fix(supervise): preserve cloud director continuity and scoped access

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.231.0
+
+Retained provider directors now reuse their environment and conversation across deliberate re-prompts.
+Each new turn has a distinct execution identity; retries recover the original turn without creating replacement work.
+The existing scope settlement policy releases the environment after all turns or preserves it for recovery.
+Failed cleanup remains visible in the journal and final result.
+
+Authenticated coordination now follows the live scope and its original deadline by default.
+An explicit credential TTL still expires as requested.
+Signed credentials reject noncanonical signature encodings, preserving revocation after key rotation.
+
+Local regressions cover three consecutive turns, interruption during the second turn, cleanup isolation, and authenticated HTTP past three simulated hours.
+These checks do not establish live multi-hour reliability.
+Related system issue: SYS-011 — outcome: mitigates — proof: agent-runtime#1246 and retained owner recovery tests.
+
 ## 0.229.0
 
 - A settlement can now say whether a sandbox child's own harness transcript survived

api-surface.json

@@ -1156,7 +1156,7 @@
       "RetainedRunIntentAdmission": "type b66fa18d06a4",
       "RetainedRunReplayPoint": "type 51964fc96901",
       "RetainedRunSnapshot": "type 2415f4255673",
-      "RetainedRunStartMaterial": "type 4065e18ce1c2",
+      "RetainedRunStartMaterial": "type 02c0c2f4cb72",
       "RetainedRunTurnInput": "type 18b243b8b913",
       "RollingDispatchOptions": "type 94f6dce5b352",
       "RootHandle": "type 9eaa838c3456",

bench/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.13.1
+
+Require Knowledge 17.0.2 for validated memory writes, matching the Runtime workspace cohort.
+
 ## 0.13.0
 
 Remove the SWE and quant research campaign drivers, their historical fixtures, and the campaign-specific rollout ledger bridge from the source package.

bench/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-bench",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "type": "module",
   "description": "Benchmark adapters and execution for agent-runtime across coding, tool-use, RAG, memory, browser, and terminal tasks.",
   "repository": {

docs/agent-managed-compute/reliability.md

@@ -203,7 +203,7 @@ Provider conformance tests belong in the shared provider test package.
 
 Remote coordination MCP requires:
 
-- an expiring bearer token scoped to one run and actor,
+- a bearer token scoped to one live run and actor,
 - an audience bound to the MCP endpoint,
 - expiration and key rotation,
 - a maximum request size,
@@ -215,11 +215,13 @@ Remote coordination MCP requires:
 
 The default remains loopback-only.
 Set `coordination.authentication` to `true` to mint an ephemeral credential.
-Credentials expire after 15 minutes by default. A caller may set `authentication.ttlMs` to a longer finite lifetime with a safely representable expiry.
-There is no independent 24-hour cutoff. Long-lived bearer credentials increase exposure; use narrow grants, protected storage, and revocable signing keys.
+By default, credentials remain valid while their scope is live, within its original absolute deadline.
+Closing the listener or aborting the scope rejects its credentials immediately.
+Set `authentication.ttlMs` to require an additional finite expiry.
+Long-lived bearer credentials increase exposure; use narrow grants, protected storage, and revocable signing keys.
 Runtime does not renew credentials automatically or refresh credentials inside a retained environment.
-Configure `ttlMs` to cover the manager invocation and expected coordinator downtime.
-Run deadlines do not extend credential lifetime.
+If specified, `ttlMs` must cover the manager invocation and expected coordinator downtime.
+Neither key rotation nor coordinator restart extends the original scope deadline.
 Set `coordination.publicUrl` to the caller-owned reachable endpoint or an actor-aware endpoint resolver.
 The resolver can return a promise and receives the bound port, run identity, actor identity, and manager signal.
 Runtime awaits resolution before admitting the manager, while the listener refuses requests.
@@ -231,7 +233,7 @@ Remote public endpoints require HTTPS.
 
 For same-host coordinator restart, configure `authentication.signingKeys` with an active key ID and a secret key map.
 Keep the public URL, run ID, actor ID, tool grants, and verification key stable until the retained credential expires.
-Stable keys support resumed coordination only before the original credential expires.
+Stable keys support resumed coordination within the original scope deadline and any explicit credential expiry.
 After expiry, the retained session can reattach, but its coordination requests receive HTTP 401.
 A new active key can mint credentials while previous keys verify existing credentials.
 Remove a verification key to revoke its credentials across coordinator restarts.
@@ -242,6 +244,10 @@ Provider managers require `capabilities.create.runtimeAttachments.mcp` and an au
 Runtime passes the MCP server through `CreateAgentEnvironmentInput.runtimeAttachments`, preserving the canonical profile.
 Credential headers remain runtime-only and must not appear in receipts or journals.
 Retained manager recovery uses the original admitted backend input and validates its intent before reconnecting.
+Deliberate re-prompts retain the manager's environment and conversation, with a fresh execution and turn identity.
+Retrying an interrupted turn retains its original identities and does not create replacement work.
+The scope's existing `retainedAtSettlement` policy releases or preserves the environment after all manager turns.
+An unconfirmed release remains explicit in the journal and final result.
 
 The HTTP adapter bounds request bytes, body and action deadlines, concurrent work, and request rates.
 A timed-out action keeps its admission slot until execution settles.

docs/api/primitive-catalog.md

@@ -7,7 +7,7 @@
 
 # Primitive catalog — the never-stale anti-reinvention inventory
 
-> **GENERATED** from `@tangle-network/agent-runtime@0.229.0` and `@tangle-network/agent-eval@0.182.0` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
+> **GENERATED** from `@tangle-network/agent-runtime@0.231.0` and `@tangle-network/agent-eval@0.182.0` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
 
 ## 1. agent-runtime — own public surface
 

docs/api/runtime.md

@@ -8136,6 +8136,12 @@ Environment, turn, and optional identity needed to replay one retained start.
 
 > **idempotencyKey**: `string`
 
+##### existingEnvironmentId?
+
+> `readonly` `optional` **existingEnvironmentId?**: `string`
+
+Reuse an environment whose retained ownership key is verified instead of creating one.
+
 ##### turn
 
 > `readonly` **turn**: [`RetainedRunTurnInput`](#retainedrunturninput)
@@ -8184,6 +8190,16 @@ A retained start is retry-safe only when environment and turn keys are explicit.
 
 [`RetainedRunStartMaterial`](#retainedrunstartmaterial).[`environment`](#environment-2)
 
+##### existingEnvironmentId?
+
+> `readonly` `optional` **existingEnvironmentId?**: `string`
+
+Reuse an environment whose retained ownership key is verified instead of creating one.
+
+###### Inherited from
+
+[`RetainedRunStartMaterial`](#retainedrunstartmaterial).[`existingEnvironmentId`](#existingenvironmentid)
+
 ##### turn
 
 > `readonly` **turn**: [`RetainedRunTurnInput`](#retainedrunturninput)
@@ -13415,7 +13431,7 @@ End one peer exchange: every further mail on the thread is refused `thread-stopp
 
 > `readonly` `optional` **ttlMs?**: `number`
 
-Explicit finite credential lifetime; defaults to 15 minutes. Longer runs must configure it.
+Explicit finite lifetime. Omission binds the credential to the live scope and its deadline.
 
 ##### signingKeys?
 

docs/canonical-api.md

@@ -4,7 +4,7 @@
 Generated signatures and the complete export list live in docs/api/.
 Run pnpm docs:freshness after editing this file. -->
 
-> **Version 0.229.0.**
+> **Version 0.231.0.**
 > [`docs/api/primitive-catalog.md`](./api/primitive-catalog.md) lists every export and import path.
 > `agent-eval` must satisfy `>=0.182.0 <0.183.0`.
 > `sandbox` must satisfy `>=0.36.4 <0.40.0`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.229.0",
+  "version": "0.231.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {

pnpm-workspace.yaml

@@ -25,7 +25,7 @@ catalog:
   '@types/node': 26.4.0
   '@tangle-network/agent-eval': '>=0.182.0 <0.183.0'
   '@tangle-network/agent-interface': ^2.6.0
-  '@tangle-network/agent-knowledge': ^17.0.1
+  '@tangle-network/agent-knowledge': ^17.0.2
   '@tangle-network/agent-profile-materialize': '>=0.19.0 <0.20.0'
   '@tangle-network/agent-trace-contract': ^1.0.2
   '@tangle-network/sandbox': '>=0.36.4 <0.40.0'