threadwire 0.1.11 → 0.1.12

package/src/isolated-runtime.js

@@ -2,15 +2,17 @@
 /* eslint-disable jsdoc/require-jsdoc */
 
 import {randomBytes} from "node:crypto"
+import {once} from "node:events"
 import {lstat, realpath} from "node:fs/promises"
 import {createServer} from "node:http"
 import {isAbsolute, join, normalize, relative} from "node:path"
 import {DockerApi} from "./docker-api.js"
-import {buildWorkerContainerSpec, isDigestImage} from "./isolated-worker.js"
+import {buildKimiBindingValidatorSpec, buildKimiRelayContainerSpec, buildWorkerContainerSpec, isDigestImage} from "./isolated-worker.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {codexSessionId, parseCodexEvent} from "./providers/codex.js"
 import {kimiSessionEnvelopeId, validateKimiProviderArguments} from "./providers/kimi.js"
 import {parseApprovedKimiModels} from "./kimi-model-broker-policy.js"
+import {parseThreadwireBinding, resumeTaskIdentity, threadwireBindingDigest} from "./threadwire-binding.js"
 import {openStateRegistry, validateStateVolume} from "./isolated-state.js"
 import {assertNoNestedMounts} from "./mount-policy.js"
 import {AbsoluteDeadline, deadlineAfter} from "./absolute-deadline.js"
@@ -23,7 +25,8 @@ const PREFLIGHT_TASK_CAPACITY = 8
 const GC_INTERVAL_MS = 5_000
 const ACTIVE_RUN_CAPACITY = 16
 const ACTIVE_TASK_CAPACITY = 2
-const WORKER_TIMEOUT_MS = 3_600_000
+const GRANT_LEASE_MS = 60_000
+const GRANT_LEASE_MAX_MS = 3_600_000
 const PREFLIGHT_TIMEOUT_MS = 30_000
 const MAX_RAW_OUTPUT_BYTES = 1_048_576
 
@@ -46,12 +49,20 @@ export async function startIsolatedRuntime(options = {}) {
   const brokerAdminToken = provider === "kimi"
     ? authoritySetting(environment[brokerAdminName], brokerAdminName)
     : safeSetting(environment[brokerAdminName], brokerAdminName)
-  const brokerContainer = safeSetting(environment[brokerContainerName], brokerContainerName)
-  const allowedRoots = parseAllowedRoots(environment.THREADWIRE_ALLOWED_WORKTREE_ROOTS)
+  const brokerContainer = provider === "kimi" ? undefined : safeSetting(environment[brokerContainerName], brokerContainerName)
+  const relayImage = provider === "kimi"
+    ? safeSetting(environment.THREADWIRE_KIMI_MODEL_RELAY_IMAGE, "THREADWIRE_KIMI_MODEL_RELAY_IMAGE")
+    : undefined
+  if (relayImage !== undefined && !isDigestImage(relayImage)) throw new Error("THREADWIRE_KIMI_MODEL_RELAY_IMAGE must use an immutable digest")
+  const relayWorkerUrl = provider === "kimi"
+    ? normalizedHttpUrl(environment.THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL, "THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL")
+    : undefined
+  const allowedRoots = provider === "kimi" ? [] : parseAllowedRoots(environment.THREADWIRE_ALLOWED_WORKTREE_ROOTS)
   const worktreeVolume = environment.THREADWIRE_WORKTREE_VOLUME
   const sessionTtlMs = positiveDuration(environment.THREADWIRE_SESSION_TTL_MS, 86_400_000)
-  const workerTimeoutMs = positiveDuration(environment.THREADWIRE_WORKER_TIMEOUT_MS, WORKER_TIMEOUT_MS)
+  const workerTimeoutMs = optionalDuration(environment.THREADWIRE_WORKER_TIMEOUT_MS)
   const preflightTimeoutMs = positiveDuration(environment.THREADWIRE_PREFLIGHT_TIMEOUT_MS, PREFLIGHT_TIMEOUT_MS)
+  const grantLeaseMs = grantLeaseSetting(environment.THREADWIRE_GRANT_LEASE_MS)
   const docker = options.docker ?? new DockerApi()
   const fetchImplementation = options.fetchImplementation ?? fetch
   const now = options.now ?? Date.now
@@ -84,7 +95,7 @@ export async function startIsolatedRuntime(options = {}) {
   const collectState = () => {
     gcPromise = gcPromise.then(async () => {
       if (shutdown.signal.aborted) return
-      const collection = deadlineAfter(Math.min(30_000, workerTimeoutMs), {signal: shutdown.signal, timeoutMessage: "Isolated runtime collection timeout"})
+      const collection = deadlineAfter(30_000, {signal: shutdown.signal, timeoutMessage: "Isolated runtime collection timeout"})
       const releaseCollection = activeLineages.beginCollection()
       try {
         const active = new Set(activeLineages.values())
@@ -117,7 +128,7 @@ export async function startIsolatedRuntime(options = {}) {
       if (request.method === "POST" && request.url === "/preflight") {
         const releaseIncoming = incomingRequests.acquire("preflight")
         const launchDeadlineAt = requestedDeadline(request.headers["x-threadwire-launch-deadline"], workerTimeoutMs)
-        const operation = new AbsoluteDeadline(Math.min(Date.now() + preflightTimeoutMs, launchDeadlineAt), {
+        const operation = new AbsoluteDeadline(minimumDeadline(Date.now() + preflightTimeoutMs, launchDeadlineAt), {
           signal: shutdown.signal, request, response, timeoutMessage: "Isolated runtime operation timed out", disconnectMessage: "Isolated runtime caller disconnected"
         })
         try {
@@ -137,8 +148,8 @@ export async function startIsolatedRuntime(options = {}) {
             try { validateStateVolume(volume, state.volume, state.labels) } catch { throw new ClientError(`${providerName(provider)} resume state is unavailable`) }
           } else state = stateRegistry.allocate(task)
           const preflightId = randomBytes(24).toString("base64url")
-          preflights.add(preflightId, task, {...selection, providerSelection, state, fingerprint, worktreeRoot, launchDeadlineAt})
-          sendJson(response, 200, {ok: true, preflightId, launchDeadlineAt})
+          preflights.add(preflightId, task, {...selection, provider, providerSelection, state, fingerprint, worktreeRoot, ...(launchDeadlineAt === undefined ? {} : {launchDeadlineAt})})
+          sendJson(response, 200, {ok: true, preflightId, ...(launchDeadlineAt === undefined ? {} : {launchDeadlineAt})})
         } finally {
           operation.close()
           releaseIncoming()
@@ -157,7 +168,7 @@ export async function startIsolatedRuntime(options = {}) {
         }
         const preflight = preflights.consume(body.preflightId)
         if (!preflight) throw new ClientError("Isolated runtime preflight expired")
-        const operation = new AbsoluteDeadline(Math.min(preflight.launchDeadlineAt,
+        const operation = new AbsoluteDeadline(minimumDeadline(preflight.launchDeadlineAt,
           requestedDeadline(request.headers["x-threadwire-launch-deadline"], workerTimeoutMs)), {
           signal: shutdown.signal, request, response, timeoutMessage: "Isolated runtime launch timed out", disconnectMessage: "Isolated runtime caller disconnected"
         })
@@ -173,12 +184,19 @@ export async function startIsolatedRuntime(options = {}) {
           }
           await revalidateFingerprint(preflight.fingerprint)
           operation.throwIfAborted()
+          const writeFrame = async (frame) => {
+            if (!response.headersSent) response.writeHead(200, {"content-type": "application/x-ndjson"})
+            if (!response.write(`${JSON.stringify(frame)}\n`)) await abortable(once(response, "drain"), operation.signal)
+          }
           const result = await runIsolatedWorker({
-            docker, workerImage, brokerUrl, brokerAdminToken, brokerContainer,
-            fetchImplementation, preflight, ...body, task, now, stateRegistry, sessionTtlMs, operation,
+            docker, workerImage, brokerUrl, brokerAdminToken, brokerContainer, relayImage, relayWorkerUrl,
+            fetchImplementation, preflight, ...body, task, now, stateRegistry, sessionTtlMs, operation, grantLeaseMs,
+            onRecord: (record) => writeFrame({type: "record", record}),
             ...(worktreeVolume === undefined ? {} : {worktreeVolume})
           })
-          sendJson(response, 200, result)
+          for (const chunk of result.rawChunks) await writeFrame({type: "chunk", ...chunk})
+          await writeFrame({type: "terminal", exitCode: result.exitCode})
+          response.end()
         } finally {
           operation.close()
           releaseLineage?.()
@@ -190,6 +208,10 @@ export async function startIsolatedRuntime(options = {}) {
       response.writeHead(404)
       response.end()
     } catch (error) {
+      if (response.headersSent) {
+        if (!response.writableEnded && !response.destroyed) response.end(`${JSON.stringify({type: "terminal", exitCode: 1})}\n`)
+        return
+      }
       sendJson(response, error instanceof ClientError ? 400 : 503, {
         error: error instanceof ClientError ? error.message : "Isolated runtime unavailable"
       })
@@ -221,7 +243,9 @@ async function verifyPrerequisites(options) {
   if (typeof version.ApiVersion !== "string") throw new Error("Docker API unavailable")
   const image = /** @type {{Id?: unknown}} */ (await docker.inspectImage(workerImage, operation.options()))
   if (typeof image.Id !== "string" || !isDigestImage(image.Id)) throw new Error("Worker image unavailable")
-  const validatedWorktree = await validateWorktreeSelection(selection.repositoryRoot, selection.cwd, allowedRoots)
+  const validatedWorktree = selection.provider === "kimi"
+    ? await verifyKimiBindingAdmission(docker, selection.binding, operation.options())
+    : await validateWorktreeSelection(selection.repositoryRoot, selection.cwd, allowedRoots)
   const health = await abortable(fetchImplementation(new URL("/healthz", brokerUrl), {
     method: "GET",
     redirect: "error",
@@ -232,6 +256,51 @@ async function verifyPrerequisites(options) {
   return validatedWorktree
 }
 
+async function verifyKimiBindingAdmission(docker, value, requestOptions) {
+  const binding = parseThreadwireBinding(value)
+  const source = await docker.inspectVolume(binding.source.volume, requestOptions)
+  const context = await docker.inspectVolume(binding.context.volume, requestOptions)
+  const expected = {"org.threadwire.owner": "threadwire-task", "org.threadwire.binding-schema": "1", "org.threadwire.task": binding.taskId}
+  const labelsMatch = (labels, extra) => isRecord(labels)
+    && Object.entries({...expected, ...extra}).every(([key, item]) => labels[key] === item)
+  if (!isRecord(source) || source.Name !== binding.source.volume
+    || !isRecord(source.Labels) || source.Labels["org.threadwire.owner"] !== "threadwire-task"
+    || source.Labels["org.threadwire.task"] !== binding.taskId || source.Labels["org.threadwire.role"] !== "source"
+    || (source.Labels["org.threadwire.binding-schema"] !== undefined && source.Labels["org.threadwire.binding-schema"] !== "1")) {
+    throw new ClientError("Threadwire binding is unavailable")
+  }
+  if (!isRecord(context) || context.Name !== binding.context.volume || !labelsMatch(context.Labels, {
+    "org.threadwire.role": "context",
+    "org.threadwire.context-manifest-sha256": binding.context.digests.manifest,
+    "org.threadwire.context-content-sha256": binding.context.digests.content,
+    "org.threadwire.context-image-id": binding.context.imageId
+  })) throw new ClientError("Threadwire binding is unavailable")
+  const lease = await docker.inspectContainer(binding.leaseContainerId, requestOptions)
+  const configuredMounts = lease?.HostConfig?.Mounts
+  const effectiveMounts = lease?.Mounts
+  const leaseLabels = lease?.Config?.Labels
+  const expectedUser = binding.runtime.uid + ":" + binding.runtime.gid
+  if (!isRecord(lease) || lease.Id !== binding.leaseContainerId || lease.Image !== binding.context.imageId || lease.State?.Running !== true
+    || lease.Config?.User !== expectedUser || lease.Config?.WorkingDir !== binding.runtime.workdir
+    || !labelsMatch(leaseLabels, {"org.threadwire.role": "lease"})
+    || !Array.isArray(configuredMounts) || configuredMounts.length !== 2 || !Array.isArray(effectiveMounts) || effectiveMounts.length !== 2) {
+    throw new ClientError("Threadwire binding is unavailable")
+  }
+  const expectedMounts = [binding.source, binding.context]
+  for (const mount of expectedMounts) {
+    const configured = configuredMounts.find((item) => item?.Type === "volume" && item.Source === mount.volume && item.Target === mount.target)
+    const effective = effectiveMounts.find((item) => item?.Type === "volume" && item.Name === mount.volume && item.Destination === mount.target)
+    if (Boolean(configured?.ReadOnly) !== mount.readOnly || effective?.RW !== !mount.readOnly) throw new ClientError("Threadwire binding is unavailable")
+  }
+  for (const volume of [binding.source.volume, binding.context.volume]) {
+    const references = await docker.listVolumeReferences(volume, requestOptions)
+    if (!Array.isArray(references) || references.length !== 1 || references[0]?.Id !== binding.leaseContainerId) {
+      throw new ClientError("Threadwire binding is unavailable")
+    }
+  }
+  return {fingerprint: [], root: binding.source.target}
+}
+
 export async function validateWorktree(repositoryRoot, cwd, allowedRoots) {
   return (await validateWorktreeSelection(repositoryRoot, cwd, allowedRoots)).fingerprint
 }
@@ -281,6 +350,7 @@ export async function revalidateFingerprint(fingerprint) {
 export async function runIsolatedWorker(options) {
   const runId = `tw-${randomBytes(12).toString("hex")}`
   const networkName = `${runId}-net`
+  const egressNetworkName = `${runId}-egress`
   const state = options.preflight.state
   const provider = options.preflight.provider ?? "codex"
   const providerSelection = options.preflight.providerSelection ?? options.preflight.codexArguments
@@ -288,22 +358,45 @@ export async function runIsolatedWorker(options) {
   const freshState = options.resumeSession === undefined
   let keepFreshState = false
   let networkId
+  let egressNetworkId
+  let validatorId
+  let relayId
+  let relayContainerName
   let containerId
   let grantToken
+  let grantRenewalTimer
   let runTracked = false
+  let runStage = "state"
   const operation = options.operation
   const worktreeSubpath = options.worktreeVolume === undefined
     ? ""
     : deriveVolumeWorktreeSubpath(options.preflight.worktreeRoot, options.preflight.repositoryRoot)
   try {
     operation.throwIfAborted()
+    runStage = "state-volume"
     await prepareStateVolume(options.docker, state, freshState, operation.options())
+    runStage = "lineage-track"
     if (freshState) await options.stateRegistry.track(state, operation.signal)
-    const runIdentity = expectedRunIdentity(options, runId, networkName, state, worktreeSubpath)
+    runStage = "run-identity"
+    // Docker normalizes a created container's Config.Image to the image
+    // content Id, so the sealed Kimi identity pins the resolved relay image Id
+    // (not the configured reference) for restart reconciliation to recognize
+    // the genuine relay. The worker/validator image Id is the binding-sealed
+    // contextImageId.
+    let relayImageId
+    if (provider === "kimi") {
+      if (!isDigestImage(options.relayImage)) throw new Error("Kimi relay configuration unavailable")
+      const relayImageInspection = /** @type {{Id?: unknown}} */ (await options.docker.inspectImage(options.relayImage, operation.options()))
+      if (typeof relayImageInspection.Id !== "string" || !isDigestImage(relayImageInspection.Id)) throw new Error("Kimi relay image unavailable")
+      relayImageId = relayImageInspection.Id
+    }
+    const runIdentity = expectedRunIdentity(options, runId, networkName, state, worktreeSubpath, relayImageId)
     const runSeal = options.stateRegistry.sealRun(runIdentity)
+    runStage = "run-track"
     await options.stateRegistry.trackRun(runIdentity, operation.signal)
     runTracked = true
     const resourceLabels = {
+      "org.threadwire.owner": "isolated-runtime",
       "org.threadwire.namespace": options.stateRegistry.namespace,
       "org.threadwire.provider": provider,
       "org.threadwire.run": runId,
@@ -312,12 +405,65 @@ export async function runIsolatedWorker(options) {
       "org.threadwire.state-volume": state.volume,
       "org.threadwire.run-seal": runSeal
     }
+    if (provider === "kimi") {
+      runStage = "validator"
+      const validatorSpec = buildKimiBindingValidatorSpec({image: options.workerImage, binding: options.preflight.binding, labels: {...resourceLabels, "org.threadwire.role": "validator"}})
+      const validator = /** @type {{Id?: unknown}} */ (await options.docker.createContainer(`${runId}-validator`, validatorSpec, operation.options()))
+      if (typeof validator.Id !== "string") throw new Error("Kimi binding validator creation failed")
+      validatorId = validator.Id
+      await validateWorkerMountInventory(await options.docker.inspectContainer(validatorId, operation.options()), validatorSpec.HostConfig.Mounts)
+      await options.docker.startContainer(validatorId, operation.options())
+      const validatorWait = await options.docker.waitContainer(validatorId, operation.options())
+      const validatorLogs = await options.docker.logs(validatorId, operation.options())
+      if (validatorWait.StatusCode !== 0) throw new Error("Kimi binding validation failed")
+      const validatorOutput = demultiplexDockerLogChunks(validatorLogs)
+      let attestation
+      try {
+        attestation = JSON.parse(Buffer.concat(validatorOutput.filter((chunk) => chunk.channel === "stdout").map((chunk) => chunk.data)).toString("utf8").trim())
+      } catch {
+        throw new Error("Kimi binding validation failed")
+      }
+      const binding = options.preflight.binding
+      if (!isRecord(attestation) || !exactKeys(attestation, ["content", "manifest", "ok", "revision"]) || attestation.ok !== true
+        || attestation.revision !== binding.source.revision || attestation.manifest !== binding.context.digests.manifest
+        || attestation.content !== binding.context.digests.content) throw new Error("Kimi binding validation failed")
+      await cleanupDocker(() => options.docker.removeContainer(validatorId, operation.options()))
+      validatorId = undefined
+    }
+    runStage = "network"
     const network = /** @type {{Id?: unknown}} */ (await options.docker.createNetwork(networkName, resourceLabels, operation.options()))
     if (typeof network.Id !== "string") throw new Error("Docker network creation failed")
     networkId = network.Id
-    await options.docker.connectNetwork(networkId, options.brokerContainer, [], operation.options())
-    const networkInspection = await options.docker.inspectNetwork(networkId, operation.options())
-    const brokerAddress = brokerNetworkAddress(networkInspection, options.brokerContainer)
+    let workerBrokerUrl
+    let brokerAddress
+    if (provider === "kimi") {
+      if (!isDigestImage(options.relayImage) || !(options.relayWorkerUrl instanceof URL)) throw new Error("Kimi relay configuration unavailable")
+      runStage = "relay"
+      const egressNetwork = /** @type {{Id?: unknown}} */ (await options.docker.createEgressNetwork(egressNetworkName, resourceLabels, operation.options()))
+      if (typeof egressNetwork.Id !== "string") throw new Error("Docker egress network creation failed")
+      egressNetworkId = egressNetwork.Id
+      const relaySpec = buildKimiRelayContainerSpec({
+        image: options.relayImage,
+        upstreamUrl: options.relayWorkerUrl.toString(),
+        listenPort: 8788,
+        networkName: egressNetworkName,
+        labels: {...resourceLabels, "org.threadwire.role": "relay"}
+      })
+      relayContainerName = `${runId}-relay`
+      const relay = /** @type {{Id?: unknown}} */ (await options.docker.createContainer(relayContainerName, relaySpec, operation.options()))
+      if (typeof relay.Id !== "string") throw new Error("Kimi relay creation failed")
+      relayId = relay.Id
+      await validateWorkerMountInventory(await options.docker.inspectContainer(relayId, operation.options()), relaySpec.HostConfig.Mounts)
+      await options.docker.connectNetwork(networkId, relayId, [`${runId}-relay`], operation.options())
+      await options.docker.startContainer(relayId, operation.options())
+      const networkInspection = await options.docker.inspectNetwork(networkId, operation.options())
+      workerBrokerUrl = `http://${brokerNetworkAddress(networkInspection, relayContainerName)}:8788/v1`
+    } else {
+      await options.docker.connectNetwork(networkId, options.brokerContainer, [], operation.options())
+      const networkInspection = await options.docker.inspectNetwork(networkId, operation.options())
+      brokerAddress = brokerNetworkAddress(networkInspection, options.brokerContainer)
+    }
+    runStage = "grant"
     const grantResponse = await abortable(options.fetchImplementation(new URL("/admin/grants", options.brokerUrl), {
       method: "POST",
       redirect: "error",
@@ -325,20 +471,21 @@ export async function runIsolatedWorker(options) {
       headers: {authorization: `Bearer ${options.brokerAdminToken}`, "content-type": "application/json"},
       body: JSON.stringify(provider === "kimi"
         ? {
-          runId, provider, networkId, modelAlias: providerSelection.modelAlias, brokerAddress,
+          runId, provider, networkId, modelAlias: providerSelection.modelAlias,
           taskId: state.labels["org.threadwire.task"],
           sessionId: options.resumeSession ?? `pending:${state.lineage}`,
-          ttlMs: Math.min(operation.remaining(), 3_600_000)
+          ttlMs: grantLease(options.grantLeaseMs)
         }
-        : {runId, provider, networkId, model: providerSelection.model, brokerAddress, ttlMs: Math.min(operation.remaining(), 3_600_000)})
+        : {runId, provider, networkId, model: providerSelection.model, brokerAddress, ttlMs: grantLease(options.grantLeaseMs)})
     }), operation.signal)
+    process.stderr.write(`threadwire-runtime: grant response status=${grantResponse.status}\n`)
     if (!grantResponse.ok) throw new Error("Model broker grant failed")
     const grant = await grantResponse.json()
-    if (!isRecord(grant) || typeof grant.token !== "string" || !Number.isSafeInteger(grant.port)) throw new Error("Model broker grant failed")
+    if (!isRecord(grant) || typeof grant.token !== "string" || (provider === "codex" && !Number.isSafeInteger(grant.port))) throw new Error("Model broker grant failed")
     grantToken = grant.token
     const repository = /** @type {{path: string, ino: string}[]} */ (options.preflight.fingerprint)
-    const worktreeMetadata = repository.find((entry) => entry.path === options.preflight.repositoryRoot)
-    const cwdMetadata = repository.find((entry) => entry.path === options.preflight.cwd)
+    const worktreeMetadata = provider === "kimi" ? {ino: "0"} : repository.find((entry) => entry.path === options.preflight.repositoryRoot)
+    const cwdMetadata = provider === "kimi" ? {ino: "0"} : repository.find((entry) => entry.path === options.preflight.cwd)
     if (worktreeMetadata === undefined || cwdMetadata === undefined) throw new Error("Worktree fingerprint unavailable")
     const spec = buildWorkerContainerSpec({
       provider,
@@ -346,10 +493,10 @@ export async function runIsolatedWorker(options) {
       worktree: options.preflight.repositoryRoot,
       networkName,
       brokerToken: grantToken,
-      brokerUrl: `http://${brokerAddress}:${grant.port}/v1`,
+      brokerUrl: provider === "kimi" ? workerBrokerUrl : `http://${brokerAddress}:${grant.port}/v1`,
       prompt: options.prompt,
       providerArguments: providerSelection.arguments,
-      ...(provider === "kimi" ? {model: providerSelection.model} : {}),
+      ...(provider === "kimi" ? {model: providerSelection.model, binding: options.preflight.binding} : {}),
       stateVolume: state.volume,
       workingDirectory: `/worktree${relative(options.preflight.repositoryRoot, options.preflight.cwd) === "" ? "" : `/${relative(options.preflight.repositoryRoot, options.preflight.cwd)}`}`,
       worktreeInode: worktreeMetadata.ino,
@@ -369,11 +516,13 @@ export async function runIsolatedWorker(options) {
         }),
       ...(options.resumeSession === undefined ? {} : {resumeSession: options.resumeSession})
     })
+    runStage = "worker-create"
     const container = /** @type {{Id?: unknown}} */ (await options.docker.createContainer(`${runId}-worker`, spec, operation.options()))
     if (typeof container.Id !== "string") throw new Error("Docker worker creation failed")
     containerId = container.Id
     await revalidateFingerprint(options.preflight.fingerprint)
     await validateWorkerMountInventory(await options.docker.inspectContainer(containerId, operation.options()), spec.HostConfig.Mounts)
+    runStage = "grant-activation"
     const activationResponse = await abortable(options.fetchImplementation(
       new URL(`/admin/grants/${encodeURIComponent(grantToken)}/activate`, options.brokerUrl), {
         method: "POST",
@@ -382,24 +531,74 @@ export async function runIsolatedWorker(options) {
         headers: {authorization: `Bearer ${options.brokerAdminToken}`}
       }), operation.signal)
     if (!activationResponse.ok) throw new Error("Model broker grant activation failed")
+    const leaseMs = grantLease(options.grantLeaseMs)
+    let renewing = false
+    let renewalConfirmed = false
+    grantRenewalTimer = setInterval(() => {
+      if (renewing || operation.signal.aborted || grantToken === undefined) return
+      renewing = true
+      abortable(options.fetchImplementation(new URL(`/admin/grants/${encodeURIComponent(grantToken)}/renew`, options.brokerUrl), {
+        method: "POST", redirect: "error", signal: operation.signal,
+        headers: {authorization: `Bearer ${options.brokerAdminToken}`, "content-type": "application/json"},
+        body: JSON.stringify({ttlMs: leaseMs})
+      }), operation.signal).then((response) => {
+        if (!response.ok) throw new Error("Model broker grant renewal failed")
+        if (!renewalConfirmed) { renewalConfirmed = true; process.stderr.write("threadwire-runtime: grant renewal confirmed\n") }
+      }).catch((error) => {
+        process.stderr.write("threadwire-runtime: grant renewal failed\n")
+        operation.controller.abort(error instanceof Error ? error : new Error("Model broker grant renewal failed"))
+      }).finally(() => { renewing = false })
+    }, Math.max(1, Math.floor(leaseMs / 3)))
+    grantRenewalTimer.unref()
+    runStage = "worker-start"
     await options.docker.startContainer(containerId, operation.options())
-    const wait = /** @type {{StatusCode?: unknown}} */ (await options.docker.waitContainer(containerId, operation.options()))
-    const logs = /** @type {Buffer} */ (await options.docker.logs(containerId, operation.options()))
-    const rawChunks = demultiplexDockerLogChunks(logs)
+    let wait
+    let records
+    let rawChunks
+    runStage = "stream"
+    // Session envelopes are buffered and only published once the run's success
+    // is known: a resume hint followed by a nonzero exit must never expose an
+    // unusable resume session. Non-session records stream immediately.
+    /** @type {unknown[]} */
+    const deferredSessions = []
+    const publishRecord = options.onRecord === undefined
+      ? undefined
+      : (record) => {
+        if (provider === "kimi" && isRecord(record) && record.type === "session") {
+          deferredSessions.push(record)
+          return undefined
+        }
+        return options.onRecord(record)
+      }
+    if (provider === "kimi" && typeof options.docker.streamLogs === "function") {
+      const [streamedRecords, waitResult] = await Promise.all([
+        streamKimiWorkerRecords(options.docker, containerId, operation, publishRecord),
+        waitForKimiWorker(options.docker, containerId, operation)
+      ])
+      records = streamedRecords
+      wait = /** @type {{StatusCode?: unknown}} */ (waitResult)
+      rawChunks = []
+    } else {
+      wait = /** @type {{StatusCode?: unknown}} */ (await options.docker.waitContainer(containerId, operation.options()))
+      const logs = /** @type {Buffer} */ (await options.docker.logs(containerId, operation.options()))
+      const chunks = demultiplexDockerLogChunks(logs)
+      records = parseWorkerRecords(
+        Buffer.concat(chunks.filter((chunk) => chunk.channel === "stdout").map((chunk) => chunk.data)).toString("utf8"),
+        provider
+      )
+      rawChunks = provider === "kimi" ? [] : chunks.map((chunk) => ({channel: chunk.channel, data: chunk.data.toString("base64")}))
+      if (provider === "kimi") for (const record of records) await publishRecord?.(record)
+    }
     const result = {
       exitCode: typeof wait.StatusCode === "number" ? wait.StatusCode : 1,
-      records: parseWorkerRecords(
-        Buffer.concat(rawChunks.filter((chunk) => chunk.channel === "stdout").map((chunk) => chunk.data)).toString("utf8"),
-        provider
-      ),
-      rawChunks: provider === "kimi"
-        ? []
-        : rawChunks.map((chunk) => ({channel: chunk.channel, data: chunk.data.toString("base64")}))
+      records,
+      rawChunks
     }
     let sessionIds = [...new Set(result.records.filter((record) => record.type === "session").map((record) => record.sessionId))]
     if (provider === "kimi" && result.exitCode !== 0) {
       result.records = result.records.filter((record) => record.type !== "session")
       sessionIds = []
+      deferredSessions.length = 0
     }
     if (provider === "kimi" && result.exitCode === 0) {
       if (sessionIds.length !== 1) throw new Error("Kimi worker did not establish exactly one native session")
@@ -412,9 +611,34 @@ export async function runIsolatedWorker(options) {
       await options.stateRegistry.register(sessionIds, state, options.sessionTtlMs, operation.signal)
       keepFreshState = true
     }
+    // The run succeeded: publish any session envelopes deferred during streaming.
+    // Registration precedes delivery so a delivered identifier is always
+    // resumable; if delivery fails the client never received the identifier,
+    // so exactly the just-registered aliases are rolled back and the fresh
+    // state stays collectable by the finally-block volume cleanup instead of
+    // being retained until TTL.
+    if (result.exitCode === 0 && deferredSessions.length > 0) {
+      try {
+        for (const record of deferredSessions) await options.onRecord?.(record)
+      } catch (error) {
+        if (freshState && sessionIds.length > 0) {
+          await options.stateRegistry.unregister(sessionIds, state, operation.signal).catch((rollbackError) => {
+            process.stderr.write(`threadwire-runtime: session alias rollback failed: ${rollbackError instanceof Error ? rollbackError.message : "unknown"}\n`)
+          })
+          // The client never received a resumable identifier, so the fresh
+          // state must not be retained: let the finally-block remove it.
+          keepFreshState = false
+        }
+        throw error
+      }
+    }
     return result
+  } catch (error) {
+    process.stderr.write(`threadwire-runtime: isolated run failed at ${runStage}\n`)
+    throw error
   } finally {
     let resourcesRemoved = true
+    if (grantRenewalTimer !== undefined) clearInterval(grantRenewalTimer)
     // A caller/deadline abort cannot authorize more work, but exact force
     // teardown must remain possible. This supervisor-only emergency budget is
     // bounded and is used solely for already-recorded resource identifiers.
@@ -430,17 +654,29 @@ export async function runIsolatedWorker(options) {
         headers: {authorization: `Bearer ${options.brokerAdminToken}`}
       }), cleanupOperation.signal).catch(() => process.stderr.write("threadwire-isolated-runtime: grant cleanup failed\n"))
     }
+    if (validatorId !== undefined) await cleanupDocker(() => options.docker.removeContainer(validatorId, cleanupOptions())).catch(() => {
+      resourcesRemoved = false
+      process.stderr.write("threadwire-isolated-runtime: validator cleanup failed\n")
+    })
     if (containerId !== undefined) await cleanupDocker(() => options.docker.removeContainer(containerId, cleanupOptions())).catch(() => {
       resourcesRemoved = false
       process.stderr.write("threadwire-isolated-runtime: worker cleanup failed\n")
     })
+    if (relayId !== undefined) await cleanupDocker(() => options.docker.removeContainer(relayId, cleanupOptions())).catch(() => {
+      resourcesRemoved = false
+      process.stderr.write("threadwire-isolated-runtime: relay cleanup failed\n")
+    })
     if (networkId !== undefined) {
-      await cleanupDocker(() => options.docker.disconnectNetwork(networkId, options.brokerContainer, cleanupOptions())).catch(() => {})
+      if (provider !== "kimi") await cleanupDocker(() => options.docker.disconnectNetwork(networkId, options.brokerContainer, cleanupOptions())).catch(() => {})
       await cleanupDocker(() => options.docker.removeNetwork(networkId, cleanupOptions())).catch(() => {
         resourcesRemoved = false
         process.stderr.write("threadwire-isolated-runtime: network cleanup failed\n")
       })
     }
+    if (egressNetworkId !== undefined) await cleanupDocker(() => options.docker.removeNetwork(egressNetworkId, cleanupOptions())).catch(() => {
+      resourcesRemoved = false
+      process.stderr.write("threadwire-isolated-runtime: egress network cleanup failed\n")
+    })
     if (freshState && !keepFreshState) await cleanupDocker(() => options.docker.removeVolume(state.volume, cleanupOptions())).catch(() => { resourcesRemoved = false })
     if (runTracked && resourcesRemoved) await options.stateRegistry.completeRun(runId, cleanupOperation.signal).catch(() => {})
     emergencyCleanup?.close()
@@ -475,6 +711,95 @@ export function validateWorkerMountInventory(container, expected) {
   }
 }
 
+async function waitForKimiWorker(docker, containerId, operation) {
+  try {
+    return await docker.waitContainer(containerId, operation.options())
+  } catch (error) {
+    const name = typeof error?.name === "string" && /^[A-Za-z][A-Za-z0-9]*$/u.test(error.name) ? error.name : "unknown"
+    const code = typeof error?.code === "string" && /^[A-Z0-9_]+$/u.test(error.code) ? error.code : "none"
+    const status = Number.isSafeInteger(error?.statusCode) ? error.statusCode : "none"
+    process.stderr.write(`threadwire-runtime: Kimi wait failure name=${name} code=${code} status=${status}\n`)
+    throw error
+  }
+}
+
+async function streamKimiWorkerRecords(docker, containerId, operation, onRecord) {
+  let dockerBuffer = Buffer.alloc(0)
+  let stdoutBuffer = Buffer.alloc(0)
+  let bytes = 0
+  let failure
+  /** @type {unknown[]} */
+  const records = []
+  let callbacks = Promise.resolve()
+  const fail = (error) => {
+    if (failure !== undefined) return
+    failure = error instanceof Error ? error : new Error("Kimi worker stream failed")
+    operation.controller?.abort(failure)
+  }
+  const consumeLine = (line) => {
+    let parsed
+    try { parsed = JSON.parse(line.toString("utf8")) } catch { return }
+    if (!isRecord(parsed)) return
+    const record = validatedKimiWorkerEnvelope(parsed)
+    if (record === undefined) return
+    records.push(record)
+    callbacks = callbacks.then(() => onRecord?.(record)).catch(fail)
+  }
+  const consumeDockerChunk = (chunk) => {
+    if (failure !== undefined) return
+    try {
+      dockerBuffer = Buffer.concat([dockerBuffer, Buffer.from(chunk)])
+      while (dockerBuffer.length >= 8) {
+        const stream = dockerBuffer[0]
+        const length = dockerBuffer.readUInt32BE(4)
+        if (stream !== 1 && stream !== 2) throw new Error("Worker emitted invalid Docker logs")
+        if (length > MAX_RAW_OUTPUT_BYTES) throw new Error("Worker output exceeded capacity")
+        if (dockerBuffer.length < 8 + length) break
+        const data = dockerBuffer.subarray(8, 8 + length)
+        dockerBuffer = dockerBuffer.subarray(8 + length)
+        bytes += data.length
+        if (bytes > MAX_RAW_OUTPUT_BYTES) throw new Error("Worker output exceeded capacity")
+        if (stream === 2) {
+          const text = data.toString("utf8")
+          if (/^threadwire-kimi-worker: provider (?:record )?failure (?:authentication|network|model|configuration|context|rate-limit|tool|unknown)\n$/u.test(text)
+            || /^threadwire-kimi-worker: ignored record (?:non-object|role=[a-z0-9._-]+ type=[a-z0-9._-]+ keys=(?:unsafe|[a-z0-9_,]+))\n$/u.test(text)
+            || /^threadwire-kimi-worker: internal failure stream\n$/u.test(text)
+            || /^threadwire-kimi-worker: provider signal (?:SIGKILL|SIGTERM|SIGABRT)\n$/u.test(text)) process.stderr.write(data)
+          continue
+        }
+        stdoutBuffer = Buffer.concat([stdoutBuffer, data])
+        while (true) {
+          const newline = stdoutBuffer.indexOf(0x0a)
+          if (newline < 0) break
+          consumeLine(stdoutBuffer.subarray(0, newline))
+          stdoutBuffer = stdoutBuffer.subarray(newline + 1)
+        }
+      }
+    } catch (error) { fail(error) }
+  }
+  try {
+    await docker.streamLogs(containerId, consumeDockerChunk, operation.options())
+  } catch (error) {
+    fail(error)
+  }
+  if (dockerBuffer.length !== 0) fail(new Error("Worker emitted invalid Docker logs"))
+  if (stdoutBuffer.length !== 0) consumeLine(stdoutBuffer)
+  await callbacks
+  if (failure !== undefined) {
+    process.stderr.write(`threadwire-runtime: Kimi stream failure ${classifyKimiStreamFailure(failure)}\n`)
+    throw failure
+  }
+  return records
+}
+
+function classifyKimiStreamFailure(error) {
+  if (error.message === "Worker emitted invalid Docker logs") return "framing"
+  if (error.message === "Worker output exceeded capacity") return "capacity"
+  if (error.message === "Model broker grant renewal failed") return "grant-renewal"
+  if (/socket|closed|EPIPE|aborted/u.test(error.message)) return "client-disconnect"
+  return "unknown"
+}
+
 function parseWorkerRecords(text, provider = "codex") {
   const records = []
   let kimiSessionId
@@ -519,11 +844,12 @@ function validatedKimiWorkerEnvelope(record) {
     && typeof event.text === "string" && event.text.length <= 1_048_576 && event.streamId === "kimi:assistant") {
     return {type: "worker-event", event: {type: "text-delta", text: event.text, streamId: "kimi:assistant"}}
   }
-  if (exactKeys(event, ["type", "phase", "name", "key"]) && event.type === "tool"
+  if ((exactKeys(event, ["type", "phase", "name", "key"]) || exactKeys(event, ["type", "phase", "name", "key", "detail"])) && event.type === "tool"
     && (event.phase === "started" || event.phase === "finished")
     && typeof event.name === "string" && /^[A-Za-z_][A-Za-z0-9_.:-]{0,127}$/u.test(event.name)
-    && typeof event.key === "string" && /^tool:[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u.test(event.key)) {
-    return {type: "worker-event", event: {type: "tool", phase: event.phase, name: event.name, key: event.key}}
+    && typeof event.key === "string" && /^tool:[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u.test(event.key)
+    && (event.detail === undefined || (typeof event.detail === "string" && event.detail.length <= 512))) {
+    return {type: "worker-event", event: {type: "tool", phase: event.phase, name: event.name, key: event.key, ...(event.detail === undefined ? {} : {detail: event.detail})}}
   }
   if (exactKeys(event, ["type", "phase", "summary"]) && event.type === "lifecycle") {
     const summaries = {
@@ -563,21 +889,30 @@ export function demultiplexDockerLogChunks(buffer) {
 
 export function parsePreflight(value, expectedProvider = "codex") {
   if (!isRecord(value) || value.provider !== expectedProvider || (expectedProvider !== "codex" && expectedProvider !== "kimi")
-    || typeof value.profile !== "string" || typeof value.repositoryRoot !== "string" || typeof value.cwd !== "string"
-    || !Array.isArray(value.providerArguments) || !value.providerArguments.every((item) => typeof item === "string")) {
-    throw new ClientError("Invalid isolated runtime preflight")
-  }
-  if (!bounded(value.profile, 128) || !bounded(value.repositoryRoot, 4096) || !bounded(value.cwd, 4096)
-    || value.providerArguments.length > 16 || value.providerArguments.some((item) => !bounded(item, 512))
-    || (value.resumeSession !== undefined && !bounded(value.resumeSession, 512))) {
-    throw new ClientError("Invalid isolated runtime preflight")
-  }
+    || typeof value.profile !== "string" || !Array.isArray(value.providerArguments)
+    || !value.providerArguments.every((item) => typeof item === "string")) throw new ClientError("Invalid isolated runtime preflight")
+  if (!bounded(value.profile, 128) || value.providerArguments.length > 16 || value.providerArguments.some((item) => !bounded(item, 512))
+    || (value.resumeSession !== undefined && !bounded(value.resumeSession, 512))) throw new ClientError("Invalid isolated runtime preflight")
   if (value.resumeSession !== undefined && (typeof value.resumeSession !== "string" || /[\r\n]/u.test(value.resumeSession))) throw new ClientError("Invalid isolated runtime preflight")
+  if (expectedProvider === "kimi") {
+    // The Kimi request schema is closed: repositoryRoot/cwd are derived from
+    // the binding, so any extraneous top-level field is rejected rather than
+    // silently ignored.
+    const allowedKeys = ["provider", "profile", "binding", "providerArguments", ...(value.resumeSession === undefined ? [] : ["resumeSession"])]
+    if (!exactKeys(value, allowedKeys)) throw new ClientError("Invalid isolated runtime preflight")
+    let binding
+    try { binding = parseThreadwireBinding(value.binding) } catch { throw new ClientError("Invalid isolated runtime preflight") }
+    return {
+      provider: "kimi", profile: value.profile, binding,
+      repositoryRoot: binding.source.target, cwd: binding.runtime.workdir,
+      providerArguments: value.providerArguments,
+      ...(value.resumeSession === undefined ? {} : {resumeSession: value.resumeSession})
+    }
+  }
+  if (typeof value.repositoryRoot !== "string" || typeof value.cwd !== "string"
+    || !bounded(value.repositoryRoot, 4096) || !bounded(value.cwd, 4096)) throw new ClientError("Invalid isolated runtime preflight")
   return {
-    provider: expectedProvider,
-    profile: value.profile,
-    repositoryRoot: value.repositoryRoot,
-    cwd: value.cwd,
+    provider: "codex", profile: value.profile, repositoryRoot: value.repositoryRoot, cwd: value.cwd,
     providerArguments: value.providerArguments,
     ...(value.resumeSession === undefined ? {} : {resumeSession: value.resumeSession})
   }
@@ -587,7 +922,7 @@ export function parseRun(value) {
   if (!isRecord(value) || typeof value.preflightId !== "string" || typeof value.prompt !== "string" || value.prompt.trim().length === 0 || !Array.isArray(value.providerArguments) || !value.providerArguments.every((item) => typeof item === "string")) {
     throw new ClientError("Invalid isolated runtime run")
   }
-  if (!bounded(value.preflightId, 64) || !bounded(value.prompt, 524_288)
+  if (!bounded(value.preflightId, 64) || !boundedPrompt(value.prompt, 524_288)
     || value.providerArguments.length > 16 || value.providerArguments.some((item) => !bounded(item, 512))
     || (value.resumeSession !== undefined && !bounded(value.resumeSession, 512))) {
     throw new ClientError("Invalid isolated runtime run")
@@ -628,9 +963,37 @@ function isolatedProvider(value) {
 function providerName(provider) { return provider === "kimi" ? "Kimi" : "Codex" }
 
 function requestedDeadline(value, maximumMs) {
-  const parsed = Number(value)
-  const maximum = Date.now() + maximumMs
-  return Number.isSafeInteger(parsed) && parsed > Date.now() ? Math.min(parsed, maximum) : maximum
+  const parsed = typeof value === "string" && value.length > 0 ? Number(value) : undefined
+  const requested = Number.isSafeInteger(parsed) && parsed > Date.now() ? parsed : undefined
+  const maximum = maximumMs === undefined ? undefined : Date.now() + maximumMs
+  return minimumDeadline(requested, maximum)
+}
+
+function minimumDeadline(first, second) {
+  if (first === undefined) return second
+  if (second === undefined) return first
+  return Math.min(first, second)
+}
+
+function grantLease(value) {
+  const lease = value ?? GRANT_LEASE_MS
+  if (!Number.isSafeInteger(lease) || lease < 1 || lease > GRANT_LEASE_MAX_MS) throw new Error("Invalid broker grant lease")
+  return lease
+}
+
+/**
+ * Fail-closed startup read of the broker grant lease. The default is 60
+ * seconds and the maximum is one hour; an invalid, zero, or excessive value
+ * fails startup rather than being silently coerced.
+ * @param {string | undefined} value
+ */
+function grantLeaseSetting(value) {
+  if (value === undefined) return GRANT_LEASE_MS
+  const number = Number(value)
+  if (!/^\d+$/u.test(value) || !Number.isSafeInteger(number) || number < 1 || number > GRANT_LEASE_MAX_MS) {
+    throw new Error("THREADWIRE_GRANT_LEASE_MS must be a positive millisecond integer no greater than one hour")
+  }
+  return number
 }
 
 function parseAllowedRoots(value) {
@@ -663,7 +1026,15 @@ function ancestry(root, child) {
   return paths
 }
 
-function taskIdentity(preflight) {
+export function taskIdentity(preflight) {
+  // Kimi scopes resume/task identity to the exact binding so distinct task
+  // bindings sharing a profile root never collapse together. The binding
+  // identity intentionally excludes the mutable source revision and the
+  // recreatable lease container, so an intended same-task resume stays valid
+  // across checkout and lease rotation. Codex identity is unchanged.
+  if ((preflight.provider ?? "codex") === "kimi") {
+    return `kimi\0${preflight.profile}\0${resumeTaskIdentity(preflight.binding)}`
+  }
   return `${preflight.provider ?? "codex"}\0${preflight.profile}\0${preflight.repositoryRoot}`
 }
 
@@ -726,6 +1097,11 @@ function portValue(value, fallback) {
   return number
 }
 
+function optionalDuration(value) {
+  if (value === undefined || (typeof value === "string" && value.trim().length === 0)) return undefined
+  return positiveDuration(value)
+}
+
 function positiveDuration(value, fallback) {
   if (value === undefined) return fallback
   const number = Number(value)
@@ -793,6 +1169,10 @@ function bounded(value, maximum) {
   return typeof value === "string" && value.length > 0 && value.length <= maximum && !/[\0\r\n]/u.test(value)
 }
 
+function boundedPrompt(value, maximum) {
+  return typeof value === "string" && value.length > 0 && value.length <= maximum && !value.includes("\0")
+}
+
 export class PreflightStore {
   constructor({now = Date.now, ttlMs = PREFLIGHT_TTL_MS, capacity = PREFLIGHT_CAPACITY, taskCapacity = PREFLIGHT_TASK_CAPACITY} = {}) {
     this.now = now
@@ -907,7 +1287,7 @@ export async function reconcileDockerResources(docker, brokerContainer, stateReg
     const persisted = ownedIdentities.get(labels.run)
     if (!persisted || !stateRegistry.ownsRunSeal(persisted, labels.seal, labels.legacy)) continue
     const inspection = await docker.inspectContainer(container.Id, requestOptions).catch(() => undefined)
-    const identity = ownedContainerIdentity(inspection, labels)
+    const identity = ownedContainerIdentity(inspection, labels, persisted)
     if (!identity || !stateRegistry.ownsRun(identity, labels.seal, labels.legacy)) {
       cleanupFailed.add(labels.run)
       continue
@@ -963,12 +1343,17 @@ function validResourceLabels(value, namespace, container, expectedProvider = "co
   if (!isRecord(value)) return undefined
   const provider = value["org.threadwire.provider"] ?? "codex"
   const legacy = value["org.threadwire.provider"] === undefined
+  // Kimi containers carry an exact role label instead of the Codex network
+  // label; Kimi networks carry neither. Codex topology is unchanged.
+  const kimi = provider === "kimi"
+  const role = value["org.threadwire.role"]
   const expectedKeys = [
     "org.threadwire.owner", "org.threadwire.namespace", "org.threadwire.run",
     "org.threadwire.lineage", "org.threadwire.task", "org.threadwire.state-volume",
     "org.threadwire.run-seal",
     ...(legacy ? [] : ["org.threadwire.provider"]),
-    ...(container ? ["org.threadwire.network"] : [])
+    ...(container && !kimi ? ["org.threadwire.network"] : []),
+    ...(container && kimi ? ["org.threadwire.role"] : [])
   ]
   if (provider !== expectedProvider || (legacy && provider !== "codex")
     || Object.keys(value).length !== expectedKeys.length || expectedKeys.some((key) => typeof value[key] !== "string")) return undefined
@@ -981,11 +1366,13 @@ function validResourceLabels(value, namespace, container, expectedProvider = "co
     || !/^[0-9a-f]{64}$/u.test(value["org.threadwire.task"])
     || !/^[0-9a-f]{64}$/u.test(seal)
     || volume !== `threadwire-state-${namespace}-${lineage}`
-    || (container && value["org.threadwire.network"] !== `${run}-net`)) return undefined
-  return {provider, legacy, run, lineage, volume, seal, task: value["org.threadwire.task"], namespace}
+    || (container && !kimi && value["org.threadwire.network"] !== `${run}-net`)
+    || (container && kimi && !["validator", "relay", "worker"].includes(role))) return undefined
+  return {provider, legacy, run, lineage, volume, seal, task: value["org.threadwire.task"], namespace, ...(kimi && container ? {role} : {})}
 }
 
-function ownedContainerIdentity(container, labels) {
+function ownedContainerIdentity(container, labels, persisted) {
+  if (labels.provider === "kimi") return ownedKimiContainerIdentity(container, labels, persisted)
   if (!isRecord(container) || container.Name !== `/${labels.run}-worker`
     || !isRecord(container.Config) || !isRecord(container.HostConfig)
     || container.Config.Image !== container.Image || !isDigestImage(container.Config.Image)
@@ -1007,6 +1394,190 @@ function ownedContainerIdentity(container, labels) {
   return runIdentityFrom(labels, container.Config.Image, worktree)
 }
 
+/**
+ * Exact, fail-closed Kimi container identity. The persisted sealed run
+ * identity is the single authority for the expected validator, relay, and
+ * worker specs; any topology, security, mount, environment, image, or role
+ * drift is rejected by returning undefined so the resource is retained as a
+ * cleanup failure rather than adopted.
+ */
+function ownedKimiContainerIdentity(container, labels, persisted) {
+  if (!isRecord(container) || !isRecord(container.Config) || !isRecord(container.HostConfig) || !isRecord(persisted)) return undefined
+  const inspectedLabels = validResourceLabels(container.Config.Labels, labels.namespace, true, labels.provider)
+  if (!inspectedLabels || JSON.stringify(inspectedLabels) !== JSON.stringify(labels)) return undefined
+  const role = labels.role
+  if (role === "validator") return ownedKimiValidatorIdentity(container, persisted) ? persisted : undefined
+  if (role === "relay") return ownedKimiRelayIdentity(container, persisted) ? persisted : undefined
+  if (role === "worker") return ownedKimiWorkerIdentity(container, persisted) ? persisted : undefined
+  return undefined
+}
+
+/** @param {Record<string, unknown>} mount */
+function exactKimiMount(mount, source, target, readOnly) {
+  return isRecord(mount) && mount.Type === "volume" && mount.Source === source && mount.Target === target
+    && Boolean(mount.ReadOnly) === readOnly
+    && Object.keys(mount).every((key) => ["Type", "Source", "Target", "ReadOnly"].includes(key))
+}
+
+function ownedKimiValidatorIdentity(container, persisted) {
+  const config = container.Config
+  const host = container.HostConfig
+  const uid = persisted.runtimeUid
+  const gid = persisted.runtimeGid
+  return container.Name === `/${persisted.validator}`
+    && config.Image === persisted.image && isDigestImage(config.Image)
+    && JSON.stringify(config.Entrypoint) === JSON.stringify(["node", "/opt/threadwire/docker/kimi-binding-validator.mjs"])
+    && config.User === `${uid}:${gid}` && config.WorkingDir === persisted.workdir
+    && config.NetworkDisabled === true
+    && validKimiValidatorEnv(config.Env, persisted)
+    && host.NetworkMode === "none"
+    && validKimiSecurityPosture(host)
+    && Array.isArray(host.Mounts) && host.Mounts.length === 2
+    && exactKimiMount(host.Mounts[0], persisted.sourceVolume, persisted.sourceTarget, true)
+    && exactKimiMount(host.Mounts[1], persisted.contextVolume, persisted.contextTarget, true)
+}
+
+function ownedKimiRelayIdentity(container, persisted) {
+  const config = container.Config
+  const host = container.HostConfig
+  return container.Name === `/${persisted.relay}`
+    && config.Image === persisted.relayImage && isDigestImage(config.Image)
+    && JSON.stringify(config.Entrypoint) === JSON.stringify(["node", "/opt/threadwire/docker/kimi-model-relay-entrypoint.mjs"])
+    && config.User === "10003:10003"
+    && validKimiRelayEnv(config.Env, persisted)
+    && host.NetworkMode === persisted.egressNetwork
+    && validKimiSecurityPosture(host)
+    && Array.isArray(host.Mounts) && host.Mounts.length === 0
+}
+
+/**
+ * The relay environment is credential-free. As with the validator, Docker
+ * merges the two relay-owned keys with legitimate non-sensitive keys inherited
+ * from the image (PATH, NODE_VERSION, YARN_VERSION, and any future base-image
+ * additions), so the inspected set is the two relay-owned keys plus those
+ * inherited keys. Config.Env must be an array: missing is never accepted. Each
+ * relay-owned key must be present exactly once with the exact sealed value;
+ * any duplicate, tampered value, or unknown relay-controlled or sensitive key
+ * (any other THREADWIRE_*, CODEX, OPENAI, TELEGRAM, or KIMI_*) is rejected.
+ * @param {unknown} value @param {Record<string, unknown>} persisted
+ */
+function validKimiRelayEnv(value, persisted) {
+  if (!Array.isArray(value)) return false
+  const expected = new Map([
+    ["THREADWIRE_KIMI_RELAY_UPSTREAM_URL", persisted.endpoint],
+    ["THREADWIRE_KIMI_RELAY_LISTEN_PORT", "8788"]
+  ])
+  const seen = new Set()
+  for (const entry of value) {
+    if (typeof entry !== "string") return false
+    const separator = entry.indexOf("=")
+    const name = separator === -1 ? entry : entry.slice(0, separator)
+    const sealed = expected.get(name)
+    if (sealed !== undefined) {
+      if (seen.has(name) || entry.slice(separator + 1) !== sealed) return false
+      seen.add(name)
+      continue
+    }
+    if (name.startsWith("THREADWIRE_") || name.startsWith("CODEX") || name.startsWith("OPENAI")
+      || name.startsWith("TELEGRAM") || name.startsWith("KIMI_")) return false
+  }
+  return seen.size === expected.size
+}
+
+function ownedKimiWorkerIdentity(container, persisted) {
+  const config = container.Config
+  const host = container.HostConfig
+  const uid = persisted.runtimeUid
+  const gid = persisted.runtimeGid
+  return container.Name === `/${persisted.worker}`
+    && config.Image === persisted.image && isDigestImage(config.Image)
+    && JSON.stringify(config.Entrypoint) === JSON.stringify(["node", "/opt/threadwire/docker/kimi-worker-entrypoint.mjs"])
+    && config.User === `${uid}:${gid}` && config.WorkingDir === persisted.workdir
+    && config.NetworkDisabled === false
+    && host.NetworkMode === persisted.network
+    && validKimiWorkerEnv(config.Env)
+    && validKimiSecurityPosture(host)
+    && Array.isArray(host.Mounts) && host.Mounts.length === 3
+    && exactKimiMount(host.Mounts[0], persisted.sourceVolume, persisted.sourceTarget, persisted.sourceReadOnly === "true")
+    && exactKimiMount(host.Mounts[1], persisted.contextVolume, persisted.contextTarget, true)
+    && exactKimiMount(host.Mounts[2], persisted.volume, "/state", false)
+}
+
+/**
+ * The validator environment is credential-free. Docker merges the container's
+ * request environment with arbitrary legitimate non-sensitive keys inherited
+ * from the image (PATH, HOME, KIMI_CODE_HOME, TMPDIR, locale, and any future
+ * base-image additions), so the inspected set is the five validator-owned
+ * THREADWIRE_* keys plus those inherited keys. Config.Env must be an array:
+ * missing is never accepted. Each validator-owned key must be present exactly
+ * once with the exact value sealed in the persisted run identity; any unknown
+ * validator-controlled or sensitive key (any other THREADWIRE_*, CODEX,
+ * OPENAI, TELEGRAM, or KIMI_* except the known inherited KIMI_CODE_HOME),
+ * a duplicate, or a tampered value is rejected.
+ * @param {unknown} value @param {Record<string, unknown>} persisted
+ */
+function validKimiValidatorEnv(value, persisted) {
+  if (!Array.isArray(value)) return false
+  const expected = new Map([
+    ["THREADWIRE_TASK_ID", persisted.taskId],
+    ["THREADWIRE_EXPECTED_REVISION", persisted.expectedRevision],
+    ["THREADWIRE_CONTEXT_MANIFEST_DIGEST", persisted.contextManifestDigest],
+    ["THREADWIRE_CONTEXT_CONTENT_DIGEST", persisted.contextContentDigest],
+    ["THREADWIRE_CONTEXT_IMAGE_ID", persisted.contextImageId]
+  ])
+  const seen = new Set()
+  for (const entry of value) {
+    if (typeof entry !== "string") return false
+    const separator = entry.indexOf("=")
+    const name = separator === -1 ? entry : entry.slice(0, separator)
+    const sealed = expected.get(name)
+    if (sealed !== undefined) {
+      if (seen.has(name) || typeof sealed !== "string" || entry.slice(separator + 1) !== sealed) return false
+      seen.add(name)
+      continue
+    }
+    // Unknown validator-controlled or sensitive keys are never inherited.
+    if (name.startsWith("THREADWIRE_") || name.startsWith("CODEX") || name.startsWith("OPENAI")
+      || name.startsWith("TELEGRAM") || (name.startsWith("KIMI_") && name !== "KIMI_CODE_HOME")) return false
+  }
+  return seen.size === expected.size
+}
+
+/** The Kimi worker environment carries a per-run grant token and prompt, so only the exact name set is sealed. */
+function validKimiWorkerEnv(value) {
+  if (!Array.isArray(value)) return false
+  const names = value.map((entry) => typeof entry === "string" && entry.split("=", 1)[0])
+  if (names.some((name) => name === false)) return false
+  const resumeCount = names.filter((name) => name === "THREADWIRE_RESUME_SESSION").length
+  if (resumeCount > 1) return false
+  const expected = [
+    "PATH", "NODE_VERSION", "YARN_VERSION", "HOME", "KIMI_CODE_HOME", "TMPDIR",
+    "THREADWIRE_PROMPT", "THREADWIRE_KIMI_MODEL", "THREADWIRE_KIMI_BROKER_URL", "THREADWIRE_KIMI_BROKER_TOKEN",
+    "THREADWIRE_SOURCE_TARGET", "THREADWIRE_CONTEXT_TARGET", "THREADWIRE_TASK_ID", "THREADWIRE_SOURCE_READ_ONLY",
+    "THREADWIRE_EXPECTED_REVISION", "THREADWIRE_CONTEXT_MANIFEST_DIGEST", "THREADWIRE_CONTEXT_CONTENT_DIGEST", "THREADWIRE_CONTEXT_IMAGE_ID"
+  ]
+  return names.length === expected.length + resumeCount
+    && expected.every((name) => names.filter((entry) => entry === name).length === 1)
+    && !names.some((name) => /^(?:CODEX|OPENAI|TELEGRAM|THREADWIRE_KIMI_(?:OAUTH|CONTROL))/u.test(name))
+}
+
+/**
+ * Shared fail-closed Kimi security posture. The read-only root, dropped
+ * capabilities, and no-new-privileges posture must be exact, and no privilege
+ * escalation, published ports, or host-namespace sharing may be introduced.
+ */
+function validKimiSecurityPosture(host) {
+  return host.ReadonlyRootfs === true && host.Privileged !== true
+    && JSON.stringify(host.CapDrop) === JSON.stringify(["ALL"])
+    && JSON.stringify(host.CapAdd ?? null) === "null"
+    && JSON.stringify(host.SecurityOpt) === JSON.stringify(["no-new-privileges"])
+    && host.PublishAllPorts !== true
+    && [undefined, "", "private"].includes(host.PidMode) && [undefined, "", "private"].includes(host.IpcMode)
+    && [undefined, ""].includes(host.UTSMode) && [undefined, ""].includes(host.UsernsMode)
+    && [undefined, "", "private"].includes(host.CgroupnsMode)
+    && (host.Binds === undefined || host.Binds === null || (Array.isArray(host.Binds) && host.Binds.length === 0))
+}
+
 function validWorkerSecurity(config, host, provider = "codex") {
   if (host.AutoRemove !== false || host.ReadonlyRootfs !== true
     || host.Privileged === true || JSON.stringify(host.CapDrop) !== JSON.stringify(["ALL"])
@@ -1056,6 +1627,7 @@ function validWorkerSecurity(config, host, provider = "codex") {
 }
 
 function ownedNetworkIdentity(network, labels, identity, brokerContainer) {
+  if (labels.provider === "kimi") return ownedKimiNetworkIdentity(network, labels, identity)
   if (!isRecord(network) || network.Name !== `${labels.run}-net` || network.Internal !== true
     || network.Driver !== "bridge" || network.Scope !== "local"
     || network.EnableIPv6 !== false || network.Attachable !== false || network.Ingress !== false
@@ -1069,6 +1641,28 @@ function ownedNetworkIdentity(network, labels, identity, brokerContainer) {
   return true
 }
 
+/**
+ * Exact Kimi task and egress networks. The internal task network and the
+ * non-internal egress network are both sealed by the persisted run identity;
+ * only the per-run relay may be attached, so any foreign endpoint, name, or
+ * topology drift fails closed.
+ */
+function ownedKimiNetworkIdentity(network, labels, identity) {
+  if (!isRecord(network) || !isRecord(network.Containers)) return undefined
+  const expected = network.Name === identity.network ? {internal: true}
+    : network.Name === identity.egressNetwork ? {internal: false}
+      : undefined
+  if (expected === undefined || network.Internal !== expected.internal
+    || network.Driver !== "bridge" || network.Scope !== "local"
+    || network.EnableIPv6 !== false || network.Attachable !== false || network.Ingress !== false
+    || network.ConfigOnly !== false || !isRecord(network.Options) || Object.keys(network.Options).length !== 0) return undefined
+  const inspectedLabels = validResourceLabels(network.Labels, labels.namespace, false, labels.provider)
+  if (!inspectedLabels || JSON.stringify(inspectedLabels) !== JSON.stringify(labels)) return undefined
+  const endpoints = Object.values(network.Containers)
+  if (endpoints.some((endpoint) => !isRecord(endpoint) || endpoint.Name !== identity.relay)) return undefined
+  return true
+}
+
 function validWorktreeMount(mount) {
   if (!isRecord(mount) || mount.Target !== "/worktree" || mount.ReadOnly === true) return false
   if (mount.Type === "bind") {
@@ -1092,7 +1686,22 @@ function runIdentityFrom(labels, image, worktree) {
   }
 }
 
-function expectedRunIdentity(options, run, network, state, worktreeSubpath) {
+function expectedRunIdentity(options, run, network, state, worktreeSubpath, relayImageId) {
+  if (options.preflight.provider === "kimi") {
+    const binding = parseThreadwireBinding(options.preflight.binding)
+    if (typeof options.relayImage !== "string" || !(options.relayWorkerUrl instanceof URL) || !isDigestImage(relayImageId)) throw new Error("Kimi run identity is unavailable")
+    return {
+      provider: "kimi", namespace: options.stateRegistry.namespace, run, lineage: state.lineage,
+      task: state.labels["org.threadwire.task"], volume: state.volume, network, egressNetwork: `${run}-egress`,
+      validator: `${run}-validator`, worker: `${run}-worker`, relay: `${run}-relay`, image: binding.context.imageId,
+      relayImage: relayImageId, endpoint: options.relayWorkerUrl.toString(), bindingDigest: threadwireBindingDigest(binding),
+      sourceVolume: binding.source.volume, sourceTarget: binding.source.target, sourceReadOnly: String(binding.source.readOnly),
+      contextVolume: binding.context.volume, contextTarget: binding.context.target,
+      contextManifestDigest: binding.context.digests.manifest, contextContentDigest: binding.context.digests.content,
+      contextImageId: binding.context.imageId, runtimeUid: String(binding.runtime.uid), runtimeGid: String(binding.runtime.gid),
+      workdir: binding.runtime.workdir, taskId: binding.taskId, expectedRevision: binding.source.revision
+    }
+  }
   const volumeMode = options.worktreeVolume !== undefined
   return {
     provider: options.preflight.provider ?? "codex",