trantor 0.17.57 → 0.17.59

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.57",
+      "version": "0.17.59",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.57",
+  "version": "0.17.59",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -66,7 +66,13 @@ async function api(path, body) {
   // that shows up as a seat that quietly records nothing rather than one that errors.
   const url = HUB + path;
   const sig = signedHeaders(identity, url, opts);
-  const r = await fetch(url, { ...opts, headers: { ...opts.headers, ...sig } });
+  // HARD DEADLINE on every call (2026-08-01, crebral-health kimi seat): a long-poll whose socket
+  // dies silently (idle NAT/tailscale reset, no RST delivered) otherwise hangs fetch FOREVER —
+  // the runner sat "parked" with zero connections and zero retries while its crew was rebuilt
+  // around it. Deadline = the poll's own wait window + slack, so a healthy long-poll never trips
+  // it and a dead one surfaces as a catchable error that the main loop retries in 5s.
+  const waitS = Number((path.match(/[?&]wait=(\d+)/) || [])[1] || 0);
+  const r = await fetch(url, { ...opts, headers: { ...opts.headers, ...sig }, signal: AbortSignal.timeout((waitS + 30) * 1000) });
   return r.json();
 }
 

package/hooks/inbox-deliver.mjs

@@ -33,10 +33,10 @@ const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
 // additionalContext payload (the model still gets the readable message).
 function sanitize(s) { return String(s == null ? "" : s).replace(/[\x00-\x1f\x7f-\x9f]/g, " "); }
 
-async function getInbox(session, since) {
-  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session });
+async function getInbox(session, since, instance) {
+  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance });
   if (!ok || !json) throw new Error("hub unreachable");
-  return json;   // { messages: [...], cursor }
+  return json;   // { messages: [...], cursor, superseded? }
 }
 
 // PostToolUse hands us the tool-input JSON on stdin. We don't need it, but we must DRAIN it:
@@ -58,7 +58,12 @@ function emit(ctx) {
   try { JSON.parse(out); return out; } catch { return "{}"; }
 }
 
-async function main() {
+async function main(stdinRaw) {
+  // The harness session_id is this session's INSTANCE id (docs/INSTANCE-KEYS-CONTRACT.md): it keys
+  // the endorsed subkey that signs our reads AND the local cursor, so a baton twin (same durable
+  // name, different session_id) has its own ledger and can't eat this session's messages.
+  let instanceId = "";
+  try { instanceId = String(JSON.parse(stdinRaw || "{}").session_id || ""); } catch {}
   const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Mirror heartbeat.mjs / sessionstart.mjs: a home-directory session isn't project work and
   // isn't on the bus — nothing to deliver. Opt in with RELAY_SESSION / RELAY_PROJECT.
@@ -70,7 +75,7 @@ async function main() {
   const session = process.env.RELAY_SESSION
     || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
 
-  const safe = session.replace(/[^A-Za-z0-9_.-]/g, "_");
+  const safe = (session + (instanceId ? `@${instanceId.slice(0, 8)}` : "")).replace(/[^A-Za-z0-9_.@-]/g, "_");
   const dir = join(homedir(), ".agent-bus");
   const pollStamp = join(dir, `inbox-poll-${safe}.stamp`);
   const cursorFile = join(dir, `inbox-cursor-${safe}.id`);
@@ -89,7 +94,7 @@ async function main() {
   // so we start listening "from now" instead of replaying the whole backlog of old broadcasts.
   if (!existsSync(cursorFile)) {
     try {
-      const { cursor } = await getInbox(session, 0);
+      const { cursor } = await getInbox(session, 0, instanceId);
       writeFileSync(cursorFile, String(cursor || 0));
     } catch {}
     return "{}";
@@ -98,13 +103,19 @@ async function main() {
   let cursor = 0;
   try { cursor = Number(readFileSync(cursorFile, "utf8")) || 0; } catch {}
 
-  let messages = [], next = cursor;
+  let messages = [], next = cursor, superseded = false;
   try {
-    const res = await getInbox(session, cursor);
+    const res = await getInbox(session, cursor, instanceId);
     messages = Array.isArray(res.messages) ? res.messages : [];
     next = res.cursor || cursor;
+    superseded = res.superseded === true;
   } catch { return "{}"; }   // hub down / timeout — never block the tool flow
 
+  // Stand-down note (never a block): a newer instance of this durable identity claimed the baton.
+  if (superseded && !messages.length) {
+    return emit(`<trantor-inbox count="0">\n⚠️ A newer instance of this session has claimed the baton (instance supersession). Stand down: finish your current thought, do not consume bus messages, and let the new session carry the work.\n</trantor-inbox>\n`);
+  }
+
   if (!messages.length) return "{}";
 
   // Advance the cursor immediately so we don't re-inject these on the next tool call.
@@ -119,6 +130,7 @@ async function main() {
 
   const ctx =
     `<trantor-inbox count="${messages.length}">\n` +
+    (superseded ? `⚠️ A newer instance of this session has claimed the baton — stand down after handling anything addressed directly to you; the new session carries the work.\n` : "") +
     `📬 ${messages.length} new bus message(s) arrived while you were working (you did not poll for these — Trantor surfaced them automatically):\n` +
     lines.join("\n") + `\n` +
     `If a peer is asking you something or waiting on you, reply now with the relay_send tool (to their session id). ` +

package/hooks/sessionstart.mjs

@@ -242,6 +242,12 @@ try {
   });
   if (handoff) {
     process.stderr.write(`[trantor] ${isCompact ? "showing (not claiming, compact)" : "loaded"} pending handoff ${handoff.id}\n`);
+    // Baton claimed → supersede every OTHER instance of this durable identity (instance-keys
+    // contract). The dying twin's next /inbox or /poll answer tells its model to stand down —
+    // the hub-enforced end of the twin message race. Best-effort; compact shows don't claim.
+    if (!isCompact && stdinObj.session_id) {
+      await jpost(`${url}/instance/supersede`, { name: session, exceptInstanceId: String(stdinObj.session_id) }, session).catch(() => {});
+    }
     additionalContext += `<trantor-handoff id="${sanitize(handoff.id)}" from="${sanitize(handoff.machine)}" trigger="${sanitize(handoff.trigger)}">\n`;
     additionalContext += `🔄 **You are taking over from a prior session that hit its context limit.** This is a fresh full window. Resume the work below — the prior session's summary, git state, and a pointer to its full transcript (searchable; Foundation/Gaia has it ingested) follow. Continue from "OPEN THREADS & NEXT STEPS"; do not restart from scratch.\n\n`;
     // Verification gates FIRST — these are structured "must verify before shipping" claims the prior

package/hooks/stop-inbox.mjs

@@ -63,7 +63,10 @@ async function main() {
 
   // Share inbox-deliver.mjs's cursor: ONE local delivery ledger, so a message injected mid-turn is never
   // re-surfaced here, and vice versa.
-  const safe = session.replace(/[^A-Za-z0-9_.-]/g, "_");
+  // Same instance id + per-instance cursor as inbox-deliver (docs/INSTANCE-KEYS-CONTRACT.md):
+  // T1 and T2 share one ledger within a session; a baton twin gets its own.
+  const instanceId = String(input.session_id || "");
+  const safe = (session + (instanceId ? `@${instanceId.slice(0, 8)}` : "")).replace(/[^A-Za-z0-9_.@-]/g, "_");
   const cursorFile = join(homedir(), ".agent-bus", `inbox-cursor-${safe}.id`);
   // No cursor yet means inbox-deliver has never run for this session; it initialises to "now" on its
   // first tool call. Blocking on the whole backlog of old messages would be a terrible first impression.
@@ -75,8 +78,11 @@ async function main() {
   let messages = [];
   try {
     // PEEK: look without claiming delivery. We may yet decide to let the stop through.
-    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session });
+    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
     if (!peek.ok) return allow();
+    // Superseded twin (instance-keys contract): a newer instance claimed the baton — this session
+    // stands down. Blocking ITS stop over messages the new instance will handle would trap it.
+    if (peek.json?.superseded === true) return allow();
     messages = peek.json?.messages || [];
   } catch { return allow(); }        // hub down — never trap the session
 
@@ -86,7 +92,7 @@ async function main() {
   // Committed now: claim delivery for real so neither inbox-deliver nor the deferred waker repeats it.
   let next = cursor;
   try {
-    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session });
+    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
     if (claim.ok) next = claim.json?.cursor || cursor;
   } catch {}
   try { writeFileSync(cursorFile, String(next)); } catch {}

package/hub.mjs

@@ -9,7 +9,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSy
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { timingSafeEqual, randomBytes } from "node:crypto";
-import { verifyRequest, publicView } from "./lib/identity.mjs";
+import { verifyRequest, verifyEndorsement, publicView } from "./lib/identity.mjs";
 import { DEFAULT_ORG } from "./lib/store-contract.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 
@@ -86,7 +86,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {} };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {} };
 }
 
 function normalizeState(loaded = {}) {
@@ -108,6 +108,7 @@ function normalizeState(loaded = {}) {
   s.handoffLog = Array.isArray(loaded.handoffLog) ? loaded.handoffLog : [];
   s.identities = loaded.identities && typeof loaded.identities === "object" ? loaded.identities : {};
   s.inviteTokens = loaded.inviteTokens && typeof loaded.inviteTokens === "object" ? loaded.inviteTokens : {};
+  s.instances = loaded.instances && typeof loaded.instances === "object" ? loaded.instances : {};
   s.focus = loaded.focus && typeof loaded.focus === "object" ? loaded.focus : {};
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
   for (const [session, v] of Object.entries(loaded.peers || {})) {
@@ -532,6 +533,30 @@ async function authenticate(req, path) {
   if (seenNonces.has(nonceKey)) return soft("replay");
   seenNonces.set(nonceKey, verified.ts);
   if (seenNonces.size > 10000) seenNonces.delete(seenNonces.keys().next().value);
+  // Instance-subkey path (docs/INSTANCE-KEYS-CONTRACT.md): when the three endorsement headers ride
+  // along, x-trantor-pubkey was the INSTANCE key (whose signature we just verified). Verify that the
+  // claimed DURABLE key endorsed it, then authenticate AS the durable identity — the instance mints
+  // no authority of its own; it is the durable identity, time-boxed to one session.
+  const h = (k) => req.headers[k] ?? "";
+  const durableHdr = h("x-trantor-durable"), instId = h("x-trantor-inst");
+  if (durableHdr && instId) {
+    const endorsed = verifyEndorsement({
+      durablePubkey: durableHdr, instancePubkey: verified.pubkey, instanceId: instId,
+      createdAt: state.instances?.[verified.pubkey]?.createdAt || Number(h("x-trantor-inst-ts")) || 0,
+      endorsement: h("x-trantor-endorse"),
+    });
+    if (!endorsed) return soft("bad endorsement");
+    const identity = findIdentity(durableHdr);
+    if (!identity) return soft("unknown identity");
+    if (!state.instances || typeof state.instances !== "object") state.instances = {};
+    const rec = state.instances[verified.pubkey] ||
+      { durable: durableHdr, instanceId: instId, name: identity.name || "", firstSeen: now(),
+        createdAt: Number(h("x-trantor-inst-ts")) || now(), superseded: false };
+    rec.lastSeen = now();
+    state.instances[verified.pubkey] = rec; dirty = true;
+    return { ok: true, mode: AUTH_MODE, trusted: true, pubkey: durableHdr, identity,
+             instanceId: instId, instancePubkey: verified.pubkey, superseded: !!rec.superseded };
+  }
   const identity = findIdentity(verified.pubkey);
   if (!identity) return soft("unknown identity");
   return { ok: true, mode: AUTH_MODE, trusted: true, pubkey: verified.pubkey, identity };
@@ -971,6 +996,30 @@ const server = http.createServer(async (req, res) => {
         .filter(c => c.project === proj || linked.has(c.project)); } catch {}
       return json(res, 200, { level, links: links.map(l => ({ projects: l.projects, reason: l.reason })), peers: peersOut, inflight, warnings });
     }
+    // Supersession (docs/INSTANCE-KEYS-CONTRACT.md): EXPLICIT, never automatic — the baton-claim
+    // path calls this when a fresh session consumes a handoff. Marks every OTHER instance of the
+    // named durable identity superseded; their /inbox + /poll answers then carry superseded:true so
+    // their own hooks tell the model to stand down. Informational, never a hard block. Accepted
+    // only from an endorsed instance of the SAME durable identity, or the owner.
+    if (req.method === "POST" && P === "/instance/supersede") {
+      const b = await body(req);
+      const name = String(b.name || "").slice(0, 200);
+      const except = String(b.exceptInstanceId || "").slice(0, 200);
+      if (!name) return json(res, 400, { error: "name required" });
+      if (AUTH_MODE !== "off") {
+        const sameIdentity = auth?.identity && String(auth.identity.name || "") === name;
+        const isOwner = auth?.identity?.kind === "human" || scopeAllows(auth?.identity, "", "owner");
+        if (!sameIdentity && !isOwner && AUTH_MODE === "enforce") return json(res, 403, { error: "forbidden" });
+      }
+      let flipped = 0;
+      for (const rec of Object.values(state.instances || {})) {
+        if (rec.name !== name || rec.superseded) continue;
+        if (except && rec.instanceId === except) continue;
+        rec.superseded = now(); flipped++;
+      }
+      if (flipped) dirty = true;
+      return json(res, 200, { ok: true, superseded: flipped });
+    }
     if (req.method === "POST" && P === "/overseer/narrate") {
       const b = await body(req);
       const ev = state.events.find(e => e.id === Number(b.eventId) && e.type === "overseer.warn");
@@ -1798,7 +1847,9 @@ const server = http.createServer(async (req, res) => {
       // through). Advancing the ledger on a peek would tell the deferred waker the message had been
       // delivered when nobody ever saw it — a silent hole exactly where this feature is supposed to help.
       if (q.peek !== "1") markDelivered(q.session, cursor);
-      return json(res, 200, { messages: msgs, cursor });
+      // superseded (instance-keys contract): a baton twin that lost the claim learns it HERE, via
+      // its own read — its hooks turn this into a stand-down note for the model. Never a block.
+      return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor });
     }
     if (req.method === "GET" && P === "/poll") {
       if (!canUseInboxSession(auth, q.session)) return json(res, 403, { error: "forbidden" });
@@ -1807,7 +1858,7 @@ const server = http.createServer(async (req, res) => {
       const deadline = now() + waitMs;
       const tick = () => {
         const msgs = state.messages.filter(m => m.id > since && deliverable(m, q.session) && inboxReadable(auth, m, q.session));
-        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, { messages: msgs, cursor }); }
+        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor }); }
         setTimeout(tick, 300);
       };
       return tick();

package/lib/identity.mjs

@@ -21,6 +21,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 
 export const SCHEME = "trantor-v1";
+export const INST_SCHEME = "trantor-inst-v1";
 export const SKEW_MS = 120_000;          // reject a signature older/newer than this
 export const HDR = {
   pubkey: "x-trantor-pubkey",
@@ -28,6 +29,15 @@ export const HDR = {
   ts: "x-trantor-ts",
   nonce: "x-trantor-nonce",
 };
+// Instance-subkey headers (docs/INSTANCE-KEYS-CONTRACT.md). When present, x-trantor-pubkey above
+// carries the INSTANCE pubkey and the request is attributed to the DURABLE identity below, provided
+// the endorsement verifies. Absent → plain v1, unchanged.
+export const HDR_INST = {
+  durable: "x-trantor-durable",
+  inst: "x-trantor-inst",
+  endorse: "x-trantor-endorse",
+  instTs: "x-trantor-inst-ts",
+};
 
 const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
 const keysDir = () => join(busDir(), "keys");
@@ -134,6 +144,75 @@ export function signRequest(identity, { method, path, body }) {
   };
 }
 
+// --- session-instance subkeys (docs/INSTANCE-KEYS-CONTRACT.md) ---------------------------------
+// A per-session-instance keypair, ENDORSED by the durable identity: the durable key signs
+// endorsementString(...), attesting "this instance pubkey speaks as me until it dies". The durable
+// key keeps enrollment/grants/attribution; the instance key signs traffic and dies with the
+// session. Fixes the handoff-twin identity collision (two lineages, two subkeys, one durable name)
+// and gives per-restart credential freshness (the teams login-session model).
+export function endorsementString({ durablePubkey, instancePubkey, instanceId, createdAt }) {
+  // Same discipline as canonicalString: newline-joined, fixed arity, no field may contain \n.
+  return [INST_SCHEME, String(durablePubkey), String(instancePubkey), String(instanceId), String(createdAt)].join("\n");
+}
+
+export const instanceKeyPath = (name, instanceId) =>
+  join(keysDir(), "instances", `${safe(name)}@${safe(instanceId)}.json`);
+
+// Mint-or-load an endorsed instance identity. Atomic against racing hooks exactly like
+// loadOrCreate: two processes of one session (hooks vs MCP would use DIFFERENT instanceIds, but
+// T1/T2 hooks share one) must converge on a single keypair for a given (name, instanceId).
+export function loadOrCreateInstance(durableIdentity, instanceId) {
+  if (!durableIdentity?.privkey || !instanceId) return null;
+  const f = instanceKeyPath(durableIdentity.name, instanceId);
+  try {
+    if (existsSync(f)) {
+      const inst = JSON.parse(readFileSync(f, "utf8"));
+      if (inst?.pubkey && inst?.privkey && inst?.endorsement) return inst;
+    }
+  } catch {}
+  try {
+    mkdirSync(join(keysDir(), "instances"), { recursive: true, mode: 0o700 });
+    const { pubkey, privkey } = generate();
+    const createdAt = Date.now();
+    const msg = Buffer.from(endorsementString({
+      durablePubkey: durableIdentity.pubkey, instancePubkey: pubkey, instanceId, createdAt,
+    }), "utf8");
+    const endorsement = cryptoSign(null, msg, privKeyObject(durableIdentity)).toString("base64");
+    const inst = {
+      name: durableIdentity.name, instanceId, pubkey, privkey, createdAt, endorsement,
+      durablePubkey: durableIdentity.pubkey,
+    };
+    const tmp = `${f}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    writeFileSync(tmp, JSON.stringify(inst), { mode: 0o600 });
+    if (existsSync(f)) { try { return JSON.parse(readFileSync(f, "utf8")); } catch { return inst; } }
+    renameSync(tmp, f);
+    chmodSync(f, 0o600);
+    return inst;
+  } catch { return null; }                                  // unwritable — caller falls back to durable
+}
+
+// The extra wire headers an instance identity contributes (alongside the v1 set signed with ITS key).
+export function instanceHeaders(inst) {
+  if (!inst?.durablePubkey || !inst?.endorsement) return {};
+  return {
+    [HDR_INST.durable]: inst.durablePubkey,
+    [HDR_INST.inst]: inst.instanceId,
+    [HDR_INST.endorse]: inst.endorsement,
+    [HDR_INST.instTs]: String(inst.createdAt),
+  };
+}
+
+// Pure endorsement check: did `durablePubkey` really endorse `instancePubkey` for this instanceId?
+// Enrollment/grants/supersession stay with the hub, which owns that state.
+export function verifyEndorsement({ durablePubkey, instancePubkey, instanceId, createdAt, endorsement }) {
+  if (!durablePubkey || !instancePubkey || !instanceId || !createdAt || !endorsement) return false;
+  if (!/^[0-9a-f]{64}$/i.test(durablePubkey) || !/^[0-9a-f]{64}$/i.test(instancePubkey)) return false;
+  try {
+    const msg = Buffer.from(endorsementString({ durablePubkey, instancePubkey, instanceId, createdAt }), "utf8");
+    return cryptoVerify(null, msg, pubFromHex(durablePubkey), Buffer.from(endorsement, "base64"));
+  } catch { return false; }
+}
+
 // Pure verification: signature + freshness only. Replay defence (nonce memory) and authorization
 // (is this pubkey known? may it touch this project?) belong to the hub, which owns that state.
 // Returns { ok, pubkey, ts, nonce, reason }.

package/lib/signed-fetch.mjs

@@ -6,7 +6,7 @@
 // we send the request UNSIGNED rather than failing. Under RELAY_AUTH=warn the hub accepts it and
 // flags it; under enforce the hub rejects it and the caller sees a 401 — which is the correct place
 // for that decision, because only the hub knows the policy.
-import { signRequest, loadOrCreate } from "./identity.mjs";
+import { signRequest, loadOrCreate, instanceHeaders } from "./identity.mjs";
 
 // Sign over path + query only. The origin is not in the canonical string: the same request proxied
 // through a different host must still verify, and the hub knows its own address.
@@ -19,11 +19,15 @@ function pathOf(url) {
 export function signedHeaders(identity, url, opts = {}) {
   if (!identity?.privkey) return {};
   try {
-    return signRequest(identity, {
+    const v1 = signRequest(identity, {
       method: (opts.method || "GET").toUpperCase(),
       path: pathOf(url),
       body: opts.body,
     });
+    // An INSTANCE identity (docs/INSTANCE-KEYS-CONTRACT.md) carries its endorsement; the extra
+    // headers ride along and the hub attributes the request to the durable identity. A plain
+    // durable identity contributes nothing here — v1 wire format unchanged.
+    return { ...v1, ...instanceHeaders(identity) };
   } catch { return {}; }                       // never let signing break a caller
 }
 

package/lib/store-pg.mjs

@@ -124,6 +124,7 @@ function kvFromState(state) {
       verifyGateSeq: Number(state.verifyGateSeq || 0),
       cardEventsBackfilled: !!state.cardEventsBackfilled,
       inviteTokens: state.inviteTokens || {},
+      instances: state.instances || {},
     },
     subagentCostReset: !!state.subagentCostReset,
     seq: Number(state.seq || 0),
@@ -669,6 +670,7 @@ export class PgStore {
       handoffLog: Array.isArray(kv.handoffLog) ? kv.handoffLog : [],
       identities,
       inviteTokens: meta.inviteTokens && typeof meta.inviteTokens === "object" ? meta.inviteTokens : {},
+      instances: meta.instances && typeof meta.instances === "object" ? meta.instances : {},
       focus: kv.focus && typeof kv.focus === "object" ? kv.focus : {},
       orgPolicy: kv.orgPolicy && typeof kv.orgPolicy === "object" ? kv.orgPolicy : {},
     };

package/mcp.mjs

@@ -50,10 +50,14 @@ async function seedCursor() {
 // bus exists for. Signed reads are scope-filtered by the hub to this identity's grants — for a
 // session reading its own project + DMs that is the intended behavior. The client fail-opens on a
 // down hub (returns {ok:false}); we surface that as a thrown Error so individual tools .catch it.
+// Instance id (docs/INSTANCE-KEYS-CONTRACT.md): the MCP server has no harness session_id, so it
+// mints a random id at boot — its lifetime ≈ the session's. The endorsed subkey it keys signs all
+// traffic; the durable identity keeps enrollment and attribution.
+const INSTANCE_ID = `mcp-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 async function api(method, path, payload) {
   const r = method.toUpperCase() === "GET"
-    ? await signedGet(path, { session: SESSION })
-    : await signedPost(path, payload, { session: SESSION });
+    ? await signedGet(path, { session: SESSION, instance: INSTANCE_ID })
+    : await signedPost(path, payload, { session: SESSION, instance: INSTANCE_ID });
   if (!r.ok) throw new Error(`hub ${r.status} on ${path}`);
   return r.json;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.57",
+  "version": "0.17.59",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [