT')).payload.payload;
             if (!verifyContract(accept.contract) ||
@@ -1856,9 +2408,15 @@ export class RequesterClient {
                 gate: 'final_verification',
                 target: data,
                 details: { manifest, deliverableDigest: data.artifact.payload.digest },
+                deadline: manifest.deadline,
                 signal,
             });
-            const { result, verification, settlement } = await abortable(gateway.verifyAndSettle(wire.sealed(envelope), this.options.verificationEngine ?? new VerificationEngine(), approval, { allowUnencryptedEnvelopes: this.options.allowUnencryptedEnvelopes === true }), signal);
+            const { result, verification, settlement } = await abortable(gateway.verifyAndSettle(wire.sealed(envelope), this.options.verificationEngine ?? new VerificationEngine(), approval, { allowUnencryptedEnvelopes: this.options.allowUnencryptedEnvelopes === true, onVerifiedDelivery: () => {
+                    if (!wireDelivery)
+                        return;
+                    wireDelivery.service.markPeerObserved(wireDelivery.context.messageId, { status: 'replied', envelopeId: wireDelivery.context.messageId,
+                        replyEnvelopeId: receiptFileId(envelope.payload.envelopeId) });
+                } }), signal);
             if (!result.accepted || !settlement) {
                 await wire.sendEvent('VERIFY_REJECT', verification);
                 throw new Error('VERIFICATION_REJECTED: ' + result.reason);
@@ -1884,6 +2442,27 @@ export class RequesterClient {
             };
         }
         catch (e) {
+            if (e instanceof PeerRejectedError && wireDelivery) {
+                if (e.code === 'PENDING_OWNER_APPROVAL')
+                    wireDelivery.service.markPeerObserved(wireDelivery.context.messageId, { status: 'received_held', envelopeId: wireDelivery.context.messageId });
+                wireDelivery.service.closeMessage(wireDelivery.context.messageId, e.code ?? 'PEER_REJECTED');
+            }
+            if (e instanceof PeerRejectedError && e.code === 'PENDING_OWNER_APPROVAL' && this.options.pendingStore) {
+                let pendingId = options.pendingId, pendingStoreError;
+                if (!pendingId) {
+                    try {
+                        pendingId = this.options.pendingStore.save({ ...(options.workerRef
+                                ? { workerRef: options.workerRef } : { to: invite ? options.to : peer }),
+                            relayUrl: typeof relayOption === 'string' ? relayOption : options.pendingRelayUrl ?? this.options.pendingRelayUrl ??
+                                ('url' in relayOption && typeof relayOption.url === 'string' ? relayOption.url : undefined),
+                            manifest, input: options.input, timeouts: timeoutOptions });
+                    }
+                    catch (error) {
+                        pendingStoreError = pendingErrorCode(error);
+                    }
+                }
+                Object.assign(e, { pendingId, pendingStoreError, originalTaskId: manifest.taskId, nextStep: PENDING_NEXT_STEP });
+            }
             try {
                 if (e instanceof PeerRejectedError && e.recovery) {
                     if (e.recovery.proposalDigest !== digest({ manifest, input: options.input }))
@@ -1912,11 +2491,11 @@ export class RequesterClient {
                         return cached;
                     }
                 }
-                if (verifiedReceipt)
+                if (!wire.hasCommittedSend || e instanceof PeerRejectedError || verifiedReceipt)
                     throw e;
                 // A closed recipient inbox is terminal for every attached task. Do not wait
                 // for another relay send (or cancellation handshake) on the failed connection.
-                if (e instanceof Error && 'code' in e && ['RELAY_TERMINAL', 'RELAY_ENVELOPE_EXPIRED'].includes(String(e.code)))
+                if (e instanceof Error && 'code' in e && ['RELAY_TERMINAL', 'RELAY_AUTH_RECOVERY_EXHAUSTED', 'RELAY_ENVELOPE_EXPIRED'].includes(String(e.code)))
                     throw e;
                 if (cancelStarted) {
                     try {
@@ -1953,6 +2532,17 @@ export class RequesterClient {
         }
     }
     async delegateMulti(options) {
+        if (options.idempotencyKey !== undefined && !options.idempotencyOperation) {
+            validateIdempotencyKey(options.idempotencyKey);
+            options = { ...options, input: structuredClone(options.input),
+                outputSchema: options.outputSchema && structuredClone(options.outputSchema),
+                budget: options.budget && structuredClone(options.budget),
+                capabilities: options.capabilities && structuredClone(options.capabilities) };
+            options = { ...options, workers: structuredClone(options.workers) };
+            const action = this.keyedAction(options);
+            return unwrapIdempotency(await this.keyedStore().run('acp_delegate_multi', options.idempotencyKey, action, async (operation) => ({ isError: false, value: await this.delegateMulti({ ...options,
+                    idempotencyKey: undefined, idempotencyOperation: operation }) }), { children: options.workers.length }));
+        }
         if (!Array.isArray(options.workers) || options.workers.length === 0)
             throw new Error('WORKERS_REQUIRED');
         if (options.mode !== 'race' && options.mode !== 'quorum')
@@ -1986,6 +2576,8 @@ export class RequesterClient {
         const receipts = [];
         const incompleteReceipts = [];
         let failures = 0;
+        const approvalFailures = [];
+        const allApprovalFailed = () => approvalFailures.length === count ? approvalFailures[0] : undefined;
         let winnerDigest;
         const abortUnfinished = (reason) => {
             controllers.forEach((controller, index) => {
@@ -2024,6 +2616,9 @@ export class RequesterClient {
                     minimumIsolationLevel: options.minimumIsolationLevel,
                     signal,
                     onProgress: options.onProgress,
+                    beforePropose: options.beforePropose,
+                    idempotencyOperation: options.idempotencyOperation,
+                    idempotencyChildIndex: index,
                     auditPath: options.auditPath
                         ? options.auditPath.replace(/(\.jsonl)?$/, '.' + index + '.jsonl')
                         : undefined,
@@ -2056,6 +2651,10 @@ export class RequesterClient {
             catch (error) {
                 if (error instanceof IncompleteSettlementError)
                     incompleteReceipts.push(error.incompleteReceipt);
+                await options.idempotencyOperation?.childReady(index, error);
+                if ((options.beforePropose || options.idempotencyOperation) && error instanceof Error &&
+                    /^(APPROVAL_|IDEMPOTENCY_)/.test(error.message))
+                    approvalFailures.push(error);
                 finished[index] = true;
                 failures += 1;
                 if (options.mode === 'quorum' && !winnerDigest && failures > count - quorumSize)
@@ -2072,7 +2671,7 @@ export class RequesterClient {
                 winner = await Promise.any(jobs);
             }
             catch {
-                throw Object.assign(new Error('RACE_FAILED'), { receipts, incompleteReceipts });
+                throw Object.assign(allApprovalFailed() ?? new Error('RACE_FAILED'), { receipts, incompleteReceipts });
             }
             abortUnfinished('RACE_LOST');
             await Promise.allSettled(jobs);
@@ -2099,7 +2698,7 @@ export class RequesterClient {
         }
         await Promise.allSettled(jobs);
         if (!winnerDigest)
-            throw Object.assign(new Error('QUORUM_NOT_REACHED'), { receipts, incompleteReceipts });
+            throw Object.assign(allApprovalFailed() ?? new Error('QUORUM_NOT_REACHED'), { receipts, incompleteReceipts });
         const seenWinners = new Set();
         const winners = receipts.filter((receipt) => {
             if (receipt.outputDigest !== winnerDigest || seenWinners.has(receipt.workerDid))
@@ -2207,9 +2806,10 @@ async function canonicalizeDiscoveredWorkers(targets, options) {
     }));
 }
 export function buildTaskManifest(options) {
-    const createdAt = new Date().toISOString(), deadline = new Date(Date.now() + (options.taskTimeoutMs ?? 600000)).toISOString();
+    const now = (options.now ?? Date.now)();
+    const createdAt = new Date(now).toISOString(), deadline = new Date(now + (options.taskTimeoutMs ?? 600000)).toISOString();
     return {
-        protocolVersion: '0.1.0',
+        protocolVersion: options.protocolVersion ?? '0.2.0',
         taskId: 'task_' + randomUUID().replaceAll('-', ''),
         createdAt,
         deadline,