threadwire 0.1.11 → 0.1.13

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## Unreleased
 
+## 0.1.13 - 2026-08-01
+
+- Remove the default one-hour full-run deadline from the isolated runtime: when `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) and `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) are unset or blank, a healthy running worker continues until natural completion, caller cancellation/disconnect, supervisor shutdown, or concrete failure. Setting either to a positive millisecond value enables the existing single absolute preflight+run deadline with unchanged validation and caps. Compose no longer inserts numeric timeout defaults. Preflight admission, per-operation Docker/network calls, state collection (30 seconds), and emergency cleanup stay independently bounded.
+- Add authenticated broker grant-lease renewal (Kimi and Codex): grants are issued as a bounded lease (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, capped at one hour) that the supervisor renews via `POST /admin/grants/{token}/renew` while the run is active. Cleanup still revokes explicitly; if the supervisor dies or loses contact, renewals stop and the broker expires and aborts the grant within one lease. Malformed renewals (unknown/expired token, invalid ttlMs, missing admin auth) fail closed without extending the grant, and no renewal route exists on worker endpoints.
+- Add Kimi-only Threadwire binding v1 named-volume admission: task-labelled source/context/lease validation, immutable context manifest validation, offline validator, dynamic task UID/GID workers with context RO/state RW mounts and an exact binding-declared source mount mode, and v5 authenticated binding state. Kimi path/worktree preflights and supervisor host workspace/socket mounts are no longer accepted.
+- Fail closed on Kimi context manifest task/image identity mismatch: the worker itself revalidates the mounted manifest against the binding task attestation before launch, so a mismatched manifest task identity can never produce a successful client run.
+- Support explicitly read-only Kimi review sources: binding v1 `source.readOnly: true` pins a read-only lease/worker source mount for Docker-enforced reviewers, while writable implementation sources keep the exact read-write mode.
+- Add a credential-free per-run cross-daemon relay: the central Kimi broker splits into an internal admin/control endpoint and a stable worker endpoint, and each run creates a tiny mount-free, credential-free relay on the separate task DinD that forwards only the fixed chat shape to the worker endpoint. The worker URL and published bind have no insecure default and must be explicitly task-DinD-reachable; the configured worker URL is the stable worker origin, which the relay normalizes to the fixed `/v1/chat/completions` path (rejecting any other path fail-closed). Kimi-specific values are load-time optional so a genuine Codex-only relay-write profile renders and starts without them, while the Kimi runtime and client still fail closed at startup or job launch when they are absent. Outer-Compose DNS and outer-host loopback are never assumed, and admin/worker authority stay distinct.
+- Stream Kimi output incrementally over bounded framed NDJSON: the supervisor follows the worker's multiplexed Docker logs, validates each stdout envelope as it arrives, and relays `record` frames to the client before worker completion, followed by exactly one `terminal` exit-code frame. Session envelopes are buffered and published only once the run succeeds, so a resume hint followed by a nonzero exit never exposes an unusable resume session. Byte caps, redaction/admission rules, exact session validation, cancellation/deadline behavior, and cleanup are preserved; stderr is never relayed.
+- Reconcile exact relay/worker/network/state/grant identity on restart: genuine resources are adopted and cleaned up by their exact sealed spec, while image, mount, network, or environment tampering fails closed and retains authenticated cleanup evidence. The sealed Kimi worker/validator/relay image is the resolved image content Id (the worker/validator pin the binding's `contextImageId`; the relay pins its inspected image Id), matching how Docker normalizes a created container's `Config.Image`, so a genuine crash survivor is recognized rather than retained as a cleanup failure. The validator and relay environments accept legitimate non-sensitive keys inherited from the image while every owned key must match its sealed value exactly once and any injected sensitive or controlled key fails closed.
+- Qualify genuine separate-daemon fresh/resume/denial/read-only/concurrency operation with zero residue: adversarial split-daemon E2E proves exact resume, read-only review mounts, binding/argument denial, concurrent task isolation, and complete relay/network/state cleanup on the task DinD.
+
+- Remove workspace profiles from normal provider execution. `--cwd` now passes
+  any caller-accessible directory directly to Codex, Claude, Kimi, and
+  OpenCode; no Git, source identity, task binding, or root-allowlist lookup is
+  performed. `--workspace-profile` is rejected—migrate invocations to
+  `--cwd <directory>`. Native Kimi is the default path, supports
+  `THREADWIRE_KIMI_BIN`, translates exact `--resume-session` values to Kimi's
+  native `--session` option, and passes compatible provider arguments while
+  Threadwire retains prompt and stream-output ownership. The optional isolated
+  Kimi path remains explicit and fail-closed without native fallback.
+- Preserve only the explicit caller-owned native Kimi configuration contract,
+  report exactly one completed or failed terminal lifecycle outcome, and reject
+  provider option terminators that could neutralize Threadwire-owned arguments.
+
 ## 0.1.10 - 2026-07-28
 
 - Accept official slash-qualified Kimi model aliases through workspace-free

package/README.md

@@ -1,6 +1,6 @@
 # Threadwire
 
-Threadwire is a Node.js CLI that launches a Codex, Claude, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
+Threadwire is a Node.js CLI that launches a Codex, Claude, Kimi, or OpenCode worker and streams a concise, human-readable activity feed to one explicitly selected Telegram destination: a direct message, normal chat, or forum topic. The default feed includes the assistant's response prose, lifecycle outcomes, and diagnostics. Provider tool-status messages are disabled by default.
 
 For the container-native webhook deployment, including its named-volume worktree,
 non-root Codex provider, Docker secrets, loopback TLS proxy, verification, and
@@ -8,10 +8,18 @@ rollback path, see [Container runtime](docs/container-runtime.md). The legacy
 host launcher below remains supported and is separate from that deployment.
 
 Relay-originated Codex writes are explicit and default off. `--relay-write`
-requires a reviewed `--workspace-profile` plus the root-owned isolated runtime
-and credential broker. The worker gets one writable task worktree, no upstream
+selects the optional root-owned isolated runtime and credential broker. The worker gets one writable task worktree, no upstream
 or Git credential, and no route except its run-scoped broker. Missing
 prerequisites fail before prompt or credential reads with no native fallback.
+The isolated runtime imposes no default full-run deadline: a healthy running
+worker is never stopped merely because time elapsed. An operator may set
+`THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) and
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) to a positive
+millisecond value to enable one absolute preflight+run deadline; empty or
+unset means unlimited. Broker grants use a bounded lease that the supervisor
+renews while the run is active and that expires within one lease if the
+supervisor dies; unrelated safety timeouts (preflight slice, per-operation
+Docker/network calls, state collection, emergency cleanup) are unchanged.
 See [Isolated provider runtime](docs/isolated-provider-runtime.md).
 
 ## Run with npx
@@ -62,11 +70,11 @@ Use the local launcher. Install or refresh it after updating Threadwire with `np
 
 The target always has the form `telegram:<chat-id>:<thread-id>` for topics, or `telegram:<chat-id>` for direct messages (DMs) and ordinary chats. The chat ID is always required and must be a nonzero signed integer. The thread ID is optional and valid only as the explicit topic suffix: when present it must be a positive safe integer, and a DM target simply omits it — a missing thread ID is never an error. `--provider` must be exactly one of `codex`, `claude`, `kimi`, or `opencode`. Malformed or missing provider, chat ID, or thread ID arguments are hard failures (exit code 2) reported through Threadwire's normal error path with fixed messages; they fail before the Telegram token is read, before any transport is created, and before any provider is launched, and the messages never echo the bot token or the untrusted argument value. `--process-number` accepts an explicit positive safe integer for automation; when omitted, Threadwire uses its launcher PID. Every Telegram message is labeled consistently, such as `[P42] …`, including chunked continuations.
 
-Pass `--workspace-profile <name>` only when invoking Threadwire inside the container-native runtime, for example with `node bin/threadwire.js run` as shown in [Container runtime](docs/container-runtime.md). A profile selects a reviewed entry from the checked-in [threadwire.workspace-profiles.json](threadwire.workspace-profiles.json). It supplies the absolute in-container repository root, the exact in-container working directory, and the allowlisted providers for that workspace. Threadwire validates the selected profile, rejects malformed or unknown names, verifies the configured workspace exists and is still a healthy Git worktree, and records the selected profile plus immutable revision/worktree identity in the local activity log before provider spawn. The checked-in `container-runtime` default targets `/workspace/threadwire` inside the container-native runtime and allowlists `codex` and isolated `kimi`.
+`--cwd` is the complete workspace contract for every provider. It may name any caller-accessible directory, including a non-Git directory. Threadwire passes it unchanged to the native provider and performs no profile, repository, source-identity, task-binding, or root-allowlist lookup. `--workspace-profile` has been removed and is rejected; migrate invocations by replacing it with `--cwd <directory>`.
 
-Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream options owned by Threadwire. Kimi is narrower: it always uses the dedicated isolated subscription runtime and accepts only one server-approved model alias through `--model <alias>` (or `-m <alias>`); Threadwire owns its prompt, output, session, permissions, configuration, tools, skills, plugins, MCP, and directories.
+Provider tool-start and tool-finish events do not produce Telegram messages by default. Pass the boolean `--tool-messages` flag to opt in, as shown above. When enabled, each tool is one concise, silent status line rather than a pair of noisy start/finish notices: when a tool starts, Threadwire sends `🛠 [P42] Tool: <safe command or tool description>` (for example `🛠 [P42] Tool: command — git status --short`), and when that same tool finishes, it edits the original message in place so it begins `✅` instead — no second completion message is sent, and Telegram edits raise no notification. The command/description shows a safe CLI-style preview with credential-bearing values (tokens, passwords, keys, authorization/cookie forms, credentials in URLs) redacted and control characters stripped; only normalized Codex command-completion output may also be appended to that same edited status as a Telegram-native expandable HTML blockquote with the visible label `Output →`; it is credential-redacted, HTML-escaped, and Unicode-safe bounded. Stderr, reasoning, and every other raw provider result remain excluded. Use `--max-output-length <positive-integer>` to truncate only that preview Unicode-safely; omit the option for unlimited tool detail. A prompt may instead come from `--prompt-file` or piped stdin, and every source rejects blank/whitespace content. Arguments following `--` pass to the selected provider, except output-stream and session options owned by Threadwire. Native Kimi uses the caller's compatible configuration. Threadwire maps its public `--resume-session <exact-id>` option to Kimi's native `--session <exact-id>` option and owns `--prompt` plus `--output-format stream-json`. The caller environment or image must provide the Kimi executable at `/usr/local/bin/kimi` or set `THREADWIRE_KIMI_BIN`; a missing executable fails normally.
 
-Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
+Threadwire directly spawns the structurally separate terminal adapters `/opt/data/libexec/threadwire/codex`, `/opt/data/libexec/threadwire/claude`, `/usr/local/bin/kimi`, or `/opt/data/libexec/threadwire/opencode-local-fleet` with an argv array and `shell: false`. These libexec adapters hold the real provider-CLI logic and are never on a worker's `PATH`, so relaying can never recurse back into the front-door shims. Each spawn also sets `THREADWIRE_ACTIVE=1` in the provider child environment. The executable can be overridden per provider with `THREADWIRE_CODEX_BIN`, `THREADWIRE_CLAUDE_BIN`, `THREADWIRE_KIMI_BIN`, or `THREADWIRE_OPENCODE_BIN` for staged cutover and rollback. It does not impose a worker timeout. `SIGINT` and `SIGTERM` are forwarded to the worker as explicit cancellation.
 
 ## Provider front-door shims
 
@@ -74,11 +82,11 @@ Threadwire directly spawns the structurally separate terminal adapters `/opt/dat
 
 The relay contract: the caller supplies `THREADWIRE_TARGET` (`telegram:<chat-id>` or `telegram:<chat-id>:<thread-id>`) and, optionally, `THREADWIRE_PROCESS_NUMBER`. The prompt arrives on a piped stdin; all native provider flags pass through after `--`. A positional prompt is never parsed. A missing `THREADWIRE_TARGET` fails closed (exit code 2) and a malformed one is rejected by the launcher's token-free preflight — the shim never invents a default destination and never silently downgrades a requested relay to a direct run. A shim relays only for a worker mode (`codex exec …`, `opencode-local-fleet run …`, or any non-interactive `claude …`); it drops the worker subcommand before relaying and Threadwire re-adds it around the prompt. Version and help queries, non-worker subcommands, interactive TTY sessions, and any invocation already inside a relayed run (`THREADWIRE_ACTIVE=1`, so nested provider workers stay local/native) run the real CLI directly through the libexec adapter.
 
-Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
+Pass `--resume-session <exact-provider-session-id>` to continue a stored Codex, Claude, Kimi, or OpenCode session. Threadwire preserves the provider's native resume ordering and streaming options and never uses implicit latest-session behavior.
 
 Pass `--transcript <path>` to capture the exact normalized, caller-facing JSONL protocol written to run stdout. The file is created privately (mode `0600`), must not already exist, and contains the same records in the same byte order as stdout. It never contains provider JSONL, reasoning, tool payloads, prompts, stderr, or credentials.
 
-`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—the selected workspace profile and immutable provenance, provider start (`provider`, child `pid`), and available native session ID. It is local-only and never enters Telegram or normalized stdout.
+`--activity-log <path>` is different: it retains its append contract and writes only minimal safe lifecycle facts—provider start (`provider`, child `pid`) and available native session ID. It is local-only and never enters Telegram or normalized stdout.
 
 Provider stdout is decoded as JSONL with a finite 1 MiB UTF-8 byte limit for each pending unterminated record. Exceeding it rejects the run, removes listeners and signal handlers, and terminates the provider without parsing or rendering the oversized content.
 

package/TELEGRAM-INGRESS.md

@@ -1,10 +1,10 @@
 # Telegram Ingress for Threadwire
 
 Standalone Threadwire webhook service that accepts Telegram Bot API updates.
-Codex, Claude, and OpenCode retain the existing worker behavior. Kimi always
-uses its dedicated isolated preflight/run authority with no native fallback;
-a missing Kimi runtime fails before provider or transport construction. Hermes
-is not involved.
+Codex, Claude, Kimi, and OpenCode use their native provider adapter by default.
+An operator may explicitly configure the Kimi isolated client; that selected
+path remains fail-closed and never falls back to native execution. Hermes is
+not involved.
 
 ## Important bot ownership
 
@@ -83,8 +83,10 @@ Optional:
 | `THREADWIRE_TELEGRAM_REQUEST_TIMEOUT_MS` | Deadline for each outbound Telegram request, including response parsing (default `30000`, positive safe integer no greater than `2147483647`) |
 | `THREADWIRE_UPDATE_ID_CAPACITY` | Max retained completed `update_id` entries (default `10000`) |
 | `THREADWIRE_UPDATE_ID_TTL_MS` | Retention TTL for completed `update_id` entries in ms (default `86400000`) |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Dedicated Kimi supervisor URL; Compose defaults to `http://kimi-isolated-runtime:8790` |
-| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Dedicated Kimi control token. When absent, `/code kimi` remains recognized but fails closed before launch. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_URL` | Optional dedicated Kimi supervisor URL, used only with an explicit control token. |
+| `THREADWIRE_KIMI_ISOLATED_RUNTIME_CONTROL_TOKEN` | Selects the optional dedicated Kimi isolation client. Without it, `/code kimi` runs natively. |
+| `THREADWIRE_KIMI_TASK_BINDING` | Optional trusted binding used only by the explicitly selected Kimi isolation client; native Kimi never reads it. |
+| `THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` | Optional absolute preflight+run deadline in ms for isolated (Codex relay-write and Kimi) runs. Empty/unset means no full-run deadline: a healthy running worker is never stopped merely because time elapsed. The supervisor-side equivalent is `THREADWIRE_WORKER_TIMEOUT_MS`. Broker grants always use a bounded lease renewed by the supervisor while the run is active, expiring within one lease if the supervisor dies; unrelated safety timeouts are unchanged. |
 
 ## Run
 

package/docs/container-runtime.md

@@ -84,16 +84,13 @@ docker compose exec -T threadwire sh -c 'test "$(id -u):$(id -g)" = 10001:10001
 
 Telegram commands derive their explicit destination from the authenticated
 update. A credentialed direct smoke test must also name a target explicitly and
-keeps both credentials mounted as secret files. The checked-in
-`container-runtime` workspace profile points to the bootstrapped
-`/workspace/threadwire` worktree inside the current runtime, so `threadwire run`
-selects that reviewed in-container workspace directly rather than deriving a
-path from ambient host state or Telegram input:
+keeps both credentials mounted as secret files. Direct execution supplies the
+caller-accessible working directory explicitly:
 
 ```sh
 node bin/threadwire.js run \
   --provider codex --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
+  --cwd /workspace/threadwire \
   --prompt 'Inspect the container worktree.'
 ```
 
@@ -114,27 +111,11 @@ permissions that deny the provider, or move it to a separate container or
 sandbox. The same-UID, same-container, capability-free design cannot truthfully
 provide that stronger boundary.
 
-With `--workspace-profile`, `threadwire run` emits one caller-facing
-`execution_environment` JSONL record before provider startup. It includes only
-the resolved profile name, in-container repository path, exact Git revision,
-and immutable worktree identity; it never includes Telegram or provider
-credentials.
-
-The same reviewed profile file also governs authenticated webhook launches. The
-default profile is selected server-side; Telegram message text never supplies a
-raw path, container identifier, executable path, Git URL, or environment
-assignment. Before every spawn, Threadwire verifies that the configured
-workspace still exists, is still a Git worktree at the configured root, and
-still has a stable revision/worktree identity. If the worktree is removed or
-unhealthy, spawn fails before the provider starts so Telegram can retry after
-remediation.
-
-Provision profile changes and revision updates entirely inside the container
-worktree. Edit `threadwire.workspace-profiles.json` in `/workspace/threadwire`,
-commit the reviewed change in that worktree, and let the existing bootstrap and
-rollback flow move the whole repository plus its `.threadwire-source-identity`
-forward or backward together. Do not introduce host-only paths, Docker CLI
-arguments, or Compose-generated container names into the profile file.
+`--workspace-profile` is removed and rejected. Threadwire does not inspect Git,
+source identity, task binding, or workspace allowlists for normal provider
+launches. Telegram ingress uses its own process working directory unless its
+operator supplies another caller-accessible directory through the embedding
+configuration; Telegram message text never supplies a path.
 
 ## Verification and leakage audit
 
@@ -203,12 +184,20 @@ Never export or archive mounted secret files with workspace/provider backups.
 
 ## Kimi subscription containers
 
-Kimi is intentionally excluded from the same-UID container-native provider
-launch described above. Never mount `threadwire-kimi-oauth`, its access/refresh
-tokens, or the auth home into the Threadwire runtime, supervisor, worker,
-workspace, or session-state volume. Kimi uses four immutable build targets:
-`kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and `isolated-runtime`.
-The first two share UID/GID 10003 and only the OAuth volume; the worker uses
+Kimi source is not a host worktree. The task controller creates one labelled source named volume (including its `.git` directory), one labelled immutable context named volume, and a running labelled lease container. The trusted Kimi supervisor reaches only the owning task-DinD API through `THREADWIRE_KIMI_TASK_DOCKER_HOST`; it has no workspace bind or outer Docker socket. It verifies the closed binding, exact labels/volume identities, lease image/user/workdir/mounts, references, Git revision, and manifest before issuing a broker grant. The worker has exactly the binding-declared source mount at `/workspace` (read-write for implementation sources, read-only for review sources), context RO at `/context`, and lineage state RW at `/state`. The worker entrypoint independently revalidates the mounted context manifest task/image identity and the exact source mount mode before Kimi starts; a mismatched manifest task identity or mount mode fails the run closed.
+
+The checked-in standard `runtime` image installs Codex only: it does not install
+Kimi or provide Kimi credentials. Native Kimi therefore requires a caller image
+or environment that provides `/usr/local/bin/kimi` (or sets
+`THREADWIRE_KIMI_BIN`); a missing executable fails normally. Never mount
+`threadwire-kimi-oauth`, its access/refresh tokens, or the auth home into the
+Threadwire runtime, supervisor, worker, workspace, or session-state volume.
+The optional isolated Kimi flow uses five immutable build targets:
+`kimi-auth`, `kimi-model-broker`, `kimi-model-relay`, `kimi-relay-worker`, and
+`isolated-runtime`.
+The first two share UID/GID 10003 and only the OAuth volume; the credential-free
+relay also uses UID/GID 10003 with no mounts and no credential environment; the
+worker uses
 UID/GID 10002 with only the selected worktree and provider-bound state; the
 root supervisor alone receives the Docker socket. The broker/auth service uses
 Node `22.19.0` and exactly `@moonshot-ai/kimi-code@0.29.2` with the checked npm
@@ -216,8 +205,39 @@ integrity and archive SHA-512 in the Dockerfile.
 
 Enable the checked-in override with `--profile kimi` only after the OAuth/model
 operator flow in [Isolated provider runtime](isolated-provider-runtime.md).
-The default workspace profile allowlists Kimi because isolation is mandatory;
-without the dedicated Kimi control token/client, both CLI and Telegram Kimi
-jobs fail closed rather than using the native child path. Keep broker egress
+The per-run relay is created on the separate task DinD, so the deployment has
+no default central worker route: set
+`THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL` to an explicit address the task DinD
+can reach (for example the outer host's task-DinD gateway) and
+`THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND` to an explicit bind reachable by that
+daemon. The URL is the stable worker origin; the relay normalizes a bare origin
+to the fixed `/v1/chat/completions` path and rejects any other path fail-closed.
+Outer-Compose DNS and outer-host loopback are unreachable from the task
+daemon. Both values are load-time optional so a Codex-only relay-write profile
+renders without them; the Kimi runtime then fails closed at startup when they
+are empty, so the Kimi profile never becomes functional without both explicit
+values. An unset bind renders the published worker port on a non-task-reachable
+loopback sentinel (`127.0.0.1`) so the file loads without publishing on every
+interface; the broker receives the raw setting and refuses to open either
+listener until an explicit nonempty bind is configured, so the sentinel is
+never an operational default.
+Only the worker port is published, on that bind — the admin endpoint stays on
+the internal control network.
+The optional Kimi supervisor is selected only by its dedicated control
+token/client. Without that explicit selection, CLI and Telegram Kimi jobs use
+the native child path and caller/provider configuration. Keep broker egress
 restricted to official Kimi Code subscription/auth endpoints and do not provide
 a Moonshot API key, custom base URL, Docker socket, or ingress secret.
+
+Neither the Kimi nor the Codex isolated runtime imposes a default full-run
+deadline: `THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) and
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) pass through empty
+when unset, and an empty/unset value means a healthy running worker is never
+stopped merely because time elapsed. Setting either to a positive millisecond
+value enables one absolute preflight+run deadline. Broker grants are bounded
+leases (default 60 seconds, `THREADWIRE_GRANT_LEASE_MS`, maximum one hour;
+invalid, zero, or excessive values fail startup) that the supervisor renews
+over the authenticated admin endpoint while the run is active; the grant
+expires within one lease if
+the supervisor dies. Unrelated safety timeouts (preflight slice, per-operation
+Docker/network calls, state collection, emergency cleanup) are unchanged.

package/docs/isolated-provider-runtime.md

@@ -1,7 +1,7 @@
 # Isolated provider runtime
 
 Relay-originated Codex writes are disabled unless the caller supplies both
-`--relay-write` and a reviewed `--workspace-profile`. The write path never
+`--relay-write` and an explicitly selected supervisor. The write path never
 falls back to the native provider launcher.
 When the Telegram service is configured with isolated-runtime authority, Codex
 webhook jobs use the same preflight/run boundary exclusively; an unavailable
@@ -30,7 +30,11 @@ container-local tmp/run, resource limits, and exactly one writable
 worktree mount. It has no host home, common Git directory, sibling worktree,
 host temp, shared provider state, secret, Docker/SSH socket, or external route. Its
 short-lived broker grant is revoked during cleanup.
-The grant owns one absolute deadline and every accepted socket. Expiry,
+The grant is issued as a bounded lease (default 60 seconds) that the
+supervisor renews over the authenticated admin endpoint while its run is
+active; cleanup still revokes it explicitly, and if the supervisor dies or
+loses contact the broker's own expiry timer fires within one lease. The grant
+owns every accepted socket. Expiry,
 explicit revoke, credential reload, or broker shutdown aborts an incomplete
 upload or upstream request, destroys accepted sockets, and closes the listener;
 authorization is checked again after the bounded request body is acquired.
@@ -69,15 +73,19 @@ expire without requiring a matching `/run`.
 Consumed capabilities enter a separate global/per-task active-run admission
 before validation can yield. The lineage reservation is acquired synchronously
 at that boundary, preventing periodic GC from deleting resume state during
-revalidation. Docker and broker operations have bounded deadlines, and each
-worker has a bounded operator-configured lifetime; timeout cleanup revokes the
+revalidation. Docker and broker operations have bounded deadlines. There is no
+default full-run deadline: a healthy running worker is never stopped merely
+because time elapsed. An operator may set `THREADWIRE_WORKER_TIMEOUT_MS` to a
+positive millisecond value to enable one absolute preflight+run deadline;
+timeout cleanup revokes the
 grant and removes the exactly labelled worker and network before capacity is
 released.
-The relay creates one absolute launch deadline before preflight. The same
-deadline and cancellation signal span prompt/stdin and file-secret reads,
+When the operator enables it, the relay creates one absolute launch deadline
+before preflight. That
+deadline and the cancellation signal span prompt/stdin and file-secret reads,
 evidence and Telegram setup, Docker setup, broker readiness, execution,
 response/log reads, upstream work and exact cleanup. A disconnected caller or
-supervisor shutdown aborts its run. Independent per-step timeouts cannot extend
+supervisor shutdown aborts its run regardless. Independent per-step timeouts cannot extend
 the overall budget, and response bodies are stream-limited to 2 MiB.
 
 Codex bypasses its nested sandbox only inside this mandatory outer container.
@@ -105,10 +113,20 @@ credential. The supervisor alone receives `/var/run/docker.sock`. Restrict
 broker egress at the host/firewall to provider endpoints.
 
 The supervisor defaults to 16 active runs globally, two per reviewed task, a
-30-second maximum preflight slice, and a one-hour end-to-end launch deadline. Operators may
-lower these finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
+30-second maximum preflight slice, and no full-run deadline: an unset or empty
+`THREADWIRE_WORKER_TIMEOUT_MS` (supervisor) or
+`THREADWIRE_ISOLATED_RUNTIME_CLIENT_TIMEOUT_MS` (client) means a run may
+continue until natural completion, caller cancellation/disconnect, supervisor
+shutdown, or concrete failure. Setting either to a positive millisecond value
+enables one absolute preflight+run deadline. Operators may
+lower the finite limits with `THREADWIRE_PREFLIGHT_TIMEOUT_MS`,
 `THREADWIRE_ACTIVE_RUN_CAPACITY`, `THREADWIRE_ACTIVE_TASK_CAPACITY`, and
 `THREADWIRE_WORKER_TIMEOUT_MS`; invalid, zero, or excessive values fail startup.
+Broker grants always use a bounded lease (default 60 seconds, tunable with
+`THREADWIRE_GRANT_LEASE_MS`, maximum one hour) that the supervisor renews while
+the run is active; the grant expires within one lease if the supervisor dies.
+An invalid, zero, or excessive `THREADWIRE_GRANT_LEASE_MS` value fails startup
+rather than being silently coerced.
 
 The authenticated registry persists through file fsync, atomic rename, and
 parent-directory fsync. Startup removes only strictly named abandoned temp
@@ -137,7 +155,19 @@ by that script. E2E uses host-volume canaries and fake-upstream authorization
 logs; worker self-report is not the sole assertion.
 
 
-## Native Kimi Code subscription boundary
+## Optional isolated Kimi Code subscription boundary
+
+Normal `threadwire run --provider kimi` is native execution: it directly runs
+the caller-provided Kimi executable at `/usr/local/bin/kimi`, or the path in
+`THREADWIRE_KIMI_BIN`. It does not select this isolated supervisor, broker, or
+model allowlist. The checked-in standard `runtime` image installs Codex only,
+so native Kimi needs a caller-supplied executable and fails normally when it is
+missing. The remaining section documents the separately configured, optional
+isolated Kimi supervisor.
+
+Kimi binding v1 is separate from the Codex worktree contract. A Kimi preflight contains `binding`, never `repositoryRoot` or `cwd`. The supervisor queries the task-DinD daemon for exactly one labelled source volume, context volume, and running lease, rejects ambiguity/RW context references, validates the lease and worker image, then uses an offline two-volume validator to check the real Git revision and complete immutable context manifest. Only after that does it create the per-run data plane on the task daemon: a private internal worker network, a task-owned non-internal egress network, one credential-free relay attached to both, and a three-volume Kimi worker attached only to the internal network. OAuth remains broker-only; workers receive a synthetic per-run grant and no raw binding, volume, lease, control, or OAuth value. Kimi v6 state seals include the binding digest, source/context identities, source mount mode, dynamic UID/GID/workdir, validator, worker, relay, relay image, both networks, the central endpoint identity, state, and image. Old path-based and pre-relay Kimi state is intentionally not adopted.
+
+The binding's `source.readOnly` selects the exact admitted mount mode: `false` is a writable implementation source, `true` an explicitly read-only review source for Docker-enforced reviewers. Admission and revalidation pin the lease and worker source mounts to that exact mode, one-writer isolation is unchanged, and the worker entrypoint independently asserts the mounted mode from `/proc/self/mountinfo` before launch. Both the validator and the worker compare the mounted context manifest's task and image identity against the binding attestation; a mismatch fails the run closed and can never produce a successful client run.
 
 Kimi uses the same proven supervisor mechanics but a distinct protocol and
 credential service. `THREADWIRE_ISOLATED_PROVIDER=kimi` makes the supervisor
@@ -147,14 +177,54 @@ provider-bound state in the separate Kimi namespace. Codex requests, sessions,
 workers, grants, and volumes cannot be adopted by this service, and the Codex
 broker remains unchanged.
 
+The central Kimi broker runs on an outer daemon, not the task daemon, so the
+supervisor never resolves a broker container by name. It splits the broker into
+an admin/control endpoint (grant lifecycle only) and a stable worker endpoint
+(grant-auth chat proxy). For each run it creates a tiny credential-free relay
+on the task daemon from the immutable `THREADWIRE_KIMI_MODEL_RELAY_IMAGE`
+digest. The relay knows only the configured central worker URL
+(`THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL`) and its own listen port, receives
+no grant, OAuth, admin token, binding, mount, or Docker socket, and is attached
+to both the internal worker network and a dedicated egress network. The worker
+reaches only the relay's internal address; the relay forwards the fixed
+`POST /v1/chat/completions` shape to the central worker endpoint, preserving
+the grant bearer. The configured worker URL is the stable worker origin: a bare
+origin (for example `http://<gateway>:8792`) or the already-exact accepted path
+is normalized to the fixed `/v1/chat/completions` path, and any other path is
+rejected fail-closed at relay startup rather than forwarded verbatim. There is
+no DNS or host-gateway fallback, no container-name resolution, and TLS
+verification is never disabled.
+
+Because the relay runs on the separate task daemon, the stable worker URL is
+not defaulted: `THREADWIRE_KIMI_MODEL_BROKER_WORKER_URL` must be set to an
+explicit address the task daemon can reach (for example the outer host's
+task-DinD gateway), and the broker's published worker bind
+(`THREADWIRE_KIMI_MODEL_BROKER_WORKER_BIND`) must likewise be chosen explicitly
+to be reachable by that daemon. Outer-Compose DNS and outer-host loopback are
+unreachable from the task daemon and are never assumed. These values are
+load-time optional so a Codex-only relay-write profile renders and starts
+without them; the Kimi runtime and client then fail closed at startup or job
+launch when they are empty, so a Kimi deployment that does not supply an
+explicit task-reachable URL and bind never becomes functional. When the bind
+is unset, Compose renders the published worker port on a non-task-reachable
+loopback sentinel (`127.0.0.1`) purely so the file loads — never on every
+interface — and passes the raw setting through to the broker, which requires a
+nonempty explicit bind before opening either listener. The sentinel is not an
+operational default: without the explicit bind the broker exits instead of
+serving. The
+admin/control endpoint is never published — only the worker
+port is, on the explicit bind — so admin and worker authority stay distinct.
+
 The Kimi broker is not a generic credential proxy. It accepts only
 `POST /v1/chat/completions`, validates a closed request schema and one approved
 wire model, substitutes OAuth immediately before the fixed official
 `https://api.kimi.com/coding/v1/chat/completions` request, and streams the
 bounded response. A grant is pending until the inspected worker is ready and is
 bound to provider, task hash, exact resume session (or fresh lineage), run,
-Docker network, approved alias, and wire model. Revocation, timeout, shutdown,
-or cleanup closes its private listener and active sockets.
+Docker network, approved alias, and wire model. The grant is a bounded lease
+renewed by the supervisor while the run is active. Revocation, lease expiry,
+shutdown,
+or cleanup rejects the grant and closes its active sockets.
 
 The immutable Kimi worker image pins `@moonshot-ai/kimi-code@0.29.2` and verifies
 the npm archive SHA-512 before installation. It receives no OAuth file, Docker
@@ -164,7 +234,8 @@ Its fixed entrypoint owns `--model`, optional exact `--session`, `--prompt`,
 `--output-format stream-json`, and an empty skills directory. Static deny rules,
 workspace/config ancestry checks, a sanitized private home, read-only root,
 and the existing mount/inode checks remain mandatory. There is no native unsafe
-fallback and no `THREADWIRE_KIMI_BIN` control.
+fallback within the explicitly selected isolated path. Normal Kimi execution
+uses the native adapter and may use `THREADWIRE_KIMI_BIN`.
 
 Only exact pinned stream records are normalized: assistant string content,
 validated tool name/key start and finish, and one exact
@@ -174,10 +245,26 @@ and OAuth material are discarded. The worker is the only reader of native Kimi
 stdout and Docker receives only sanitized envelopes and fixed lifecycle events;
 the supervisor returns `rawChunks: []` for every Kimi run.
 
+The supervisor does not wait for worker completion before relaying output. It
+follows the worker's multiplexed Docker logs, demultiplexes and validates each
+stdout envelope as it arrives, and streams it to the relay caller over a single
+framed NDJSON run response: `record` frames are written incrementally, then
+exactly one `terminal` frame carries the final exit code. The client parses the
+same NDJSON stream and forwards each validated event to `WorkerControl` as it
+arrives, so long runs relay assistant/tool/lifecycle output to Telegram
+incrementally. Session envelopes are the one exception: they are buffered and
+only published once the run's success is known, so a resume hint followed by a
+nonzero exit never exposes an unusable resume session. Stderr frames are
+dropped, the same byte caps and conflicting-session rejection apply as the
+buffered path, and a mid-stream
+failure or cancellation still revokes the grant and removes the exact worker,
+relay, and both networks before capacity is released.
+
 ### Operator OAuth and model approval
 
-Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-relay-worker`, and
-existing `isolated-runtime` targets as immutable digests. Set distinct random
+Build and publish the `kimi-auth`, `kimi-model-broker`, `kimi-model-relay`,
+`kimi-relay-worker`, and existing `isolated-runtime` targets as immutable
+digests. Set distinct random
 Kimi runtime and broker admin tokens of at least 32 characters, the Kimi image digests, and an allowlist
 such as:
 
@@ -185,7 +272,8 @@ such as:
 export THREADWIRE_ALLOWED_KIMI_MODELS='{"default":{"model":"kimi-for-coding","protocol":"kimi"},"kimi-code/kimi-for-coding":{"model":"kimi-for-coding","protocol":"kimi"}}'
 ```
 
-`default` is the server-owned selection for no-argument and Telegram jobs.
+`default` is the server-owned selection for isolated supervisor jobs without a
+model argument.
 `kimi-code/kimi-for-coding` is the exact official provider-qualified alias for
 explicit callers. Each key is an opaque allowlisted value, not a path, and
 Threadwire never normalizes or strips its prefix. The `model` field is the
@@ -194,8 +282,8 @@ alias.
 
 OAuth writes only the named `threadwire-kimi-oauth` volume at the official
 `credentials/kimi-code.json` location. Stop the broker during interactive auth
-so the CLI and broker cannot race a refresh, then run the opt-in, workspace-free
-auth service:
+so the auth CLI and broker cannot race a refresh, then run the opt-in,
+workspace-free auth service:
 
 ```sh
 docker compose -f compose.yaml -f compose.relay-write.yaml stop kimi-isolated-runtime kimi-model-broker
@@ -210,20 +298,12 @@ The auth service has no workspace, ingress network, Docker socket, Threadwire
 control token, or Telegram credential and uses Docker logging driver `none`.
 `verify <provider-qualified-alias>` discards native output and prints only a
 fixed success/failure; use it to confirm each exact official alias before
-adding that alias and its independently verified wire model to the server
-allowlist. An explicit CLI job selects the exact key as one argv value:
-
-```sh
-node bin/threadwire.js run \
-  --provider kimi \
-  --target telegram:-1001234567890:42 \
-  --workspace-profile container-runtime \
-  --prompt 'Inspect the project.' \
-  -- --model 'kimi-code/kimi-for-coding'
-```
+adding that alias and its independently verified wire model to the isolated
+supervisor allowlist. This operator configuration does not configure or select
+the native CLI Kimi model.
 
-API keys, Moonshot platform mode, custom base URLs, discovery by ordinary jobs,
-and arbitrary aliases are unsupported.
+For the isolated supervisor, API keys, Moonshot platform mode, custom base
+URLs, discovery by ordinary jobs, and arbitrary aliases are unsupported.
 
 For logout or account rotation, stop the Kimi runtime and broker, run
 `--profile kimi-auth run --rm kimi-auth logout` or `login`, verify approved
@@ -244,7 +324,8 @@ payload, or synthetic grant.
 
 Rollback by stopping `kimi-isolated-runtime` and `kimi-model-broker`, removing
 the `kimi` Compose profile/control variables, and reverting the Threadwire image.
-Kimi commands then fail closed; Codex behavior is unaffected. Preserve the OAuth
+Isolated Kimi requests then fail closed; native Kimi remains independent of
+that optional deployment. Codex behavior is unaffected. Preserve the OAuth
 and Kimi state volumes for a recoverable rollback. Remove them only as an
 explicit credential/session teardown after OAuth revocation; never archive them
 with workspace backups.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",
@@ -20,8 +20,7 @@
     "docs/",
     "scripts/",
     "src/",
-    "TELEGRAM-INGRESS.md",
-    "threadwire.workspace-profiles.json"
+    "TELEGRAM-INGRESS.md"
   ],
   "bin": {
     "threadwire-isolated-runtime": "bin/isolated-runtime.js",

package/scripts/provider-shims/front-door.sh.template

@@ -58,15 +58,11 @@ threadwire_relay_arguments=(run --provider "$THREADWIRE_PROVIDER" --target "$THR
 case "${THREADWIRE_RELAY_WRITE:-0}" in
   0) ;;
   1)
-    if [[ ! "${THREADWIRE_WORKSPACE_PROFILE:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
-      printf '%s\n' 'threadwire: relay write capability requires a valid THREADWIRE_WORKSPACE_PROFILE' >&2
-      exit 2
-    fi
     if [[ "$THREADWIRE_PROVIDER" != codex ]]; then
       printf '%s\n' 'threadwire: relay write capability is only supported for codex' >&2
       exit 2
     fi
-    threadwire_relay_arguments+=(--workspace-profile "$THREADWIRE_WORKSPACE_PROFILE" --relay-write)
+    threadwire_relay_arguments+=(--relay-write)
     ;;
   *)
     printf '%s\n' 'threadwire: relay write capability must be enabled with THREADWIRE_RELAY_WRITE=1' >&2

package/scripts/verify-package.js

@@ -77,10 +77,9 @@ const EXPECTED_FILES = [
   "src/telegram-ingress/http.js",
   "src/telegram-ingress/update-guard.js",
   "src/telegram-webhook.js",
+  "src/threadwire-binding.js",
   "src/types.js",
-  "src/worker-control.js",
-  "src/workspace-profile.js",
-  "threadwire.workspace-profiles.json"
+  "src/worker-control.js"
 ]
 
 /** @returns {Promise<void>} */

package/src/absolute-deadline.js

@@ -3,7 +3,7 @@
 
 export class AbsoluteDeadline {
   constructor(expiresAt, {signal, request, response, now = Date.now, timeoutMessage = "Operation timeout", disconnectMessage = "Caller disconnected"} = {}) {
-    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now()) throw new Error(timeoutMessage)
+    if (expiresAt !== undefined && (!Number.isSafeInteger(expiresAt) || expiresAt <= now())) throw new Error(timeoutMessage)
     this.expiresAt = expiresAt
     this.now = now
     this.controller = new AbortController()
@@ -26,13 +26,14 @@ export class AbsoluteDeadline {
     request?.once?.("aborted", this.abortRequest)
     response?.once?.("close", this.abortResponse)
     this.socket?.once?.("close", this.abortSocket)
-    this.timer = setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
-    this.timer.unref()
+    this.timer = expiresAt === undefined ? undefined : setTimeout(() => this.controller.abort(new Error(timeoutMessage)), Math.max(1, expiresAt - now()))
     this.signal.addEventListener("abort", () => request?.destroy?.(this.signal.reason), {once: true})
     if (request?.aborted || (response?.destroyed && !response.writableEnded)) this.abortRequest()
   }
   remaining() {
     this.throwIfAborted()
+    if (this.expiresAt === undefined) return undefined
+    if (this.expiresAt === undefined) return undefined
     const remaining = this.expiresAt - this.now()
     if (remaining <= 0) {
       this.controller.abort(new Error(this.timeoutMessage))
@@ -41,13 +42,14 @@ export class AbsoluteDeadline {
     return Math.max(1, remaining)
   }
   options() {
-    return {signal: this.signal, timeoutMs: this.remaining()}
+    const timeoutMs = this.remaining()
+    return timeoutMs === undefined ? {signal: this.signal} : {signal: this.signal, timeoutMs}
   }
   throwIfAborted() {
     if (this.signal.aborted) throw this.signal.reason instanceof Error ? this.signal.reason : new Error("Operation aborted")
   }
   close() {
-    clearTimeout(this.timer)
+    if (this.timer !== undefined) clearTimeout(this.timer)
     this.abortParent && this.parentSignal?.removeEventListener?.("abort", this.abortParent)
     this.request?.off?.("aborted", this.abortRequest)
     this.response?.off?.("close", this.abortResponse)
@@ -89,6 +91,7 @@ export async function readResponseCapped(response, capacity, signal) {
     }
     return Buffer.concat(chunks, size)
   } finally {
+    if (signal?.aborted) await reader.cancel(signal.reason).catch(() => {})
     reader.releaseLock()
   }
 }