{"id":"@lssm-tech/app.agent-host","slug":"app.agent-host","name":"@lssm-tech/app.agent-host","version":"0.3.1","path":"packages/apps/agent-host","manifestPath":"packages/apps/agent-host/package.json","manifestBlobSha":"3b15fafb1214175a84b86b3afb22ffea0d7b810f","layer":"apps","physicalArea":null,"primaryArea":"agents-and-context","classification":{"privateDeclared":true,"catalogFamily":null,"catalogKind":null,"catalogStatus":null,"adoptionMode":null,"stability":null},"description":null,"descriptionOrigin":"package.json","catalog":{"visualTesting":{"status":"deferred","owner":"@contractspec-core","targetWave":"wave-3-react-packages","rationale":"agent-host is a delivery host whose only TSX is an operation-parity test; its UI surfaces come from bundle/module catalogs, so it defers its own Storybook catalog."}},"canonicalImports":[],"scripts":{"build":"bun build --target bun --packages bundle --external pg-native --outfile dist/server.js src/server.ts","lint:check":"node ../../../scripts/biome.cjs check .","qualification:generate":"bun scripts/generate-qualification-ledger.ts --genesis","start":"bun run src/server.ts","test":"bun scripts/run-tests.ts","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@lssm-tech/integration.communication-os-runtime":"workspace:^","@lssm-tech/lib.ai-agent":"workspace:^","@lssm-tech/lib.ai-providers":"workspace:^","@lssm-tech/lib.agent-evals":"workspace:^","@lssm-tech/lib.contracts-spec":"workspace:^","@lssm-tech/lib.contracts-integrations":"workspace:^","@lssm-tech/lib.lssm-os-runtime":"workspace:*","@lssm-tech/lib.lssm-os-spec":"workspace:*","@lssm-tech/integration.lssm-os-state-sqlite":"workspace:*","@lssm-tech/integration.lssm-os-state-postgres":"workspace:*","@lssm-tech/integration.authos-better-auth":"workspace:^","@lssm-tech/module.agent-fleet":"workspace:^","@lssm-tech/integration.runtime":"workspace:*","@lssm-tech/lib.builder-runtime":"workspace:*","@lssm-tech/module.lssm-os-control-plane":"workspace:*","@lssm-tech/integration.workspace-ai":"workspace:*","@lssm-tech/lib.agent-protocol-spec":"workspace:^","@lssm-tech/lib.contractspec-connect":"workspace:^","pg":"catalog:server","zod":"catalog:","@lssm-tech/integration.agent-durable-store":"workspace:*"},"devDependencies":{"@lssm-tech/integration.communication-os-persistence":"workspace:^","@lssm-tech/bundle.managed-companyos":"workspace:*","@lssm-tech/bundle.founder-suite":"workspace:*","@lssm-tech/integration.lssm-os-operation-client":"workspace:^","@lssm-tech/lib.contracts-runtime-client-react":"workspace:^","@lssm-tech/module.personal-community":"workspace:*","@electric-sql/pglite":"^0.5.4","@lssm-tech/bundle.workspace":"workspace:*","@lssm-tech/integration.lssm-os-cache-redis":"workspace:*","@lssm-tech/integration.lssm-os-ingress-mqtt":"workspace:*","@lssm-tech/integration.lssm-os-queue-gcp":"workspace:*","@lssm-tech/integration.lssm-os-queue-sqs":"workspace:*","@lssm-tech/integration.lssm-os-queue-rabbitmq":"workspace:*","@lssm-tech/integration.lssm-os-provider-docker":"workspace:*","@lssm-tech/integration.lssm-os-provider-github":"workspace:*","@lssm-tech/integration.lssm-os-provider-neon":"workspace:*","@lssm-tech/integration.lssm-os-provider-resend":"workspace:*","@lssm-tech/integration.lssm-os-provider-railway":"workspace:*","@lssm-tech/integration.lssm-os-provider-supabase":"workspace:*","@lssm-tech/integration.lssm-os-provider-vercel":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","@types/bun":"catalog:types","happy-dom":"catalog:testing","react":"catalog:","react-dom":"catalog:","typescript":"catalog:","@types/pg":"catalog:types"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./operation-status":"./src/operation-status.ts","./t0":"./src/t0.ts","./t1":"./src/t1.ts"},"publishExports":null,"types":null,"files":null,"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/app.agent-host","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/apps/agent-host/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./operation-status","importPath":"@lssm-tech/app.agent-host/operation-status","target":"./src/operation-status.ts","targets":[{"conditions":[],"target":"./src/operation-status.ts","sourcePath":"packages/apps/agent-host/src/operation-status.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/src/operation-status.ts","sourceStatus":"verified source file"}]},{"subpath":"./t0","importPath":"@lssm-tech/app.agent-host/t0","target":"./src/t0.ts","targets":[{"conditions":[],"target":"./src/t0.ts","sourcePath":"packages/apps/agent-host/src/t0.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/src/t0.ts","sourceStatus":"verified source file"}]},{"subpath":"./t1","importPath":"@lssm-tech/app.agent-host/t1","target":"./src/t1.ts","targets":[{"conditions":[],"target":"./src/t1.ts","sourcePath":"packages/apps/agent-host/src/t1.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/src/t1.ts","sourceStatus":"verified source file"}]}],"entryCount":4,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.agent-host.txt"},"readme":{"status":"available","body":"# LSSM OS Agent Host\n\n`@lssm-tech/app.agent-host` is the single deployable host for governed agent\napplications. Its first production vertical is Release Steward, but the host\nis shared by the wider CommunicationOS and CompanyOS omnichannel program.\n\nRun `bun run test` for the complete package suite. It runs test files sequentially\nin fresh Bun processes so native/WASM and HTTP state cannot leak between suites.\nTest helpers use `.test-support.ts` names and are imported by actual test files.\nThe Release Steward replay qualification intentionally takes over 200 seconds;\nits declared 270-second timeout remains in force.\n\nThe host claims strict Durable Queue V2 envelopes, passes each exact claim to\nan injected Runtime Node V3 service, and acknowledges transport only from the\nservice's durable operation receipt. Queue fences never authorize effects.\nIndeterminate work remains unacknowledged and is reconciled from SQL before a\nretry. Shutdown stops new claims and drains bounded in-flight work.\n\nThe application lifecycle is `install_disabled -> configured -> qualified ->\nactive`, with `paused`, `revoked`, and `uninstalled` safety states. Readiness\nrequires active lifecycle, a recent queue cycle, and exact qualified component\nbindings for Runtime Node, queue, topology state, durable agent state, task\ngraph, CommunicationOS gateway, and organizational policy.\n\n`startAgentHostApplicationV1` is the deployable composition boundary: it starts\nthe governed consumer, serves liveness/readiness, forwards cancellation, and\ndrains bounded in-flight work.\n\n### Production entrypoint and readiness matrix\n\n`src/server.ts` (what `build` and `start` target) calls\n`startAgentHostServerV1`, which parses explicit `AGENT_HOST_*` keys, loads the\nqualified deployment document and, only when every binding is present,\ncomposes the PostgreSQL T1 host (`composeAgentHostT1ServerV1`): verified\nqueue/topology profiles, the installation lifecycle, Runtime Node V3 with the\nPostgres dispatch authority, a verify-only Connect authority whose policy is the\nstanding mandate, pinned component qualifications and registered effect\nproviders. Otherwise it serves `/healthz` (live) and a `/readyz` 503 whose body\nnames each blocking capability; a bootstrap artifact is never usable.\n\n| Key | Meaning |\n| --- | --- |\n| `AGENT_HOST_PORT` (`PORT`) | Listen port, default 3004 |\n| `AGENT_HOST_RUNTIME_DATABASE_URL` | Runtime role (secret; never logged) |\n| `AGENT_HOST_AUTHORITY_DATABASE_URL` | Distinct dispatch-authority role (secret) |\n| `AGENT_HOST_DATABASE_SSL_MODE` | `verify-full` (default) or `disable` |\n| `AGENT_HOST_DATABASE_POOL_MAX` | 1-32, default 4 |\n| `AGENT_HOST_DEPLOYMENT_FILE` | `lssm.agent-host.deployment.v1` JSON: lifecycle scope, queue/topology profiles, queue binding, backpressure, component bindings, qualification pins, provider bindings, `deploymentDigest` |\n| `AGENT_HOST_CONSUMER_INSTANCE_ID` | Stable consumer id (random per process when unset) |\n| `AGENT_HOST_INTERVAL_MS` / `_TIMEOUT_MS` / `_SHUTDOWN_DRAIN_MS` | Bounded timings |\n| `AGENT_HOST_CONNECT_ISSUER_REF` / `_KEY_REF` / `_PUBLIC_KEY` | Connect issuer identity and raw Ed25519 public key (base64); the host never holds a signing key |\n| `AGENT_HOST_DELIVERY_WORKLOAD_TOKEN_SHA256` | SHA-256 hex of the CommunicationOS worker bearer token (delivery effects) |\n| `AGENT_HOST_PROTOCOL_WORKLOAD_TOKEN_SHA256` | SHA-256 hex of the protocol-admission workload bearer token |\n| `AGENT_HOST_EFFECT_WAIT_MS` | Bounded wait for a request-driven effect receipt, default 20000 |\n\nConnect evidence (`createPostgresConnectAuthorityStoreV1`) and standing\nmandates (`createPostgresAgentStandingMandateStoreV1`) are read from\n`@lssm-tech/integration.lssm-os-state-postgres` through the runtime role;\napply its `LSSM_OS_POSTGRES_CONNECT_AUTHORITY_MIGRATION_V1` and\n`LSSM_OS_POSTGRES_AGENT_STANDING_MANDATE_MIGRATION_V1` first. Windowed mandate\ngrants reserve their slot atomically per exact Connect request digest.\n\n### Request-driven duties (single effect path)\n\n- `POST /v1/communication/runtime-node/delivery-effects`\n  (`communication.runtime-node.delivery-effect.v1`, bearer workload token,\n  required `Idempotency-Key` equal to the outbox record key) admits one\n  delivery through the Connect-side `effectAdmission` binding and the durable\n  queue, then answers a `CommunicationDeliveryEffectResult` from the Runtime\n  Node operation and provider receipt. Not admitted → retryable `rejected`;\n  admitted but unobservable → `indeterminate` with the work-order digest.\n- `POST /v1/agent-host/protocol-runs` (`lssm.agent-host.protocol-run-admission.v1`)\n  admits or exactly resumes a protocol run for the installed application.\n  Application, compiler and model route are host-bound (`protocolRuns`\n  binding); artifacts persist in the canonical Postgres protocol artifact\n  store.\n- `createAgentHostCodingAgentControlPortV1` implements the S08\n  `CodingAgentControlPortV1` over the same admission path; anything unproven\n  throws `AgentHostCodingControlUncertainError` and is never re-sent.\n\nEach duty has its own optional readiness row (`delivery_effects`,\n`coding_control`, `protocol_runs`, `bounded_agent_runs`) and never blocks\nworker readiness.\n\n### Bounded agent runs\n\n`createAgentHostBoundedAgentRunnerV1` composes the `@lssm-tech/lib.ai-agent`\nbounded-epoch runner for a `ContractSpecAgent` (any target with its\n`generate`), so a run is bounded by a host-owned epoch policy (per-epoch\ntoken, wall-time and tool-call budget, finite renewals, a no-progress stop and\n`maxResumes`) and not only by the agent's `maxSteps`. Each `generate` call is\ncapped at the remaining tool-call budget, receives the epoch abort signal and\nruns as one write-ahead journaled effect (`agent-host:generate:<epoch>:<step>`):\na restarted host replays recorded calls without sending them again, and the\nopen epoch's token and tool-call spend continues from its persisted value. A\ncall that fails, is cancelled or reaches the wall-time budget after its\njournal entry is written, or that a crash interrupts, stops the run as\n`effect_indeterminate`; it is never sent again. That holds when the host\nrestarts after the epoch's wall time has run out: the call's journal entry\nadmitted its step, so the restarted epoch reaches the entry without a budget\ncheck. The run result's `stopDetail` names the call and a redacted failure\nclass (the abort reason or the error's class name, never its message).\n`generate` takes no token cap,\nso tokens are checked between calls: one call can overrun the epoch token\nbudget. Runs are keyed by tenant, workspace and `runRef`. The runner refuses\nat composition a policy the epoch contract rejects and an `approval_required`\npolicy without a renewal approver.\n\nIn the server, the optional `boundedAgentRuns` binding supplies the agent id,\npolicy and approver; the duty stores runs in the canonical PostgreSQL agent\ncheckpoint table of the runtime role (apply `migratePostgresAgentDurableStore`\nfrom `@lssm-tech/integration.agent-durable-store/postgres/migrations` first) and\nexposes the runner as `duties.boundedAgentRuns`. Its row is `disabled` until\nbound, and `invalid` for a binding that throws or a refused policy.\n\n### Connect-side effect admission\n\nWith `AGENT_HOST_CONNECT_DATABASE_URL` (the `lssm_os_connect` role),\n`AGENT_HOST_CONNECT_SIGNING_KEY_FILE` (mounted PKCS#8 Ed25519 key, never an\ninline value) and deployment `effectProfiles`, the host composes the issuing\nConnect authority (`admitConnectEffectV1` from\n`@lssm-tech/lib.contractspec-connect`): the standing-mandate policy decides,\nConnect signs the Runtime V3 lifecycle, the operation and its envelope are\nadmitted co-atomically (`admitPostgresOperationAndQueue`), the qualification\nauthority records the orders and the operation is queued after\n`verifyAdmission`. Admission is idempotent per request (time-anchored replay);\na different request for the same idempotency key is denied.\n\nStanding mandates must carry `ownerSignature` over `mandateDigest`, verified\nagainst an active human key registered to the owner\n(`createPostgresPrincipalKeyStoreV1`); a delegate key never authenticates.\nMandate exceptions are lifted only by a Connect operation-approval receipt\n(`createAgentHostMandateApprovalsV1`): human approver other than the delegate,\nsingle-use nonce, re-verified (not re-consumed) for the same request.\n\nWhen the deployment declares `routes.operationStatus: \"required\"` (RT-009), the\n`operation_status` row becomes required and stays missing until an\n`operationStatus` authorization binding is supplied.\n\nReadiness rows (`configuration`, `runtime_database`, `authority_database`,\n`deployment`, `durable_queue`, `application_lifecycle`, `runtime_node`,\n`effect_providers`, `connect_verifier`, `standing_mandate`,\n`component_qualification`, `worker_cycle`) fail closed individually;\n`operation_status` is optional and disabled until an authorization port is\nbound. Connect authority stores, the standing-mandate store and the\nCommunicationOS outbox dependencies are injected through\n`AgentHostServerBindingsV1` by their owners; until bound they stay `missing`.\n`SIGTERM`/`SIGINT` stop claims, drain, stop HTTP and close both pools. A\nrestart resumes from SQL: unacknowledged claims are redelivered after lease\nexpiry and Runtime Node replays durable receipts instead of repeating effects.\n\n### Standing mandate to typed permits\n\n`lssm.agent-host.standing-mandate.v1` records the owner, delegate actor,\ninstallation scope, granted action classes (sender accounts, target prefixes,\npermit lifetime, optional rate window), exception rules and contract-required\nhuman-decision classes. `createAgentHostStandingMandatePolicyV1` is the Connect\npolicy: on issuance and again at dispatch it resolves the current revision into\na typed expiring permit, `deny`, or `require_review`. Revocation, expiry, a\nchanged sender/target, an exhausted window or an unresolved exception stops the\naction; a review is lifted only by an approval bound to the exact Connect\nrequest digest. Issuers encode actions with\n`encodeAgentHostMandateConnectTargetV1` so sender and target are part of the\nsigned request.\n\nThe same application can expose authenticated durable operation status at\n`/v1/lssm-os/operations/{tenant}/{workspace}/{environment}/{operation}` by\ninjecting `operationStatus`. Authorization is bounded and exact-scope before\nthe PostgreSQL/SQLite operation adapter is read; denied identities receive a\nnon-disclosing 404. Successful responses return the canonical Runtime Node\nREST projection unchanged, including HTTP 202 for every nonterminal state and\nthe exact request, receipt, and projection digests. Responses are private and\n`no-store`; malformed, substituted, timed-out, or unavailable dependencies\nfail closed without returning bearer material.\n\nApplication shells that need only this boundary may import\n`@lssm-tech/app.agent-host/operation-status` without loading queue, provider,\nor state-adapter compositions. The integrated F3 proof drives that REST\nhandler through the canonical SDK, CLI, MCP, and React UI projections and\nrequires one identical projection digest on every surface.\n\nThe PostgreSQL application-installation lifecycle is tenant/workspace/\nenvironment/product scoped and revision-CAS guarded. Apply\n`AGENT_HOST_POSTGRES_LIFECYCLE_MIGRATION_V1` through an owner connection,\nprovision the initial disabled installation through the owner-only helper, and\ngive the runtime only SELECT plus the guarded transition function. Raw runtime\nINSERT/UPDATE/DELETE stays revoked. The state machine and its validators are\nowned by `@lssm-tech/lib.agent-protocol-spec/protocol/application-lifecycle`,\nand the adapter and migration by\n`@lssm-tech/integration.lssm-os-state-postgres/agent-application-lifecycle`\n(and `-migration`); the host root re-exports them under the existing names.\n\nRelease Steward uses one frozen application profile through T1, T2, and T3.\nT2 requires a separately qualified distributed-cache binding and T3 a\nseparately qualified event-stream binding; both retain the same SQL durable\nqueue and Runtime Node authority components. Its first channels are web and\nin-app, its default is single-agent, and merge/release authority is hard-disabled\nuntil branch protection is independently qualified.\n\n`createAgentHostWakeAcceleratedQueueV1` is the app-local T2/T3 composition seam.\nIt retains PostgreSQL as the complete Durable Queue V2 and claimed-envelope\nauthority while routing admission, claim, acknowledgement, and reconciliation\nthrough a qualified event-stream wake accelerator. Capability, renewal,\nredrive, health, and envelope reads remain directly SQL-backed. A T2 host must\nalso inject an actual distributed-cache port matching its qualified component;\na component label alone is rejected. The Release Steward T2 walking skeleton\nuses the real Redis integration with an independently qualified cache and\nStreams binding, then makes Redis unavailable during claim and acknowledgement.\nSQL still completes and acknowledges exactly one effect, and a stale wake hint\ncannot create a second effect after Redis recovers. This is credential-free\nfallback evidence, not live Redis/Valkey failover or performance qualification.\n\nT3 additionally requires an injected event-stream port whose exact component,\ncapability, adapter, server, client, topology, and generation bindings match the\nqualified topology. The Release Steward T3 walking skeleton uses the real SQS\nwake integration over the same PostgreSQL queue. It admits co-atomically in\nSQL, publishes one opaque SQS hint, makes SQS unavailable during claim and\nacknowledgement, and still completes exactly one authorized effect through SQL.\nAfter SQS recovers, the stale broker hint observes an empty SQL queue and cannot\nrepeat the effect. This is credential-free fallback evidence; AWS/Scaleway live\nfailover, visibility-expiry, scale, cost, and performance qualification remain\nblocked.\n\nThe same Release Steward T3 path is qualified with the real RabbitMQ wake\nadapter and an independently bound quorum-queue capability profile. Publisher\nconfirms only accelerate a co-atomically admitted SQL operation; broker loss\nduring claim and acknowledgement falls back to SQL, and the recovered stale\ndelivery cannot repeat the durable Runtime Node effect. This remains a\ncredential-free simulation. Live RabbitMQ quorum failover, publisher-confirm\nambiguity, consumer death, prefetch/backpressure, DLQ redrive, scale, cost, and\nperformance qualification remain blocked.\n\nGCP Pub/Sub and Cloud Tasks use the same Release Steward T3 proof with separate,\nexactly qualified transport profiles. Both publish only after durable SQL\noperation and outbox admission. Transport failure during claim and\nacknowledgement cannot prevent SQL completion or repeat the provider effect;\nafter recovery, a stale Pub/Sub delivery or Cloud Tasks callback remains a\nnon-authoritative hint and observes an empty SQL queue. This is\ncredential-free simulation evidence only. Live GCP redelivery, acknowledgement\ndeadline, callback authentication, regional failover, scaling, cost, and\nperformance qualification remain blocked.\n\nMQTT remains an ingress/fan-out protocol rather than an Agent Host work queue.\nThe CommunicationOS credential-free walking skeleton authenticates and\nnormalizes one MQTT 5 publication, derives a source-bound outbox identity, and\nadmits it into the real PostgreSQL Durable Queue V2 before Agent Host can claim\nit. The existing CommunicationOS Runtime Node path then produces one governed\naudit, one reply event, one durable effect, and one queue acknowledgement;\nduplicate MQTT publication before or after completion replays the SQL admission\nand cannot repeat the effect. This is simulated product evidence only. Live\nbroker ACL, mTLS/token, QoS/session reconnect, retained-message, shared-\nsubscription, broker-failover, scale, cost, and performance evidence remains\nblocked.\n\n`qualifyReleaseStewardApplicationV1` is the host-owned proof boundary for the\nfirst vertical. It requires an active durable installation and runs the real\nfilesystem-authored Release Steward application through bounded injected\nexecution. The v0 gate records 100 production-shaped, credential-free runs,\nincluding approval, exactly-once replay, checkpoint/resume, dead-letter, and\nlocal-harness evidence. The report remains `candidate`, keeps merge and release\nauthority disabled, and explicitly requires separate live qualification.\n\nRelease Steward now opts into Protocol V1 compilation. A signer is an injected\nport and never exposes its private key to Agentpacks or Agent Host. Agent Host\nverifies the canonical application signature with an Ed25519 first-party trust\nroot, binds its publisher/key/policy and artifact digests, then advances the\ndurable installation through `install_disabled -> configured -> qualified ->\nactive` with revision CAS. Replayed activation is idempotent only for the exact\nconfiguration and qualification. The credential-free keypair used by tests is\nephemeral and is not production trust evidence.\n\n`./t1` provides the PostgreSQL infrastructure factory. It creates\nthe real Durable Queue V2, topology-state, and V3 operation adapters and only\nreports verified after their owner-provisioned queue and topology profiles\nmatch the exact active binding. It does not provision profiles, mint authority,\nor bridge the legacy V2 worker. The T1 Runtime Node bridge reloads the exact\nclaimed envelope, durable operation, and signed standard or cleanup V3 order;\nkeeps the queue fence distinct from the Runtime Node authority fence; and\ndelegates at most one effect to an injected V3 execution service. It creates a\nqueue acknowledgement only after rereading the exact terminal operation\nreceipt. Terminal retries replay that receipt without repeating the effect,\nwhile missing, substituted, timed-out, or indeterminate results stay unacked.\nProduction activation still requires static composition of the concrete V3\nexecution service and a durable application lifecycle adapter.\n\n`createAgentHostCommunicationOsT1RuntimeV1` is the production composition seam\nfor CommunicationOS provider execution. It accepts a qualified provider\nbinding plus injected durable payload, delivery, and execution-custody ports,\nthen returns only the governed Runtime Node port. The concrete provider is not\nexposed, so a worker or product cannot call it as ambient send authority.\n\n`admitAgentHostContextV1` is the fail-closed AI context boundary. It accepts\nonly the exact qualified `context_compiler` binding for the active topology,\nreturns a typed block reason when required context is unavailable, and keeps\nretrieved or channel content non-instructional even when it contains prompt-like\ntext. The baseline effect worker remains backward compatible and cannot use\ncontext admission to expand Runtime Node authority.\n\n`admitAgentHostProtocolRunV1` composes that exact context boundary with the\ndurable `AgentProtocolRuntimeV1`. Admission requires qualified, topology-matched\n`context_compiler`, `protocol_runtime`, `agent_durable_store`, and baseline\nAgent Host bindings. It also re-materializes the exact signed first-party\napplication through an injected qualification authority on every admission and\nresume. The manifest, permission summary, policy bindings, installation\nrevision, lifecycle digests, release SHA, application/prompt/model/tool/policy/\ncontext/evaluator versions, and sandbox digest must all match before context is\ncompiled or durable state is returned. Revoked, paused, stale, unsigned,\nnon-first-party, substituted, or tool-widened applications fail closed.\nAdmission also stores an immutable run-scoped application binding, preventing a\nsame-version requalification or policy change from silently altering a resumed\nrun.\nIt independently validates and persists the exact model routing V2 capability\nprofile, invocation profile, route, qualification, evaluation decision,\nselection, and optional canary artifacts before context compilation, after an\nexact Connect route decision and connection verification. The selection must\nuse the installed application's model policy; `live_verified` routes require\nan exact production-canary binding. Resume (`resumeAgentHostProtocolRunV1`)\ntakes the same V2 route plus authority and connection ports, re-verifies\nConnect authority and route expiry at resume time, never recreates missing\nmodel artifacts, and requires a replan when the persisted selection changes.\n\nModel routing V1 admission, V1 checkpoint fallback, and the V1 resolver are\nretired; a V1 route supplied to admission is rejected. A run persisted under\nmodel routing V1 is upcast deterministically on resume. V1 records carry no\nmodel author, serving identity, invocation profile, evaluation decision,\ndataset, qualification expiry, or Connect decision, so the upcast never invents\nthem: `classifyAgentHostPersistedModelRoutingV1` verifies the persisted run\nstate and every bound V1 profile, route, qualification, and selection\n(digest-bound, schema-strict, via the contracts-spec\n`planAgentModelRoutingV2Migration` plan), and\n`upcastAgentHostModelRoutingV1ToV2` accepts only a requalified V2 route for the\nsame run, plan, selection policy, model id/version, route version, and region.\nThe full V2 admission (Connect authority, connection verification, expiry,\nbudget) re-runs and persists the V2 artifacts before the run state is rebound to\nthe V2 selection with `model_routing.v1_upcast.<selection>` evidence; a second\nresume sees a V2 run. Unknown, malformed, or tampered V1 state, a terminal,\nin-flight, reconciling, or fallback-active V1 run, a resume expectation that\ndoes not bind the run, and a non-corresponding route block with\n`agent_host.model_route_upcast_rejected` (`model_routing.upcast_rejected:<code>`,\n`AgentHostModelRoutingUpcastError`) before any V2 artifact is written;\na denied or failed V2 admission blocks with `agent_host.model_route_untrusted`\nand leaves the run on V1. Re-admitting an existing V1 run blocks with\n`model_routing.v1_resume_required:<selection>`; resume performs the upcast.\nCheckpoint fallback (`admitAgentHostModelFallbackV2`) re-materializes the\nactive signed application, verifies the admitted run binding, and permits only\nan equivalent eligible route. It never falls back from an indeterminate\nprovider outcome, and exact retry returns the same durable decision without\nanother transition.\nThe Host-owned resolver reloads that persisted selection/fallback before every\nmodel execution, canonical-verifies the active V2 candidate, rechecks the run\nbudget, and requires an exact Connect decision before requesting a lease. It\nalso loads the current `IntegrationConnection`, hashes only an\nadapter-allowlisted secret-free projection, and rejects version, configuration,\ndeployment, gateway, adapter, policy, or connection substitution.\nRoute/profile/invocation/current qualification/evaluation/current\ncanary artifacts and exact route cost are reconstructed directly from the\nHost artifact store. A changed qualification or canary head invalidates the\nselection binding before authority or lease resolution; callers do not provide\ncandidate artifacts to the production resolver.\n\nQualification and canary lifecycle writes use artifact-head CAS and retain\nhistorical revisions. A model reselection is accepted only after the active\nroute has a persisted evidence-backed rolled-back canary. Agent Host verifies\nthe replacement baseline and its Connect/connection bindings before the\nProtocol runtime atomically activates the new plan, validation, and selection\nand clears stale fallback state.\nAdmission persists the immutable compiled context manifest and idempotently\nresumes an exact already-admitted run instead of duplicating its plan.\n\n`respondToAgentHostProtocolHelpV1` accepts a waiting-run response only through\nan exact qualified organizational-policy authority port. That port must verify\nthe responder and evidence against the pending request. Conversation text and\nmodel output are never treated as approval or authority.\n\nThe governed automation runtime materializes only an exact automation\ndefinition listed by the active signed application manifest and bound to its\ncurrent qualification digest. Injected authority and scheduler ports control\nmaterialization, pause/resume/revoke/expiry, claims, and background follow-ups.\nState uses revision CAS; occurrence and run identities are deterministic;\nactive claims survive lease loss as `resume_required`; receipt-first completion\nrecovers after process interruption without inventing another run. An\nindeterminate result keeps its claim in `reconciliation_required` and cannot\ncreate a follow-up. Agent Host persists coordination artifacts but never sends\nthe follow-up or performs the scheduled run's external effects.\n\n`createAgentHostV3ExecutionServiceV1` is that frozen execution composition\n(owned by `@lssm-tech/lib.lssm-os-runtime/runtime-node/v3-execution-service`\nas `createRuntimeNodeV3ExecutionServiceV1`; `./t1` re-exports it).\nIt projects the signed V3 one-step authority into the provider lifecycle,\nindependently persists the exact provider receipt, and completes the durable\noperation before the queue can acknowledge. A running retry without durable\nprovider evidence never repeats the effect; it enters `indeterminate` custody.\nWhen an exact provider receipt supplies sanitized diagnostic evidence for that\nambiguity, custody persists those refs alongside its deterministic recovery ref\nwithout inventing an external delivery reference. Those diagnostics support\nreconciliation and operator help but never authorize retry, fallback, or a\nterminal outcome.\nThe provider-receipt adapter remains an injected persistence boundary so T0\nand T1 state packages can preserve their own atomic transaction semantics.\n\nThe GitHub T1 walking skeleton composes the actual GitHub provider lifecycle,\nPostgreSQL qualification authority, V3 operation and provider-receipt stores,\nand Agent Host execution service. Its credential-free PGlite qualification\nproves one draft effect across 100 concurrent host calls plus exact restart\nreplay. It is production-shaped candidate evidence, not live GitHub evidence;\ncredentialed canary create, observe, compensate, teardown, and billing proofs\nremain required before live activation.\n\nThe Vercel T1 walking skeleton reuses that same PostgreSQL authority and Agent\nHost execution boundary with the actual Vercel Runtime Node provider. Its\ncredential-free structural project command proves one effect across 100\nconcurrent host calls and exact terminal replay after reconstructing the host\nand provider composition. The Vercel qualification row remains blocked until\ncredentialed create, observe, compensate, teardown, billing, and 24-hour\nobservation evidence is attached.\n\nThe Railway T1 walking skeleton exercises the provider API ownership mode with\nan exact service-update command through the same PostgreSQL authority and Agent\nHost execution boundary. One of 100 concurrent calls performs the effect, and\na reconstructed host/provider composition replays the terminal receipt without\nanother mutation. Railway remains blocked until credentialed lifecycle,\nteardown, billing, and 24-hour observation evidence is attached.\n\nThe Supabase T1 walking skeleton routes an exact private storage-bucket command\nthrough the management-driver side of the actual Supabase Runtime Node provider.\nThe PostgreSQL authority permits one effect across 100 concurrent Agent Host\ncalls, and reconstructed composition replays the durable terminal receipt.\nSupabase remains blocked until credentialed lifecycle, teardown, billing, and\n24-hour observation evidence is attached.\n\nThe Neon T1 walking skeleton binds an opaque project, branch, parent branch,\nrole profile, and region into a branch-create command. The actual Neon Runtime\nNode provider performs one effect across 100 Agent Host races and replays its\ndurable receipt after reconstruction. Neon remains blocked until credentialed\nbranch lifecycle, teardown, billing, and 24-hour observation evidence exists.\n\nThe Resend T1 walking skeleton binds only opaque message, recipient,\nsender-profile, template, and encrypted-content references into the actual\nResend Runtime Node provider. The PostgreSQL authority permits one send across\n100 Agent Host races, and reconstructed composition replays the durable receipt\nwithout another effect. No credential or email body enters the order. Resend\nremains blocked until credentialed delivery, observation, billing, and 24-hour\nevidence is attached.\n\nThe Release Steward T1 walking skeleton additionally crosses the complete\nproduct-shaped path: co-atomic accepted operation and Durable Queue V2\nadmission, real Agent Host claim and V3 execution, one structural GitHub draft\neffect, durable provider and operation receipts, exact queue acknowledgement,\nthen 100 consecutive post-effect acknowledgement interruptions across fresh\nhost/runtime/provider composition. Every five failed claims follows the\ndeclared attempt ceiling into DLQ and uses a digest-bound redrive receipt before\ncontinuing. The final delivery acknowledges the original terminal operation\nwith exactly one provider effect. This remains\n`credential_free_simulation` evidence and does not promote any provider,\nproduct, or channel row to live qualification.\nThe paired real-PostgreSQL completion-boundary command additionally SIGKILLs\n100 worker processes after terminal operation/receipt verification but before\nqueue acknowledgement. Fresh processes reclaim every expired lease and commit\n100 exact acknowledgements while the durable effect table remains exactly 100.\nThis is local-live completion-boundary evidence; the remaining boundaries are\ntracked below and independent production-host audit remains blocked.\nThe T1 outbox-boundary command separately SIGKILLs 100 workers immediately\nafter co-atomic operation, outbox, and queue admission. A fresh worker exact-\nreplays every request, and the final database inventory must contain exactly\n100 operations, 100 outbox rows, and 100 messages with no provider effect.\nThe authority command separately SIGKILLs 100 workers after atomic lifecycle\nissuance; the same public issuance call exact-replays in fresh processes without\ncharging budget or inserting again. The dispatch command kills 100 workers\nafter the running-operation and normal-reservation CAS; fresh workers recognize\nthe exact durable authority tuple without redispatching.\nThe effect-boundary command kills 100 workers after one durable simulated\nprovider mutation but before any receipt. Fresh workers reconcile the existing\neffect into one terminal operation receipt without reinsertion. The receipt-\nboundary command kills after immutable provider receipt append and recovers\nthat exact receipt into terminal completion. Both finish with 100 effects and\nzero duplicates. Cleanup then kills 100 workers after permit-bound teardown\neffects and recovers signed absence completion. Settlement kills 100 workers\nafter evidence commit and exact-replays the same public settlement call. All\neight local PostgreSQL crash boundaries pass; independent production-host audit\nremains required.\n\nThe CommunicationOS in-app T1 walking skeleton uses the same authority path\nwithout making Agent Host a channel sender. CommunicationOS owns the approved\ndelivery command, exact context resolution, `approveAndSend` reconciliation,\nevent, and audit. Its public `./agent-host` adapter binds that command to a\nRuntime Node provider lifecycle receipt, while `./agent-host-admission` creates\nthe strict Queue V2 handoff consumed by Agent Host. The credential-free proof\ncovers PostgreSQL admission, V3 execution, the real CommunicationOS\napproved-send orchestrator, governed audit persistence, one reply event,\ndurable receipts, failed first ack, restart/redelivery, and exactly one in-app delivery. Product and\nchannel rows remain blocked until credentialed provider and full omnichannel\nqualification exists.\n\nThe ContractSpec T1 walking skeleton runs the real workspace Connect service\nfor a safe governed contract edit, persists its context, plan, and permit\nverdict, binds their exact digests into the accepted operation, queue envelope,\noutbox, signed V3 GitHub draft order, and provider evidence, then crosses the\nsame Agent Host restart/replay boundary without a second effect. This advances\nthe ContractSpec product journey with credential-free CLI-service evidence;\nThe integrated operation proof now covers API, MCP, SDK, CLI, and React UI\nprojection parity. Credentialed GitHub and live product qualification remain\nrelease blockers.\n\nThe Managed CompanyOS T1 walking skeleton composes its real deterministic\nworkspace, fail-closed policy decisions, replay, executable proof, and evidence\nreceipt with an actual ContractSpec Connect permit. Those exact digests bind a\ndraft-only GitHub V3 order before co-atomic PostgreSQL admission, Agent Host\nexecution, durable receipts, failed acknowledgement, restart, and exact replay.\nManaged CompanyOS remains the policy/control-plane owner; Connect and Runtime\nNode remain effect authority. This is credential-free simulated product\nevidence, not a live provider or production qualification claim.\n\nThe Pactena T1 walking skeleton binds its standalone founder-suite meeting\nprojection to a real Connect permit. The AI projection may edit but cannot\napprove, publish, or dispatch; the human projection retains those actions.\nTheir exact digest enters a draft-only V3 order, PostgreSQL admission, Agent\nHost execution, durable receipts, failed acknowledgement, restart, and replay.\nThis is simulated product evidence only; complete Pactena omnichannel and live\nprovider qualification remain blocked.\n\nThe HCircle T1 walking skeleton executes the real subject-bound personal\ncommunity contract for a private, non-discoverable profile draft. A\nhuman-required decision receipt, exact idempotent replay, and real Connect\npermit bind the draft-only V3 order, PostgreSQL admission, Agent Host\nexecution, failed acknowledgement, restart, and durable replay. This remains\ncredential-free simulated evidence; HCircle live provider and complete\nomnichannel qualification remain blocked.\n\nProvider adoption qualification also verifies that GitHub, Docker, Vercel,\nRailway, Supabase, Neon, and Resend expose and advertise the canonical\n`./runtime-node` production boundary in workspace, published, and ContractSpec\ncatalog metadata. Offline discoverability does not satisfy credentialed\nprovider lifecycle or 24-hour observation gates; every provider row remains\nblocked until those external proofs exist.\n\nThe Docker T1 walking skeleton now binds a Docker-specific V3 work order and\npayload to the production Runtime Node adapter, persists authority and receipts\nin the PostgreSQL state boundary, races 100 host executions, and replays after a\nfresh host/provider composition without a second Docker effect. The driver is a\ncredential-free structural simulation; the Docker provider row therefore\nremains blocked for isolated live lifecycle and 24-hour observation evidence.\n\n`./t0` provides the embedded single-node infrastructure factory. It composes\nthe real SQLite-backed Durable Queue V2, topology-state, and V3 operation\nadapters, validates the exact T0 topology and queue qualification, and proves\nthat admitted work survives a process restart. Qualification-order reads and\nprovider-receipt persistence remain explicit injected authority boundaries;\nthe factory neither substitutes in-memory authority nor claims that the\ncurrent SQLite state package can issue signed V3 orders. T0 activation stays\nclosed until those durable boundaries and the application lifecycle are\nstatically composed.\n\n`qualification:generate` materializes the one-time LSSM OS v0 requirements\ngenesis at `generated/qualification/lssm-os/v0/<release-sha>/requirements.json`.\nThe inventory covers retained v3 authority, Agent Host, Release Steward, T0-T5,\neach mandatory database/cache/broker/replica transition and rollback path,\ncache, brokers, providers, products, channels, topology, scale, chaos, disaster\nrecovery, and canary proof. Evidence must be tracked and is SHA-256 bound into\nthe deterministic ledger. Required rows cannot be omitted or promoted to\n`live_verified` without provider-live, canary, and authority evidence. Local\ntests therefore never inflate the production denominator.\nGenesis is accepted only on the commit that introduces the generator. The\nrepository CLI intentionally has no continuation mode until a trusted lineage\nverifier is statically composed. Integrations may use the public builder for\ncontinuation only by injecting independent lineage and requalification\nverifiers that authenticate the prior ledger as an exact ancestor artifact and\nretain that verifier identity in the new ledger. Any changed scope, topology,\nadapter/client/server version, policy requirement, authority binding, product\ncontract, rollback rule, dependency, blocker, or evidence digest is emitted as\n`requalification_required` with `freshness: invalidated`. The generator reads\nevidence from the selected Git commit object and refuses a dirty worktree, so\nworking-copy bytes cannot masquerade as evidence for `HEAD`.\nInvalidation is sticky across repeated generations; it cannot be cleared by\npresenting the invalidated ledger again. A separately governed, validated\nrequalification transition is required before such a row may become fresh.\n\n## Memory import HTTP boundary\n\nThe application factory accepts optional `memoryImports` dependencies. When present\nand the lifecycle is active, `POST /v1/agents/memory-imports` accepts a bearer-authenticated\nJSON request and dispatches `agent.memory.import.submit@1.0.0` through the supplied\ncanonical registry. Use `createMemoryImportOperationRegistry` with real Runtime Node\nverification, restricted artifact readers and the durable submission adapters.\nThe authenticator must return server-owned identity and permissions; body fields\nnever establish the actor. Disabled/unconfigured hosts return 503.\n\nBodies are capped at 64 KiB; authentication, body reading and execution are bounded.\nResponses are private/no-store and expose only submission status, proposal digest\nand operation reference. A timed-out dispatch is indeterminate, not failed or\nsuccessful. This boundary does not mint work orders or promote memory. Production\nauthentication/authority configuration and console route wiring remain required.\n\nMemory import transports can use `createAgentMemoryImportAuthenticator` with a\ntrusted deployment origin serving AuthOS and CompanyOS authority. It verifies\nthe bearer session, explicit current fleet-review permission, tenant binding,\nactive organization/workspace, response freshness and authority revisions, then\nrechecks the session. The HTTP handler refreshes authority after reading input;\nworkspace changes or revoked permission stop dispatch. No role-derived grant or\ndeployment permission is produced. Production still requires configured runtime\nauthority and durable ports plus live session qualification.\n\n`createAgentHostMemoryImports` composes AuthOS/CompanyOS authentication, the\ncanonical command registry and the V3 memory-import verifier. Pass its result as\n`startAgentHostApplicationV1({ ..., memoryImports })`. The composition requires\nexplicit runtime order/payload/operation readers, Connect verification, restricted\nartifact readers, content/owner policy verification and an artifact store. It\ncannot accept a replacement command registry or a shortcut operation verifier.\n\nThe application checks fresh lifecycle state and current readiness before import\nauthentication and dispatch. Paused, unavailable, unready or shutting-down hosts\nreject new imports. Shutdown does not grant authority to finish an uncertain\nexternal effect; Runtime Node reconciliation and durable state still own recovery.\n\nThe database composition proof exercises this application path with synthetic\nAuthOS/CompanyOS responses and an injected Connect signature-verification fixture,\nincluding permission revocation, runtime denial, pause, shutdown and database\nreopen/replay. Production ports, credentials and live qualification remain required.\n\n## Internal supervised provider processes\n\n`createSupervisedProvider` can adapt a statically configured, trusted POSIX child\nentrypoint to the existing provider lifecycle port. Compose it in the exact\nprovider router consumed by `createAgentHostV3ExecutionServiceV1`; V3 dispatch\nand SQL receipt persistence remain authoritative. The child receives one bounded\nexecution JSON document on stdin and must emit one canonical receipt on stdout.\nAn independent receipt verifier must accept that receipt before it can return.\nThe executable and working directory must be absolute, environment is explicit\nwith production mode, and no shell or ambient credentials are inherited.\n\nTimeout, cancellation, excessive output, nonzero exit, or an unconfirmed process\ngroup exit yields an error for the existing V3 indeterminate-custody path. A\npartial stdout receipt never establishes success. Local tests exercise real child\nprocesses plus synthetic provider receipts; they do not qualify live Builder\ninference, a production child entrypoint, or host-crash recovery. Windows needs a\nqualified Job Object/container implementation and is currently rejected. This is\nsupervision of trusted host code, not containment for hostile code, escaped\nprocess groups, or arbitrary external effects. The adapter is internal and is\nnot activated by the default host binary.\n\n### Static Builder child composition\n\nThe canonical `@lssm-tech/app.agent-host/t1` surface exports\n`createAgentHostBuilderChild`, `serveSupervisedProviderChild` and\n`createSupervisedProvider`. The child factory composes the real Git patch adapter\nwith the governed Builder patch service and existing Runtime Node provider.\nDeployment configuration must supply exact provider binding, repository/checkout/\nartifact roots, qualified generation providers, Connect packet authority, QA,\nclock, approved payload reader, active-claim coordinator and durable receipt\nwriter/verifier. None has a permissive default. The app does not accept this\nconfiguration from a submitted intent or choose a model from ambient login state.\n\nA deployment-owned entrypoint statically imports its configuration and calls\n`await serveSupervisedProviderChild(createAgentHostBuilderChild(configuration))`.\nThe supervising host configures that exact executable and entrypoint, routes it\nthrough V3 authority, and independently verifies its returned receipt. There is\nno dynamic plugin/configuration-module path in the submitted JSON protocol.\n\nThe composition integration test produces a real Git candidate, verifies retained\nartifacts and exact receipt replay. Authority signatures, claim coordination,\nmodel output and receipt persistence in this test are fixtures. Provider credentials, independent QA and live deployment qualification remain\nactivation blockers. Same-host process custody is described below. The default binary is\nunchanged and does not claim to generate applications yet.\n\nAfter a termination request the supervisor observes closure for at most two more\nseconds. Unconfirmed processes retain their host handles until actual close;\noperator inspection through `unresolvedSupervisedProcesses` never authorizes a\nretry. Escaped descendants with inherited pipes are covered by a real subprocess\ntest. Deadline expiry is never treated as proof that an executor stopped.\n\n### Builder V3 PostgreSQL receipts\n\n`createAgentHostBuilderPostgresChild` accepts the admitted operation's exact\nscope/order reference and a restricted runtime PostgreSQL pool. It composes the\nexisting issued-order reader and V3 provider receipt store, then supplies them to\nthe Builder child. Operators no longer need a V2 receipt/claim-store adapter.\n`createBuilderV3ReceiptWriter` is the lower-level composition for qualified V3\nports. Neither function issues orders, authorizes dispatch, runs migrations or\nprovides an active-claim coordinator.\n\nEach read/write reloads the issued standard order and binds all execution fields\nto its canonical V3 execution. SQL rejects receipt writes before dispatch. A\nreceipt returns only after exact persisted readback; replay requires the same\ncandidate and evidence. The existing Agent Host V3 service owns terminal operation\ncompletion and skips provider execution when its durable receipt already exists.\n\nA file-backed embedded PostgreSQL test now closes and reopens the database, creates\nfresh writer/host instances, and verifies receipt/terminal replay with one generation.\nIt also rejects pre-dispatch writes, cross-workspace execution and altered replay\nresults. Generation, signature-verification and connection-role metadata remain\nexplicit fixtures; live PostgreSQL role isolation and production execution fencing\nstill require qualification. No default host activation or live inference is implied.\n\n### Local/personal Builder process custody\n\n`createAgentHostBuilderLocalPostgresChild` supplies the same-host coordinator as\nwell as concrete V3 SQL receipt persistence. Configure a stable custody directory,\nthe admitted node identity and a bounded maximum duration. Run this provider in\nthe supervised child process with a supervisor timeout no greater than that\nmaximum. Generation still requires configured Connect packet authority, a\nqualified model provider and independent QA.\n\nThe coordinator verifies the issued order and current running SQL claim before\nreserving an operation and again around its callback. Its filesystem reservation\nis keyed by tenant/workspace/environment/operation, so a new attempt cannot erase\nan unresolved previous executor. Only one actual process can reserve that local\noperation. Roots and ancestors must be owned/trusted, cannot traverse symlinks,\nand must remain disjoint from repository and checkout roots. Reservation and\noutcome markers plus their directory entries are flushed durably.\n\nA throw, lost acknowledgement or dead owner leaves custody in place. Expiry or a\nmissing PID never releases it. After restart the existing V3 service can replay a\nverified SQL receipt without dispatching the provider again; absent such evidence,\noperator reconciliation is required. Never delete custody to force a retry.\nThis is local POSIX process exclusion, not distributed/cloud fencing or automatic\nrecovery of arbitrary external effects. Windows and cross-host coordination\nremain unqualified.\n\nTests race two real processes, kill an owner after durable reservation, and reject\nfresh-process/expired-custody reuse. The SQL/host proof now loses acknowledgement\nafter a real receipt append, retains unknown custody, closes/reopens the database,\nand completes by receipt replay with exactly one generation. Policy signatures,\nmodel output and SQL connection-role metadata in that proof remain fixtures.\n\n### Private provider failure diagnostics\n\nSupervised process configuration accepts an optional diagnostic port. Host-owned\ncompositions can use `createPrivateProviderDiagnostics` with a stable run reference\nand a private directory. Failed process stdout/stderr share the configured byte\nbudget; known environment secrets and recognizable bearer/key tokens are redacted.\nFiles are created exclusively with mode 0600 under a checked trusted directory,\nflushed and read back before returning an opaque diagnostic reference. Arguments,\nenvironment maps and credential files are not copied into diagnostic records.\n\nFailure objects expose only the reason, numeric exit/signal when observed, whether\nstream closure was confirmed, the diagnostic reference and availability status.\nRaw child output stays in the private artifact. An exited parent with an unclosed\ninherited pipe remains explicitly unconfirmed even if its exit code was zero.\nDiagnostic persistence is observed for at most five seconds; unavailable or uncertain\nlogging never converts a failed/unknown execution into success. Existing V3 custody\nand reconciliation remain authoritative. Diagnostic artifacts need host-authorized\naccess and operator retention/cleanup; they are not public release evidence.\n\n### Local Builder with SQLite\n\n`createAgentHostBuilderLocalSqliteChild` on `./t0` composes the existing Builder\nchild with concrete SQLite issued-order reads, V3 provider receipt persistence,\noperation state and same-host custody. Configure one migrated SQLite driver, the\nadmitted operation's exact order reference, trusted clock, protected custody\nlocation, qualified generation provider, Connect packet authority and QA.\n\nThe owner runs `migrateSingleNodeState`, `migrateSqliteQualificationAuthority` and\n`migrateSqliteV3ProviderReceipts` first. `SqliteQualificationIssuance` persists the\ncanonical signed lifecycle with mandatory Connect verification, and\n`SqliteQualificationDispatch` must authorize the queued operation before the child\ncan reserve custody or write receipts. Existing T0 queue/topology infrastructure\naccepts the same `SqliteQualificationOrderReader` and\n`SqliteV3ProviderReceiptPortV1`. The child supplies no permissive verification or\nmodel defaults and requires no PostgreSQL service.\n\nThe file-backed local proof executes one custody callback, persists synthetic\nBuilder evidence, closes/reopens SQLite and replays the exact receipt. It does not\nqualify live generation. The SQLite qualification evidence adapter separately\nsupports evidence-backed settlement and release of an unused cleanup reservation;\nthose methods require canonical signed evidence and retain conservative budget\naccounting. `createSqliteQualificationAuthorityV2` now composes cleanup dispatch,\nsigned absence completion and two-principal custody transfer as well. Run the\nexplicit `migrateSqliteQualificationCleanup` upgrade and configure mandatory\nConnect, observation, evidence and custody verifiers before using these methods.\nThe child composition grants no authority; live provider effects and deployment\ntrust qualification remain separate from these local state-port proofs.\n\n`createBuilderClaimedQueuePayloadReader` is available from `./t0`. Construct it\nfor the exact issued order, current queue claim and qualified queue binding, then\nsupply its `loadApprovedInput` to `createAgentHostBuilderLocalSqliteChild`.\nEvery read reloads the claimed envelope and verifies transport binding, claim,\norder and content digests. It neither grants dispatch authority nor substitutes\nfor the child's durable operation/custody checks. Do not cache a returned payload\nacross claims or use a caller-supplied order reference.\n","sourcePath":"packages/apps/agent-host/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/agent-host/README.md","blobSha":"864b43f525196bfac8dc8a9fa3a677e57e632731","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"agents-and-context","areaTitle":"Agents, execution and context","displayName":"app.agent-host","runtimes":[],"platforms":[],"kind":"apps","scope":"Workspace only","canonicalRoute":"/docs/packages/app.agent-host/","contextUrl":"/docs/packages/app.agent-host.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}