trantor 0.17.56 → 0.17.58

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.56",
+      "version": "0.17.58",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.56",
+  "version": "0.17.58",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/balances.mjs

@@ -18,11 +18,8 @@ const noPush = args.includes("--no-push");
 // Only check providers the user configured in `trantor profile` — never stray keys in the ambient env.
 const configured = Object.keys(loadProfile().providers || {});
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST rejected under enforce.
+import { signedPost } from "../hooks/lib/api.mjs";
 let _qpct = DEFAULT_LOW_QUOTA_PCT;
 function thresholds() {
   try { const c = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")); if (typeof c.lowQuotaPct === "number") _qpct = c.lowQuotaPct; if (c.lowBalance && typeof c.lowBalance === "object") return { ...DEFAULT_LOW, ...c.lowBalance }; } catch {}
@@ -35,8 +32,7 @@ const low = thresholds();
 // push the snapshot to the hub (best-effort) so the dashboard + warning line can use it
 if (!noPush) {
   try {
-    await fetch(`${relayUrl()}/balances`, { method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ balances, ts: Date.now() }), signal: AbortSignal.timeout(2500) });
+    await signedPost("/balances", { balances, ts: Date.now() }, { timeoutMs: 2500 });
   } catch {}
 }
 

package/bin/catchup.mjs

@@ -10,19 +10,20 @@ import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): hand-rolled relayUrl missed the
+// per-project hubs map; unsigned reads 401 under enforce. signedGet resolves + signs per call.
+import { relayUrl, signedGet } from "../hooks/lib/api.mjs";
 const haveScrooge = () => { try { execSync("command -v scrooge", { stdio: "ignore" }); return true; } catch { return false; } };
 
 const dir = process.cwd();
 const project = resolveProject(dir);
-const url = relayUrl();
+const url = relayUrl(project);
 
 let cu = null;
-try { cu = await (await fetch(`${url}/catchup?project=${encodeURIComponent(project)}`, { signal: AbortSignal.timeout(4000) })).json(); } catch (e) { console.error(`could not reach hub at ${url}: ${e.message}`); }
+{
+  const r = await signedGet(`/catchup?project=${encodeURIComponent(project)}`, { timeoutMs: 4000 });
+  if (r.ok) cu = r.json; else console.error(`could not reach hub at ${url} (status ${r.status})`);
+}
 let gitlog = "";
 try { gitlog = execSync(`git -C ${JSON.stringify(dir)} log --oneline -12 2>/dev/null`, { encoding: "utf8" }).trim(); } catch {}
 

package/bin/crew-verify.mjs

@@ -24,12 +24,13 @@ const SINCE = si >= 0 ? Number(args.splice(si, 2)[1]) : NaN;
 const [PROJ, ...AGENTS] = args;
 if (!PROJ || !AGENTS.length) { console.error("usage: crew-verify.mjs <project> <agent...> [--timeout 30] [--since <ms>]"); process.exit(2); }
 
-function hubUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const u = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).url; if (u) return u; } catch {}
-  return "http://127.0.0.1:4477";
-}
-const HUB = hubUrl();
+// Signed + per-project hub (2026-07-31, agent-UX audit): unsigned /peers is a dead 401 under
+// enforce — crew verification would report every seat missing while the crew was fine.
+import { resolveHub, hostId } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+const HUB = process.env.RELAY_URL || resolveHub(PROJ);
+const VERIFY_ID = loadOrCreate(process.env.RELAY_SESSION || `${hostId()}:${PROJ}`, "agent");
 // Two distinct clocks, deliberately separate:
 //  - FRESH_SINCE: the freshness threshold. A registration counts only if lastSeen >= this.
 //    Prefer the launcher's pre-spawn epoch (so an early "booting" beat counts); else our start.
@@ -43,7 +44,7 @@ const FRESH_SINCE = Number.isFinite(SINCE) ? SINCE : Date.now();
   const up = new Set();
   while (Date.now() < DEADLINE && up.size < want.size) {
     try {
-      const { peers } = await (await fetch(`${HUB}/peers`)).json();
+      const { peers } = await (await sfetchJson(`${HUB}/peers`, { method: "GET", identity: VERIFY_ID })).json();
       for (const p of peers) if (want.has(p.session) && p.lastSeen >= FRESH_SINCE) up.add(p.session);
     } catch {}
     if (up.size < want.size) await new Promise(s => setTimeout(s, 1500));

package/bin/gates.mjs

@@ -11,21 +11,20 @@ const args = process.argv.slice(2);
 const all = args.includes("--all");
 const asJson = args.includes("--json");
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const u = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).url; if (u) return u; } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): the hand-rolled relayUrl here
+// missed the per-project hubs map AND sent unsigned (401 under enforce). relayUrl/signedGet from
+// hooks/lib/api.mjs resolve the cwd project's hub and sign as this session.
+import { relayUrl, signedGet } from "../hooks/lib/api.mjs";
 
 const project = resolveProject(process.cwd());
-const url = `${relayUrl()}/verify-gates?project=${encodeURIComponent(project)}${all ? "&all=1" : ""}`;
 let gates = [];
-try {
-  const r = await fetch(url, { signal: AbortSignal.timeout(2500) });
-  gates = (await r.json()).gates || [];
-} catch {
-  console.error(`could not reach the hub at ${relayUrl()} — is it running? (trantor setup / trantor hub)`);
-  process.exit(1);
+{
+  const r = await signedGet(`/verify-gates?project=${encodeURIComponent(project)}${all ? "&all=1" : ""}`, { timeoutMs: 2500 });
+  if (!r.ok) {
+    console.error(`could not reach the hub at ${relayUrl(project)} (status ${r.status}) — is it running? (trantor setup / trantor hub)`);
+    process.exit(1);
+  }
+  gates = r.json?.gates || [];
 }
 
 if (asJson) { process.stdout.write(JSON.stringify(gates, null, 2) + "\n"); process.exit(0); }

package/bin/git-backfill.mjs

@@ -11,18 +11,16 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST /task was rejected
+// under enforce; hand-rolled relayUrl missed the per-project hubs map.
+import { relayUrl, signedGet, signedPost } from "../hooks/lib/api.mjs";
 const args = process.argv.slice(2);
 const arg = (name, def) => { const i = args.indexOf("--" + name); return i >= 0 ? args[i + 1] : def; };
 const dir = process.cwd();
 const project = arg("project", resolveProject(dir));
 const since = arg("since", "14 days ago");
 const dry = args.includes("--dry-run");
-const url = relayUrl();
+const url = relayUrl(project);
 const me = `${hostId()}:${project}`;
 
 const themeOf = (s) => {
@@ -53,7 +51,7 @@ for (const r of rows) {
 }
 
 let existing = new Set();
-try { const t = (await (await fetch(`${url}/tasks?project=${encodeURIComponent(project)}`)).json()).tasks || []; existing = new Set(t.map(x => x.title)); } catch {}
+try { const r = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { session: me }); const t = r.json?.tasks || []; existing = new Set(t.map(x => x.title)); } catch {}
 
 const ents = [...groups.entries()].sort((a, b) => a[1].latest - b[1].latest);
 let posted = 0, skipped = 0;
@@ -68,8 +66,7 @@ for (const [theme, g] of ents) {
   if (existing.has(title)) { skipped++; continue; }
   if (dry) { console.log(`+ [${new Date(g.latest).toISOString().slice(0, 10)}] ${theme.padEnd(20)} ${g.commits.length}c  ${title.slice(0, 64)}`); posted++; continue; }
   try {
-    await fetch(`${url}/task`, { method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ project, title, status: "done", phase: theme, source: "git", ts: g.latest, assignee: me, by: me }) });
+    await signedPost("/task", { project, title, status: "done", phase: theme, source: "git", ts: g.latest, assignee: me, by: me }, { session: me });
     posted++;
   } catch (e) { console.error(`post failed for "${title}": ${e.message}`); }
 }

package/bin/reconcile.mjs

@@ -14,11 +14,10 @@ import { homedir } from "node:os";
 import { execSync, spawnSync } from "node:child_process";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): the unsigned POST /task/update was
+// rejected outright under enforce and merely flagged under warn; the hand-rolled relayUrl missed
+// the per-project hubs map. signedGet/signedPost resolve the cwd project's hub + sign per call.
+import { relayUrl, signedGet, signedPost } from "../hooks/lib/api.mjs";
 function parseDur(s, def) {
   if (!s) return def;
   const m = String(s).match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i);
@@ -38,16 +37,16 @@ const doIt = has("--yes", "-y");
 const difficulty = ["easy", "medium", "hard"].includes(val("--difficulty", "-d")) ? val("--difficulty", "-d") : "medium";
 const dir = process.cwd();
 const project = resolveProject(dir);
-const url = relayUrl();
+const url = relayUrl(project);
 
 async function tasks() {
-  const r = await fetch(`${url}/tasks?project=${encodeURIComponent(project)}`, { signal: AbortSignal.timeout(6000) });
-  const j = await r.json();
-  return Array.isArray(j) ? j : (j.tasks || j.cards || []);
+  const r = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { timeoutMs: 6000 });
+  if (!r.ok) return [];
+  const j = r.json;
+  return Array.isArray(j) ? j : (j?.tasks || j?.cards || []);
 }
 async function move(id, status) {
-  await fetch(`${url}/task/update`, { method: "POST", headers: { "content-type": "application/json" },
-    body: JSON.stringify({ id, status, by: "reconcile" }), signal: AbortSignal.timeout(4000) }).catch(() => {});
+  await signedPost("/task/update", { id, status, by: "reconcile" }, { timeoutMs: 4000 }).catch(() => {});
 }
 // the memory record for THIS project (Claude Code stores it per encoded-cwd); optional context.
 function memoryExcerpt() {

package/bin/recost.mjs

@@ -10,11 +10,8 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { scanSubagentCosts } from "../lib/subagent-scan.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed via the shared client (2026-07-31, agent-UX audit): unsigned POST rejected under enforce.
+import { relayUrl, signedPost } from "../hooks/lib/api.mjs";
 
 const dry = process.argv.includes("--dry-run");
 const asJson = process.argv.includes("--json");
@@ -35,10 +32,11 @@ if (dry) {
 }
 
 let result;
-try {
-  result = await fetch(`${relayUrl()}/subagent-recost`, { method: "POST", headers: { "content-type": "application/json" },
-    body: JSON.stringify({ entries: allEntries }), signal: AbortSignal.timeout(15000) }).then(x => x.json());
-} catch (e) { console.error(`recost failed: ${e.message}`); process.exit(1); }
+{
+  const r = await signedPost("/subagent-recost", { entries: allEntries }, { timeoutMs: 15000 });
+  if (!r.ok) { console.error(`recost failed: hub ${r.status} at ${relayUrl()}`); process.exit(1); }
+  result = r.json;
+}
 
 const projs = (result?.projects || []);
 const seeded = projs.filter(p => !p.skipped);

package/bin/relay-watch.mjs

@@ -2,22 +2,24 @@
 // relay-watch — a live feed of the bus via SSE (true push, no polling). Run in a terminal
 // to watch sessions talk in real time, or to monitor a presence/status board.
 //   node bin/relay-watch.mjs [session]   (default: "all" — see every message)
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
+// Signed + per-project hub (2026-07-31, agent-UX audit): the hand-rolled relayUrl() here read
+// only the global config `url` (wrong hub for a migrated project) and fetched unsigned (dead
+// 401 under RELAY_AUTH=enforce). Now: canonical resolver + this session's keypair on every call.
+import { resolveProject, hostId, resolveHub } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetch, sfetchJson } from "../lib/signed-fetch.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
-const URL_BASE = relayUrl();
+const PROJECT = resolveProject(process.cwd());
+const ME = process.env.RELAY_SESSION
+  || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${PROJECT}` : `${hostId()}:${PROJECT}`);
+const identity = loadOrCreate(ME, "agent");
+const URL_BASE = resolveHub(PROJECT);
 const SESSION = process.argv[2] || "all";
 const t = () => new Date().toLocaleTimeString();
 
 async function showPeers() {
   try {
-    const { peers } = await (await fetch(`${URL_BASE}/peers`)).json();
+    const { peers } = await (await sfetchJson(`${URL_BASE}/peers`, { method: "GET", identity })).json();
     const live = peers.filter(p => p.online);
     console.log(`\n  live sessions (${live.length}):`);
     for (const p of live) console.log(`   🟢 ${p.session}${p.status ? `  — ${p.status}` : ""}`);
@@ -30,7 +32,7 @@ async function watch() {
   await showPeers();
   for (;;) {
     try {
-      const r = await fetch(`${URL_BASE}/stream?session=${encodeURIComponent(SESSION)}`, { headers: { accept: "text/event-stream" } });
+      const r = await sfetch(`${URL_BASE}/stream?session=${encodeURIComponent(SESSION)}`, { headers: { accept: "text/event-stream" } }, identity);
       if (!r.ok || !r.body) throw new Error(`stream ${r.status}`);
       let buf = "";
       const dec = new TextDecoder();

package/bin/statusline.mjs

@@ -8,19 +8,18 @@ import { readFileSync, existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir, hostname } from "node:os";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed read via the shared client (2026-07-31, agent-UX audit): unsigned /peers is a dead 401
+// under enforce, which painted "trantor offline" while the hub was fine.
+import { sessionContext, signedGet } from "../hooks/lib/api.mjs";
 async function main() {
   let stdin = ""; try { for await (const c of process.stdin) stdin += c; } catch {}
   let cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   try { const j = JSON.parse(stdin || "{}"); cwd = j.cwd || j.workspace?.current_dir || cwd; } catch {}
-  const me = process.env.RELAY_SESSION || `${hostname()}:${basename(cwd)}`;
+  const me = process.env.RELAY_SESSION || sessionContext(cwd).session;
   try {
-    const r = await fetch(`${relayUrl()}/peers`, { signal: AbortSignal.timeout(800) });
-    const { peers } = await r.json();
+    const r = await signedGet("/peers", { timeoutMs: 800, session: me });
+    if (!r.ok) throw new Error(`hub ${r.status}`);
+    const { peers } = r.json;
     const live = peers.filter(p => p.online && p.session !== me).length;
     process.stdout.write(`\x1b[38;5;43m● trantor\x1b[0m \x1b[2m· ${live} other${live === 1 ? "" : "s"} live\x1b[0m`);
   } catch {

package/bin/sweep.mjs

@@ -12,11 +12,11 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject } from "../lib/project.mjs";
 
-function relayUrl() {
-  if (process.env.RELAY_URL) return process.env.RELAY_URL;
-  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
-  return "http://127.0.0.1:4477";
-}
+// Signed as the OWNER (2026-07-31, agent-UX audit): /sweep is an owner endpoint — an unsigned
+// POST is rejected under enforce. Sign with config.ownerIdentity, same pattern as bin/policy.mjs.
+import { relayUrl } from "../hooks/lib/api.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
 function parseDur(s, def) {
   if (!s) return def;
   const m = String(s).match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i);
@@ -33,12 +33,15 @@ const olderMs = parseDur(val("--older", "-o"), 30 * 60 * 1000);
 const doIt = has("--yes", "-y");
 const allProjects = has("--all-projects", "--all");
 const project = allProjects ? null : resolveProject(process.cwd());
-const url = relayUrl();
+const url = relayUrl(project || undefined);
+let ownerName = "admin";
+try { ownerName = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")).ownerIdentity || "admin"; } catch {}
+const ownerId = loadOrCreate(ownerName, "human");
 
 async function sweep(dryRun) {
   const body = { olderMs, dryRun, by: "cli-sweep" };
   if (project) body.project = project;
-  const r = await fetch(`${url}/sweep`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal: AbortSignal.timeout(6000) });
+  const r = await sfetchJson(`${url}/sweep`, { identity: ownerId, payload: body, signal: AbortSignal.timeout(6000) });
   return r.json();
 }
 

package/hooks/inbox-deliver.mjs

@@ -24,7 +24,7 @@ import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
-import { getJSON } from "./lib/api.mjs";
+import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T1 delivery is silently dead
 
 const POLL_MS = Number(process.env.RELAY_INBOX_POLL_MS || 4000);
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
@@ -33,10 +33,10 @@ const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
 // additionalContext payload (the model still gets the readable message).
 function sanitize(s) { return String(s == null ? "" : s).replace(/[\x00-\x1f\x7f-\x9f]/g, " "); }
 
-async function getInbox(session, since) {
-  const { ok, json } = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS });
+async function getInbox(session, since, instance) {
+  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance });
   if (!ok || !json) throw new Error("hub unreachable");
-  return json;   // { messages: [...], cursor }
+  return json;   // { messages: [...], cursor, superseded? }
 }
 
 // PostToolUse hands us the tool-input JSON on stdin. We don't need it, but we must DRAIN it:
@@ -58,7 +58,12 @@ function emit(ctx) {
   try { JSON.parse(out); return out; } catch { return "{}"; }
 }
 
-async function main() {
+async function main(stdinRaw) {
+  // The harness session_id is this session's INSTANCE id (docs/INSTANCE-KEYS-CONTRACT.md): it keys
+  // the endorsed subkey that signs our reads AND the local cursor, so a baton twin (same durable
+  // name, different session_id) has its own ledger and can't eat this session's messages.
+  let instanceId = "";
+  try { instanceId = String(JSON.parse(stdinRaw || "{}").session_id || ""); } catch {}
   const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Mirror heartbeat.mjs / sessionstart.mjs: a home-directory session isn't project work and
   // isn't on the bus — nothing to deliver. Opt in with RELAY_SESSION / RELAY_PROJECT.
@@ -70,7 +75,7 @@ async function main() {
   const session = process.env.RELAY_SESSION
     || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
 
-  const safe = session.replace(/[^A-Za-z0-9_.-]/g, "_");
+  const safe = (session + (instanceId ? `@${instanceId.slice(0, 8)}` : "")).replace(/[^A-Za-z0-9_.@-]/g, "_");
   const dir = join(homedir(), ".agent-bus");
   const pollStamp = join(dir, `inbox-poll-${safe}.stamp`);
   const cursorFile = join(dir, `inbox-cursor-${safe}.id`);
@@ -89,7 +94,7 @@ async function main() {
   // so we start listening "from now" instead of replaying the whole backlog of old broadcasts.
   if (!existsSync(cursorFile)) {
     try {
-      const { cursor } = await getInbox(session, 0);
+      const { cursor } = await getInbox(session, 0, instanceId);
       writeFileSync(cursorFile, String(cursor || 0));
     } catch {}
     return "{}";
@@ -98,13 +103,19 @@ async function main() {
   let cursor = 0;
   try { cursor = Number(readFileSync(cursorFile, "utf8")) || 0; } catch {}
 
-  let messages = [], next = cursor;
+  let messages = [], next = cursor, superseded = false;
   try {
-    const res = await getInbox(session, cursor);
+    const res = await getInbox(session, cursor, instanceId);
     messages = Array.isArray(res.messages) ? res.messages : [];
     next = res.cursor || cursor;
+    superseded = res.superseded === true;
   } catch { return "{}"; }   // hub down / timeout — never block the tool flow
 
+  // Stand-down note (never a block): a newer instance of this durable identity claimed the baton.
+  if (superseded && !messages.length) {
+    return emit(`<trantor-inbox count="0">\n⚠️ A newer instance of this session has claimed the baton (instance supersession). Stand down: finish your current thought, do not consume bus messages, and let the new session carry the work.\n</trantor-inbox>\n`);
+  }
+
   if (!messages.length) return "{}";
 
   // Advance the cursor immediately so we don't re-inject these on the next tool call.
@@ -119,6 +130,7 @@ async function main() {
 
   const ctx =
     `<trantor-inbox count="${messages.length}">\n` +
+    (superseded ? `⚠️ A newer instance of this session has claimed the baton — stand down after handling anything addressed directly to you; the new session carries the work.\n` : "") +
     `📬 ${messages.length} new bus message(s) arrived while you were working (you did not poll for these — Trantor surfaced them automatically):\n` +
     lines.join("\n") + `\n` +
     `If a peer is asking you something or waiting on you, reply now with the relay_send tool (to their session id). ` +

package/hooks/sessionstart.mjs

@@ -71,11 +71,14 @@ function readStdin() {
     process.stdin.on("data", c => (d += c)); process.stdin.on("end", () => res(d));
     setTimeout(() => res(d), 100); });
 }
-// Hub reads/writes through the shared client (TDD §8). Writes are SIGNED (Ed25519, via signedPost);
-// reads go unsigned for now (see api.mjs:getJSON — pending the hub's DM scope-filtering fix). Each
-// resolves to {ok,status,json}; a down hub returns {ok:false,json:null} and the caller's catch keeps
-// the session alive (fail-open contract, acceptance §9 #10).
-async function jget(u, session) { const r = await getJSON(u, { timeoutMs: 2500 }); return r.ok ? (r.json || {}) : {}; }
+// Hub reads/writes through the shared client (TDD §8), ALL signed (Ed25519). Writes via signedPost
+// close the self-asserted `from` hole; reads via signedGet survive RELAY_AUTH=enforce, which 401s
+// unsigned reads (unsigned, the roster/handoff injection was silently dead on the remote hub — the
+// 2026-07-30 agent-UX gap). The hub scope-filters signed reads to this identity's grants; for a
+// session reading its own project + declared links that is the intended shape. Each resolves to
+// {ok,status,json}; a down hub returns {ok:false,json:null} and the caller's catch keeps the
+// session alive (fail-open contract, acceptance §9 #10).
+async function jget(u, session) { const r = await signedGet(u, { timeoutMs: 2500, session }); return r.ok ? (r.json || {}) : {}; }
 async function jpost(u, b, session) { return (await signedPost(u, b, { session, timeoutMs: 2500 })).ok; }
 
 // Strip control chars from untrusted injected text so the hook's JSON stdout (which
@@ -239,6 +242,12 @@ try {
   });
   if (handoff) {
     process.stderr.write(`[trantor] ${isCompact ? "showing (not claiming, compact)" : "loaded"} pending handoff ${handoff.id}\n`);
+    // Baton claimed → supersede every OTHER instance of this durable identity (instance-keys
+    // contract). The dying twin's next /inbox or /poll answer tells its model to stand down —
+    // the hub-enforced end of the twin message race. Best-effort; compact shows don't claim.
+    if (!isCompact && stdinObj.session_id) {
+      await jpost(`${url}/instance/supersede`, { name: session, exceptInstanceId: String(stdinObj.session_id) }, session).catch(() => {});
+    }
     additionalContext += `<trantor-handoff id="${sanitize(handoff.id)}" from="${sanitize(handoff.machine)}" trigger="${sanitize(handoff.trigger)}">\n`;
     additionalContext += `🔄 **You are taking over from a prior session that hit its context limit.** This is a fresh full window. Resume the work below — the prior session's summary, git state, and a pointer to its full transcript (searchable; Foundation/Gaia has it ingested) follow. Continue from "OPEN THREADS & NEXT STEPS"; do not restart from scratch.\n\n`;
     // Verification gates FIRST — these are structured "must verify before shipping" claims the prior

package/hooks/stop-inbox.mjs

@@ -25,7 +25,7 @@ import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, hostId } from "../lib/project.mjs";
-import { getJSON } from "./lib/api.mjs";
+import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_STOP_TIMEOUT_MS || 1500);
 
@@ -63,7 +63,10 @@ async function main() {
 
   // Share inbox-deliver.mjs's cursor: ONE local delivery ledger, so a message injected mid-turn is never
   // re-surfaced here, and vice versa.
-  const safe = session.replace(/[^A-Za-z0-9_.-]/g, "_");
+  // Same instance id + per-instance cursor as inbox-deliver (docs/INSTANCE-KEYS-CONTRACT.md):
+  // T1 and T2 share one ledger within a session; a baton twin gets its own.
+  const instanceId = String(input.session_id || "");
+  const safe = (session + (instanceId ? `@${instanceId.slice(0, 8)}` : "")).replace(/[^A-Za-z0-9_.@-]/g, "_");
   const cursorFile = join(homedir(), ".agent-bus", `inbox-cursor-${safe}.id`);
   // No cursor yet means inbox-deliver has never run for this session; it initialises to "now" on its
   // first tool call. Blocking on the whole backlog of old messages would be a terrible first impression.
@@ -75,8 +78,11 @@ async function main() {
   let messages = [];
   try {
     // PEEK: look without claiming delivery. We may yet decide to let the stop through.
-    const peek = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS });
+    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
     if (!peek.ok) return allow();
+    // Superseded twin (instance-keys contract): a newer instance claimed the baton — this session
+    // stands down. Blocking ITS stop over messages the new instance will handle would trap it.
+    if (peek.json?.superseded === true) return allow();
     messages = peek.json?.messages || [];
   } catch { return allow(); }        // hub down — never trap the session
 
@@ -86,7 +92,7 @@ async function main() {
   // Committed now: claim delivery for real so neither inbox-deliver nor the deferred waker repeats it.
   let next = cursor;
   try {
-    const claim = await getJSON(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS });
+    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
     if (claim.ok) next = claim.json?.cursor || cursor;
   } catch {}
   try { writeFileSync(cursorFile, String(next)); } catch {}

package/hub.mjs

@@ -9,7 +9,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSy
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { timingSafeEqual, randomBytes } from "node:crypto";
-import { verifyRequest, publicView } from "./lib/identity.mjs";
+import { verifyRequest, verifyEndorsement, publicView } from "./lib/identity.mjs";
 import { DEFAULT_ORG } from "./lib/store-contract.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 
@@ -86,7 +86,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {} };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {} };
 }
 
 function normalizeState(loaded = {}) {
@@ -108,6 +108,7 @@ function normalizeState(loaded = {}) {
   s.handoffLog = Array.isArray(loaded.handoffLog) ? loaded.handoffLog : [];
   s.identities = loaded.identities && typeof loaded.identities === "object" ? loaded.identities : {};
   s.inviteTokens = loaded.inviteTokens && typeof loaded.inviteTokens === "object" ? loaded.inviteTokens : {};
+  s.instances = loaded.instances && typeof loaded.instances === "object" ? loaded.instances : {};
   s.focus = loaded.focus && typeof loaded.focus === "object" ? loaded.focus : {};
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
   for (const [session, v] of Object.entries(loaded.peers || {})) {
@@ -532,6 +533,30 @@ async function authenticate(req, path) {
   if (seenNonces.has(nonceKey)) return soft("replay");
   seenNonces.set(nonceKey, verified.ts);
   if (seenNonces.size > 10000) seenNonces.delete(seenNonces.keys().next().value);
+  // Instance-subkey path (docs/INSTANCE-KEYS-CONTRACT.md): when the three endorsement headers ride
+  // along, x-trantor-pubkey was the INSTANCE key (whose signature we just verified). Verify that the
+  // claimed DURABLE key endorsed it, then authenticate AS the durable identity — the instance mints
+  // no authority of its own; it is the durable identity, time-boxed to one session.
+  const h = (k) => req.headers[k] ?? "";
+  const durableHdr = h("x-trantor-durable"), instId = h("x-trantor-inst");
+  if (durableHdr && instId) {
+    const endorsed = verifyEndorsement({
+      durablePubkey: durableHdr, instancePubkey: verified.pubkey, instanceId: instId,
+      createdAt: state.instances?.[verified.pubkey]?.createdAt || Number(h("x-trantor-inst-ts")) || 0,
+      endorsement: h("x-trantor-endorse"),
+    });
+    if (!endorsed) return soft("bad endorsement");
+    const identity = findIdentity(durableHdr);
+    if (!identity) return soft("unknown identity");
+    if (!state.instances || typeof state.instances !== "object") state.instances = {};
+    const rec = state.instances[verified.pubkey] ||
+      { durable: durableHdr, instanceId: instId, name: identity.name || "", firstSeen: now(),
+        createdAt: Number(h("x-trantor-inst-ts")) || now(), superseded: false };
+    rec.lastSeen = now();
+    state.instances[verified.pubkey] = rec; dirty = true;
+    return { ok: true, mode: AUTH_MODE, trusted: true, pubkey: durableHdr, identity,
+             instanceId: instId, instancePubkey: verified.pubkey, superseded: !!rec.superseded };
+  }
   const identity = findIdentity(verified.pubkey);
   if (!identity) return soft("unknown identity");
   return { ok: true, mode: AUTH_MODE, trusted: true, pubkey: verified.pubkey, identity };
@@ -971,6 +996,30 @@ const server = http.createServer(async (req, res) => {
         .filter(c => c.project === proj || linked.has(c.project)); } catch {}
       return json(res, 200, { level, links: links.map(l => ({ projects: l.projects, reason: l.reason })), peers: peersOut, inflight, warnings });
     }
+    // Supersession (docs/INSTANCE-KEYS-CONTRACT.md): EXPLICIT, never automatic — the baton-claim
+    // path calls this when a fresh session consumes a handoff. Marks every OTHER instance of the
+    // named durable identity superseded; their /inbox + /poll answers then carry superseded:true so
+    // their own hooks tell the model to stand down. Informational, never a hard block. Accepted
+    // only from an endorsed instance of the SAME durable identity, or the owner.
+    if (req.method === "POST" && P === "/instance/supersede") {
+      const b = await body(req);
+      const name = String(b.name || "").slice(0, 200);
+      const except = String(b.exceptInstanceId || "").slice(0, 200);
+      if (!name) return json(res, 400, { error: "name required" });
+      if (AUTH_MODE !== "off") {
+        const sameIdentity = auth?.identity && String(auth.identity.name || "") === name;
+        const isOwner = auth?.identity?.kind === "human" || scopeAllows(auth?.identity, "", "owner");
+        if (!sameIdentity && !isOwner && AUTH_MODE === "enforce") return json(res, 403, { error: "forbidden" });
+      }
+      let flipped = 0;
+      for (const rec of Object.values(state.instances || {})) {
+        if (rec.name !== name || rec.superseded) continue;
+        if (except && rec.instanceId === except) continue;
+        rec.superseded = now(); flipped++;
+      }
+      if (flipped) dirty = true;
+      return json(res, 200, { ok: true, superseded: flipped });
+    }
     if (req.method === "POST" && P === "/overseer/narrate") {
       const b = await body(req);
       const ev = state.events.find(e => e.id === Number(b.eventId) && e.type === "overseer.warn");
@@ -1798,7 +1847,9 @@ const server = http.createServer(async (req, res) => {
       // through). Advancing the ledger on a peek would tell the deferred waker the message had been
       // delivered when nobody ever saw it — a silent hole exactly where this feature is supposed to help.
       if (q.peek !== "1") markDelivered(q.session, cursor);
-      return json(res, 200, { messages: msgs, cursor });
+      // superseded (instance-keys contract): a baton twin that lost the claim learns it HERE, via
+      // its own read — its hooks turn this into a stand-down note for the model. Never a block.
+      return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor });
     }
     if (req.method === "GET" && P === "/poll") {
       if (!canUseInboxSession(auth, q.session)) return json(res, 403, { error: "forbidden" });
@@ -1807,7 +1858,7 @@ const server = http.createServer(async (req, res) => {
       const deadline = now() + waitMs;
       const tick = () => {
         const msgs = state.messages.filter(m => m.id > since && deliverable(m, q.session) && inboxReadable(auth, m, q.session));
-        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, { messages: msgs, cursor }); }
+        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor }); }
         setTimeout(tick, 300);
       };
       return tick();

package/lib/identity.mjs

@@ -21,6 +21,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 
 export const SCHEME = "trantor-v1";
+export const INST_SCHEME = "trantor-inst-v1";
 export const SKEW_MS = 120_000;          // reject a signature older/newer than this
 export const HDR = {
   pubkey: "x-trantor-pubkey",
@@ -28,6 +29,15 @@ export const HDR = {
   ts: "x-trantor-ts",
   nonce: "x-trantor-nonce",
 };
+// Instance-subkey headers (docs/INSTANCE-KEYS-CONTRACT.md). When present, x-trantor-pubkey above
+// carries the INSTANCE pubkey and the request is attributed to the DURABLE identity below, provided
+// the endorsement verifies. Absent → plain v1, unchanged.
+export const HDR_INST = {
+  durable: "x-trantor-durable",
+  inst: "x-trantor-inst",
+  endorse: "x-trantor-endorse",
+  instTs: "x-trantor-inst-ts",
+};
 
 const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
 const keysDir = () => join(busDir(), "keys");
@@ -134,6 +144,75 @@ export function signRequest(identity, { method, path, body }) {
   };
 }
 
+// --- session-instance subkeys (docs/INSTANCE-KEYS-CONTRACT.md) ---------------------------------
+// A per-session-instance keypair, ENDORSED by the durable identity: the durable key signs
+// endorsementString(...), attesting "this instance pubkey speaks as me until it dies". The durable
+// key keeps enrollment/grants/attribution; the instance key signs traffic and dies with the
+// session. Fixes the handoff-twin identity collision (two lineages, two subkeys, one durable name)
+// and gives per-restart credential freshness (the teams login-session model).
+export function endorsementString({ durablePubkey, instancePubkey, instanceId, createdAt }) {
+  // Same discipline as canonicalString: newline-joined, fixed arity, no field may contain \n.
+  return [INST_SCHEME, String(durablePubkey), String(instancePubkey), String(instanceId), String(createdAt)].join("\n");
+}
+
+export const instanceKeyPath = (name, instanceId) =>
+  join(keysDir(), "instances", `${safe(name)}@${safe(instanceId)}.json`);
+
+// Mint-or-load an endorsed instance identity. Atomic against racing hooks exactly like
+// loadOrCreate: two processes of one session (hooks vs MCP would use DIFFERENT instanceIds, but
+// T1/T2 hooks share one) must converge on a single keypair for a given (name, instanceId).
+export function loadOrCreateInstance(durableIdentity, instanceId) {
+  if (!durableIdentity?.privkey || !instanceId) return null;
+  const f = instanceKeyPath(durableIdentity.name, instanceId);
+  try {
+    if (existsSync(f)) {
+      const inst = JSON.parse(readFileSync(f, "utf8"));
+      if (inst?.pubkey && inst?.privkey && inst?.endorsement) return inst;
+    }
+  } catch {}
+  try {
+    mkdirSync(join(keysDir(), "instances"), { recursive: true, mode: 0o700 });
+    const { pubkey, privkey } = generate();
+    const createdAt = Date.now();
+    const msg = Buffer.from(endorsementString({
+      durablePubkey: durableIdentity.pubkey, instancePubkey: pubkey, instanceId, createdAt,
+    }), "utf8");
+    const endorsement = cryptoSign(null, msg, privKeyObject(durableIdentity)).toString("base64");
+    const inst = {
+      name: durableIdentity.name, instanceId, pubkey, privkey, createdAt, endorsement,
+      durablePubkey: durableIdentity.pubkey,
+    };
+    const tmp = `${f}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    writeFileSync(tmp, JSON.stringify(inst), { mode: 0o600 });
+    if (existsSync(f)) { try { return JSON.parse(readFileSync(f, "utf8")); } catch { return inst; } }
+    renameSync(tmp, f);
+    chmodSync(f, 0o600);
+    return inst;
+  } catch { return null; }                                  // unwritable — caller falls back to durable
+}
+
+// The extra wire headers an instance identity contributes (alongside the v1 set signed with ITS key).
+export function instanceHeaders(inst) {
+  if (!inst?.durablePubkey || !inst?.endorsement) return {};
+  return {
+    [HDR_INST.durable]: inst.durablePubkey,
+    [HDR_INST.inst]: inst.instanceId,
+    [HDR_INST.endorse]: inst.endorsement,
+    [HDR_INST.instTs]: String(inst.createdAt),
+  };
+}
+
+// Pure endorsement check: did `durablePubkey` really endorse `instancePubkey` for this instanceId?
+// Enrollment/grants/supersession stay with the hub, which owns that state.
+export function verifyEndorsement({ durablePubkey, instancePubkey, instanceId, createdAt, endorsement }) {
+  if (!durablePubkey || !instancePubkey || !instanceId || !createdAt || !endorsement) return false;
+  if (!/^[0-9a-f]{64}$/i.test(durablePubkey) || !/^[0-9a-f]{64}$/i.test(instancePubkey)) return false;
+  try {
+    const msg = Buffer.from(endorsementString({ durablePubkey, instancePubkey, instanceId, createdAt }), "utf8");
+    return cryptoVerify(null, msg, pubFromHex(durablePubkey), Buffer.from(endorsement, "base64"));
+  } catch { return false; }
+}
+
 // Pure verification: signature + freshness only. Replay defence (nonce memory) and authorization
 // (is this pubkey known? may it touch this project?) belong to the hub, which owns that state.
 // Returns { ok, pubkey, ts, nonce, reason }.

package/lib/signed-fetch.mjs

@@ -6,7 +6,7 @@
 // we send the request UNSIGNED rather than failing. Under RELAY_AUTH=warn the hub accepts it and
 // flags it; under enforce the hub rejects it and the caller sees a 401 — which is the correct place
 // for that decision, because only the hub knows the policy.
-import { signRequest, loadOrCreate } from "./identity.mjs";
+import { signRequest, loadOrCreate, instanceHeaders } from "./identity.mjs";
 
 // Sign over path + query only. The origin is not in the canonical string: the same request proxied
 // through a different host must still verify, and the hub knows its own address.
@@ -19,11 +19,15 @@ function pathOf(url) {
 export function signedHeaders(identity, url, opts = {}) {
   if (!identity?.privkey) return {};
   try {
-    return signRequest(identity, {
+    const v1 = signRequest(identity, {
       method: (opts.method || "GET").toUpperCase(),
       path: pathOf(url),
       body: opts.body,
     });
+    // An INSTANCE identity (docs/INSTANCE-KEYS-CONTRACT.md) carries its endorsement; the extra
+    // headers ride along and the hub attributes the request to the durable identity. A plain
+    // durable identity contributes nothing here — v1 wire format unchanged.
+    return { ...v1, ...instanceHeaders(identity) };
   } catch { return {}; }                       // never let signing break a caller
 }
 

package/lib/store-pg.mjs

@@ -124,6 +124,7 @@ function kvFromState(state) {
       verifyGateSeq: Number(state.verifyGateSeq || 0),
       cardEventsBackfilled: !!state.cardEventsBackfilled,
       inviteTokens: state.inviteTokens || {},
+      instances: state.instances || {},
     },
     subagentCostReset: !!state.subagentCostReset,
     seq: Number(state.seq || 0),
@@ -669,6 +670,7 @@ export class PgStore {
       handoffLog: Array.isArray(kv.handoffLog) ? kv.handoffLog : [],
       identities,
       inviteTokens: meta.inviteTokens && typeof meta.inviteTokens === "object" ? meta.inviteTokens : {},
+      instances: meta.instances && typeof meta.instances === "object" ? meta.instances : {},
       focus: kv.focus && typeof kv.focus === "object" ? kv.focus : {},
       orgPolicy: kv.orgPolicy && typeof kv.orgPolicy === "object" ? kv.orgPolicy : {},
     };

package/mcp.mjs

@@ -21,7 +21,7 @@ const PROJECT = resolveProject(process.env.CLAUDE_PROJECT_DIR || process.cwd());
 // Hub URL is PER-PROJECT (TDD §12.1): RELAY_URL env → config.json hubs[PROJECT] → legacy
 // global `url` → local default. A project lives on exactly one hub; codependent projects
 // must share one, so both are pinned to the same hub via `trantor hub set`.
-const URL_BASE = resolveHub(PROJECT);
+const URL_BASE = resolveHub(PROJECT);   // boot-time snapshot: startup log only — every api() call re-resolves
 // Identity: RELAY_SESSION wins; else RELAY_AGENT ("codex", "kimi", …) brands the session per-project
 // (set it once in the CLI's global MCP config — works in every project); else hostname:project.
 const SESSION = process.env.RELAY_SESSION
@@ -50,10 +50,14 @@ async function seedCursor() {
 // bus exists for. Signed reads are scope-filtered by the hub to this identity's grants — for a
 // session reading its own project + DMs that is the intended behavior. The client fail-opens on a
 // down hub (returns {ok:false}); we surface that as a thrown Error so individual tools .catch it.
+// Instance id (docs/INSTANCE-KEYS-CONTRACT.md): the MCP server has no harness session_id, so it
+// mints a random id at boot — its lifetime ≈ the session's. The endorsed subkey it keys signs all
+// traffic; the durable identity keeps enrollment and attribution.
+const INSTANCE_ID = `mcp-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 async function api(method, path, payload) {
   const r = method.toUpperCase() === "GET"
-    ? await signedGet(path, { session: SESSION })
-    : await signedPost(path, payload, { session: SESSION });
+    ? await signedGet(path, { session: SESSION, instance: INSTANCE_ID })
+    : await signedPost(path, payload, { session: SESSION, instance: INSTANCE_ID });
   if (!r.ok) throw new Error(`hub ${r.status} on ${path}`);
   return r.json;
 }
@@ -63,7 +67,7 @@ const server = new McpServer({ name: "trantor", version: "0.1.0" });
 
 server.tool("relay_whoami", "Show this session's relay identity, project, and the hub URL.", {}, async () => {
   await api("POST", "/register", { session: SESSION, project: PROJECT }).catch(() => {});
-  return { content: [{ type: "text", text: `session=${SESSION}\nproject=${PROJECT}\nhub=${URL_BASE}` }] };
+  return { content: [{ type: "text", text: `session=${SESSION}\nproject=${PROJECT}\nhub=${resolveHub(PROJECT)}` }] };
 });
 
 server.tool("relay_task_add", "Add a Kanban card to a project's board on the dashboard (what you're about to work on). Defaults: THIS project, assigned to you, status 'todo'. Pass `project` to target another board — e.g. when you orchestrate a crew that runs in a different directory than the one you launched Claude from. Keep the team's progress visible.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.56",
+  "version": "0.17.58",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [